overlord-cli 0.2605311843.0 → 0.2605312007.1

package/README.md

@@ -149,10 +149,11 @@ Agents can find docs here: https://www.ovld.ai/docs/for-agents
 - `get-device` / `update-device` - register the caller machine (per organization + user + fingerprint) and rename its label
 - `list-project-resources` / `add-project-resource` / `update-project-resource` - manage filesystem directories tied to a project device
 - `request-execution` / `claim-execution` / `complete-execution-launch` / `fail-execution-launch` - durable runner queue operations used by auto-advance and manual Run
+- `list-organizations` - list every organization the authenticated user (or agent token) belongs to; the runner uses this to poll all of your organizations, not just the one stored at login
 
 Devices are keyed by **(organization, user, fingerprint)** so the same physical workstation can appear once per org session.
 
-`ovld runner start` keeps a foreground runner alive for CLI-only or remote hosts. It claims compatible execution requests for the current device and launches the assigned agent/model with `ovld launch`; `ovld runner once` claims at most one request and exits.
+`ovld runner start` keeps a foreground runner alive for CLI-only or remote hosts. It claims compatible execution requests for the current device and launches the assigned agent/model with `ovld launch`; `ovld runner once` claims at most one request and exits. By default a single runner drains queued requests from **every organization you belong to**, so you do not need one runner per org. Pin it to a single org with `--organization-id <id>` or `OVERLORD_ORGANIZATION_ID`.
 
 Use `create` for future work you want to track, `prompt` for work that should start immediately, and `record-work` for work that was already completed in chat and now needs a review ticket plus feed post. Use multiple tickets when prompts represent different features or goals; use `add-objectives` or `--objectives-json '[{"objective":"Step one"},{"objective":"Step two"}]'` when prompts are sequential steps toward the same feature or goal.
 

package/bin/_cli/protocol.mjs

@@ -2049,6 +2049,24 @@ async function protocolClaimExecution(args) {
   console.log(JSON.stringify(data, null, 2));
 }
 
+async function protocolListOrganizations(args) {
+  const flags = parseFlags(args);
+  const { platformUrl, bearerToken, localSecret, organizationId } =
+    await resolveProtocolAuthForFlags(flags);
+  const timeoutMs = resolveTimeout(flags);
+
+  const data = await apiPost(
+    platformUrl,
+    bearerToken,
+    localSecret,
+    organizationId,
+    '/api/protocol/organizations',
+    {},
+    timeoutMs
+  );
+  console.log(JSON.stringify(data, null, 2));
+}
+
 async function protocolCompleteExecutionLaunch(args) {
   const flags = parseFlags(args);
   const { platformUrl, bearerToken, localSecret, organizationId } =
@@ -2225,7 +2243,7 @@ async function protocolPrompt(args) {
 
   // When --project-id is not provided, auto-send cwd as workingDirectory so
   // the server can resolve the project from the caller's project_user
-  // local_working_directory setting.
+  // project resource directory setting.
   const personal = Boolean(flags.personal);
   const workingDirectory =
     flags['working-directory'] ?? (!flags['project-id'] && !personal ? process.cwd() : undefined);
@@ -2644,6 +2662,7 @@ Subcommands:
   request-approval-gate     Flip auto_advance=false on the next queued future objective
   request-execution         Queue an objective for local/remote runner execution
   claim-execution           Claim one queued execution request for this device
+  list-organizations        List organizations the authenticated user belongs to
   complete-execution-launch Mark a claimed execution request launched
   fail-execution-launch     Mark a claimed execution request failed
   permission-request        Notify Overlord that the agent is requesting tool permission
@@ -2901,7 +2920,7 @@ prompt:
   Purpose:
     Create a ticket and attach to it in one call.
     When --project-id is omitted, automatically resolves the project from the
-    current working directory (matching against the caller's project_user.local_working_directory).
+    current working directory (matching against the caller's project resource directories).
   Required:
     --objective <text>
     or: --objectives-json <json> / --objectives-file <path|-> with [{ "objective": "...", "title": "...", "autoAdvance": true }]
@@ -3009,7 +3028,7 @@ record-work:
   Notes:
     Project resolution mirrors \`prompt\`: if --project-id is not set and --personal is not used,
     the CLI sends cwd as workingDirectory and the API matches it against your configured
-    project_user.local_working_directory rows. If no match, the API returns 400 — re-run with
+    project_resource_directories rows. If no match, the API returns 400 — re-run with
     --project-id <id> or --personal.
     Use this for completed-from-chat work. If you still need to execute the work, use \`create\`
     for a draft ticket or \`prompt\` to create and start execution immediately.
@@ -3139,6 +3158,12 @@ claim-execution:
     --lease-seconds <n>
     --project-id <uuid>
 
+list-organizations:
+  Purpose:
+    Print every organization the authenticated user (or agent token) belongs to.
+    The runner uses this to poll all of your organizations, not just the one
+    stored at login. Takes no required flags.
+
 complete-execution-launch:
   Required:
     --request-id <uuid>        (or EXECUTION_REQUEST_ID env var)
@@ -3184,6 +3209,7 @@ Examples:
   ovld protocol attachment-download-url --session-key <key> --attachment-id <attachment-id>
   ovld protocol request-execution --ticket-id 1:899 --agent codex --requested-from manual_run
   ovld protocol claim-execution --device-fingerprint $OVERLORD_DEVICE_FINGERPRINT
+  ovld protocol list-organizations
   ovld protocol deliver --session-key <key> --ticket-id <ticket_id> --summary "Done"
   ovld protocol deliver --session-key <key> --ticket-id <ticket_id> --summary "Done" --artifacts-file ./artifacts.json
   ovld protocol deliver --session-key <key> --ticket-id <ticket_id> --payload-json '{"summary":"Done","artifacts":[{"type":"note","label":"Delivery","content":"..."}]}'
@@ -3303,6 +3329,10 @@ EOF
     await protocolClaimExecution(args);
     return;
   }
+  if (subcommand === 'list-organizations') {
+    await protocolListOrganizations(args);
+    return;
+  }
   if (subcommand === 'complete-execution-launch') {
     await protocolCompleteExecutionLaunch(args);
     return;

package/bin/_cli/runner.mjs

@@ -27,8 +27,12 @@ Options:
   --device-fingerprint <fp>  Override runner device identity
   --poll-interval-ms <ms>    Poll interval for start mode (default 3000)
   --project-id <uuid>        Only claim requests for one project
+  --organization-id <id>     Only poll one organization (also OVERLORD_ORGANIZATION_ID).
+                             Default: poll every organization you belong to.
 
 The runner claims durable execution requests and launches them with \`${primaryCommand} launch\`.
+By default it drains queued requests from all of your organizations, so a single
+runner serves every org without needing one instance per org.
 `);
 }
 
@@ -89,7 +93,7 @@ function protocolJson(subcommand, args, env) {
   return stdout.trim() ? JSON.parse(stdout) : {};
 }
 
-function claimExecution(flags, deviceFingerprint) {
+function claimExecution(flags, deviceFingerprint, organizationId) {
   const args = [
     '--device-fingerprint',
     deviceFingerprint,
@@ -98,12 +102,82 @@ function claimExecution(flags, deviceFingerprint) {
     '--device-platform',
     process.platform
   ];
+  // An explicit organization id scopes this claim to one org. The CLI turns it
+  // into the `x-organization-id` header, which OAuth-authenticated protocol
+  // requests require and the server validates against the user's membership.
+  if (organizationId) {
+    args.push('--organization-id', String(organizationId));
+  }
   if (typeof flags['project-id'] === 'string') {
     args.push('--project-id', flags['project-id']);
   }
   return protocolJson('claim-execution', args, { OVERLORD_DEVICE_FINGERPRINT: deviceFingerprint });
 }
 
+function listOrganizationIds(deviceFingerprint) {
+  const data = protocolJson('list-organizations', [], {
+    OVERLORD_DEVICE_FINGERPRINT: deviceFingerprint
+  });
+  const organizations = Array.isArray(data.organizations) ? data.organizations : [];
+  return organizations
+    .map(organization => organization?.id)
+    .filter(id => Number.isInteger(id) && id > 0)
+    .map(id => String(id));
+}
+
+function resolvePinnedOrganizationId(flags) {
+  const fromFlag =
+    typeof flags['organization-id'] === 'string' ? flags['organization-id'].trim() : '';
+  if (fromFlag) return fromFlag;
+  const fromEnv = process.env.OVERLORD_ORGANIZATION_ID?.trim();
+  return fromEnv || '';
+}
+
+// Re-discover the user's organizations periodically so a runner picks up newly
+// joined orgs without a restart, without hitting the API on every poll.
+const ORGANIZATION_REFRESH_MS = 60_000;
+
+/**
+ * Resolves which organizations a poll pass should claim from.
+ *
+ * - When the user pins an org (`--organization-id` flag or
+ *   `OVERLORD_ORGANIZATION_ID`), only that org is polled.
+ * - Otherwise the runner discovers every org the authenticated user belongs to
+ *   and polls each one. If discovery fails or returns nothing, it falls back to
+ *   the credential default (an empty scope id) so behavior never regresses.
+ */
+export function createOrganizationScope(flags, deviceFingerprint) {
+  const pinned = resolvePinnedOrganizationId(flags);
+  if (pinned) {
+    return { pinned: true, resolve: () => [pinned] };
+  }
+
+  let cache = [];
+  let fetchedAt = 0;
+  return {
+    pinned: false,
+    resolve() {
+      const now = Date.now();
+      if (cache.length === 0 || now - fetchedAt >= ORGANIZATION_REFRESH_MS) {
+        try {
+          const ids = listOrganizationIds(deviceFingerprint);
+          fetchedAt = now;
+          // Keep the last known good list on a transient empty result.
+          if (ids.length > 0) cache = ids;
+        } catch (error) {
+          process.stderr.write(
+            `[runner] could not list organizations (${
+              error instanceof Error ? error.message : error
+            }); using the default organization\n`
+          );
+        }
+      }
+      // Empty string = "no override", i.e. the org stored in credentials.
+      return cache.length > 0 ? cache : [''];
+    }
+  };
+}
+
 function completeLaunch(requestId, deviceFingerprint) {
   protocolJson(
     'complete-execution-launch',
@@ -358,14 +432,34 @@ export async function launchClaimedRequest(claim, deviceFingerprint) {
   return true;
 }
 
-export async function runOnce(flags, deviceFingerprint) {
-  const claim = claimExecution(flags, deviceFingerprint);
-  if (!claim.request) {
+export async function runOnce(flags, deviceFingerprint, organizationScope) {
+  const scope = organizationScope ?? createOrganizationScope(flags, deviceFingerprint);
+  const organizationIds = scope.resolve();
+
+  let launchedAny = false;
+  for (const organizationId of organizationIds) {
+    let claim;
+    try {
+      claim = claimExecution(flags, deviceFingerprint, organizationId);
+    } catch (error) {
+      // A single organization failing (transient API/auth error) must not stop
+      // the runner from servicing the others.
+      process.stderr.write(
+        `[runner] claim failed for organization ${organizationId || 'default'}: ${
+          error instanceof Error ? error.message : error
+        }\n`
+      );
+      continue;
+    }
+    if (!claim.request) continue;
+    await launchClaimedRequest(claim, deviceFingerprint);
+    launchedAny = true;
+  }
+
+  if (!launchedAny) {
     process.stderr.write('[runner] no queued execution requests\n');
-    return false;
   }
-  await launchClaimedRequest(claim, deviceFingerprint);
-  return true;
+  return launchedAny;
 }
 
 function sleep(ms) {
@@ -408,10 +502,18 @@ export async function runRunnerCommand(subcommand, args, primaryCommand = 'ovld'
       typeof flags['poll-interval-ms'] === 'string'
         ? Math.max(1000, Number.parseInt(flags['poll-interval-ms'], 10) || 3000)
         : 3000;
+    // Build the organization scope once so its discovery cache persists across
+    // polls instead of refetching the org list every iteration.
+    const organizationScope = createOrganizationScope(flags, deviceFingerprint);
     process.stderr.write(`[runner] started with device ${deviceFingerprint}\n`);
+    process.stderr.write(
+      organizationScope.pinned
+        ? `[runner] polling a single organization\n`
+        : `[runner] polling every organization you belong to\n`
+    );
     for (;;) {
       try {
-        const launched = await runOnce(flags, deviceFingerprint);
+        const launched = await runOnce(flags, deviceFingerprint, organizationScope);
         if (!launched) await sleep(pollIntervalMs);
       } catch (error) {
         process.stderr.write(`[runner] ${error instanceof Error ? error.message : error}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord-cli",
-  "version": "0.2605311843.0",
+  "version": "0.2605312007.1",
   "description": "Overlord CLI — launch AI agents on tickets from anywhere",
   "homepage": "https://www.ovld.ai/docs/",
   "type": "module",

package/plugins/antigravity/skills/overlord-ticket/SKILL.md

@@ -123,7 +123,7 @@ Use this mode when the conversation starts normally and the user asks you to cre
 
 1. If the user wants to create tickets (and does not ask to start execution), run `ovld protocol create --agent antigravity --objectives-json '[{"objective":"..."}]'`.
    - When `--session-key` and `--ticket-id` are provided, it creates a follow-up draft.
-   - When session flags are omitted, it resolves the project by matching current working directory (or `--working-directory`) to Overlord `local_working_directory`, then creates a standalone draft.
+   - When session flags are omitted, it resolves the project by matching current working directory (or `--working-directory`) to Overlord project resource directories, then creates a standalone draft.
    - Pass multiple items in `--objectives-json` when creating ordered steps for the same feature or goal.
 2. Default to `create` for new tickets. Only use `/overlord:prompt` or `ovld protocol prompt --agent antigravity --objectives-json '[{"objective":"..."}]'` when the user explicitly asks to create and execute immediately.
    `prompt` creates the ticket in `execute` status and attaches immediately.
@@ -276,4 +276,4 @@ This keeps the ticket feed readable while preserving the full document in versio
 - Do not add or commit changes unless the user explicitly asks you to commit.
 - Delivery is the concluding step. After delivering, stop implementation work unless the user explicitly asks for follow-up execution; once follow-up execution is complete, deliver again.
 
-<!-- version: 0.1.5 -->
+<!-- version: 0.1.6 -->

package/plugins/claude/skills/overlord-ticket/SKILL.md

@@ -60,7 +60,7 @@ Use this mode when the conversation starts normally and the user asks Claude to
 
 1. If the user wants to create tickets (and does not ask to start execution), use `/overlord:create` or run `ovld protocol create --agent claude-code --objectives-json '[{"objective":"..."}]'`.
    - When `--session-key` and `--ticket-id` are provided, it creates a follow-up draft.
-   - When session flags are omitted, it resolves the project by matching current working directory (or `--working-directory`) to Overlord `local_working_directory`, then creates a standalone draft.
+   - When session flags are omitted, it resolves the project by matching current working directory (or `--working-directory`) to Overlord project resource directories, then creates a standalone draft.
    - Pass multiple items in `--objectives-json` when creating ordered steps for the same feature or goal.
    - If the user wants to **add more objectives to an existing ticket** (not create a new ticket), use `ovld protocol add-objectives --ticket-id <ticket_id> --objectives-json '[{"objective":"..."}]'` instead.
 2. Default to `create` for new tickets. Only use `/overlord:prompt` or `ovld protocol prompt --agent claude-code --objectives-json '[{"objective":"..."}]'` when the user explicitly asks to create and execute immediately.
@@ -114,5 +114,5 @@ For the `record-change-rationales` command and full payload shape with optional
 - [reference/context.md](reference/context.md) — Shared state, attachments, and large artifact policy
 - [reference/shell-escaping.md](reference/shell-escaping.md) — Heredoc stdin piping for special characters in summaries and payloads
 
-<!-- version: 0.5.9 -->
+<!-- version: 0.5.10 -->
 

package/plugins/cursor/skills/overlord-ticket/SKILL.md

@@ -60,7 +60,7 @@ Use this mode when the conversation starts normally and the user asks Cursor to
 
 1. If the user wants to create tickets (and does not ask to start execution), use `/create` or run `ovld protocol create --agent cursor --objectives-json '[{"objective":"..."}]'`.
    - When `--session-key` and `--ticket-id` are provided, it creates a follow-up draft.
-   - When session flags are omitted, it resolves the project by matching current working directory (or `--working-directory`) to Overlord `local_working_directory`, then creates a standalone draft.
+   - When session flags are omitted, it resolves the project by matching current working directory (or `--working-directory`) to Overlord project resource directories, then creates a standalone draft.
    - Pass multiple items in `--objectives-json` when creating ordered steps for the same feature or goal.
    - If the user wants to **add more objectives to an existing ticket** (not create a new ticket), use `ovld protocol add-objectives --ticket-id <ticket_id> --objectives-json '[{"objective":"..."}]'` instead.
 2. Default to `create` for new tickets. Only use `/prompt` or `ovld protocol prompt --agent cursor --objectives-json '[{"objective":"..."}]'` when the user explicitly asks to create and execute immediately.
@@ -114,5 +114,5 @@ For the `record-change-rationales` command and full payload shape with optional
 - [reference/context.md](reference/context.md) — Shared state, attachments, and large artifact policy
 - [reference/shell-escaping.md](reference/shell-escaping.md) — Heredoc stdin piping for special characters in summaries and payloads
 
-<!-- version: 0.5.9 -->
+<!-- version: 0.5.10 -->
 

package/plugins/overlord/skills/overlord-ticket/SKILL.md

@@ -60,7 +60,7 @@ Use this mode when the conversation starts normally and the user asks Codex to c
 
 1. If the user wants to create tickets (and does not ask to start execution), run `ovld protocol create --agent codex --objectives-json '[{"objective":"..."}]'`.
    - When `--session-key` and `--ticket-id` are provided, it creates a follow-up draft.
-   - When session flags are omitted, it resolves the project by matching current working directory (or `--working-directory`) to Overlord `local_working_directory`, then creates a standalone draft.
+   - When session flags are omitted, it resolves the project by matching current working directory (or `--working-directory`) to Overlord project resource directories, then creates a standalone draft.
    - Pass multiple items in `--objectives-json` when creating ordered steps for the same feature or goal.
    - If the user wants to **add more objectives to an existing ticket** (not create a new ticket), use `ovld protocol add-objectives --ticket-id <ticket_id> --objectives-json '[{"objective":"..."}]'` instead.
 2. Default to `create` for new tickets. Only use `ovld protocol prompt --agent codex --objectives-json '[{"objective":"..."}]'` when the user explicitly asks to create and execute immediately.
@@ -115,5 +115,5 @@ For the `record-change-rationales` command and full payload shape with optional
 - [reference/context.md](reference/context.md) — Shared state, attachments, and large artifact policy
 - [reference/shell-escaping.md](reference/shell-escaping.md) — Heredoc stdin piping for special characters in summaries and payloads
 
-<!-- version: 0.5.9 -->
+<!-- version: 0.5.10 -->