overlord-cli 0.2606011152.0 → 0.2606021930.0

package/README.md

@@ -89,7 +89,7 @@ ovld doctor
 
 **Antigravity:** Gemini CLI is deprecated. Use `ovld setup antigravity` and `ovld launch antigravity --ticket-id <ticket_id>`. Antigravity manages model selection internally.
 
-For ticket-scoped protocol and launch commands, `ticket_id` values such as `1:899` carry the organization id. The CLI uses that first, then `--organization-id` for UUID compatibility, then stored auth. `ovld auth login` stores the first available organization as a default when an account belongs to multiple organizations; pass `--organization-id <id>` only when you want a different default.
+The CLI is organization-agnostic: `ovld auth login` stores your identity only and never a default organization. Your identity (OAuth session or agent token) resolves to the list of organizations you belong to — see `ovld auth status --verbose`. Each command resolves its organization from the `ticket_id` (values such as `1:899` carry the organization id), then an explicit `--organization-id`, otherwise from your membership. Commands that browse or search — `ovld add-cwd`, `ovld create`/`ovld prompt`, `ovld tickets list`, and `ovld protocol search-tickets` — span every organization you belong to. Actions against an organization you are not a member of return a clear permission error rather than silently falling back to another org.
 
 When `ovld launch` has an explicit `--working-directory`, or when you run it from a registered project directory containing `.overlord/project.json`, it exports `TMPDIR`, `TMP`, `TEMP`, and `OVERLORD_TMPDIR` to that project's `.overlord/tmp/` directory before spawning the agent. Otherwise it falls back to the system temp directory.
 
@@ -141,7 +141,7 @@ Agents can find docs here: https://www.ovld.ai/docs/for-agents
 - `record-change-rationales` - persist structured change rationales without a normal progress update
 - `ask` - post a blocking question and move the ticket to review
 - `permission-request` - notify Overlord that the agent is requesting tool permission
-- `hook-event` - record lifecycle hook events such as `UserPromptSubmit` / Cursor `beforeSubmitPrompt` without a session key
+- `hook-event` - record lifecycle hook events such as `UserPromptSubmit` / Cursor `beforeSubmitPrompt` without a session key; optionally persist a native resume/session id onto the active Overlord session
 - `read-context` - read shared persistent context for this ticket
 - `write-context` - write shared persistent context for future sessions
 - `deliver` - send artifacts/rationales and move the ticket to review

package/bin/_cli/add-cwd.mjs

@@ -12,7 +12,7 @@ import { stdin as input, stdout as output } from 'node:process';
 
 import { buildAuthHeaders, resolveAuth } from './credentials.mjs';
 import { upsertLocalOverlordConfig } from './local-config.mjs';
-import { parseNumberedSelection, sortProjects } from './new-ticket.mjs';
+import { fetchProjectsAcrossOrganizations, parseNumberedSelection } from './new-ticket.mjs';
 import { readOrCreateDeviceFingerprint } from './runner.mjs';
 
 function parseFlags(args) {
@@ -41,19 +41,6 @@ function projectLabel(project) {
   return organizationName ? `${project.name} — ${organizationName}` : project.name;
 }
 
-async function fetchProjects(platformUrl, bearerToken, localSecret, organizationId) {
-  const res = await fetch(`${platformUrl}/api/protocol/projects`, {
-    headers: buildAuthHeaders(bearerToken, localSecret, organizationId)
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    throw new Error(
-      `Failed to list projects (${res.status}): ${data.error ?? JSON.stringify(data)}`
-    );
-  }
-  return Array.isArray(data.projects) ? sortProjects(data.projects) : [];
-}
-
 async function promptForProject(projects, cwd) {
   if (!projects.length) {
     throw new Error('No projects available. Create a project in Overlord first.');
@@ -118,9 +105,10 @@ By default the registered resource is marked primary for this device. Pass
 
   const isPrimary = !(flags.primary === 'false' || flags.primary === false);
 
-  const { platformUrl, bearerToken, localSecret, organizationId } = await resolveAuth({});
+  const auth = await resolveAuth({});
+  const { platformUrl, bearerToken, localSecret } = auth;
 
-  const projects = await fetchProjects(platformUrl, bearerToken, localSecret, organizationId);
+  const projects = await fetchProjectsAcrossOrganizations(auth);
   let project = null;
   if (typeof flags['project-id'] === 'string' && flags['project-id'].trim()) {
     const wanted = flags['project-id'].trim();
@@ -139,6 +127,10 @@ By default the registered resource is marked primary for this device. Pass
 
   const deviceFingerprint = readOrCreateDeviceFingerprint(flags);
 
+  // Register the resource in the organization that owns the chosen project,
+  // never a stored default org.
+  const organizationId = project.organizationId ?? null;
+
   const body = {
     projectId: project.id,
     directoryPath,

package/bin/_cli/attach.mjs

@@ -9,7 +9,7 @@
  *   ovld attach <ticketId> <agent>      # non-interactive: launch immediately
  */
 
-import { buildAuthHeaders, resolveAuth } from './credentials.mjs';
+import { resolveAuth, searchTicketsAcrossOrganizations } from './credentials.mjs';
 import { runLauncherCommand } from './launcher.mjs';
 
 const AGENTS = ['claude', 'cursor', 'codex', 'antigravity', 'opencode'];
@@ -58,26 +58,15 @@ function statusColor(status) {
 
 // ─── API ──────────────────────────────────────────────────────────────────────
 
-async function searchTickets(platformUrl, bearerToken, localSecret, organizationId, query) {
-  const res = await fetch(`${platformUrl}/api/protocol/search-tickets`, {
-    method: 'POST',
-    headers: {
-      ...buildAuthHeaders(bearerToken, localSecret, organizationId),
-      'Content-Type': 'application/json'
-    },
-    body: JSON.stringify({
-      includeCompleted: false,
-      query,
-      limit: MAX_VISIBLE
-    })
+// Organization-agnostic ticket search: spans every organization the identity
+// belongs to (no default org) by delegating to the shared fan-out helper.
+async function searchTickets(auth, query) {
+  const { tickets } = await searchTicketsAcrossOrganizations(auth, {
+    includeCompleted: false,
+    query,
+    limit: MAX_VISIBLE
   });
-
-  if (!res.ok) {
-    throw new Error(`Failed to search tickets (${res.status}): ${await res.text()}`);
-  }
-
-  const data = await res.json();
-  return data.tickets ?? [];
+  return tickets ?? [];
 }
 
 // ─── Interactive prompt ───────────────────────────────────────────────────────
@@ -287,7 +276,7 @@ function runInteractivePrompt({ label, items = [], search, prefix = '' }) {
 export async function runAttachCommand(args) {
   const [ticketIdArg, agentArg] = args;
 
-  const { platformUrl, bearerToken, localSecret, organizationId } = await resolveAuth();
+  const auth = await resolveAuth();
 
   // ── Phase 1: Ticket selection ──────────────────────────────────────────────
 
@@ -301,8 +290,7 @@ export async function runAttachCommand(args) {
 
     const selectedTicket = await runInteractivePrompt({
       label: 'Search tickets',
-      search: nextQuery =>
-        searchTickets(platformUrl, bearerToken, localSecret, organizationId, nextQuery)
+      search: nextQuery => searchTickets(auth, nextQuery)
     });
 
     if (!selectedTicket) {

package/bin/_cli/auth.mjs

@@ -13,6 +13,8 @@ import {
   loadCredentials,
   loadRuntime,
   repairCredentials,
+  resolveAuth,
+  resolveOrganizations,
   saveCredentials
 } from './credentials.mjs';
 
@@ -558,47 +560,91 @@ export async function authLogin(args = []) {
     credentials.access_token,
     localSecret
   );
-  const selectedOrganization = selectLoginOrganization(organizations, preselectedOrganizationId);
+
+  // The CLI is organization-agnostic: login stores the identity only, never a
+  // default organization. `--organization-id` is still validated so a typo is
+  // caught early, but it is no longer persisted — every command resolves its org
+  // from the ticket id, an explicit --organization-id, or your membership.
+  if (preselectedOrganizationId !== null) {
+    selectLoginOrganization(organizations, preselectedOrganizationId);
+  }
 
   saveCredentials({
     access_token: credentials.access_token,
     access_token_expires_at: credentials.access_token_expires_at ?? undefined,
     refresh_token: credentials.refresh_token,
-    organization_id: selectedOrganization.id,
     platform_url: resolvedPlatformUrl
   });
 
-  if (organizations.length > 1 && preselectedOrganizationId === null) {
+  console.log('Logged in successfully.');
+  printOrganizationMemberships(organizations);
+  if (preselectedOrganizationId !== null) {
     console.log(
-      `Logged in successfully. Default organization: ${describeOrganization(selectedOrganization)}. ` +
-        'Ticket-scoped commands override this from the ticket id; use --organization-id to set a different default.'
+      `\nNote: --organization-id is no longer stored as a default. ` +
+        'Commands resolve their organization from the ticket id, an explicit --organization-id, or your membership.'
     );
-  } else {
-    console.log(`Logged in successfully. Default organization: ${describeOrganization(selectedOrganization)}.`);
   }
 }
 
+function printOrganizationMemberships(organizations) {
+  if (!organizations.length) {
+    console.log('  You are not yet a member of any organization. Complete onboarding in Overlord first.');
+    return;
+  }
+
+  if (organizations.length === 1) {
+    console.log(`  Organization: ${describeOrganization(organizations[0])}`);
+    return;
+  }
+
+  console.log(`  Member of ${organizations.length} organizations:`);
+  for (const organization of organizations) {
+    console.log(`    - ${describeOrganization(organization)}`);
+  }
+  console.log('  Commands resolve their organization from the ticket id or --organization-id.');
+}
+
 async function authLoginWithAgentToken(agentToken, args) {
   const preselectedOrganizationId = parseOrganizationFlag(args);
   const storedCredentials = loadCredentials();
   const platformUrl = resolveLoginPlatformUrl(null, storedCredentials?.platform_url ?? null);
 
+  // Agent-token login stores the identity only — never a default organization.
   saveCredentials({
     agent_token: agentToken,
-    platform_url: platformUrl,
-    ...(preselectedOrganizationId !== null ? { organization_id: preselectedOrganizationId } : {})
+    platform_url: platformUrl
   });
 
   console.log(`Agent token saved. The CLI will use this token for all protocol commands.`);
+  console.log(`  Organizations are resolved from your token's membership per command.`);
   if (preselectedOrganizationId !== null) {
-    console.log(`  Default organization: ${preselectedOrganizationId}`);
-  } else {
-    console.log(`  Organization will be derived from your token's membership.`);
+    console.log(
+      `  Note: --organization-id is no longer stored as a default; pass it per command (or use a ticket id) to scope an action.`
+    );
   }
   console.log(`  Platform URL: ${platformUrl}`);
   console.log(`\nTo remove: ovld auth logout`);
 }
 
+async function printOrganizationMembershipStatus() {
+  try {
+    const auth = await resolveAuth();
+    const organizations = await resolveOrganizations(auth);
+    if (!organizations.length) {
+      console.log('  Organizations: none (not a member of any organization)');
+      return;
+    }
+    console.log(`  Organizations (${organizations.length}):`);
+    for (const organization of organizations) {
+      console.log(`    - ${describeOrganization(organization)}`);
+    }
+  } catch (error) {
+    console.log(
+      `  Organizations: unavailable (${error instanceof Error ? error.message : String(error)})`
+    );
+  }
+}
+
 async function printVerboseAuthStatus() {
   const status = await getAuthStatus();
   if (!status.isLoggedIn) {
@@ -617,7 +663,9 @@ async function printVerboseAuthStatus() {
   console.log(`  Token source: ${status.tokenSource}`);
   console.log(`  Token present: ${status.tokenPresent ? 'yes' : 'no'}`);
   console.log(`  Auth mode: ${status.authMode}`);
-  console.log(`  Organization ID: ${status.organizationId ?? 'none'}`);
+  if (status.isLoggedIn) {
+    await printOrganizationMembershipStatus();
+  }
   if (status.error) {
     console.log(`  Error: ${status.error}`);
   }
@@ -681,10 +729,11 @@ Subcommands:
   login    Authorize the CLI via browser (works locally or over SSH)
              --token <oat_…>          Persist an agent token from Settings → Agents & MCP.
                                       Skips the browser flow; token never expires.
-             --organization-id <id>   Optional default organization override
-                                      (ticket-scoped commands infer organization
-                                      from ticket ids such as 1:899)
-  status   Show current login status (use --verbose for redacted diagnostics)
+             --organization-id <id>   Optional. Validated against your membership but
+                                      no longer stored as a default — the CLI is
+                                      organization-agnostic. Scope a command with a
+                                      ticket id (e.g. 1:899) or --organization-id.
+  status   Show current login status (use --verbose to list your organizations)
   repair   Mirror and chmod shared Desktop/CLI credentials when possible
   logout   Remove stored credentials
 `);

package/bin/_cli/credentials.mjs

@@ -584,12 +584,12 @@ export async function resolveAuth(options = {}) {
       typeof process.env.OVERLORD_ORGANIZATION_ID === 'string'
         ? Number.parseInt(process.env.OVERLORD_ORGANIZATION_ID, 10)
         : null;
-    const resolvedOrganizationId = organizationIdHint ?? envOrganizationId;
-    if (!Number.isFinite(resolvedOrganizationId)) {
-      throw new Error(
-        'OVERLORD_ACCESS_TOKEN requires OVERLORD_ORGANIZATION_ID so protocol requests stay scoped.'
-      );
-    }
+    // Organization is no longer required up front. When neither a per-action hint
+    // nor an explicit OVERLORD_ORGANIZATION_ID override is present, the platform
+    // resolves the organization from the token owner's membership, so the CLI stays
+    // org-agnostic instead of pinning a single default.
+    const resolvedOrganizationId =
+      organizationIdHint ?? (Number.isFinite(envOrganizationId) ? envOrganizationId : null);
 
     if (isEnvAccessTokenUsable(envAccessToken)) {
       return {
@@ -603,11 +603,14 @@ export async function resolveAuth(options = {}) {
   }
 
   if (creds?.agent_token) {
+    // Stored credentials never act as a default organization. Org is taken from the
+    // per-action hint (ticket id or --organization-id) and otherwise left to the
+    // platform's membership lookup.
     return {
       platformUrl,
       bearerToken: creds.agent_token,
       localSecret,
-      organizationId: organizationIdHint ?? creds.organization_id ?? null,
+      organizationId: organizationIdHint ?? null,
       authMode: 'agent_token'
     };
   }
@@ -641,19 +644,18 @@ export async function resolveAuth(options = {}) {
       }
     }
 
-    if (!Number.isFinite(nextCredentials.organization_id)) {
-      throw new Error('Overlord login is missing an organization selection. Run `ovld auth login` again.');
-    }
-
     if (!nextCredentials.access_token) {
       throw new Error('No OAuth access token is available. Run `ovld auth login` again.');
     }
 
+    // OAuth sessions are not bound to a stored default organization. The platform
+    // derives the organization from the signed-in user's membership when no
+    // per-action hint is supplied, keeping the CLI org-agnostic.
     return {
       platformUrl,
       bearerToken: nextCredentials.access_token,
       localSecret,
-      organizationId: organizationIdHint ?? nextCredentials.organization_id,
+      organizationId: organizationIdHint ?? null,
       authMode: 'oauth'
     };
   }
@@ -667,6 +669,122 @@ export async function resolveAuth(options = {}) {
   };
 }
 
+/**
+ * Lists every organization the authenticated identity belongs to.
+ *
+ * This is the org-agnostic replacement for a stored "default organization": the
+ * caller's identity (OAuth session or agent token) resolves to the full set of
+ * memberships, and commands fan out or prompt over that list instead of assuming
+ * a single org. Works for OAuth, agent tokens, and local-dev alike because
+ * `/api/protocol/organizations` resolves the caller through the standard
+ * protocol auth path.
+ *
+ * @param {{ platformUrl: string, bearerToken: string, localSecret?: string }} auth
+ * @returns {Promise<Array<{ id: number, name: string }>>}
+ */
+export async function resolveOrganizations(auth) {
+  const { platformUrl, bearerToken, localSecret } = auth;
+  let res;
+  try {
+    res = await fetch(`${platformUrl}/api/protocol/organizations`, {
+      method: 'POST',
+      headers: {
+        ...buildAuthHeaders(bearerToken, localSecret),
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({})
+    });
+  } catch (error) {
+    throw describeNetworkError(error, `Failed to list organizations from ${platformUrl}`);
+  }
+
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new Error(
+      `Failed to list organizations (${res.status}): ${data.error ?? JSON.stringify(data)}`
+    );
+  }
+
+  return Array.isArray(data.organizations)
+    ? data.organizations
+        .map(org => ({ id: org.id, name: typeof org.name === 'string' ? org.name : '' }))
+        .filter(org => Number.isFinite(org.id))
+    : [];
+}
+
+/**
+ * Searches tickets across every organization the identity belongs to.
+ *
+ * Organization-agnostic by default: with no explicit organization it resolves the
+ * membership list and fans out the per-org search, merging and de-duplicating by
+ * ticket id. An explicit `organizationId` (from --organization-id) scopes the
+ * search to that single org instead. There is no default-org fallback.
+ *
+ * @param {{ platformUrl: string, bearerToken: string, localSecret?: string }} auth
+ * @param {Record<string, unknown>} body search-tickets request body
+ * @param {{ organizationId?: number | null }} [options]
+ * @returns {Promise<{ tickets: unknown[], count: number }>}
+ */
+export async function searchTicketsAcrossOrganizations(auth, body, options = {}) {
+  const { platformUrl, bearerToken, localSecret } = auth;
+  const explicitOrganizationId =
+    Number.isFinite(options.organizationId) ? options.organizationId : null;
+
+  const post = async organizationId => {
+    const res = await fetch(`${platformUrl}/api/protocol/search-tickets`, {
+      method: 'POST',
+      headers: {
+        ...buildAuthHeaders(bearerToken, localSecret, organizationId),
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new Error(
+        `Failed to search tickets (${res.status}): ${data.error ?? JSON.stringify(data)}`
+      );
+    }
+    return Array.isArray(data.tickets) ? data.tickets : [];
+  };
+
+  if (explicitOrganizationId !== null) {
+    const tickets = await post(explicitOrganizationId);
+    return { tickets, count: tickets.length };
+  }
+
+  const organizations = await resolveOrganizations(auth);
+  if (!organizations.length) {
+    const tickets = await post(null);
+    return { tickets, count: tickets.length };
+  }
+
+  const results = await Promise.allSettled(organizations.map(org => post(org.id)));
+  const failures = results
+    .map((result, index) => ({ result, organization: organizations[index] }))
+    .filter(({ result }) => result.status === 'rejected');
+  if (failures.length > 0) {
+    const detail = failures
+      .map(({ result, organization }) => {
+        const reason = result.status === 'rejected' ? result.reason : null;
+        const message = reason instanceof Error ? reason.message : String(reason);
+        return `${organization.name || `organization ${organization.id}`} (${organization.id}): ${message}`;
+      })
+      .join('; ');
+    throw new Error(`Ticket search returned partial failures: ${detail}`);
+  }
+
+  const perOrg = results.map(result => (result.status === 'fulfilled' ? result.value : []));
+  const byId = new Map();
+  for (const ticket of perOrg.flat()) {
+    if (ticket && ticket.id && !byId.has(ticket.id)) {
+      byId.set(ticket.id, ticket);
+    }
+  }
+  const tickets = [...byId.values()];
+  return { tickets, count: tickets.length };
+}
+
 export async function getAuthStatus() {
   const creds = loadCredentials();
   let resolved;

package/bin/_cli/index.mjs

@@ -34,6 +34,7 @@ Usage:
   ${primaryCommand} create "<objective>"       Create a ticket with numbered project selection; supports --agent/--model/--delegate
   ${primaryCommand} prompt "<objective>"       Create a ticket, then launch an agent on it
   ${primaryCommand} add-cwd                   Register the current directory as a project resource (interactive)
+  ${primaryCommand} onboard                   Create an account, project, cwd link, and onboarding ticket
   ${primaryCommand} auth <subcommand>          Login, logout, repair, or check auth status
   ${primaryCommand} tickets <subcommand>       Create or list tickets
   ${primaryCommand} ticket <subcommand>        Work with a single ticket
@@ -117,6 +118,12 @@ export async function runCli({ primaryCommand }) {
     return;
   }
 
+  if (command === 'onboard') {
+    const { runOnboardCommand } = await import('./onboard.mjs');
+    await runOnboardCommand(rest);
+    return;
+  }
+
   // Auth group
   if (command === 'auth') {
     await runAuthCommand(rest[0], rest.slice(1));

package/bin/_cli/new-ticket.mjs

@@ -4,7 +4,7 @@ import readline from 'node:readline';
 import { stdin as input, stdout as output } from 'node:process';
 import fs from 'node:fs';
 
-import { buildAuthHeaders, resolveAuth } from './credentials.mjs';
+import { buildAuthHeaders, resolveAuth, resolveOrganizations } from './credentials.mjs';
 import { runLauncherCommand } from './launcher.mjs';
 
 const PROMPT_AGENT_IDENTIFIERS = {
@@ -232,7 +232,57 @@ async function fetchProjects(platformUrl, bearerToken, localSecret, organization
     );
   }
 
-  return Array.isArray(data.projects) ? sortProjects(data.projects) : [];
+  return Array.isArray(data.projects) ? data.projects : [];
+}
+
+/**
+ * Lists projects across every organization the identity belongs to.
+ *
+ * The CLI is organization-agnostic: instead of listing only a single default
+ * org's projects, it resolves the membership list and fans out the per-org
+ * projects query, then merges and de-duplicates by project id. Each project
+ * carries its own `organizationId`, so the caller scopes follow-up writes (ticket
+ * creation, resource registration) to the chosen project's org — no default org.
+ *
+ * @param {{ platformUrl: string, bearerToken: string, localSecret?: string }} auth
+ */
+export async function fetchProjectsAcrossOrganizations(auth) {
+  const { platformUrl, bearerToken, localSecret } = auth;
+  const organizations = await resolveOrganizations(auth);
+
+  // No memberships resolved (or a backend that scopes by membership anyway): fall
+  // back to a single unscoped query so the command still works.
+  if (!organizations.length) {
+    return sortProjects(await fetchProjects(platformUrl, bearerToken, localSecret, null));
+  }
+
+  const results = await Promise.allSettled(
+    organizations.map(org => fetchProjects(platformUrl, bearerToken, localSecret, org.id))
+  );
+  const failures = results
+    .map((result, index) => ({ result, organization: organizations[index] }))
+    .filter(({ result }) => result.status === 'rejected');
+  if (failures.length > 0) {
+    const detail = failures
+      .map(({ result, organization }) => {
+        const reason = result.status === 'rejected' ? result.reason : null;
+        const message = reason instanceof Error ? reason.message : String(reason);
+        return `${organization.name || `organization ${organization.id}`} (${organization.id}): ${message}`;
+      })
+      .join('; ');
+    throw new Error(`Project listing returned partial failures: ${detail}`);
+  }
+
+  const perOrg = results.map(result => (result.status === 'fulfilled' ? result.value : []));
+
+  const byId = new Map();
+  for (const project of perOrg.flat()) {
+    if (project && project.id && !byId.has(project.id)) {
+      byId.set(project.id, project);
+    }
+  }
+
+  return sortProjects([...byId.values()]);
 }
 
 async function createTicket(platformUrl, bearerToken, localSecret, organizationId, body) {
@@ -312,8 +362,9 @@ async function runTicketCreationFlow(args, { commandName, launchAgent }) {
   const { flags } = parseFlags(args);
   const objectiveInput = await resolveObjectiveInput(flags);
 
-  const { platformUrl, bearerToken, localSecret, organizationId } = await resolveAuth();
-  const projects = await fetchProjects(platformUrl, bearerToken, localSecret, organizationId);
+  const auth = await resolveAuth();
+  const { platformUrl, bearerToken, localSecret } = auth;
+  const projects = await fetchProjectsAcrossOrganizations(auth);
 
   if (!projects.length) {
     throw new Error('No projects available. Create a project first.');
@@ -328,6 +379,10 @@ async function runTicketCreationFlow(args, { commandName, launchAgent }) {
       renderItem: project => projectLabel(project)
     }));
 
+  // The ticket is created in the organization that owns the chosen project,
+  // never a stored default org.
+  const organizationId = selectedProject.organizationId ?? null;
+
   const selectedAgent = launchAgent
     ? (resolveAgent(typeof flags.agent === 'string' ? flags.agent : '') ??
       (await promptForSelection({