overlord-cli 0.2606070914.0 → 0.2606081356.0

package/README.md

@@ -38,15 +38,36 @@ overlord help
 ### Auth
 
 ```bash
+# No account yet? Create one entirely from the terminal with just an email.
+ovld auth signup --email agent@example.com --name "Build Agent" # emails an 8-digit code, then mints a durable oat_ agent token by default
+ovld onboard --email agent@example.com --project-name Repo       # same signup, plus org/project/cwd setup
+
 # Repair shared credentials first when a session already exists
 ovld auth repair # mirror and chmod shared Desktop/CLI credentials when possible
 
 # Login to Overlord if repair does not restore access
 ovld auth login #opens a browser when possible and also prints a verification URL/code so login can be completed from another machine over SSH.
+ovld auth login --email agent@example.com # log back in after logout with an emailed code (no browser)
 ovld auth status # show current login status (use --verbose for redacted diagnostics)
 ovld auth logout # remove stored credentials
 ```
 
+#### Terminal-native account creation
+
+`ovld auth signup` creates an Overlord account without a browser: it emails an
+8-digit confirmation code, you enter it in the terminal, and the CLI stores valid
+credentials. Pass `--password` to set a password-manager-generated password;
+without one, signup is passwordless and you log back in later with
+`ovld auth login --email`. By default a durable `oat_…` agent token is minted and
+saved for headless use — pass `--no-agent-token` to skip it. For agents that read
+email out of band, the split flow is available:
+
+```bash
+ovld auth signup request --email agent@example.com --name "Build Agent" --json
+ovld auth signup verify  --email agent@example.com --code 12345678 --json
+ovld onboard --use-current-auth --project-name Repo --directory "$PWD" --yes
+```
+
 Desktop-installed wrappers default `OVERLORD_URL` to `https://www.ovld.ai` unless you override it explicitly.
 For local dev against the web app on port 3000, export the override before running auth or protocol commands:
 

package/bin/_cli/auth.mjs

@@ -726,7 +726,14 @@ export async function runAuthCommand(subcommand, args = []) {
     console.log(`ovld auth <subcommand>
 
 Subcommands:
+  signup   Create a new Overlord account from the terminal (email + confirmation code)
+             --email <email>          Email to create the account with.
+             --name <name>            Display name.
+             --password <password>    Optional password-manager password.
+             --no-agent-token         Skip minting a durable oat_ token.
+           Run \`ovld auth signup help\` for request/verify split flow.
   login    Authorize the CLI via browser (works locally or over SSH)
+             --email <email>          Log in with an emailed code instead of a browser.
              --token <oat_…>          Persist an agent token from Settings → Agents & MCP.
                                       Skips the browser flow; token never expires.
              --organization-id <id>   Optional. Validated against your membership but
@@ -740,7 +747,29 @@ Subcommands:
     return;
   }
 
+  if (subcommand === 'signup') {
+    const { runAuthSignupCommand } = await import('./signup.mjs');
+    await runAuthSignupCommand(args);
+    return;
+  }
+
   if (subcommand === 'login') {
+    const [maybeSub, ...rest] = args;
+    if (maybeSub === 'request') {
+      const { runEmailLoginRequest } = await import('./signup.mjs');
+      await runEmailLoginRequest(rest);
+      return;
+    }
+    if (maybeSub === 'verify') {
+      const { runEmailLoginVerify } = await import('./signup.mjs');
+      await runEmailLoginVerify(rest);
+      return;
+    }
+    if (args.some(arg => arg === '--email' || arg.startsWith('--email='))) {
+      const { runEmailLogin } = await import('./signup.mjs');
+      await runEmailLogin(args);
+      return;
+    }
     await authLogin(args);
     return;
   }

package/bin/_cli/credentials.mjs

@@ -785,6 +785,57 @@ export async function searchTicketsAcrossOrganizations(auth, body, options = {})
   return { tickets, count: tickets.length };
 }
 
+/**
+ * Resolve a fresh Supabase access token (JWT) from stored credentials, refreshing
+ * via the stored refresh token when the cached access token is stale.
+ *
+ * Unlike {@link resolveAuth}, this never returns an `oat_…` agent token: it is for
+ * callers that must present a real Supabase user JWT (e.g. `/api/auth/cli-onboarding`
+ * and `/api/auth/agent-token`, which validate the session with `auth.getUser`).
+ *
+ * @returns {Promise<{ accessToken: string, platformUrl: string, localSecret: string }>}
+ */
+export async function resolveStoredSupabaseAccessToken() {
+  const selected = selectStoredCredentials();
+  const creds = selected?.credentials ?? migrateLegacyCredentials();
+  const platformUrl =
+    normalizePlatformUrl(process.env.OVERLORD_URL) ??
+    normalizeStoredPlatformUrl(creds?.platform_url) ??
+    getDefaultOverlordUrl();
+  const runtime = isLocalhostUrl(platformUrl) ? loadRuntime(platformUrl) : null;
+  const localSecret =
+    runtime?.local_secret && runtime.platform_url === platformUrl ? runtime.local_secret : '';
+
+  if (!creds) {
+    throw new Error('No stored Overlord credentials. Run `ovld auth signup` or `ovld auth login` first.');
+  }
+
+  if (creds.access_token && isAccessTokenFresh(creds)) {
+    return { accessToken: creds.access_token, platformUrl, localSecret };
+  }
+
+  if (creds.refresh_token) {
+    const refreshed = await refreshOAuthAccessToken(platformUrl, creds.refresh_token, localSecret);
+    if (!refreshed.access_token) {
+      throw new Error('Failed to refresh the stored Supabase session. Run `ovld auth login --email` again.');
+    }
+    saveCredentialsToSource(
+      {
+        ...creds,
+        access_token: refreshed.access_token,
+        access_token_expires_at: refreshed.access_token_expires_at,
+        refresh_token: refreshed.refresh_token || creds.refresh_token
+      },
+      selected?.source
+    );
+    return { accessToken: refreshed.access_token, platformUrl, localSecret };
+  }
+
+  throw new Error(
+    'Stored credentials have no Supabase session. Run `ovld auth login --email` to obtain one.'
+  );
+}
+
 export async function getAuthStatus() {
   const creds = loadCredentials();
   let resolved;

package/bin/_cli/index.mjs

@@ -59,7 +59,8 @@ Agents:
   Key protocol commands: auth-status, discover-project, create, prompt, attach, connect, load-context, heartbeat.
 
 Auth:
-  ${primaryCommand} auth login               Authorize CLI via browser or --token <oat_…>
+  ${primaryCommand} auth signup              Create an account from the terminal (--email <email>)
+  ${primaryCommand} auth login               Authorize CLI via browser, --email <email>, or --token <oat_…>
   ${primaryCommand} auth status              Show login status
   ${primaryCommand} auth repair              Repair shared Desktop/CLI credentials
   ${primaryCommand} auth logout              Remove stored credentials

package/bin/_cli/onboard.mjs

@@ -11,6 +11,7 @@ import {
   buildAuthHeaders,
   loadCredentials,
   loadRuntime,
+  resolveStoredSupabaseAccessToken,
   saveCredentials
 } from './credentials.mjs';
 import { upsertLocalOverlordConfig } from './local-config.mjs';
@@ -150,18 +151,87 @@ function buildWebProjectUrl(platformUrl, result) {
   return `${platformUrl}/projects/${projectId}`;
 }
 
+/**
+ * Resolve the credentials onboarding will use, based on the chosen auth mode:
+ *  - `--use-current-auth`: reuse the already signed-in Supabase session.
+ *  - `--email`: create the account entirely in the terminal (email + code).
+ *  - default: browser device-authorization flow.
+ *
+ * Returns the Supabase access token to call `cli-onboarding` with, the resolved
+ * platform URL and local secret, and (only for the browser flow) the freshly
+ * issued session that still needs persisting.
+ */
+async function resolveOnboardingAuth({ flags, name, inviteToken }) {
+  const useCurrentAuth = flags['use-current-auth'] === true || flags['use-current-auth'] === 'true';
+  const email = trimFlag(flags, 'email');
+
+  if (useCurrentAuth) {
+    const { accessToken, platformUrl, localSecret } = await resolveStoredSupabaseAccessToken();
+    return { accessToken, platformUrl, localSecret, sessionToPersist: null };
+  }
+
+  if (email) {
+    const { runCliSignupFlow } = await import('./signup.mjs');
+    const { session, platformUrl, localSecret } = await runCliSignupFlow({
+      email,
+      name,
+      password: trimFlag(flags, 'password') || undefined,
+      invite: inviteToken || undefined,
+      'no-agent-token': flags['no-agent-token'] === true
+    });
+    return {
+      accessToken: session.access_token,
+      platformUrl: session.platform_url ?? platformUrl,
+      localSecret,
+      sessionToPersist: null
+    };
+  }
+
+  const storedCredentials = loadCredentials();
+  const platformUrl = resolveLoginPlatformUrl(null, storedCredentials?.platform_url ?? null);
+  const runtime = loadRuntime(platformUrl);
+  const localSecret = runtime?.local_secret ?? process.env.OVERLORD_LOCAL_SECRET ?? '';
+
+  console.log('\nStarting Overlord onboarding in your browser.');
+  console.log('Create an account or sign in, then approve the CLI authorization request.\n');
+
+  const credentials = await authLoginViaDeviceFlow(platformUrl, localSecret, {
+    browserOpener: verificationUri => {
+      const signupUrl = buildSignupUrl(platformUrl, verificationUri, name, inviteToken);
+      console.log(`  Signup URL: ${signupUrl}`);
+      openBrowser(signupUrl);
+    }
+  });
+
+  return {
+    accessToken: credentials.access_token,
+    platformUrl: credentials.platform_url ?? platformUrl,
+    localSecret,
+    sessionToPersist: credentials
+  };
+}
+
 export async function runOnboardCommand(args) {
   const flags = parseFlags(args);
 
   if (flags.help === true || flags.h === true || args[0] === 'help') {
-    console.log(`Usage: ovld onboard [--name <name>] [--organization-name <name>] [--project-name <name>] [--directory <path>] [--invite <token|url>] [--yes] [--no-desktop]
+    console.log(`Usage: ovld onboard [--name <name>] [--organization-name <name>] [--project-name <name>] [--directory <path>] [--invite <token|url>] [--email <email>] [--password <password>] [--use-current-auth] [--yes] [--no-desktop]
 
 Creates an Overlord account setup from the terminal:
   1. collects your name, organization, project, and repository directory
-  2. opens browser signup/login and authorizes the CLI
+  2. authorizes the CLI (browser by default; terminal-only with --email)
   3. creates the organization/project, links this directory, and creates the first onboarding ticket
   4. opens the Desktop download page, or the web project when --no-desktop is used
 
+Authorization modes:
+  (default)            Browser signup/login + device authorization.
+  --email <email>      Create the account entirely in the terminal: an 8-digit
+                       confirmation code is emailed and entered here. Add
+                       --password <password> to set a password-manager password;
+                       otherwise future login uses \`ovld auth login --email\`.
+  --use-current-auth   Skip auth and provision using the already signed-in session
+                       (e.g. right after \`ovld auth signup\`).
+
 With --invite <token>, joins the inviting organization (from an invite email)
 with the invited role instead of creating a new organization; the organization
 prompt is skipped. Accepts a bare token or a full /invite/<token> URL.
@@ -190,42 +260,43 @@ Run this from the repository you want Overlord agents to work in.`);
     throw new Error('Organization name is required (or pass --invite <token> to join an org).');
   }
 
-  const storedCredentials = loadCredentials();
-  const platformUrl = resolveLoginPlatformUrl(null, storedCredentials?.platform_url ?? null);
-  const runtime = loadRuntime(platformUrl);
-  const localSecret = runtime?.local_secret ?? process.env.OVERLORD_LOCAL_SECRET ?? '';
-
-  console.log('\nStarting Overlord onboarding in your browser.');
-  console.log('Create an account or sign in, then approve the CLI authorization request.\n');
-
-  const credentials = await authLoginViaDeviceFlow(platformUrl, localSecret, {
-    browserOpener: verificationUri => {
-      const signupUrl = buildSignupUrl(platformUrl, verificationUri, name, inviteToken);
-      console.log(`  Signup URL: ${signupUrl}`);
-      openBrowser(signupUrl);
-    }
-  });
+  const {
+    accessToken,
+    platformUrl: resolvedPlatformUrl,
+    localSecret,
+    sessionToPersist
+  } = await resolveOnboardingAuth({ flags, name, inviteToken });
 
-  const resolvedPlatformUrl = credentials.platform_url ?? platformUrl;
   const deviceFingerprint = readOrCreateDeviceFingerprint(flags);
-  const result = await completeCliOnboarding(resolvedPlatformUrl, localSecret, credentials, {
-    name,
-    ...(organizationName ? { organizationName } : {}),
-    projectName,
-    directoryPath,
-    deviceFingerprint,
-    deviceHostname: os.hostname(),
-    devicePlatform: process.platform,
-    ...(inviteToken ? { inviteToken } : {})
-  });
-
-  saveCredentials({
-    access_token: credentials.access_token,
-    access_token_expires_at: credentials.access_token_expires_at ?? undefined,
-    refresh_token: credentials.refresh_token,
-    organization_id: result.organization.organizationId,
-    platform_url: resolvedPlatformUrl
-  });
+  const result = await completeCliOnboarding(
+    resolvedPlatformUrl,
+    localSecret,
+    { access_token: accessToken },
+    {
+      name,
+      ...(organizationName ? { organizationName } : {}),
+      projectName,
+      directoryPath,
+      deviceFingerprint,
+      deviceHostname: os.hostname(),
+      devicePlatform: process.platform,
+      ...(inviteToken ? { inviteToken } : {})
+    }
+  );
+
+  // The browser device-auth flow returns a session that hasn't been stored yet;
+  // persist it (with the resolved org). The --email and --use-current-auth paths
+  // already saved credentials (including any minted agent token), so we leave the
+  // stored credential — and its durable agent token — untouched.
+  if (sessionToPersist) {
+    saveCredentials({
+      access_token: sessionToPersist.access_token,
+      access_token_expires_at: sessionToPersist.access_token_expires_at ?? undefined,
+      refresh_token: sessionToPersist.refresh_token,
+      organization_id: result.organization.organizationId,
+      platform_url: resolvedPlatformUrl
+    });
+  }
 
   try {
     const localConfig = await upsertLocalOverlordConfig({