overlord-cli 0.2605291046.0 → 0.2605300746.0

package/bin/_cli/auth.mjs

@@ -500,7 +500,27 @@ function parseOrganizationFlag(args) {
   return parsed;
 }
 
+function parseTokenFlag(args) {
+  const index = args.findIndex(arg => arg === '--token' || arg.startsWith('--token='));
+  if (index === -1) return null;
+  const raw = args[index].includes('=') ? args[index].split('=')[1] : args[index + 1];
+  if (!raw || typeof raw !== 'string') {
+    throw new Error('--token requires a value (e.g. --token oat_…)');
+  }
+  const trimmed = raw.trim();
+  if (!trimmed.startsWith('oat_')) {
+    throw new Error('--token value must be an agent token starting with oat_');
+  }
+  return trimmed;
+}
+
 export async function authLogin(args = []) {
+  const agentToken = parseTokenFlag(args);
+
+  if (agentToken) {
+    return authLoginWithAgentToken(agentToken, args);
+  }
+
   const preselectedOrganizationId = parseOrganizationFlag(args);
   const storedCredentials = loadCredentials();
   const platformUrl = resolveLoginPlatformUrl(null, storedCredentials?.platform_url ?? null);
@@ -558,6 +578,27 @@ export async function authLogin(args = []) {
   }
 }
 
+async function authLoginWithAgentToken(agentToken, args) {
+  const preselectedOrganizationId = parseOrganizationFlag(args);
+  const storedCredentials = loadCredentials();
+  const platformUrl = resolveLoginPlatformUrl(null, storedCredentials?.platform_url ?? null);
+
+  saveCredentials({
+    agent_token: agentToken,
+    platform_url: platformUrl,
+    ...(preselectedOrganizationId !== null ? { organization_id: preselectedOrganizationId } : {})
+  });
+
+  console.log(`Agent token saved. The CLI will use this token for all protocol commands.`);
+  if (preselectedOrganizationId !== null) {
+    console.log(`  Default organization: ${preselectedOrganizationId}`);
+  } else {
+    console.log(`  Organization will be derived from your token's membership.`);
+  }
+  console.log(`  Platform URL: ${platformUrl}`);
+  console.log(`\nTo remove: ovld auth logout`);
+}
+
 async function printVerboseAuthStatus() {
   const status = await getAuthStatus();
   if (!status.isLoggedIn) {
@@ -638,6 +679,8 @@ export async function runAuthCommand(subcommand, args = []) {
 
 Subcommands:
   login    Authorize the CLI via browser (works locally or over SSH)
+             --token <oat_…>          Persist an agent token from Settings → Agents & MCP.
+                                      Skips the browser flow; token never expires.
              --organization-id <id>   Optional default organization override
                                       (ticket-scoped commands infer organization
                                       from ticket ids such as 1:899)

package/bin/_cli/credentials.mjs

@@ -79,19 +79,21 @@ function parseStoredCredentialsData(parsed, { requireAuthData = false } = {}) {
     typeof parsed.access_token_expires_at === 'string'
       ? parsed.access_token_expires_at.trim()
       : '';
+  const agentToken = normalizeAgentToken(parsed.agent_token);
   const organizationId =
     typeof parsed.organization_id === 'number' && Number.isFinite(parsed.organization_id)
       ? parsed.organization_id
       : null;
 
   if (!platformUrl) return null;
-  if (requireAuthData && !refreshToken) return null;
+  if (requireAuthData && !refreshToken && !agentToken) return null;
 
   return {
     platform_url: platformUrl,
     ...(refreshToken ? { refresh_token: refreshToken } : {}),
     ...(accessToken ? { access_token: accessToken } : {}),
     ...(accessTokenExpiresAt ? { access_token_expires_at: accessTokenExpiresAt } : {}),
+    ...(agentToken ? { agent_token: agentToken } : {}),
     ...(organizationId ? { organization_id: organizationId } : {}),
     ...(typeof parsed.user_email === 'string' && parsed.user_email.trim()
       ? { user_email: parsed.user_email.trim() }
@@ -116,6 +118,7 @@ function normalizeCredentialsForSave(data) {
     ...(parsed.access_token_expires_at
       ? { access_token_expires_at: parsed.access_token_expires_at }
       : {}),
+    ...(parsed.agent_token ? { agent_token: parsed.agent_token } : {}),
     ...(parsed.organization_id ? { organization_id: parsed.organization_id } : {}),
     ...(parsed.user_email ? { user_email: parsed.user_email } : {}),
     ...(parsed.updated_at ? { updated_at: parsed.updated_at } : {})
@@ -181,10 +184,13 @@ function selectStoredCredentials() {
         requireAuthData: true
       })
     }
-  ].filter(candidate => candidate.credentials?.refresh_token);
+  ].filter(candidate => candidate.credentials?.refresh_token || candidate.credentials?.agent_token);
 
   if (candidates.length === 0) return null;
 
+  const agentTokenCandidate = candidates.find(c => c.credentials?.agent_token);
+  if (agentTokenCandidate) return agentTokenCandidate;
+
   const fresh = candidates.filter(candidate => isAccessTokenFresh(candidate.credentials));
   const pool = fresh.length > 0 ? fresh : candidates;
   return pool.sort(
@@ -551,6 +557,27 @@ export async function resolveAuth(options = {}) {
       ? runtime.local_secret
       : '';
 
+  const envAgentToken = normalizeAgentToken(process.env.OVERLORD_AGENT_TOKEN);
+  if (envAgentToken) {
+    const envOrganizationId =
+      typeof process.env.OVERLORD_ORGANIZATION_ID === 'string'
+        ? Number.parseInt(process.env.OVERLORD_ORGANIZATION_ID, 10)
+        : null;
+    const resolvedOrganizationId =
+      organizationIdHint ?? (Number.isFinite(envOrganizationId) ? envOrganizationId : null);
+
+    // Agent tokens are long-lived and never need refreshing. Organization is
+    // optional — the platform derives it from the token owner's membership when
+    // no hint is supplied, so a headless CLI keeps working without Desktop.
+    return {
+      platformUrl,
+      bearerToken: envAgentToken,
+      localSecret,
+      organizationId: resolvedOrganizationId,
+      authMode: 'agent_token'
+    };
+  }
+
   const envAccessToken = normalizeAccessToken(process.env.OVERLORD_ACCESS_TOKEN);
   if (envAccessToken) {
     const envOrganizationId =
@@ -575,6 +602,16 @@ export async function resolveAuth(options = {}) {
     }
   }
 
+  if (creds?.agent_token) {
+    return {
+      platformUrl,
+      bearerToken: creds.agent_token,
+      localSecret,
+      organizationId: organizationIdHint ?? creds.organization_id ?? null,
+      authMode: 'agent_token'
+    };
+  }
+
   if (!creds) {
     return {
       platformUrl,
@@ -649,10 +686,15 @@ export async function getAuthStatus() {
     };
   }
 
+  const envAgentToken = normalizeAgentToken(process.env.OVERLORD_AGENT_TOKEN);
   const envAccessToken = normalizeAccessToken(process.env.OVERLORD_ACCESS_TOKEN);
   let tokenSource = 'fallback';
-  if (envAccessToken && isEnvAccessTokenUsable(envAccessToken)) {
+  if (envAgentToken) {
+    tokenSource = 'OVERLORD_AGENT_TOKEN';
+  } else if (envAccessToken && isEnvAccessTokenUsable(envAccessToken)) {
     tokenSource = 'OVERLORD_ACCESS_TOKEN';
+  } else if (creds?.agent_token) {
+    tokenSource = getCredentialFileSource() + ' (agent token)';
   } else if (creds?.refresh_token) {
     tokenSource = getCredentialFileSource();
   }
@@ -704,6 +746,14 @@ function normalizeAccessToken(value) {
   return value.trim();
 }
 
+const AGENT_TOKEN_PREFIX = 'oat_';
+
+function normalizeAgentToken(value) {
+  if (typeof value !== 'string') return '';
+  const trimmed = value.trim();
+  return trimmed.startsWith(AGENT_TOKEN_PREFIX) ? trimmed : '';
+}
+
 function isEnvAccessTokenUsable(accessToken) {
   const expiresAt = decodeJwtExpiry(accessToken);
   return expiresAt === null || expiresAt * 1000 - Date.now() > 60_000;

package/bin/_cli/direct-launch.mjs

@@ -216,7 +216,7 @@ Overlord flags:
   --model <identifier>          Preferred model (sets the ticket delegate and is forwarded to the agent)
   --thinking <level>            Agent reasoning/effort level
   --flag <value>                Extra agent flag (repeatable)
-  --pre-command <command>       Command to run before the agent binary (e.g. ollama)
+  --pre-command <command>       Shell command to run before the agent binary (e.g. ollama, agent-pod)
   --project-id <uuid>           Target project (skips working-directory resolution)
   --personal                    Create the ticket in your personal project
   --for-human                   Create a human-review ticket

package/bin/_cli/index.mjs

@@ -57,7 +57,7 @@ Agents:
   Key protocol commands: auth-status, discover-project, create, prompt, attach, connect, load-context.
 
 Auth:
-  ${primaryCommand} auth login               Authorize CLI via browser
+  ${primaryCommand} auth login               Authorize CLI via browser or --token <oat_…>
   ${primaryCommand} auth status              Show login status
   ${primaryCommand} auth repair              Repair shared Desktop/CLI credentials
   ${primaryCommand} auth logout              Remove stored credentials

package/bin/_cli/launcher.mjs

@@ -137,24 +137,53 @@ const supportedAgents = ['claude', 'codex', 'cursor', 'antigravity', 'opencode',
 // Re-exported under clearer names for the direct-launch dispatcher in index.mjs.
 export { supportedAgents as BUILTIN_LAUNCH_AGENTS, agentIdentifierMap };
 
+/** @internal Test-only overrides for launcher subprocess calls. */
+export const launcherTestHooks = {
+  execFileSync: null,
+  shell: null,
+  platform: null
+};
+
 function shellQuote(value) {
   return `'${String(value).replace(/'/g, `'\\''`)}'`;
 }
 
+function resolveLauncherShell() {
+  const platform = launcherTestHooks.platform ?? process.platform;
+  if (platform === 'win32') {
+    return null;
+  }
+  return launcherTestHooks.shell ?? process.env.SHELL ?? 'sh';
+}
+
 /**
  * Run an agent binary, optionally routed through a user-defined pre-command
- * (e.g. `ollama` to run claude-code through Ollama). When a pre-command is set,
- * its first token becomes the executable and the agent binary + args follow it:
- *   preCommand="ollama"  →  ollama claude <args...>
+ * (e.g. `ollama` to run claude-code through Ollama). On POSIX shells, execute
+ * the wrapper through the user's interactive login shell so aliases, functions,
+ * and PATH customizations are available:
+ *   preCommand="agent-pod"  →  $SHELL -ilc 'agent-pod codex <args...>'
+ *
+ * The shell must be interactive (`-i`), not just a login shell (`-l`): zsh only
+ * sources ~/.zshrc — and bash only sources ~/.bashrc — for interactive shells.
+ * Wrappers like agent-pod are commonly installed as a shell alias in ~/.zshrc
+ * (its documented default), so a plain `-lc` login shell never sees them and
+ * fails with `command not found`.
  */
 function execAgentBinary(binary, args, opts, preCommand) {
+  const exec = launcherTestHooks.execFileSync ?? execFileSync;
   const pre = typeof preCommand === 'string' ? preCommand.trim() : '';
   if (pre) {
+    const shell = resolveLauncherShell();
+    if (shell) {
+      const command = [pre, shellQuote(binary), ...args.map(arg => shellQuote(arg))].join(' ');
+      exec(shell, ['-ilc', command], opts);
+      return;
+    }
     const preTokens = pre.split(/\s+/).filter(Boolean);
-    execFileSync(preTokens[0], [...preTokens.slice(1), binary, ...args], opts);
+    exec(preTokens[0], [...preTokens.slice(1), binary, ...args], opts);
     return;
   }
-  execFileSync(binary, args, opts);
+  exec(binary, args, opts);
 }
 
 function toTomlString(value) {
@@ -292,7 +321,7 @@ Options:
   --model <identifier>              Preferred model identifier
   --thinking <level>                Agent reasoning/effort level
   --flag <value>                    Extra agent flag (repeatable)
-  --pre-command <command>           Command to run before the agent binary (e.g. ollama)
+  --pre-command <command>           Shell command to run before the agent binary (e.g. ollama, agent-pod)
   --ssh-command <command>           Launch remotely over SSH by running ovld on the target host
   --remote-working-directory <path> Change to this path on the remote host before launch
   --server-multiplexer <none|tmux>  Wrap remote launches in tmux

package/bin/_cli/protocol.mjs

@@ -2614,7 +2614,7 @@ Subcommands:
 Environment fallback:
   --session-key  <- SESSION_KEY or auto-persisted session from last attach/connect/prompt in this working directory
   --ticket-id    <- TICKET_ID  or auto-persisted session (human-readable ticket_id, e.g. 1:899)
-  auth/host     <- OVERLORD_URL, optional OVERLORD_ACCESS_TOKEN + OVERLORD_ORGANIZATION_ID, or shared OAuth credentials from ovld auth/Desktop login
+  auth/host     <- OVERLORD_URL, OVERLORD_AGENT_TOKEN (durable; best for headless/CI), optional OVERLORD_ACCESS_TOKEN + OVERLORD_ORGANIZATION_ID, or shared OAuth credentials from ovld auth/Desktop login
   --timeout     <- OVERLORD_TIMEOUT
 
 Common flags:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord-cli",
-  "version": "0.2605291046.0",
+  "version": "0.2605300746.0",
   "description": "Overlord CLI — launch AI agents on tickets from anywhere",
   "homepage": "https://www.ovld.ai/docs/",
   "type": "module",