cli/auth: unhide entire auth token

0c18390→main·

georg·1w ago·3 files·+10 added/-12 removed

Make the control-plane bearer helper discoverable in entire auth --help and agent-help instead of a hidden scripting-only escape hatch. It still prints a live credential (documented as a secret in the doc comment), resolves the same bearer the API client uses (ENTIRE_TOKEN verbatim, else the refreshed active-context login JWT), and keeps errors on stderr so command substitution stays clean. Behavior is unchanged; only visibility. The --insecure-http-auth flag stays hidden.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

Sessions

860e188caf74View transcript

Changes

3

• MCLAUDE.md+1/-1

• cmd/entire/cli

• Mauth.go+8/-10

• Mauth_token_test.go+1/-1

44 unmodified lines

- `configure`: bare prints help and a hint pointing at `entire agent`; flags
  manage non-agent settings (telemetry, git-hook installation mode, strategy
  options, summary provider). Agent CRUD lives under `entire agent`.
- `auth`: `login`, `logout`, `status`, `contexts`, `use`, plus the hidden
- `auth`: `login`, `logout`, `status`, `contexts`, `use`, plus
  `token` (prints the active control-plane bearer to stdout for scripting/curl;
  honors `ENTIRE_TOKEN`, else the refreshed active-context login JWT). `logout`
  takes `--everywhere` (revoke every session on the active core, not just the 

MCLAUDE.md+1/-1

131 unmodified lines

//

//	curl -H "Authorization: Bearer $(entire auth token)" "$CORE/api/v1/clusters"
//
// Hidden: it emits a live credential, so it's a deliberate scripting escape
// hatch, not part of the everyday surface. It resolves the same bearer the API
// client would — ENTIRE_TOKEN verbatim when set, otherwise the active context's
// login JWT, refreshed if it's near expiry — and prints nothing but the token
// (errors and the not-logged-in hint go to stderr) so command substitution
// stays clean.
// It emits a live credential, so treat the output as a secret. It resolves the
// same bearer the API client would — ENTIRE_TOKEN verbatim when set, otherwise
// the active context's login JWT, refreshed if it's near expiry — and prints
// nothing but the token (errors and the not-logged-in hint go to stderr) so
// command substitution stays clean.
func newAuthTokenCmd() *cobra.Command {
    var insecureHTTPAuth bool
    cmd := &cobra.Command{
        Use:    "token",
        Short:  "Print the active control-plane bearer token (for scripting)",
        Hidden: true,
        Args:   cobra.NoArgs,
    }

RunE: func(cmd *cobra.Command, _ []string) error {
        // Refresh may exchange/refresh over the network; honor the
        // plain-HTTP opt-in before resolving so local dev cores work.

Mcmd/entire/cli/auth.go+8/-10

19 unmodified lines

`TestAuthTokenCmd` covers the hidden `entire auth token` scripting helper.
`TestAuthTokenCmd` covers the `entire auth token` scripting helper.

// Not parallel: it manipulates ENTIRE_TOKEN / ENTIRE_CONFIG_DIR.
func TestAuthTokenCmd(t *testing.T) {
`