overlord-cli 0.2609221008.0 → 0.2609250853.0

package/dist/connectors/VERSION

@@ -1 +1 @@
-0.3.47
+0.3.48

package/dist/connectors/adapters/antigravity/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "overlord",
-  "version": "0.3.47",
+  "version": "0.3.48",
   "description": "Chat-driven access to Overlord mission protocol workflows through skills and MCP.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.47",
+  "version": "0.3.48",
   "description": "Overlord mission protocol workflow for Claude Code — attach/update/ask/deliver, slash commands, and hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.47",
+  "version": "0.3.48",
   "description": "Chat-driven access to Overlord mission protocol workflows with hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/cursor/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.47",
+  "version": "0.3.48",
   "description": "Overlord mission protocol workflow for Cursor — attach/update/ask/deliver, slash commands, MCP bridge, and follow-up capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/core/overlord-mission/reference/context.md

@@ -10,10 +10,17 @@ ovld protocol update-artifact --mission-id $MISSION_ID --artifact-id <artifact-i
 ovld protocol attachment-list --session-key <sessionKey> --objective-id <objective-id>
 ovld protocol attachment-upload-file --session-key <sessionKey> --objective-id <objective-id> --file ./spec.pdf --content-type application/pdf
 ovld protocol attachment-download-url --session-key <sessionKey> --attachment-id <attachment-id>
+ovld protocol attachment-download-url --session-key <sessionKey> --attachment-id <attachment-id> --output ./attachment.pdf
 ```
 
 The `attach` and `load-context` responses already include an `attachments` array plus `previousObjectives` and `futureObjectives` arrays — use those for `<attachment-id>` and `<objective-id>` values. The objective currently being executed is not repeated in those arrays; it is the top-level `objective`. `previousObjectives` are the objectives already worked (before the current one) and `futureObjectives` are the ones queued after it. Run `attachment-list` mid-session if new files have been uploaded since attach. `--mission-id` is optional for attachment calls when `--objective-id` is a full display ID that lets the server derive the mission; an attachment ID alone does not carry mission scope.
 
+Attachment HTTPS URLs require Overlord authentication. Use `--output` to save
+the bytes through the CLI's existing authenticated client; it creates a new
+file and will not overwrite one. Do not read CLI credential files or pass their
+contents to `curl`. Hosted MCP callers can use their authenticated tool or
+client transport to retrieve the same attachment.
+
 ## Creating artifacts during a turn
 
 Artifacts do not require delivery. Publish a plan, notes, decision, or URL mid-session with `add-artifact` (or MCP `overlord_add_artifact`). Provide `--type`, `--label`, and at least one of `--content-text` / `--content-text-file` or `--external-url`. An optional `--session-key` (auto-injected from the attach cache when present) stamps session/objective provenance; `delivery_id` stays null. Delivery may still attach additional artifacts later.

package/dist/connectors/core/scripts/overlord-mcp.mjs

@@ -1228,7 +1228,7 @@ process.stdin.on('data', async chunk => {
         result: {
           protocolVersion: PROTOCOL_VERSION,
           capabilities: { tools: { listChanged: false } },
-          serverInfo: { name: 'overlord-__OVERLORD_ADAPTER_KEY__', version: '0.3.47' }
+          serverInfo: { name: 'overlord-__OVERLORD_ADAPTER_KEY__', version: '0.3.48' }
         }
       });
       continue;

package/dist/index.js

@@ -3285,7 +3285,8 @@ function createBackendClient() {
     path: path38,
     body,
     extraHeaders,
-    rawBody
+    rawBody,
+    responseType = "json"
   }) {
     const url2 = `${baseUrl}${path38.startsWith("/") ? path38 : `/${path38}`}`;
     const auth = resolveAuthHeaders({ baseUrl });
@@ -3300,7 +3301,7 @@ The backend URL may have changed. Run \`ovld auth login\` to sign in to the curr
       response = await fetch(url2, {
         method,
         headers: {
-          Accept: "application/json",
+          Accept: responseType === "bytes" ? "application/octet-stream" : "application/json",
           ...rawBody === void 0 && body !== void 0 ? { "Content-Type": "application/json" } : {},
           "x-overlord-device-fingerprint": clientDevice.deviceFingerprint,
           "x-overlord-device-label": clientDevice.deviceLabel,
@@ -3317,7 +3318,7 @@ Start the Desktop/local backend or run \`ovld config set cloud <url>\`.
 ` + (error51 instanceof Error ? error51.message : String(error51))
       });
     }
-    const payload = await readResponseJson2(response);
+    const payload = response.ok && responseType === "bytes" ? Buffer.from(await response.arrayBuffer()) : await readResponseJson2(response);
     if (!response.ok) {
       if (isExecutionRequestAlreadyLinkedPayload(payload)) {
         throw new CliError({ message: formatExecutionRequestAlreadyLinkedDiagnostic() });
@@ -3339,6 +3340,7 @@ Start the Desktop/local backend or run \`ovld config set cloud <url>\`.
     baseUrl,
     health: () => request({ method: "GET", path: "/api/health" }),
     get: (path38) => request({ method: "GET", path: path38 }),
+    getBytes: (path38) => request({ method: "GET", path: path38, responseType: "bytes" }),
     post: ({ path: path38, body }) => request({ method: "POST", path: path38, body }),
     patch: ({ path: path38, body }) => request({ method: "PATCH", path: path38, body }),
     delete: (path38) => request({ method: "DELETE", path: path38 }),
@@ -37397,12 +37399,21 @@ async function loadMissionContext({
       const id = objective.id;
       if (typeof id !== "string" || id.length === 0) return;
       const attachments = await runtime.backend.get(`/api/objectives/${encodeURIComponent(id)}/attachments`).catch(() => []);
-      const label = objectiveDisplayRef(objective) ?? "objective";
+      const label = objectiveDisplayRef(objective) ?? id;
       for (const attachment of attachments) {
         const record2 = asRecord4(attachment);
         const filename = String(record2.filename ?? "attachment");
         const contentType = record2.contentType ? ` (${String(record2.contentType)})` : "";
-        attachmentLines.push(`- [${label}] ${filename}${contentType}`);
+        const attachmentId = typeof record2.id === "string" ? record2.id : null;
+        const storageKey = typeof record2.storageKey === "string" ? record2.storageKey : null;
+        const url2 = storageKey ? `${runtime.backend.baseUrl}/api/storage/attachments/${encodeURIComponent(storageKey)}` : null;
+        attachmentLines.push(`- [${label}] ${filename}${contentType}${url2 ? ` \u2014 ${url2}` : ""}`);
+        if (attachmentId) {
+          const output = `./.overlord/tmp/attachment-${attachmentId}-${path31.basename(filename)}`;
+          attachmentLines.push(
+            `  Download: \`ovld protocol attachment-download-url --objective-id ${shellQuote2(label)} --attachment-id ${shellQuote2(attachmentId)} --output ${shellQuote2(output)}\``
+          );
+        }
       }
     })
   );
@@ -37425,7 +37436,7 @@ async function loadMissionContext({
     "",
     ...attachmentLines.length > 0 ? [
       "## Attachments",
-      "Files attached to the objective(s) below. Use `ovld protocol attachment-list` and `ovld protocol attachment-download-url` to retrieve them.",
+      "Attachment URLs require Overlord authentication. Use the download commands below; the CLI supplies its own credentials. Use `ovld protocol attachment-list` to refresh this list.",
       ...attachmentLines,
       ""
     ] : [],
@@ -38832,12 +38843,14 @@ attachment-list:
 
 attachment-download-url:
   Purpose:
-    Return the download URL for a specific attachment on the mission.
+    Return the authenticated download URL for a specific attachment, or save it
+    to a new file using the CLI's existing authentication.
   Required:
     --mission-id <id>
     --attachment-id <id>  (use the id from attachment-list output)
   Optional:
     --objective-id <id>         Restrict the lookup to one objective
+    --output <path>             Download to a new local file (never overwrites)
 
 list-organizations:
   Purpose:
@@ -39670,6 +39683,7 @@ __export(commands_exports, {
   firstObjectiveId: () => firstObjectiveId,
   launchFailureMessage: () => launchFailureMessage,
   queueableObjectiveId: () => queueableObjectiveId,
+  readWorktreeBranchAutomationEnabled: () => readWorktreeBranchAutomationEnabled,
   resolveActiveObjectiveId: () => resolveActiveObjectiveId,
   resolveProtocolFileInputs: () => resolveProtocolFileInputs,
   runManagementCommand: () => runManagementCommand,
@@ -39678,7 +39692,7 @@ __export(commands_exports, {
   sanitizeRunnerFailureMessage: () => sanitizeRunnerFailureMessage,
   shouldRefuseInlineRunnerLaunch: () => shouldRefuseInlineRunnerLaunch
 });
-import { readFileSync as readFileSync21 } from "node:fs";
+import { readFileSync as readFileSync21, writeFileSync as writeFileSync13 } from "node:fs";
 import path37 from "node:path";
 function resourceAccessModeBody(value) {
   if (typeof value !== "string") return {};
@@ -39910,10 +39924,14 @@ function parseLaunchEnvVarsValue(value) {
   }
   return vars;
 }
-async function readWorktreeBranchAutomationEnabled(runtime) {
+async function readWorktreeBranchAutomationEnabled({
+  runtime,
+  workspaceId
+}) {
   try {
     const settings = await fetchLaunchSettings({
-      backend: runtime.backend
+      backend: runtime.backend,
+      workspaceId
     });
     return settings.worktreeBranchAutomationEnabled === true;
   } catch (error51) {
@@ -40450,6 +40468,30 @@ Run \`${primaryCommand} protocol help\` for usage.`
   if (subcommand === "attachment-download-url") {
     const relUrl = resultRecord.url;
     if (typeof relUrl === "string" && relUrl.startsWith("/")) {
+      const output = flags["--output"];
+      if (output !== void 0) {
+        if (typeof output !== "string" || !output.trim()) {
+          throw new CliError({ message: "--output requires a file path." });
+        }
+        if (!relUrl.startsWith("/api/storage/attachments/")) {
+          throw new CliError({ message: "Unexpected attachment download path." });
+        }
+        const bytes = await runtime.backend.getBytes(relUrl);
+        try {
+          writeFileSync13(output, bytes, { flag: "wx", mode: 384 });
+        } catch (error51) {
+          throw new CliError({
+            message: `Could not create attachment file ${output}: ${String(error51)}`
+          });
+        }
+        printJson({
+          id: resultRecord.id,
+          filename: resultRecord.filename,
+          output,
+          sizeBytes: bytes.length
+        });
+        return;
+      }
       printJson({ ...resultRecord, url: `${runtime.backend.baseUrl}${relUrl}` });
       return;
     }
@@ -40747,7 +40789,10 @@ async function runManagementCommand({
           missionId,
           workingDirectory,
           objectiveId: objectiveId ?? void 0,
-          automationEnabled: await readWorktreeBranchAutomationEnabled(scopedRuntime),
+          automationEnabled: await readWorktreeBranchAutomationEnabled({
+            runtime: scopedRuntime,
+            workspaceId: missionWorkspaceId
+          }),
           dryRun,
           overrideBranch: flagValue(parsed.flags, "--branch"),
           noWorktree: flagBoolean(parsed.flags, "--no-worktree")
@@ -41144,7 +41189,10 @@ The runner will not register a target for you \u2014 declare this machine first,
         missionId,
         workingDirectory: String(requestRecord.workingDirectory ?? process.cwd()),
         objectiveId: String(requestRecord.objectiveId ?? ""),
-        automationEnabled: await readWorktreeBranchAutomationEnabled(runtime),
+        automationEnabled: await readWorktreeBranchAutomationEnabled({
+          runtime,
+          workspaceId: requestWorkspaceId
+        }),
         dryRun,
         overrideBranch: flagValue(parsed.flags, "--branch"),
         noWorktree: flagBoolean(parsed.flags, "--no-worktree")