overlord-cli 0.2609270909.0 → 0.2609281350.0

package/README.md

@@ -31,6 +31,7 @@ queue operations all reach persistence through the backend URL you configure —
 ### First run
 
 Install the published package:
+
 ```bash
 npm install -g --no-fund overlord-cli
 ```
@@ -86,10 +87,10 @@ Configuration lives in `overlord.toml` — a per-instance, uncommitted file
 discovered from the current directory upward, or in `~/.ovld/overlord.toml` for a
 global install.
 
-| Mode | Config key | How to set it |
-| ---- | ---------- | ------------- |
-| **Local backend** | `backend_url` | `ovld config set local [url]` — defaults to `http://127.0.0.1:4310` |
-| **Hosted backend** | `backend_url` | `ovld config set cloud <url>` |
+| Mode               | Config key    | How to set it                                                       |
+| ------------------ | ------------- | ------------------------------------------------------------------- |
+| **Local backend**  | `backend_url` | `ovld config set local [url]` — defaults to `http://127.0.0.1:4310` |
+| **Hosted backend** | `backend_url` | `ovld config set cloud <url>`                                       |
 
 `ovld config set` without arguments opens the interactive backend selector.
 `ovld config list` shows the resolved target; `ovld doctor` checks that the
@@ -98,7 +99,7 @@ backend is reachable.
 Environment overrides (useful in scripts and CI):
 
 - `OVLD_HOME` — relocate the entire global `~/.ovld` data directory (SQLite, object storage, objective ledgers, and native-session caches)
-- `OVERLORD_BACKEND_URL` — production/global backend target; an *explicit* runtime value (shell export, container/launcher injection) takes precedence over the resolved `overlord.toml` `backend_url`
+- `OVERLORD_BACKEND_URL` — production/global backend target; an _explicit_ runtime value (shell export, container/launcher injection) takes precedence over the resolved `overlord.toml` `backend_url`
 - `OVERLORD_BACKEND_URL_DEV` — **development-only** backend target, read solely by the in-repo source build and the dev/test tooling that runs it (`yarn dev`, the test harness). An installed/published `ovld` never reads it, and nothing aliases it into the production `OVERLORD_BACKEND_URL`
 - `OVERLORD_WEB_PORT` — port the local backend binds when launched
 - `OVERLORD_USER_TOKEN` / `OVLD_USER_TOKEN` / `USER_TOKEN` — bearer token sent to the backend when set (checked in that order; takes precedence over stored credentials)
@@ -139,6 +140,27 @@ Both the desktop app and the CLI authenticate to `/api/*` with a bearer token:
   previously stored the raw 7-day Better Auth session token, which is why they
   expired far sooner than cloud logins.)
 
+For an external automation that files missions in selected projects, create a
+project automation token:
+
+```bash
+ovld user-token create --label "Feedback importer" \
+  --scope project-automation --project <project-id> --no-expiry
+```
+
+Repeat `--project` to select more projects. The token can read those projects
+and create missions with initial objectives using `ovld protocol create
+--project-id <project-id> --objectives-json '[{"objective":"..."}]'` or
+`POST /api/missions`. The project default status applies when `statusId` is
+omitted, and the mission is unassigned unless `assignedWorkspaceUserId` is
+supplied. The token label appears as **Created via token** on its missions and
+remains there after rename or revocation. The default expiry is 90 days;
+`--no-expiry` disables it. Read the project's missions before creating a new
+one on retry, since create has no idempotency key. This preset cannot manage
+webhooks or call `prompt`, `record-work`, `add-objectives`, session, or launch
+commands. Its exact REST and protocol route allowlist is in the
+[authentication guide](../docs/src/content/docs/authentication-and-permissions.mdx).
+
 For the **local** backend, desktop and CLI share `~/.ovld/auth.json`:
 
 - Signing in through the desktop app writes the session bearer to `auth.json`, so

package/dist/connectors/VERSION

@@ -1 +1 @@
-0.3.48
+0.3.49

package/dist/connectors/adapters/antigravity/conformance-manifest.yaml

@@ -1,4 +1,4 @@
-contractVersion: "143"
+contractVersion: "151"
 componentType: connector
 componentKey: antigravity
 label: "Antigravity Connector"

package/dist/connectors/adapters/antigravity/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "overlord",
-  "version": "0.3.48",
+  "version": "0.3.49",
   "description": "Chat-driven access to Overlord mission protocol workflows through skills and MCP.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/claude/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.48",
+  "version": "0.3.49",
   "description": "Overlord mission protocol workflow for Claude Code — attach/update/ask/deliver, slash commands, and hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/claude/README.md

@@ -52,15 +52,6 @@ The plugin prompts for `overlord_url` and, when needed for non-interactive use,
 claude --plugin-dir /absolute/path/to/Overlord/connectors/adapters/claude
 ```
 
-### Install (published marketplace)
-
-Once published:
-
-```bash
-claude plugin marketplace add cooperativ/overlord-marketplace
-claude plugin install overlord@cooperativ
-```
-
 ### Namespaced components
 
 Inside Claude Code the components are surfaced with the plugin prefix:

package/dist/connectors/adapters/claude/conformance-manifest.yaml

@@ -1,4 +1,4 @@
-contractVersion: "143"
+contractVersion: "151"
 componentType: connector
 componentKey: claude
 label: "Claude Code Connector"

package/dist/connectors/adapters/codex/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.48",
+  "version": "0.3.49",
   "description": "Chat-driven access to Overlord mission protocol workflows with hook-driven activity capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/codex/conformance-manifest.yaml

@@ -1,4 +1,4 @@
-contractVersion: "143"
+contractVersion: "151"
 componentType: connector
 componentKey: codex
 label: "Codex Connector"

package/dist/connectors/adapters/cursor/.cursor-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord",
-  "version": "0.3.48",
+  "version": "0.3.49",
   "description": "Overlord mission protocol workflow for Cursor — attach/update/ask/deliver, slash commands, MCP bridge, and follow-up capture.",
   "author": {
     "name": "Cooperativ",

package/dist/connectors/adapters/cursor/conformance-manifest.yaml

@@ -1,4 +1,4 @@
-contractVersion: "143"
+contractVersion: "151"
 componentType: connector
 componentKey: cursor
 label: "Cursor Connector"

package/dist/connectors/adapters/opencode/conformance-manifest.yaml

@@ -1,4 +1,4 @@
-contractVersion: "143"
+contractVersion: "151"
 componentType: connector
 componentKey: opencode
 label: "OpenCode Connector"

package/dist/connectors/adapters/pi/conformance-manifest.yaml

@@ -1,4 +1,4 @@
-contractVersion: "143"
+contractVersion: "151"
 componentType: connector
 componentKey: pi
 label: "PI Connector"

package/dist/connectors/core/overlord-mission/SKILL.md

@@ -222,8 +222,8 @@ nothing qualifies. Omit the report when none of these facts apply.
 
 #### Writing a human action the operator can complete
 
-Human actions are collected across every mission into the Feed page's **Human actions** rail,
-where the operator reads them without the delivery context. Each item must stand alone:
+Human actions are shown on the delivery card, where the operator reads them without your
+session transcript. Each item must stand alone:
 
 | Field      | Expected   | What to write                                                                                     |
 | ---------- | ---------- | ------------------------------------------------------------------------------------------------- |
@@ -241,7 +241,7 @@ Vague (the operator has to rediscover everything):
 { "action": "Set up the env var for Gemini." }
 ```
 
-Good (the operator can finish it from the rail alone):
+Good (the operator can finish it from the card alone):
 
 ```json
 {

package/dist/connectors/core/scripts/overlord-mcp.mjs

@@ -1228,7 +1228,7 @@ process.stdin.on('data', async chunk => {
         result: {
           protocolVersion: PROTOCOL_VERSION,
           capabilities: { tools: { listChanged: false } },
-          serverInfo: { name: 'overlord-__OVERLORD_ADAPTER_KEY__', version: '0.3.48' }
+          serverInfo: { name: 'overlord-__OVERLORD_ADAPTER_KEY__', version: '0.3.49' }
         }
       });
       continue;

package/dist/index.js

@@ -4137,6 +4137,7 @@ var init_setup = __esm({
 var user_token_exports = {};
 __export(user_token_exports, {
   durationToIso: () => durationToIso,
+  projectFlags: () => projectFlags,
   runUserTokenCommand: () => runUserTokenCommand
 });
 function durationToIso(value, now = Date.now()) {
@@ -4176,10 +4177,28 @@ function normalizeScope(raw) {
   const value = raw.trim().toLowerCase();
   if (value === "full") return "full";
   if (value === "mission-lifecycle" || value === "mission_lifecycle") return "mission_lifecycle";
+  if (value === "project-automation" || value === "project_automation") return "project_automation";
   throw new CliError({
-    message: `Unknown --scope '${raw}'. Use 'full' or 'mission-lifecycle'.`
+    message: `Unknown --scope '${raw}'. Use 'full', 'mission-lifecycle', or 'project-automation'.`
   });
 }
+function projectFlags(args) {
+  const projects = [];
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--project") {
+      const value = args[++i];
+      if (!value || value.startsWith("--"))
+        throw new CliError({ message: "--project requires an ID or name" });
+      projects.push(value);
+    } else if (arg?.startsWith("--project=")) {
+      const value = arg.slice("--project=".length);
+      if (!value) throw new CliError({ message: "--project requires an ID or name" });
+      projects.push(value);
+    }
+  }
+  return projects;
+}
 function formatDate(iso) {
   return iso ?? "\u2014";
 }
@@ -4194,6 +4213,8 @@ function printTokenTable(tokens) {
       `${token.tokenPrefix}\u2026  ${token.status.padEnd(8)}  ${token.scope.padEnd(16)}  ${expiry}  ${token.label}`
     );
     console.log(`    id: ${token.id}`);
+    if (token.projects.length)
+      console.log(`    projects: ${token.projects.map((project) => project.name).join(", ")}`);
   }
 }
 async function runUserTokenCommand({ rest }) {
@@ -4208,6 +4229,15 @@ async function runUserTokenCommand({ rest }) {
         throw new CliError({ message: 'A label is required: --label "macbook runner".' });
       }
       const scope = normalizeScope(flagValue(parsed.flags, "--scope"));
+      const selectedProjects = projectFlags(subArgs);
+      if (scope === "project_automation" && selectedProjects.length === 0) {
+        throw new CliError({
+          message: "Project automation tokens require at least one --project."
+        });
+      }
+      if (scope !== "project_automation" && selectedProjects.length > 0) {
+        throw new CliError({ message: "--project requires --scope project-automation." });
+      }
       let expiresAt;
       if (flagBoolean(parsed.flags, "--no-expiry")) {
         expiresAt = null;
@@ -4218,6 +4248,21 @@ async function runUserTokenCommand({ rest }) {
       const body = { label: label.trim() };
       if (expiresAt !== void 0) body.expiresAt = expiresAt;
       if (scope !== void 0) body.scope = scope;
+      if (scope === "project_automation") {
+        const projects = await backend.get(
+          "/api/projects?lifecycle=all"
+        );
+        body.projectIds = selectedProjects.map((selection) => {
+          const matches = projects.filter(
+            (project) => project.id === selection || project.name.toLowerCase() === selection.toLowerCase()
+          );
+          if (matches.length !== 1)
+            throw new CliError({
+              message: `Project '${selection}' must identify one authorized project; use its ID if ambiguous.`
+            });
+          return matches[0].id;
+        });
+      }
       const result = await backend.post({
         path: "/api/user-tokens",
         body
@@ -4231,9 +4276,16 @@ async function runUserTokenCommand({ rest }) {
 `);
       console.log(`  label:  ${result.token.label}`);
       console.log(`  scope:  ${result.token.scope}`);
+      if (result.token.projects.length)
+        console.log(`  projects: ${result.token.projects.map((project) => project.name).join(", ")}`);
       console.log(
         `  expiry: ${result.token.expiresAt ? formatDate(result.token.expiresAt) : "no expiry"}`
       );
+      if (result.token.scope === "project_automation" && result.token.expiresAt) {
+        console.log(
+          "  Renew this automation token before it expires, or choose --no-expiry when creating its replacement."
+        );
+      }
       console.log("\nAuthenticate with:  ovld auth login --token <secret>");
       return;
     }
@@ -38714,8 +38766,8 @@ deliver:
       "link":     ".env.example"  // when known. HTTP(S) URL or repo-relative path only.
     }
     Vague: { "action": "Set up the env var for Gemini." } forces the operator to rediscover
-    the name, the place, and the check. Actions are read from the Feed rail without the
-    delivery, so each must stand alone. Overlord adds deterministic_rule actions for new
+    the name, the place, and the check. Actions are read from the delivery card without
+    your transcript, so each must stand alone. Overlord adds deterministic_rule actions for new
     migrations, .env.example edits, dependency manifests, and CI workflow files on its own;
     report those yourself when you can supply the real command and verify step.
   Optional:
@@ -41693,7 +41745,7 @@ var COMMAND_FLAGS = {
   "agent-setup": ["--dry-run", "--home", "--export"],
   config: ["--path", "--url"],
   auth: ["--token", "--organization-id"],
-  "user-token": ["--label", "--expires-in", "--no-expiry", "--scope", "--id"],
+  "user-token": ["--label", "--expires-in", "--no-expiry", "--scope", "--project", "--id"],
   prune: [],
   "agent-session": AGENT_SESSION_FLAGS,
   "create-project": ["--name", "--directory", "--no-directory"],