overlord-cli 0.2609221008.0 → 0.2609270909.0

package/README.md

@@ -202,6 +202,8 @@ Notes for headless use:
 - `ovld agent-setup` accepts `--home <dir>` to target a specific `OVLD_HOME`,
   `--dry-run` to preview, and `--json` for machine-readable output. List
   installable connectors with `ovld agent-setup --json`.
+- `ovld agent-setup codex --export <dir>` renders the self-contained plugin
+  package into an empty directory without changing the user's Codex setup.
 - Set `OVLD_HOME=/some/writable/dir` if the default `~/.ovld` is not writable in
   your container; it relocates the entire CLI data directory.
 - Interactive `ovld auth login` / `ovld config set` (no args) and `ovld setup`

package/dist/connectors/VERSION

@@ -1 +1 @@
-0.3.47
+0.3.48

package/dist/connectors/adapters/antigravity/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "overlord",
-  "version": "0.3.47",
+  "version": "0.3.48",
   "description": "Chat-driven access to Overlord mission protocol workflows through skills and MCP.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.47",
+  "version": "0.3.48",
   "description": "Overlord mission protocol workflow for Claude Code — attach/update/ask/deliver, slash commands, and hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.47",
+  "version": "0.3.48",
   "description": "Chat-driven access to Overlord mission protocol workflows with hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/cursor/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.47",
+  "version": "0.3.48",
   "description": "Overlord mission protocol workflow for Cursor — attach/update/ask/deliver, slash commands, MCP bridge, and follow-up capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/core/overlord-mission/reference/context.md

@@ -10,10 +10,17 @@ ovld protocol update-artifact --mission-id $MISSION_ID --artifact-id <artifact-i
 ovld protocol attachment-list --session-key <sessionKey> --objective-id <objective-id>
 ovld protocol attachment-upload-file --session-key <sessionKey> --objective-id <objective-id> --file ./spec.pdf --content-type application/pdf
 ovld protocol attachment-download-url --session-key <sessionKey> --attachment-id <attachment-id>
+ovld protocol attachment-download-url --session-key <sessionKey> --attachment-id <attachment-id> --output ./attachment.pdf
 ```
 
 The `attach` and `load-context` responses already include an `attachments` array plus `previousObjectives` and `futureObjectives` arrays — use those for `<attachment-id>` and `<objective-id>` values. The objective currently being executed is not repeated in those arrays; it is the top-level `objective`. `previousObjectives` are the objectives already worked (before the current one) and `futureObjectives` are the ones queued after it. Run `attachment-list` mid-session if new files have been uploaded since attach. `--mission-id` is optional for attachment calls when `--objective-id` is a full display ID that lets the server derive the mission; an attachment ID alone does not carry mission scope.
 
+Attachment HTTPS URLs require Overlord authentication. Use `--output` to save
+the bytes through the CLI's existing authenticated client; it creates a new
+file and will not overwrite one. Do not read CLI credential files or pass their
+contents to `curl`. Hosted MCP callers can use their authenticated tool or
+client transport to retrieve the same attachment.
+
 ## Creating artifacts during a turn
 
 Artifacts do not require delivery. Publish a plan, notes, decision, or URL mid-session with `add-artifact` (or MCP `overlord_add_artifact`). Provide `--type`, `--label`, and at least one of `--content-text` / `--content-text-file` or `--external-url`. An optional `--session-key` (auto-injected from the attach cache when present) stamps session/objective provenance; `delivery_id` stays null. Delivery may still attach additional artifacts later.

package/dist/connectors/core/scripts/overlord-mcp.mjs

@@ -1228,7 +1228,7 @@ process.stdin.on('data', async chunk => {
         result: {
           protocolVersion: PROTOCOL_VERSION,
           capabilities: { tools: { listChanged: false } },
-          serverInfo: { name: 'overlord-__OVERLORD_ADAPTER_KEY__', version: '0.3.47' }
+          serverInfo: { name: 'overlord-__OVERLORD_ADAPTER_KEY__', version: '0.3.48' }
         }
       });
       continue;

package/dist/index.js

@@ -2952,13 +2952,25 @@ function setupConnector({
   agentKey,
   home,
   configureCodexPermissions = true,
-  dryRun = false
+  dryRun = false,
+  exportPath
 }) {
+  if (exportPath && agentKey !== "codex") {
+    throw new CliError({
+      message: "Export mode is currently supported only for the Codex connector."
+    });
+  }
   const manifest = readConnectorManifest(agentKey);
   const resolvedHome = resolveHome(home);
-  const installPath = expandInstallPath(manifest.connector.installPath, resolvedHome);
+  const installPath = exportPath ? path6.resolve(exportPath) : expandInstallPath(manifest.connector.installPath, resolvedHome);
   const sourceDir = connectorDir(agentKey);
   const warnings = [];
+  if (exportPath) {
+    mkdirSync3(installPath, { recursive: true });
+    if (readdirSync(installPath).length > 0) {
+      throw new CliError({ message: `Export destination must be empty: ${installPath}` });
+    }
+  }
   const files = [];
   const stateFiles = [];
   const previousState = readInstallState(agentKey, resolvedHome);
@@ -3032,10 +3044,10 @@ function setupConnector({
       `Agent binary "${binaryName}" not found on PATH. The connector is installed; install ${binaryName} to launch this agent.`
     );
   }
-  if (agentKey === "cursor") {
+  if (!exportPath && agentKey === "cursor") {
     warnings.push(...configureCursorHarness({ home: resolvedHome, dryRun }));
   }
-  if (agentKey === "codex") {
+  if (!exportPath && agentKey === "codex") {
     warnings.push(
       ...configureCodexHarness({
         home: resolvedHome,
@@ -3045,10 +3057,10 @@ function setupConnector({
       })
     );
   }
-  if (agentKey === "claude") {
+  if (!exportPath && agentKey === "claude") {
     warnings.push(...configureClaudeHarness({ home: resolvedHome, installPath, dryRun }));
   }
-  if (!dryRun) {
+  if (!dryRun && !exportPath) {
     const installedStateFiles = manifest.connector.managedFiles.map((relativePath) => {
       const target = path6.join(installPath, relativePath);
       if (!existsSync6(target)) return null;
@@ -3285,7 +3297,8 @@ function createBackendClient() {
     path: path38,
     body,
     extraHeaders,
-    rawBody
+    rawBody,
+    responseType = "json"
   }) {
     const url2 = `${baseUrl}${path38.startsWith("/") ? path38 : `/${path38}`}`;
     const auth = resolveAuthHeaders({ baseUrl });
@@ -3300,7 +3313,7 @@ The backend URL may have changed. Run \`ovld auth login\` to sign in to the curr
       response = await fetch(url2, {
         method,
         headers: {
-          Accept: "application/json",
+          Accept: responseType === "bytes" ? "application/octet-stream" : "application/json",
           ...rawBody === void 0 && body !== void 0 ? { "Content-Type": "application/json" } : {},
           "x-overlord-device-fingerprint": clientDevice.deviceFingerprint,
           "x-overlord-device-label": clientDevice.deviceLabel,
@@ -3317,7 +3330,7 @@ Start the Desktop/local backend or run \`ovld config set cloud <url>\`.
 ` + (error51 instanceof Error ? error51.message : String(error51))
       });
     }
-    const payload = await readResponseJson2(response);
+    const payload = response.ok && responseType === "bytes" ? Buffer.from(await response.arrayBuffer()) : await readResponseJson2(response);
     if (!response.ok) {
       if (isExecutionRequestAlreadyLinkedPayload(payload)) {
         throw new CliError({ message: formatExecutionRequestAlreadyLinkedDiagnostic() });
@@ -3339,6 +3352,7 @@ Start the Desktop/local backend or run \`ovld config set cloud <url>\`.
     baseUrl,
     health: () => request({ method: "GET", path: "/api/health" }),
     get: (path38) => request({ method: "GET", path: path38 }),
+    getBytes: (path38) => request({ method: "GET", path: path38, responseType: "bytes" }),
     post: ({ path: path38, body }) => request({ method: "POST", path: path38, body }),
     patch: ({ path: path38, body }) => request({ method: "PATCH", path: path38, body }),
     delete: (path38) => request({ method: "DELETE", path: path38 }),
@@ -4024,8 +4038,12 @@ async function runAgentSetupCommand({
   const target = parsed.positional[0];
   const dryRun = flagBoolean(parsed.flags, "--dry-run");
   const home = flagValue(parsed.flags, "--home");
+  const exportPath = flagValue(parsed.flags, "--export");
+  if (exportPath && target !== "codex") {
+    throw new CliError({ message: "`--export` requires `agent-setup codex`." });
+  }
   const shouldConfigureCodexPermissions = async (agentKey) => {
-    if (agentKey !== "codex" || dryRun || json2 || !process.stdin.isTTY) return true;
+    if (agentKey !== "codex" || exportPath || dryRun || json2 || !process.stdin.isTTY) return true;
     return promptYesNo(
       "Configure Codex permissions to allow it to communicate with the Overlord server?",
       true
@@ -4053,15 +4071,21 @@ async function runAgentSetupCommand({
     setupConnector({
       agentKey: target,
       home,
+      exportPath,
       dryRun,
       configureCodexPermissions: await shouldConfigureCodexPermissions(target)
     })
   ];
   if (json2) {
-    printJson({ ok: true, dryRun, results });
+    printJson({ ok: true, dryRun, exported: Boolean(exportPath), results });
   } else {
     for (const result of results) {
-      printHumanResult(result);
+      if (exportPath) {
+        printLine(`Exported connector "${result.agentKey}" \u2192 ${result.installPath}`);
+        for (const file2 of result.files) printLine(`  + ${file2.path}`);
+      } else {
+        printHumanResult(result);
+      }
     }
   }
 }
@@ -20362,6 +20386,23 @@ var init_errors2 = __esm({
   }
 });
 
+// ../packages/core/dist/service/worker-jobs.js
+var init_worker_jobs = __esm({
+  "../packages/core/dist/service/worker-jobs.js"() {
+    "use strict";
+    init_util2();
+  }
+});
+
+// ../packages/core/dist/service/live-activity-jobs.js
+var init_live_activity_jobs = __esm({
+  "../packages/core/dist/service/live-activity-jobs.js"() {
+    "use strict";
+    init_util2();
+    init_worker_jobs();
+  }
+});
+
 // ../database/dist/better-sqlite3-loader.js
 var init_better_sqlite3_loader = __esm({
   "../database/dist/better-sqlite3-loader.js"() {
@@ -35711,6 +35752,7 @@ var init_requests = __esm({
     "use strict";
     init_change_feed();
     init_errors2();
+    init_live_activity_jobs();
     init_util2();
     init_webhook_events();
     init_window();
@@ -37397,12 +37439,21 @@ async function loadMissionContext({
       const id = objective.id;
       if (typeof id !== "string" || id.length === 0) return;
       const attachments = await runtime.backend.get(`/api/objectives/${encodeURIComponent(id)}/attachments`).catch(() => []);
-      const label = objectiveDisplayRef(objective) ?? "objective";
+      const label = objectiveDisplayRef(objective) ?? id;
       for (const attachment of attachments) {
         const record2 = asRecord4(attachment);
         const filename = String(record2.filename ?? "attachment");
         const contentType = record2.contentType ? ` (${String(record2.contentType)})` : "";
-        attachmentLines.push(`- [${label}] ${filename}${contentType}`);
+        const attachmentId = typeof record2.id === "string" ? record2.id : null;
+        const storageKey = typeof record2.storageKey === "string" ? record2.storageKey : null;
+        const url2 = storageKey ? `${runtime.backend.baseUrl}/api/storage/attachments/${encodeURIComponent(storageKey)}` : null;
+        attachmentLines.push(`- [${label}] ${filename}${contentType}${url2 ? ` \u2014 ${url2}` : ""}`);
+        if (attachmentId) {
+          const output = `./.overlord/tmp/attachment-${attachmentId}-${path31.basename(filename)}`;
+          attachmentLines.push(
+            `  Download: \`ovld protocol attachment-download-url --objective-id ${shellQuote2(label)} --attachment-id ${shellQuote2(attachmentId)} --output ${shellQuote2(output)}\``
+          );
+        }
       }
     })
   );
@@ -37425,7 +37476,7 @@ async function loadMissionContext({
     "",
     ...attachmentLines.length > 0 ? [
       "## Attachments",
-      "Files attached to the objective(s) below. Use `ovld protocol attachment-list` and `ovld protocol attachment-download-url` to retrieve them.",
+      "Attachment URLs require Overlord authentication. Use the download commands below; the CLI supplies its own credentials. Use `ovld protocol attachment-list` to refresh this list.",
       ...attachmentLines,
       ""
     ] : [],
@@ -38832,12 +38883,14 @@ attachment-list:
 
 attachment-download-url:
   Purpose:
-    Return the download URL for a specific attachment on the mission.
+    Return the authenticated download URL for a specific attachment, or save it
+    to a new file using the CLI's existing authentication.
   Required:
     --mission-id <id>
     --attachment-id <id>  (use the id from attachment-list output)
   Optional:
     --objective-id <id>         Restrict the lookup to one objective
+    --output <path>             Download to a new local file (never overwrites)
 
 list-organizations:
   Purpose:
@@ -39670,6 +39723,7 @@ __export(commands_exports, {
   firstObjectiveId: () => firstObjectiveId,
   launchFailureMessage: () => launchFailureMessage,
   queueableObjectiveId: () => queueableObjectiveId,
+  readWorktreeBranchAutomationEnabled: () => readWorktreeBranchAutomationEnabled,
   resolveActiveObjectiveId: () => resolveActiveObjectiveId,
   resolveProtocolFileInputs: () => resolveProtocolFileInputs,
   runManagementCommand: () => runManagementCommand,
@@ -39678,7 +39732,7 @@ __export(commands_exports, {
   sanitizeRunnerFailureMessage: () => sanitizeRunnerFailureMessage,
   shouldRefuseInlineRunnerLaunch: () => shouldRefuseInlineRunnerLaunch
 });
-import { readFileSync as readFileSync21 } from "node:fs";
+import { readFileSync as readFileSync21, writeFileSync as writeFileSync13 } from "node:fs";
 import path37 from "node:path";
 function resourceAccessModeBody(value) {
   if (typeof value !== "string") return {};
@@ -39910,10 +39964,14 @@ function parseLaunchEnvVarsValue(value) {
   }
   return vars;
 }
-async function readWorktreeBranchAutomationEnabled(runtime) {
+async function readWorktreeBranchAutomationEnabled({
+  runtime,
+  workspaceId
+}) {
   try {
     const settings = await fetchLaunchSettings({
-      backend: runtime.backend
+      backend: runtime.backend,
+      workspaceId
     });
     return settings.worktreeBranchAutomationEnabled === true;
   } catch (error51) {
@@ -40450,6 +40508,30 @@ Run \`${primaryCommand} protocol help\` for usage.`
   if (subcommand === "attachment-download-url") {
     const relUrl = resultRecord.url;
     if (typeof relUrl === "string" && relUrl.startsWith("/")) {
+      const output = flags["--output"];
+      if (output !== void 0) {
+        if (typeof output !== "string" || !output.trim()) {
+          throw new CliError({ message: "--output requires a file path." });
+        }
+        if (!relUrl.startsWith("/api/storage/attachments/")) {
+          throw new CliError({ message: "Unexpected attachment download path." });
+        }
+        const bytes = await runtime.backend.getBytes(relUrl);
+        try {
+          writeFileSync13(output, bytes, { flag: "wx", mode: 384 });
+        } catch (error51) {
+          throw new CliError({
+            message: `Could not create attachment file ${output}: ${String(error51)}`
+          });
+        }
+        printJson({
+          id: resultRecord.id,
+          filename: resultRecord.filename,
+          output,
+          sizeBytes: bytes.length
+        });
+        return;
+      }
       printJson({ ...resultRecord, url: `${runtime.backend.baseUrl}${relUrl}` });
       return;
     }
@@ -40747,7 +40829,10 @@ async function runManagementCommand({
           missionId,
           workingDirectory,
           objectiveId: objectiveId ?? void 0,
-          automationEnabled: await readWorktreeBranchAutomationEnabled(scopedRuntime),
+          automationEnabled: await readWorktreeBranchAutomationEnabled({
+            runtime: scopedRuntime,
+            workspaceId: missionWorkspaceId
+          }),
           dryRun,
           overrideBranch: flagValue(parsed.flags, "--branch"),
           noWorktree: flagBoolean(parsed.flags, "--no-worktree")
@@ -41144,7 +41229,10 @@ The runner will not register a target for you \u2014 declare this machine first,
         missionId,
         workingDirectory: String(requestRecord.workingDirectory ?? process.cwd()),
         objectiveId: String(requestRecord.objectiveId ?? ""),
-        automationEnabled: await readWorktreeBranchAutomationEnabled(runtime),
+        automationEnabled: await readWorktreeBranchAutomationEnabled({
+          runtime,
+          workspaceId: requestWorkspaceId
+        }),
         dryRun,
         overrideBranch: flagValue(parsed.flags, "--branch"),
         noWorktree: flagBoolean(parsed.flags, "--no-worktree")
@@ -41602,7 +41690,7 @@ var COMMAND_FLAGS = {
   init: [],
   doctor: [],
   setup: [],
-  "agent-setup": ["--dry-run", "--home"],
+  "agent-setup": ["--dry-run", "--home", "--export"],
   config: ["--path", "--url"],
   auth: ["--token", "--organization-id"],
   "user-token": ["--label", "--expires-in", "--no-expiry", "--scope", "--id"],
@@ -41753,8 +41841,9 @@ General:
 
 Connectors:
   ${primaryCommand} agent-setup [--json]         List installable agent connectors
-  ${primaryCommand} agent-setup <agent> [--dry-run]
-                                                 Install/repair one connector (e.g. claude)
+  ${primaryCommand} agent-setup <agent> [--dry-run] [--export <dir>]
+                                                 Install/repair one connector; Codex --export
+                                                 writes a package without installing it
   ${primaryCommand} agent-setup all [--dry-run]  Install/repair all supported connectors
   ${primaryCommand} agent-session capabilities [<agent>] [--json]
                                                  What a harness can really do on the agent-session