Cloud

CLI pairing

How HarnessTap Cloud and the CLI work together.

Cloud and CLI pairing

HarnessTap Cloud is the source of truth for shared published layer versions and org access. The HarnessTap CLI owns local resources, composition, environment cascade, and project apply. Engineers use Cloud for governed distribution and the CLI for day-to-day harness work.

Command split

ConcernCLI command group
Authentication and org contextauth login, auth status, auth orgs, auth logout
Remote catalog search, install, publishlayer search, layer pull, layer publish
Apply to a projectproject apply (resolves bare names and published selectors from the catalog)

project apply fetches public catalog layers on demand when needed. Use layer pull to cache a bundle locally before working offline.

Authentication

The CLI uses a device-code flow for terminal authentication:

  1. Run harnesstap auth login [profile]
  2. Open the browser prompt and sign in with your Cloud account
  3. The CLI saves a named profile with your session and active organization

Check your identity with harnesstap auth status and switch orgs with harnesstap auth orgs --switch <slug>. Tokens refresh before remote calls; the CLI does not silently switch profiles during other commands.

Typical workflow

  1. Authenticate — harnesstap auth login (required for private org catalogs; optional for public baselines)
  2. Search — find layers your team maintains: harnesstap layer search <query>
  3. Apply or pull — materialize directly with harnesstap project apply <layer> --project <path>, or cache first with harnesstap layer pull <org>/<catalog>/<layer>[@version]
  4. Publish — export and upload a local layer: harnesstap layer publish <layer> --catalog <slug>

Cloud stores version history and access rules. Published payloads use urn:harnesstap:layer:v1.

Learn more

Access

Roles, permissions, published layer shares, and audit logging.

On this page

Cloud and CLI pairingCommand splitAuthenticationTypical workflowLearn more