overlord-cli 0.2606021051.0 → 0.2606041130.0

package/README.md

@@ -89,7 +89,7 @@ ovld doctor
 
 **Antigravity:** Gemini CLI is deprecated. Use `ovld setup antigravity` and `ovld launch antigravity --ticket-id <ticket_id>`. Antigravity manages model selection internally.
 
-For ticket-scoped protocol and launch commands, `ticket_id` values such as `1:899` carry the organization id. The CLI uses that first, then `--organization-id` for UUID compatibility, then stored auth. `ovld auth login` stores the first available organization as a default when an account belongs to multiple organizations; pass `--organization-id <id>` only when you want a different default.
+The CLI is organization-agnostic: `ovld auth login` stores your identity only and never a default organization. Your identity (OAuth session or agent token) resolves to the list of organizations you belong to — see `ovld auth status --verbose`. Each command resolves its organization from the `ticket_id` (values such as `1:899` carry the organization id), then an explicit `--organization-id`, otherwise from your membership. Commands that browse or search — `ovld add-cwd`, `ovld create`/`ovld prompt`, `ovld tickets list`, and `ovld protocol search-tickets` — span every organization you belong to. Actions against an organization you are not a member of return a clear permission error rather than silently falling back to another org.
 
 When `ovld launch` has an explicit `--working-directory`, or when you run it from a registered project directory containing `.overlord/project.json`, it exports `TMPDIR`, `TMP`, `TEMP`, and `OVERLORD_TMPDIR` to that project's `.overlord/tmp/` directory before spawning the agent. Otherwise it falls back to the system temp directory.
 

package/bin/_cli/add-cwd.mjs

@@ -12,7 +12,7 @@ import { stdin as input, stdout as output } from 'node:process';
 
 import { buildAuthHeaders, resolveAuth } from './credentials.mjs';
 import { upsertLocalOverlordConfig } from './local-config.mjs';
-import { parseNumberedSelection, sortProjects } from './new-ticket.mjs';
+import { fetchProjectsAcrossOrganizations, parseNumberedSelection } from './new-ticket.mjs';
 import { readOrCreateDeviceFingerprint } from './runner.mjs';
 
 function parseFlags(args) {
@@ -41,19 +41,6 @@ function projectLabel(project) {
   return organizationName ? `${project.name} — ${organizationName}` : project.name;
 }
 
-async function fetchProjects(platformUrl, bearerToken, localSecret, organizationId) {
-  const res = await fetch(`${platformUrl}/api/protocol/projects`, {
-    headers: buildAuthHeaders(bearerToken, localSecret, organizationId)
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    throw new Error(
-      `Failed to list projects (${res.status}): ${data.error ?? JSON.stringify(data)}`
-    );
-  }
-  return Array.isArray(data.projects) ? sortProjects(data.projects) : [];
-}
-
 async function promptForProject(projects, cwd) {
   if (!projects.length) {
     throw new Error('No projects available. Create a project in Overlord first.');
@@ -118,9 +105,10 @@ By default the registered resource is marked primary for this device. Pass
 
   const isPrimary = !(flags.primary === 'false' || flags.primary === false);
 
-  const { platformUrl, bearerToken, localSecret, organizationId } = await resolveAuth({});
+  const auth = await resolveAuth({});
+  const { platformUrl, bearerToken, localSecret } = auth;
 
-  const projects = await fetchProjects(platformUrl, bearerToken, localSecret, organizationId);
+  const projects = await fetchProjectsAcrossOrganizations(auth);
   let project = null;
   if (typeof flags['project-id'] === 'string' && flags['project-id'].trim()) {
     const wanted = flags['project-id'].trim();
@@ -139,6 +127,10 @@ By default the registered resource is marked primary for this device. Pass
 
   const deviceFingerprint = readOrCreateDeviceFingerprint(flags);
 
+  // Register the resource in the organization that owns the chosen project,
+  // never a stored default org.
+  const organizationId = project.organizationId ?? null;
+
   const body = {
     projectId: project.id,
     directoryPath,

package/bin/_cli/attach.mjs

@@ -9,7 +9,7 @@
  *   ovld attach <ticketId> <agent>      # non-interactive: launch immediately
  */
 
-import { buildAuthHeaders, resolveAuth } from './credentials.mjs';
+import { resolveAuth, searchTicketsAcrossOrganizations } from './credentials.mjs';
 import { runLauncherCommand } from './launcher.mjs';
 
 const AGENTS = ['claude', 'cursor', 'codex', 'antigravity', 'opencode'];
@@ -58,26 +58,15 @@ function statusColor(status) {
 
 // ─── API ──────────────────────────────────────────────────────────────────────
 
-async function searchTickets(platformUrl, bearerToken, localSecret, organizationId, query) {
-  const res = await fetch(`${platformUrl}/api/protocol/search-tickets`, {
-    method: 'POST',
-    headers: {
-      ...buildAuthHeaders(bearerToken, localSecret, organizationId),
-      'Content-Type': 'application/json'
-    },
-    body: JSON.stringify({
-      includeCompleted: false,
-      query,
-      limit: MAX_VISIBLE
-    })
+// Organization-agnostic ticket search: spans every organization the identity
+// belongs to (no default org) by delegating to the shared fan-out helper.
+async function searchTickets(auth, query) {
+  const { tickets } = await searchTicketsAcrossOrganizations(auth, {
+    includeCompleted: false,
+    query,
+    limit: MAX_VISIBLE
   });
-
-  if (!res.ok) {
-    throw new Error(`Failed to search tickets (${res.status}): ${await res.text()}`);
-  }
-
-  const data = await res.json();
-  return data.tickets ?? [];
+  return tickets ?? [];
 }
 
 // ─── Interactive prompt ───────────────────────────────────────────────────────
@@ -287,7 +276,7 @@ function runInteractivePrompt({ label, items = [], search, prefix = '' }) {
 export async function runAttachCommand(args) {
   const [ticketIdArg, agentArg] = args;
 
-  const { platformUrl, bearerToken, localSecret, organizationId } = await resolveAuth();
+  const auth = await resolveAuth();
 
   // ── Phase 1: Ticket selection ──────────────────────────────────────────────
 
@@ -301,8 +290,7 @@ export async function runAttachCommand(args) {
 
     const selectedTicket = await runInteractivePrompt({
       label: 'Search tickets',
-      search: nextQuery =>
-        searchTickets(platformUrl, bearerToken, localSecret, organizationId, nextQuery)
+      search: nextQuery => searchTickets(auth, nextQuery)
     });
 
     if (!selectedTicket) {

package/bin/_cli/auth.mjs

@@ -13,6 +13,8 @@ import {
   loadCredentials,
   loadRuntime,
   repairCredentials,
+  resolveAuth,
+  resolveOrganizations,
   saveCredentials
 } from './credentials.mjs';
 
@@ -558,47 +560,91 @@ export async function authLogin(args = []) {
     credentials.access_token,
     localSecret
   );
-  const selectedOrganization = selectLoginOrganization(organizations, preselectedOrganizationId);
+
+  // The CLI is organization-agnostic: login stores the identity only, never a
+  // default organization. `--organization-id` is still validated so a typo is
+  // caught early, but it is no longer persisted — every command resolves its org
+  // from the ticket id, an explicit --organization-id, or your membership.
+  if (preselectedOrganizationId !== null) {
+    selectLoginOrganization(organizations, preselectedOrganizationId);
+  }
 
   saveCredentials({
     access_token: credentials.access_token,
     access_token_expires_at: credentials.access_token_expires_at ?? undefined,
     refresh_token: credentials.refresh_token,
-    organization_id: selectedOrganization.id,
     platform_url: resolvedPlatformUrl
   });
 
-  if (organizations.length > 1 && preselectedOrganizationId === null) {
+  console.log('Logged in successfully.');
+  printOrganizationMemberships(organizations);
+  if (preselectedOrganizationId !== null) {
     console.log(
-      `Logged in successfully. Default organization: ${describeOrganization(selectedOrganization)}. ` +
-        'Ticket-scoped commands override this from the ticket id; use --organization-id to set a different default.'
+      `\nNote: --organization-id is no longer stored as a default. ` +
+        'Commands resolve their organization from the ticket id, an explicit --organization-id, or your membership.'
     );
-  } else {
-    console.log(`Logged in successfully. Default organization: ${describeOrganization(selectedOrganization)}.`);
   }
 }
 
+function printOrganizationMemberships(organizations) {
+  if (!organizations.length) {
+    console.log('  You are not yet a member of any organization. Complete onboarding in Overlord first.');
+    return;
+  }
+
+  if (organizations.length === 1) {
+    console.log(`  Organization: ${describeOrganization(organizations[0])}`);
+    return;
+  }
+
+  console.log(`  Member of ${organizations.length} organizations:`);
+  for (const organization of organizations) {
+    console.log(`    - ${describeOrganization(organization)}`);
+  }
+  console.log('  Commands resolve their organization from the ticket id or --organization-id.');
+}
+
 async function authLoginWithAgentToken(agentToken, args) {
   const preselectedOrganizationId = parseOrganizationFlag(args);
   const storedCredentials = loadCredentials();
   const platformUrl = resolveLoginPlatformUrl(null, storedCredentials?.platform_url ?? null);
 
+  // Agent-token login stores the identity only — never a default organization.
   saveCredentials({
     agent_token: agentToken,
-    platform_url: platformUrl,
-    ...(preselectedOrganizationId !== null ? { organization_id: preselectedOrganizationId } : {})
+    platform_url: platformUrl
   });
 
   console.log(`Agent token saved. The CLI will use this token for all protocol commands.`);
+  console.log(`  Organizations are resolved from your token's membership per command.`);
   if (preselectedOrganizationId !== null) {
-    console.log(`  Default organization: ${preselectedOrganizationId}`);
-  } else {
-    console.log(`  Organization will be derived from your token's membership.`);
+    console.log(
+      `  Note: --organization-id is no longer stored as a default; pass it per command (or use a ticket id) to scope an action.`
+    );
   }
   console.log(`  Platform URL: ${platformUrl}`);
   console.log(`\nTo remove: ovld auth logout`);
 }
 
+async function printOrganizationMembershipStatus() {
+  try {
+    const auth = await resolveAuth();
+    const organizations = await resolveOrganizations(auth);
+    if (!organizations.length) {
+      console.log('  Organizations: none (not a member of any organization)');
+      return;
+    }
+    console.log(`  Organizations (${organizations.length}):`);
+    for (const organization of organizations) {
+      console.log(`    - ${describeOrganization(organization)}`);
+    }
+  } catch (error) {
+    console.log(
+      `  Organizations: unavailable (${error instanceof Error ? error.message : String(error)})`
+    );
+  }
+}
+
 async function printVerboseAuthStatus() {
   const status = await getAuthStatus();
   if (!status.isLoggedIn) {
@@ -617,7 +663,9 @@ async function printVerboseAuthStatus() {
   console.log(`  Token source: ${status.tokenSource}`);
   console.log(`  Token present: ${status.tokenPresent ? 'yes' : 'no'}`);
   console.log(`  Auth mode: ${status.authMode}`);
-  console.log(`  Organization ID: ${status.organizationId ?? 'none'}`);
+  if (status.isLoggedIn) {
+    await printOrganizationMembershipStatus();
+  }
   if (status.error) {
     console.log(`  Error: ${status.error}`);
   }
@@ -681,10 +729,11 @@ Subcommands:
   login    Authorize the CLI via browser (works locally or over SSH)
              --token <oat_…>          Persist an agent token from Settings → Agents & MCP.
                                       Skips the browser flow; token never expires.
-             --organization-id <id>   Optional default organization override
-                                      (ticket-scoped commands infer organization
-                                      from ticket ids such as 1:899)
-  status   Show current login status (use --verbose for redacted diagnostics)
+             --organization-id <id>   Optional. Validated against your membership but
+                                      no longer stored as a default — the CLI is
+                                      organization-agnostic. Scope a command with a
+                                      ticket id (e.g. 1:899) or --organization-id.
+  status   Show current login status (use --verbose to list your organizations)
   repair   Mirror and chmod shared Desktop/CLI credentials when possible
   logout   Remove stored credentials
 `);

package/bin/_cli/credentials.mjs

@@ -584,12 +584,12 @@ export async function resolveAuth(options = {}) {
       typeof process.env.OVERLORD_ORGANIZATION_ID === 'string'
         ? Number.parseInt(process.env.OVERLORD_ORGANIZATION_ID, 10)
         : null;
-    const resolvedOrganizationId = organizationIdHint ?? envOrganizationId;
-    if (!Number.isFinite(resolvedOrganizationId)) {
-      throw new Error(
-        'OVERLORD_ACCESS_TOKEN requires OVERLORD_ORGANIZATION_ID so protocol requests stay scoped.'
-      );
-    }
+    // Organization is no longer required up front. When neither a per-action hint
+    // nor an explicit OVERLORD_ORGANIZATION_ID override is present, the platform
+    // resolves the organization from the token owner's membership, so the CLI stays
+    // org-agnostic instead of pinning a single default.
+    const resolvedOrganizationId =
+      organizationIdHint ?? (Number.isFinite(envOrganizationId) ? envOrganizationId : null);
 
     if (isEnvAccessTokenUsable(envAccessToken)) {
       return {
@@ -603,11 +603,14 @@ export async function resolveAuth(options = {}) {
   }
 
   if (creds?.agent_token) {
+    // Stored credentials never act as a default organization. Org is taken from the
+    // per-action hint (ticket id or --organization-id) and otherwise left to the
+    // platform's membership lookup.
     return {
       platformUrl,
       bearerToken: creds.agent_token,
       localSecret,
-      organizationId: organizationIdHint ?? creds.organization_id ?? null,
+      organizationId: organizationIdHint ?? null,
       authMode: 'agent_token'
     };
   }
@@ -641,19 +644,18 @@ export async function resolveAuth(options = {}) {
       }
     }
 
-    if (!Number.isFinite(nextCredentials.organization_id)) {
-      throw new Error('Overlord login is missing an organization selection. Run `ovld auth login` again.');
-    }
-
     if (!nextCredentials.access_token) {
       throw new Error('No OAuth access token is available. Run `ovld auth login` again.');
     }
 
+    // OAuth sessions are not bound to a stored default organization. The platform
+    // derives the organization from the signed-in user's membership when no
+    // per-action hint is supplied, keeping the CLI org-agnostic.
     return {
       platformUrl,
       bearerToken: nextCredentials.access_token,
       localSecret,
-      organizationId: organizationIdHint ?? nextCredentials.organization_id,
+      organizationId: organizationIdHint ?? null,
       authMode: 'oauth'
     };
   }
@@ -667,6 +669,122 @@ export async function resolveAuth(options = {}) {
   };
 }
 
+/**
+ * Lists every organization the authenticated identity belongs to.
+ *
+ * This is the org-agnostic replacement for a stored "default organization": the
+ * caller's identity (OAuth session or agent token) resolves to the full set of
+ * memberships, and commands fan out or prompt over that list instead of assuming
+ * a single org. Works for OAuth, agent tokens, and local-dev alike because
+ * `/api/protocol/organizations` resolves the caller through the standard
+ * protocol auth path.
+ *
+ * @param {{ platformUrl: string, bearerToken: string, localSecret?: string }} auth
+ * @returns {Promise<Array<{ id: number, name: string }>>}
+ */
+export async function resolveOrganizations(auth) {
+  const { platformUrl, bearerToken, localSecret } = auth;
+  let res;
+  try {
+    res = await fetch(`${platformUrl}/api/protocol/organizations`, {
+      method: 'POST',
+      headers: {
+        ...buildAuthHeaders(bearerToken, localSecret),
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({})
+    });
+  } catch (error) {
+    throw describeNetworkError(error, `Failed to list organizations from ${platformUrl}`);
+  }
+
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    throw new Error(
+      `Failed to list organizations (${res.status}): ${data.error ?? JSON.stringify(data)}`
+    );
+  }
+
+  return Array.isArray(data.organizations)
+    ? data.organizations
+        .map(org => ({ id: org.id, name: typeof org.name === 'string' ? org.name : '' }))
+        .filter(org => Number.isFinite(org.id))
+    : [];
+}
+
+/**
+ * Searches tickets across every organization the identity belongs to.
+ *
+ * Organization-agnostic by default: with no explicit organization it resolves the
+ * membership list and fans out the per-org search, merging and de-duplicating by
+ * ticket id. An explicit `organizationId` (from --organization-id) scopes the
+ * search to that single org instead. There is no default-org fallback.
+ *
+ * @param {{ platformUrl: string, bearerToken: string, localSecret?: string }} auth
+ * @param {Record<string, unknown>} body search-tickets request body
+ * @param {{ organizationId?: number | null }} [options]
+ * @returns {Promise<{ tickets: unknown[], count: number }>}
+ */
+export async function searchTicketsAcrossOrganizations(auth, body, options = {}) {
+  const { platformUrl, bearerToken, localSecret } = auth;
+  const explicitOrganizationId =
+    Number.isFinite(options.organizationId) ? options.organizationId : null;
+
+  const post = async organizationId => {
+    const res = await fetch(`${platformUrl}/api/protocol/search-tickets`, {
+      method: 'POST',
+      headers: {
+        ...buildAuthHeaders(bearerToken, localSecret, organizationId),
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify(body)
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      throw new Error(
+        `Failed to search tickets (${res.status}): ${data.error ?? JSON.stringify(data)}`
+      );
+    }
+    return Array.isArray(data.tickets) ? data.tickets : [];
+  };
+
+  if (explicitOrganizationId !== null) {
+    const tickets = await post(explicitOrganizationId);
+    return { tickets, count: tickets.length };
+  }
+
+  const organizations = await resolveOrganizations(auth);
+  if (!organizations.length) {
+    const tickets = await post(null);
+    return { tickets, count: tickets.length };
+  }
+
+  const results = await Promise.allSettled(organizations.map(org => post(org.id)));
+  const failures = results
+    .map((result, index) => ({ result, organization: organizations[index] }))
+    .filter(({ result }) => result.status === 'rejected');
+  if (failures.length > 0) {
+    const detail = failures
+      .map(({ result, organization }) => {
+        const reason = result.status === 'rejected' ? result.reason : null;
+        const message = reason instanceof Error ? reason.message : String(reason);
+        return `${organization.name || `organization ${organization.id}`} (${organization.id}): ${message}`;
+      })
+      .join('; ');
+    throw new Error(`Ticket search returned partial failures: ${detail}`);
+  }
+
+  const perOrg = results.map(result => (result.status === 'fulfilled' ? result.value : []));
+  const byId = new Map();
+  for (const ticket of perOrg.flat()) {
+    if (ticket && ticket.id && !byId.has(ticket.id)) {
+      byId.set(ticket.id, ticket);
+    }
+  }
+  const tickets = [...byId.values()];
+  return { tickets, count: tickets.length };
+}
+
 export async function getAuthStatus() {
   const creds = loadCredentials();
   let resolved;

package/bin/_cli/launcher.mjs

@@ -17,6 +17,21 @@ import { runAttachCommand } from './attach.mjs';
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const PACKAGE_CLAUDE_PLUGIN_DIR = path.resolve(__dirname, '..', '..', 'plugins', 'claude');
 const REPO_CLAUDE_PLUGIN_DIR = path.resolve(__dirname, '..', '..', '..', '..', 'plugins', 'claude');
+const CLAUDE_PLUGIN_CACHE_DIR = path.join(
+  os.homedir(),
+  '.claude',
+  'plugins',
+  'cache',
+  'overlord-local',
+  'overlord'
+);
+const CLAUDE_INSTALLED_PLUGINS_FILE = path.join(
+  os.homedir(),
+  '.claude',
+  'plugins',
+  'installed_plugins.json'
+);
+const CLAUDE_INSTALLED_PLUGIN_KEY = 'overlord@overlord-local';
 
 function resolveLaunchScratchDir(workingDirectory, { explicit = false } = {}) {
   const trimmed = typeof workingDirectory === 'string' ? workingDirectory.trim() : '';
@@ -47,6 +62,55 @@ function claudeSourcePluginDir() {
   return null;
 }
 
+function readJsonFile(filePath) {
+  try {
+    return JSON.parse(fs.readFileSync(filePath, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function claudeInstalledPluginDir() {
+  const installed = readJsonFile(CLAUDE_INSTALLED_PLUGINS_FILE);
+  const pluginEntries = installed?.plugins?.[CLAUDE_INSTALLED_PLUGIN_KEY];
+
+  if (Array.isArray(pluginEntries)) {
+    for (const entry of pluginEntries) {
+      const installPath = typeof entry?.installPath === 'string' ? entry.installPath.trim() : '';
+      if (installPath && fs.existsSync(path.join(installPath, '.claude-plugin', 'plugin.json'))) {
+        return installPath;
+      }
+    }
+  }
+
+  if (!fs.existsSync(CLAUDE_PLUGIN_CACHE_DIR)) return null;
+
+  const versionDirs = fs
+    .readdirSync(CLAUDE_PLUGIN_CACHE_DIR, { withFileTypes: true })
+    .filter(entry => entry.isDirectory())
+    .map(entry => path.join(CLAUDE_PLUGIN_CACHE_DIR, entry.name))
+    .filter(candidate => fs.existsSync(path.join(candidate, '.claude-plugin', 'plugin.json')))
+    .sort()
+    .reverse();
+
+  return versionDirs[0] ?? null;
+}
+
+function envTruthy(value) {
+  return /^(1|true|yes|on)$/i.test(String(value ?? '').trim());
+}
+
+function claudeLaunchPluginDir() {
+  const explicitPluginDir = process.env.OVERLORD_CLAUDE_PLUGIN_DIR?.trim();
+  if (explicitPluginDir) return explicitPluginDir;
+
+  if (envTruthy(process.env.OVERLORD_USE_CLAUDE_SOURCE_PLUGIN)) {
+    return claudeSourcePluginDir();
+  }
+
+  return null;
+}
+
 function antigravityBundleInstalled() {
   return fs.existsSync(
     path.join(os.homedir(), '.gemini', 'antigravity-cli', 'plugins', 'plugin.json')
@@ -55,7 +119,7 @@ function antigravityBundleInstalled() {
 
 function getInstructionMode(agent) {
   if (agent === 'claude') {
-    return claudeSourcePluginDir() ? 'bundle' : 'legacy';
+    return claudeInstalledPluginDir() || claudeLaunchPluginDir() ? 'bundle' : 'legacy';
   }
 
   if (agent === 'codex') {
@@ -474,7 +538,7 @@ async function runAgent(agent, mode = 'run', options = {}) {
 
   try {
     if (agent === 'claude') {
-      const pluginDir = claudeSourcePluginDir();
+      const pluginDir = claudeLaunchPluginDir();
       if (mode === 'resume') {
         const claudeSessionId = process.env.CLAUDE_SESSION_ID?.trim();
         const args = claudeSessionId

package/bin/_cli/new-ticket.mjs

@@ -4,7 +4,7 @@ import readline from 'node:readline';
 import { stdin as input, stdout as output } from 'node:process';
 import fs from 'node:fs';
 
-import { buildAuthHeaders, resolveAuth } from './credentials.mjs';
+import { buildAuthHeaders, resolveAuth, resolveOrganizations } from './credentials.mjs';
 import { runLauncherCommand } from './launcher.mjs';
 
 const PROMPT_AGENT_IDENTIFIERS = {
@@ -232,7 +232,57 @@ async function fetchProjects(platformUrl, bearerToken, localSecret, organization
     );
   }
 
-  return Array.isArray(data.projects) ? sortProjects(data.projects) : [];
+  return Array.isArray(data.projects) ? data.projects : [];
+}
+
+/**
+ * Lists projects across every organization the identity belongs to.
+ *
+ * The CLI is organization-agnostic: instead of listing only a single default
+ * org's projects, it resolves the membership list and fans out the per-org
+ * projects query, then merges and de-duplicates by project id. Each project
+ * carries its own `organizationId`, so the caller scopes follow-up writes (ticket
+ * creation, resource registration) to the chosen project's org — no default org.
+ *
+ * @param {{ platformUrl: string, bearerToken: string, localSecret?: string }} auth
+ */
+export async function fetchProjectsAcrossOrganizations(auth) {
+  const { platformUrl, bearerToken, localSecret } = auth;
+  const organizations = await resolveOrganizations(auth);
+
+  // No memberships resolved (or a backend that scopes by membership anyway): fall
+  // back to a single unscoped query so the command still works.
+  if (!organizations.length) {
+    return sortProjects(await fetchProjects(platformUrl, bearerToken, localSecret, null));
+  }
+
+  const results = await Promise.allSettled(
+    organizations.map(org => fetchProjects(platformUrl, bearerToken, localSecret, org.id))
+  );
+  const failures = results
+    .map((result, index) => ({ result, organization: organizations[index] }))
+    .filter(({ result }) => result.status === 'rejected');
+  if (failures.length > 0) {
+    const detail = failures
+      .map(({ result, organization }) => {
+        const reason = result.status === 'rejected' ? result.reason : null;
+        const message = reason instanceof Error ? reason.message : String(reason);
+        return `${organization.name || `organization ${organization.id}`} (${organization.id}): ${message}`;
+      })
+      .join('; ');
+    throw new Error(`Project listing returned partial failures: ${detail}`);
+  }
+
+  const perOrg = results.map(result => (result.status === 'fulfilled' ? result.value : []));
+
+  const byId = new Map();
+  for (const project of perOrg.flat()) {
+    if (project && project.id && !byId.has(project.id)) {
+      byId.set(project.id, project);
+    }
+  }
+
+  return sortProjects([...byId.values()]);
 }
 
 async function createTicket(platformUrl, bearerToken, localSecret, organizationId, body) {
@@ -312,8 +362,9 @@ async function runTicketCreationFlow(args, { commandName, launchAgent }) {
   const { flags } = parseFlags(args);
   const objectiveInput = await resolveObjectiveInput(flags);
 
-  const { platformUrl, bearerToken, localSecret, organizationId } = await resolveAuth();
-  const projects = await fetchProjects(platformUrl, bearerToken, localSecret, organizationId);
+  const auth = await resolveAuth();
+  const { platformUrl, bearerToken, localSecret } = auth;
+  const projects = await fetchProjectsAcrossOrganizations(auth);
 
   if (!projects.length) {
     throw new Error('No projects available. Create a project first.');
@@ -328,6 +379,10 @@ async function runTicketCreationFlow(args, { commandName, launchAgent }) {
       renderItem: project => projectLabel(project)
     }));
 
+  // The ticket is created in the organization that owns the chosen project,
+  // never a stored default org.
+  const organizationId = selectedProject.organizationId ?? null;
+
   const selectedAgent = launchAgent
     ? (resolveAgent(typeof flags.agent === 'string' ? flags.agent : '') ??
       (await promptForSelection({

package/bin/_cli/protocol.mjs

@@ -5,7 +5,12 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 
-import { buildAuthHeaders, getAuthStatus, resolveAuth } from './credentials.mjs';
+import {
+  buildAuthHeaders,
+  getAuthStatus,
+  resolveAuth,
+  searchTicketsAcrossOrganizations
+} from './credentials.mjs';
 
 /**
  * Parse simple CLI flags: --key value or --key=value
@@ -2619,9 +2624,7 @@ async function protocolAddObjectives(args) {
 
 async function protocolSearchTickets(args) {
   const flags = parseFlags(args);
-  const { platformUrl, bearerToken, localSecret, organizationId } =
-    await resolveProtocolAuthForFlags(flags);
-  const timeoutMs = resolveTimeout(flags);
+  const auth = await resolveProtocolAuthForFlags(flags);
 
   const statuses = flags.status
     ? String(flags.status)
@@ -2646,15 +2649,11 @@ async function protocolSearchTickets(args) {
     ...(flags['updated-before'] ? { updatedBefore: String(flags['updated-before']) } : {})
   };
 
-  const data = await apiPost(
-    platformUrl,
-    bearerToken,
-    localSecret,
-    organizationId,
-    '/api/protocol/search-tickets',
-    body,
-    timeoutMs
-  );
+  // Organization-agnostic: with no --organization-id this fans out across every
+  // organization you belong to and merges the results; an explicit org scopes it.
+  const data = await searchTicketsAcrossOrganizations(auth, body, {
+    organizationId: auth.organizationId ?? null
+  });
   console.log(JSON.stringify(data, null, 2));
 }
 

package/bin/_cli/setup.mjs

@@ -1138,7 +1138,9 @@ function installClaude() {
   } else {
     console.log('  ✓ No v3.25 Claude connector files needed migration.');
   }
-  console.log('  ✓ `ovld launch claude` now loads this plugin with `claude --plugin-dir`.');
+  console.log(
+    '  ✓ `ovld launch claude` now uses the installed Claude local marketplace plugin by default.'
+  );
 
   const manifest = readManifest();
   manifest.claude = {

package/bin/_cli/tickets.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-import { buildAuthHeaders, resolveAuth } from './credentials.mjs';
+import { resolveAuth, searchTicketsAcrossOrganizations } from './credentials.mjs';
 import { runCreateCommand } from './new-ticket.mjs';
 
 /**
@@ -33,23 +33,10 @@ function parseFlags(args, knownFlags) {
   return result;
 }
 
-async function apiPost(url, token, localSecret, organizationId, body) {
-  const res = await fetch(url, {
-    method: 'POST',
-    headers: {
-      ...buildAuthHeaders(token, localSecret, organizationId),
-      'Content-Type': 'application/json'
-    },
-    body: JSON.stringify(body)
-  });
-
-  const data = await res.json().catch(() => ({}));
-
-  if (!res.ok) {
-    throw new Error(`API error (${res.status}): ${data.error ?? JSON.stringify(data)}`);
-  }
-
-  return data;
+function parseOrganizationId(value) {
+  if (typeof value !== 'string' && typeof value !== 'number') return null;
+  const parsed = Number.parseInt(String(value), 10);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : null;
 }
 
 export async function ticketsCreate(args) {
@@ -57,22 +44,20 @@ export async function ticketsCreate(args) {
 }
 
 export async function ticketsList(args) {
-  const flags = parseFlags(args, ['status', 'include-completed']);
+  const flags = parseFlags(args, ['status', 'include-completed', 'organization-id']);
 
-  const { platformUrl, bearerToken, localSecret, organizationId } = await resolveAuth();
+  const auth = await resolveAuth();
 
   const body = {
     includeCompleted: flags['include-completed'] !== false,
     ...(flags.status ? { statuses: [String(flags.status)] } : {})
   };
 
-  const data = await apiPost(
-    `${platformUrl}/api/protocol/search-tickets`,
-    bearerToken,
-    localSecret,
-    organizationId,
-    body
-  );
+  // Organization-agnostic: searches every organization you belong to unless
+  // --organization-id scopes it to one.
+  const data = await searchTicketsAcrossOrganizations(auth, body, {
+    organizationId: parseOrganizationId(flags['organization-id'])
+  });
 
   if (!data.tickets?.length) {
     console.log('No tickets found.');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord-cli",
-  "version": "0.2606021051.0",
+  "version": "0.2606041130.0",
   "description": "Overlord CLI — launch AI agents on tickets from anywhere",
   "homepage": "https://www.ovld.ai/docs/",
   "type": "module",

package/plugins/antigravity/skills/overlord-ticket/SKILL.md

@@ -272,8 +272,8 @@ This keeps the ticket feed readable while preserving the full document in versio
 - When a summary or question contains backticks, `$vars`, or other shell-special characters, always use `--summary-file -` (or `--question-file -`) with a single-quoted heredoc (`<<'EOF'`). Never retry by stripping or escaping content — pipe stdin instead.
 - Use `write-context` for facts a future agent session should know.
 - If a protocol or MCP call fails with auth/session errors, run `ovld auth repair` yourself before asking the user to log in again or proceed without Overlord updates.
-- If you must run `ovld auth login`, `--organization-id <id>` is optional — use it only when you want to set a different default organization than the CLI would choose automatically.
+- If you must run `ovld auth login`, `--organization-id <id>` is optional — it validates/scopes that login or command but does not create a stored default organization.
 - Do not add or commit changes unless the user explicitly asks you to commit.
 - Delivery is the concluding step. After delivering, stop implementation work unless the user explicitly asks for follow-up execution; once follow-up execution is complete, deliver again.
 
-<!-- version: 0.1.6 -->
+<!-- version: 0.1.8 -->

package/plugins/claude/skills/overlord-ticket/SKILL.md

@@ -102,7 +102,7 @@ For the `record-change-rationales` command and full payload shape with optional
 - When a summary or question contains backticks, `$vars`, or other shell-special characters, always use `--summary-file -` (or `--question-file -`) with a single-quoted heredoc (`<<'EOF'`). Never retry by stripping or escaping content — pipe stdin instead. See [reference/shell-escaping.md](reference/shell-escaping.md).
 - Use `write-context` for facts a future agent session should know.
 - If a protocol or MCP call fails with auth/session errors, run `ovld auth repair` yourself before asking the user to log in again or proceed without Overlord updates.
-- If you must run `ovld auth login`, `--organization-id <id>` is optional — use it only when you want to set a different default organization than the CLI would choose automatically.
+- If you must run `ovld auth login`, `--organization-id <id>` is optional — it validates/scopes that login or command but does not create a stored default organization.
 - Do not add or commit changes unless the user explicitly asks you to commit.
 - Delivery is the concluding step. After delivering, stop implementation work unless the user explicitly asks for follow-up execution; once follow-up execution is complete, deliver again.
 
@@ -114,5 +114,5 @@ For the `record-change-rationales` command and full payload shape with optional
 - [reference/context.md](reference/context.md) — Shared state, attachments, and large artifact policy
 - [reference/shell-escaping.md](reference/shell-escaping.md) — Heredoc stdin piping for special characters in summaries and payloads
 
-<!-- version: 0.5.10 -->
+<!-- version: 0.5.11 -->
 

package/plugins/cursor/skills/overlord-ticket/SKILL.md

@@ -102,7 +102,7 @@ For the `record-change-rationales` command and full payload shape with optional
 - When a summary or question contains backticks, `$vars`, or other shell-special characters, always use `--summary-file -` (or `--question-file -`) with a single-quoted heredoc (`<<'EOF'`). Never retry by stripping or escaping content — pipe stdin instead. See [reference/shell-escaping.md](reference/shell-escaping.md).
 - Use `write-context` for facts a future agent session should know.
 - If a protocol or MCP call fails with auth/session errors, run `ovld auth repair` yourself before asking the user to log in again or proceed without Overlord updates.
-- If you must run `ovld auth login`, `--organization-id <id>` is optional — use it only when you want to set a different default organization than the CLI would choose automatically.
+- If you must run `ovld auth login`, `--organization-id <id>` is optional — it validates/scopes that login or command but does not create a stored default organization.
 - Do not add or commit changes unless the user explicitly asks you to commit.
 - Delivery is the concluding step. After delivering, stop implementation work unless the user explicitly asks for follow-up execution; once follow-up execution is complete, deliver again.
 
@@ -114,5 +114,5 @@ For the `record-change-rationales` command and full payload shape with optional
 - [reference/context.md](reference/context.md) — Shared state, attachments, and large artifact policy
 - [reference/shell-escaping.md](reference/shell-escaping.md) — Heredoc stdin piping for special characters in summaries and payloads
 
-<!-- version: 0.5.10 -->
+<!-- version: 0.5.11 -->
 

package/plugins/overlord/skills/overlord-ticket/SKILL.md

@@ -102,7 +102,7 @@ For the `record-change-rationales` command and full payload shape with optional
 - When a summary or question contains backticks, `$vars`, or other shell-special characters, always use `--summary-file -` (or `--question-file -`) with a single-quoted heredoc (`<<'EOF'`). Never retry by stripping or escaping content — pipe stdin instead. See [reference/shell-escaping.md](reference/shell-escaping.md).
 - Use `write-context` for facts a future agent session should know.
 - If a protocol or MCP call fails with auth/session errors, run `ovld auth repair` yourself before asking the user to log in again or proceed without Overlord updates.
-- If you must run `ovld auth login`, `--organization-id <id>` is optional — use it only when you want to set a different default organization than the CLI would choose automatically.
+- If you must run `ovld auth login`, `--organization-id <id>` is optional — it validates/scopes that login or command but does not create a stored default organization.
 - Do not add or commit changes unless the user explicitly asks you to commit.
 - Do not create or rely on a local Codex `AGENTS.md` bundle for Overlord.
 - Delivery is the concluding step. After delivering, stop implementation work unless the user explicitly asks for follow-up execution; once follow-up execution is complete, deliver again.
@@ -115,5 +115,5 @@ For the `record-change-rationales` command and full payload shape with optional
 - [reference/context.md](reference/context.md) — Shared state, attachments, and large artifact policy
 - [reference/shell-escaping.md](reference/shell-escaping.md) — Heredoc stdin piping for special characters in summaries and payloads
 
-<!-- version: 0.5.10 -->
+<!-- version: 0.5.11 -->