cli/auth: unhide `entire auth token` · Entire

cli/auth: unhide entire auth token

05f3feb·

georg·2w ago·3 files·+10 added/-12 removed

Make the control-plane bearer helper discoverable in entire auth --help and agent-help instead of a hidden scripting-only escape hatch. It still prints a live credential (documented as a secret in the doc comment), resolves the same bearer the API client uses (ENTIRE_TOKEN verbatim, else the refreshed active-context login JWT), and keeps errors on stderr so command substitution stays clean. Behavior is unchanged; only visibility. The --insecure-http-auth flag stays hidden.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

Sessions

860e188caf74View transcript

Changes

3

44 unmodified lines

45
46
47
48
48
49
50
51

44 unmodified lines

- `configure`: bare prints help and a hint pointing at `entire agent`; flags
  manage non-agent settings (telemetry, git-hook installation mode, strategy
  options, summary provider). Agent CRUD lives under `entire agent`.
- `auth`: `login`, `logout`, `status`, `contexts`, `use`, plus the hidden
- `auth`: `login`, `logout`, `status`, `contexts`, `use`, plus
  `token` (prints the active control-plane bearer to stdout for scripting/curl;
  honors `ENTIRE_TOKEN`, else the refreshed active-context login JWT). `logout`
  takes `--everywhere` (revoke every session on the active core, not just the

MCLAUDE.md+1/-1

131 unmodified lines

132
133
134
135
136
137
138
139
140
135
136
137
138
139
140
141
142
144
145
146
147
143
144
145
146
147
148

131 unmodified lines

//
//\tcurl -H "Authorization: Bearer $(entire auth token)" "$CORE/api/v1/clusters"
//
// Hidden: it emits a live credential, so it's a deliberate scripting escape
// hatch, not part of the everyday surface. It resolves the same bearer the API
// client would — ENTIRE_TOKEN verbatim when set, otherwise the active context's
// login JWT, refreshed if it's near expiry — and prints nothing but the token
// (errors and the not-logged-in hint go to stderr) so command substitution
// stays clean.
// It emits a live credential, so treat the output as a secret. It resolves the
// same bearer the API client would — ENTIRE_TOKEN verbatim when set, otherwise
// the active context's login JWT, refreshed if it's near expiry — and prints
// nothing but the token (errors and the not-logged-in hint go to stderr) so
// command substitution stays clean.
func newAuthTokenCmd() *cobra.Command {
    var insecureHTTPAuth bool
    cmd := &cobra.Command{
        Use:    "token",
        Short:  "Print the active control-plane bearer token (for scripting)",
        Hidden: true,
        Args:   cobra.NoArgs,
        Use:   "token",
        Short: "Print the active control-plane bearer token (for scripting)",
        Args:  cobra.NoArgs,
        RunE: func(cmd *cobra.Command, _ []string) error {
            // Refresh may exchange/refresh over the network; honor the
            // plain-HTTP opt-in before resolving so local dev cores work.

Mcmd/entire/cli/auth.go+8/-10

19 unmodified lines

20
21
22
23
23
24
25
26

19 unmodified lines

return header + "." + payload + "." + enc.EncodeToString([]byte("sig"))
}

// TestAuthTokenCmd covers the hidden `entire auth token` scripting helper.
// TestAuthTokenCmd covers the `entire auth token` scripting helper.
//
// Not parallel: it manipulates ENTIRE_TOKEN / ENTIRE_CONFIG_DIR.
func TestAuthTokenCmd(t *testing.T) {