overlord-cli 5.0.0 → 5.1.0

package/README.md

@@ -25,6 +25,14 @@ overlord help
 The CLI exposes the same command set under both names.
 `ovld auth login` opens a browser when possible and also prints a verification URL/code so login can be completed from another machine over SSH.
 
+Desktop-installed wrappers default `OVERLORD_URL` to `https://www.ovld.ai` unless you override it explicitly.
+For local dev against the web app on port 3000, export the override before running auth or protocol commands:
+
+```bash
+export OVERLORD_URL=http://localhost:3000
+ovld auth login
+```
+
 Common commands:
 
 ```bash

package/bin/_cli/auth.mjs

@@ -144,6 +144,17 @@ function snippet(value, max = 180) {
   return normalized.length <= max ? normalized : `${normalized.slice(0, max)}...`;
 }
 
+function describeNetworkError(error, context) {
+  const cause = error?.cause;
+  const details = [cause?.code, cause?.message].filter(Boolean).join(': ');
+  if (details) {
+    return new Error(`${context}: ${details}`);
+  }
+
+  const message = error instanceof Error ? error.message : String(error);
+  return new Error(`${context}: ${message}`);
+}
+
 async function readJsonOrThrow(res, context, baseUrl) {
   const contentType = res.headers.get('content-type') ?? '';
   const bodyText = await res.text();
@@ -165,9 +176,14 @@ async function readJsonOrThrow(res, context, baseUrl) {
 }
 
 async function fetchAuthConfig(platformUrl, localSecret) {
-  const res = await fetch(`${platformUrl}/api/auth/config`, {
-    headers: buildAuthHeaders('', localSecret)
-  });
+  let res;
+  try {
+    res = await fetch(`${platformUrl}/api/auth/config`, {
+      headers: buildAuthHeaders('', localSecret)
+    });
+  } catch (error) {
+    throw describeNetworkError(error, `Failed to fetch auth config from ${platformUrl}`);
+  }
   if (!res.ok) {
     throw new Error(
       `Failed to fetch auth config (${res.status}). Check that Overlord is running at ${platformUrl}.`
@@ -181,10 +197,18 @@ async function fetchAuthConfig(platformUrl, localSecret) {
 }
 
 async function requestDeviceAuthorization(platformUrl, localSecret) {
-  const res = await fetch(`${platformUrl}/api/auth/device/request`, {
-    method: 'POST',
-    headers: buildAuthHeaders('', localSecret)
-  });
+  let res;
+  try {
+    res = await fetch(`${platformUrl}/api/auth/device/request`, {
+      method: 'POST',
+      headers: buildAuthHeaders('', localSecret)
+    });
+  } catch (error) {
+    throw describeNetworkError(
+      error,
+      `Device authorization request failed for ${platformUrl}`
+    );
+  }
 
   if (!res.ok) {
     const text = await res.text();
@@ -195,14 +219,22 @@ async function requestDeviceAuthorization(platformUrl, localSecret) {
 }
 
 async function pollDeviceAuthorization(platformUrl, deviceCode, localSecret) {
-  const res = await fetch(`${platformUrl}/api/auth/device/poll`, {
-    method: 'POST',
-    headers: {
-      ...buildAuthHeaders('', localSecret),
-      'Content-Type': 'application/json'
-    },
-    body: JSON.stringify({ device_code: deviceCode })
-  });
+  let res;
+  try {
+    res = await fetch(`${platformUrl}/api/auth/device/poll`, {
+      method: 'POST',
+      headers: {
+        ...buildAuthHeaders('', localSecret),
+        'Content-Type': 'application/json'
+      },
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+  } catch (error) {
+    throw describeNetworkError(
+      error,
+      `Device authorization poll failed for ${platformUrl}`
+    );
+  }
 
   const body = await readJsonOrThrow(res, 'Device authorization poll', platformUrl);
 
@@ -220,17 +252,25 @@ function sleep(ms) {
 }
 
 async function exchangeCodeForSupabaseTokens(supabaseUrl, clientId, code, codeVerifier, redirectUri) {
-  const res = await fetch(`${supabaseUrl}/auth/v1/oauth/token`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    body: new URLSearchParams({
-      grant_type: 'authorization_code',
-      code,
-      client_id: clientId,
-      redirect_uri: redirectUri,
-      code_verifier: codeVerifier
-    })
-  });
+  let res;
+  try {
+    res = await fetch(`${supabaseUrl}/auth/v1/oauth/token`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        grant_type: 'authorization_code',
+        code,
+        client_id: clientId,
+        redirect_uri: redirectUri,
+        code_verifier: codeVerifier
+      })
+    });
+  } catch (error) {
+    throw describeNetworkError(
+      error,
+      `Token exchange failed for ${new URL(supabaseUrl).host}`
+    );
+  }
 
   if (!res.ok) {
     const text = await res.text();
@@ -474,8 +514,8 @@ async function promptForOrganization(organizations, preselectedId = null) {
 // Public auth commands
 // ---------------------------------------------------------------------------
 
-export function resolveLoginPlatformUrl(runtime = null) {
-  return process.env.OVERLORD_URL ?? runtime?.platform_url ?? getDefaultOverlordUrl();
+export function resolveLoginPlatformUrl(runtime = null, storedPlatformUrl = null) {
+  return process.env.OVERLORD_URL ?? storedPlatformUrl ?? runtime?.platform_url ?? getDefaultOverlordUrl();
 }
 
 function parseOrganizationFlag(args) {
@@ -491,7 +531,8 @@ function parseOrganizationFlag(args) {
 
 export async function authLogin(args = []) {
   const preselectedOrganizationId = parseOrganizationFlag(args);
-  const platformUrl = resolveLoginPlatformUrl();
+  const storedCredentials = loadCredentials();
+  const platformUrl = resolveLoginPlatformUrl(null, storedCredentials?.platform_url ?? null);
   const runtime = loadRuntime(platformUrl);
   const localSecret = runtime?.local_secret ?? process.env.OVERLORD_LOCAL_SECRET ?? '';
 

package/bin/_cli/credentials.mjs

@@ -354,13 +354,29 @@ function isAccessTokenFresh(credentials) {
   return expiresAt - Date.now() > 60_000;
 }
 
+function describeNetworkError(error, context) {
+  const cause = error?.cause;
+  const details = [cause?.code, cause?.message].filter(Boolean).join(': ');
+  if (details) {
+    return new Error(`${context}: ${details}`);
+  }
+
+  const message = error instanceof Error ? error.message : String(error);
+  return new Error(`${context}: ${message}`);
+}
+
 const authConfigCache = new Map();
 
 async function fetchAuthConfig(platformUrl, localSecret) {
   if (authConfigCache.has(platformUrl)) return authConfigCache.get(platformUrl);
-  const res = await fetch(`${platformUrl}/api/auth/config`, {
-    headers: buildAuthHeaders('', localSecret)
-  });
+  let res;
+  try {
+    res = await fetch(`${platformUrl}/api/auth/config`, {
+      headers: buildAuthHeaders('', localSecret)
+    });
+  } catch (error) {
+    throw describeNetworkError(error, `Failed to fetch auth config from ${platformUrl}`);
+  }
   if (!res.ok) {
     throw new Error(`Failed to fetch auth config (${res.status}).`);
   }
@@ -378,15 +394,23 @@ async function refreshOAuthAccessToken(platformUrl, refreshToken, localSecret) {
     throw new Error('OAuth is not configured for Overlord CLI auth.');
   }
 
-  const res = await fetch(`${supabaseUrl}/auth/v1/oauth/token`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    body: new URLSearchParams({
-      grant_type: 'refresh_token',
-      refresh_token: refreshToken,
-      client_id: clientId
-    })
-  });
+  let res;
+  try {
+    res = await fetch(`${supabaseUrl}/auth/v1/oauth/token`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: new URLSearchParams({
+        grant_type: 'refresh_token',
+        refresh_token: refreshToken,
+        client_id: clientId
+      })
+    });
+  } catch (error) {
+    throw describeNetworkError(
+      error,
+      `OAuth token refresh failed for ${new URL(supabaseUrl).host}`
+    );
+  }
 
   if (!res.ok) {
     const text = await res.text().catch(() => '');
@@ -518,9 +542,9 @@ export async function resolveAuth() {
         };
         saveCredentials(nextCredentials);
       } catch (refreshError) {
-        if (!creds.access_token) throw refreshError;
-        // Transient refresh failure — keep the existing access token and let the server
-        // reject it if it's truly expired/revoked.
+        throw new Error(
+          `Stored Overlord session expired and refresh failed. ${refreshError instanceof Error ? refreshError.message : String(refreshError)} Run \`ovld auth login\` again.`
+        );
       }
     }
 
@@ -584,7 +608,7 @@ export async function getAuthStatus() {
   }
 
   return {
-    isLoggedIn: tokenSource !== 'fallback',
+    isLoggedIn: tokenSource !== 'fallback' && !error,
     platformUrl: resolved.platformUrl,
     platformUrlSource,
     tokenPresent: tokenSource !== 'fallback',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "overlord-cli",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "Overlord CLI — launch AI agents on tickets from anywhere",
   "type": "module",
   "bin": {