overlord-cli 0.2605291450.0 → 0.2605300746.0

package/bin/_cli/auth.mjs

@@ -500,7 +500,27 @@ function parseOrganizationFlag(args) {
   return parsed;
 }
 
+function parseTokenFlag(args) {
+  const index = args.findIndex(arg => arg === '--token' || arg.startsWith('--token='));
+  if (index === -1) return null;
+  const raw = args[index].includes('=') ? args[index].split('=')[1] : args[index + 1];
+  if (!raw || typeof raw !== 'string') {
+    throw new Error('--token requires a value (e.g. --token oat_…)');
+  }
+  const trimmed = raw.trim();
+  if (!trimmed.startsWith('oat_')) {
+    throw new Error('--token value must be an agent token starting with oat_');
+  }
+  return trimmed;
+}
+
 export async function authLogin(args = []) {
+  const agentToken = parseTokenFlag(args);
+
+  if (agentToken) {
+    return authLoginWithAgentToken(agentToken, args);
+  }
+
   const preselectedOrganizationId = parseOrganizationFlag(args);
   const storedCredentials = loadCredentials();
   const platformUrl = resolveLoginPlatformUrl(null, storedCredentials?.platform_url ?? null);
@@ -558,6 +578,27 @@ export async function authLogin(args = []) {
   }
 }
 
+async function authLoginWithAgentToken(agentToken, args) {
+  const preselectedOrganizationId = parseOrganizationFlag(args);
+  const storedCredentials = loadCredentials();
+  const platformUrl = resolveLoginPlatformUrl(null, storedCredentials?.platform_url ?? null);
+
+  saveCredentials({
+    agent_token: agentToken,
+    platform_url: platformUrl,
+    ...(preselectedOrganizationId !== null ? { organization_id: preselectedOrganizationId } : {})
+  });
+
+  console.log(`Agent token saved. The CLI will use this token for all protocol commands.`);
+  if (preselectedOrganizationId !== null) {
+    console.log(`  Default organization: ${preselectedOrganizationId}`);
+  } else {
+    console.log(`  Organization will be derived from your token's membership.`);
+  }
+  console.log(`  Platform URL: ${platformUrl}`);
+  console.log(`\nTo remove: ovld auth logout`);
+}
+
 async function printVerboseAuthStatus() {
   const status = await getAuthStatus();
   if (!status.isLoggedIn) {
@@ -638,6 +679,8 @@ export async function runAuthCommand(subcommand, args = []) {
 
 Subcommands:
   login    Authorize the CLI via browser (works locally or over SSH)
+             --token <oat_…>          Persist an agent token from Settings → Agents & MCP.
+                                      Skips the browser flow; token never expires.
              --organization-id <id>   Optional default organization override
                                       (ticket-scoped commands infer organization
                                       from ticket ids such as 1:899)

package/bin/_cli/credentials.mjs

@@ -79,19 +79,21 @@ function parseStoredCredentialsData(parsed, { requireAuthData = false } = {}) {
     typeof parsed.access_token_expires_at === 'string'
       ? parsed.access_token_expires_at.trim()
       : '';
+  const agentToken = normalizeAgentToken(parsed.agent_token);
   const organizationId =
     typeof parsed.organization_id === 'number' && Number.isFinite(parsed.organization_id)
       ? parsed.organization_id
       : null;
 
   if (!platformUrl) return null;
-  if (requireAuthData && !refreshToken) return null;
+  if (requireAuthData && !refreshToken && !agentToken) return null;
 
   return {
     platform_url: platformUrl,
     ...(refreshToken ? { refresh_token: refreshToken } : {}),
     ...(accessToken ? { access_token: accessToken } : {}),
     ...(accessTokenExpiresAt ? { access_token_expires_at: accessTokenExpiresAt } : {}),
+    ...(agentToken ? { agent_token: agentToken } : {}),
     ...(organizationId ? { organization_id: organizationId } : {}),
     ...(typeof parsed.user_email === 'string' && parsed.user_email.trim()
       ? { user_email: parsed.user_email.trim() }
@@ -116,6 +118,7 @@ function normalizeCredentialsForSave(data) {
     ...(parsed.access_token_expires_at
       ? { access_token_expires_at: parsed.access_token_expires_at }
       : {}),
+    ...(parsed.agent_token ? { agent_token: parsed.agent_token } : {}),
     ...(parsed.organization_id ? { organization_id: parsed.organization_id } : {}),
     ...(parsed.user_email ? { user_email: parsed.user_email } : {}),
     ...(parsed.updated_at ? { updated_at: parsed.updated_at } : {})
@@ -181,10 +184,13 @@ function selectStoredCredentials() {
         requireAuthData: true
       })
     }
-  ].filter(candidate => candidate.credentials?.refresh_token);
+  ].filter(candidate => candidate.credentials?.refresh_token || candidate.credentials?.agent_token);
 
   if (candidates.length === 0) return null;
 
+  const agentTokenCandidate = candidates.find(c => c.credentials?.agent_token);
+  if (agentTokenCandidate) return agentTokenCandidate;
+
   const fresh = candidates.filter(candidate => isAccessTokenFresh(candidate.credentials));
   const pool = fresh.length > 0 ? fresh : candidates;
   return pool.sort(
@@ -551,6 +557,27 @@ export async function resolveAuth(options = {}) {
       ? runtime.local_secret
       : '';
 
+  const envAgentToken = normalizeAgentToken(process.env.OVERLORD_AGENT_TOKEN);
+  if (envAgentToken) {
+    const envOrganizationId =
+      typeof process.env.OVERLORD_ORGANIZATION_ID === 'string'
+        ? Number.parseInt(process.env.OVERLORD_ORGANIZATION_ID, 10)
+        : null;
+    const resolvedOrganizationId =
+      organizationIdHint ?? (Number.isFinite(envOrganizationId) ? envOrganizationId : null);
+
+    // Agent tokens are long-lived and never need refreshing. Organization is
+    // optional — the platform derives it from the token owner's membership when
+    // no hint is supplied, so a headless CLI keeps working without Desktop.
+    return {
+      platformUrl,
+      bearerToken: envAgentToken,
+      localSecret,
+      organizationId: resolvedOrganizationId,
+      authMode: 'agent_token'
+    };
+  }
+
   const envAccessToken = normalizeAccessToken(process.env.OVERLORD_ACCESS_TOKEN);
   if (envAccessToken) {
     const envOrganizationId =
@@ -575,6 +602,16 @@ export async function resolveAuth(options = {}) {
     }
   }
 
+  if (creds?.agent_token) {
+    return {
+      platformUrl,
+      bearerToken: creds.agent_token,
+      localSecret,
+      organizationId: organizationIdHint ?? creds.organization_id ?? null,
+      authMode: 'agent_token'
+    };
+  }
+
   if (!creds) {
     return {
       platformUrl,
@@ -649,10 +686,15 @@ export async function getAuthStatus() {
     };
   }
 
+  const envAgentToken = normalizeAgentToken(process.env.OVERLORD_AGENT_TOKEN);
   const envAccessToken = normalizeAccessToken(process.env.OVERLORD_ACCESS_TOKEN);
   let tokenSource = 'fallback';
-  if (envAccessToken && isEnvAccessTokenUsable(envAccessToken)) {
+  if (envAgentToken) {
+    tokenSource = 'OVERLORD_AGENT_TOKEN';
+  } else if (envAccessToken && isEnvAccessTokenUsable(envAccessToken)) {
     tokenSource = 'OVERLORD_ACCESS_TOKEN';
+  } else if (creds?.agent_token) {
+    tokenSource = getCredentialFileSource() + ' (agent token)';
   } else if (creds?.refresh_token) {
     tokenSource = getCredentialFileSource();
   }
@@ -704,6 +746,14 @@ function normalizeAccessToken(value) {
   return value.trim();
 }
 
+const AGENT_TOKEN_PREFIX = 'oat_';
+
+function normalizeAgentToken(value) {
+  if (typeof value !== 'string') return '';
+  const trimmed = value.trim();
+  return trimmed.startsWith(AGENT_TOKEN_PREFIX) ? trimmed : '';
+}
+
 function isEnvAccessTokenUsable(accessToken) {
   const expiresAt = decodeJwtExpiry(accessToken);
   return expiresAt === null || expiresAt * 1000 - Date.now() > 60_000;

package/bin/_cli/index.mjs

@@ -57,7 +57,7 @@ Agents:
   Key protocol commands: auth-status, discover-project, create, prompt, attach, connect, load-context.
 
 Auth:
-  ${primaryCommand} auth login               Authorize CLI via browser
+  ${primaryCommand} auth login               Authorize CLI via browser or --token <oat_…>
   ${primaryCommand} auth status              Show login status
   ${primaryCommand} auth repair              Repair shared Desktop/CLI credentials
   ${primaryCommand} auth logout              Remove stored credentials

package/bin/_cli/protocol.mjs

@@ -2614,7 +2614,7 @@ Subcommands:
 Environment fallback:
   --session-key  <- SESSION_KEY or auto-persisted session from last attach/connect/prompt in this working directory
   --ticket-id    <- TICKET_ID  or auto-persisted session (human-readable ticket_id, e.g. 1:899)
-  auth/host     <- OVERLORD_URL, optional OVERLORD_ACCESS_TOKEN + OVERLORD_ORGANIZATION_ID, or shared OAuth credentials from ovld auth/Desktop login
+  auth/host     <- OVERLORD_URL, OVERLORD_AGENT_TOKEN (durable; best for headless/CI), optional OVERLORD_ACCESS_TOKEN + OVERLORD_ORGANIZATION_ID, or shared OAuth credentials from ovld auth/Desktop login
   --timeout     <- OVERLORD_TIMEOUT
 
 Common flags:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord-cli",
-  "version": "0.2605291450.0",
+  "version": "0.2605300746.0",
   "description": "Overlord CLI — launch AI agents on tickets from anywhere",
   "homepage": "https://www.ovld.ai/docs/",
   "type": "module",