Add hidden entire auth token for scripting

2b58593→main·

toothbrush·3w ago·3 files·+110 added/-2 removed

Prints the active control-plane bearer to stdout so curl/scripts can auth without digging the JWT out of the keychain:

curl -H "Authorization: Bearer $(entire auth token)" "$CORE/api/v1/clusters"

Honors ENTIRE_TOKEN verbatim, else resolves and refreshes the active context's login JWT (same bearer the API client uses). Hidden; errors and the not-logged-in hint go to stderr so stdout stays clean for command substitution.

Co-Authored-By: Claude Opus 4.8 (1M context) noreply@anthropic.com

Sessions

c9e38d421945View transcript

Changes

3

• MCLAUDE.md+4/-2

• cmd/entire/cli

• Mauth.go+43

• Aauth_token_test.go+63

41 unmodified lines

42
43
44
45
46
45
46
47
48
49
50
51

41 unmodified lines

- `configure`: bare prints help and a hint pointing at `entire agent`; flags
  manage non-agent settings (telemetry, git-hook installation mode, strategy
  options, summary provider). Agent CRUD lives under `entire agent`.
- `auth`: `login`, `logout`, `status`, `contexts`, `use`. `logout` takes
  `--everywhere` (revoke every session on the active core, not just the
- `auth`: `login`, `logout`, `status`, `contexts`, `use`, plus the hidden
  `token` (prints the active control-plane bearer to stdout for scripting/curl;
  honors `ENTIRE_TOKEN`, else the refreshed active-context login JWT). `logout`
  takes `--everywhere` (revoke every session on the active core, not just the
  current one) and `--all-contexts` (log out of every saved login)
- `doctor`: bare runs the scan-and-fix flow, plus `trace`, `logs`, `bundle`

MCLAUDE.md+4/-2

117 unmodified lines

118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171

117 unmodified lines

cmd.AddCommand(newLoginCmd())
    cmd.AddCommand(newLogoutCmd())
    cmd.AddCommand(newAuthStatusCmd())
    cmd.AddCommand(newAuthTokenCmd())
    cmd.AddCommand(newAuthContextsCmd())
    cmd.AddCommand(newAuthUseCmd())
    return cmd
// --- token ------------------------------------------------------------------
// newAuthTokenCmd prints the active control-plane bearer to stdout so scripts
// (and ad-hoc curl) can authenticate against the core API without re-deriving
// the keychain slot — e.g.
//
//	curl -H "Authorization: Bearer $(entire auth token)" "$CORE/api/v1/clusters"
//
// Hidden: it emits a live credential, so it's a deliberate scripting escape
// hatch, not part of the everyday surface. It resolves the same bearer the API
// client would — ENTIRE_TOKEN verbatim when set, otherwise the active context's
// login JWT, refreshed if it's near expiry — and prints nothing but the token
// (errors and the not-logged-in hint go to stderr) so command substitution
// stays clean.
func newAuthTokenCmd() *cobra.Command {
    var insecureHTTPAuth bool
    cmd := &cobra.Command{
        Use:    "token",
        Short:  "Print the active control-plane bearer token (for scripting)",
        Hidden: true,
        Args:   cobra.NoArgs,
        RunE: func(cmd *cobra.Command, _ []string) error {
            // Refresh may exchange/refresh over the network; honor the
            // plain-HTTP opt-in before resolving so local dev cores work.
            applyInsecureHTTPAuth(insecureHTTPAuth)
            target, err := resolveAuthStatusTarget(cmd.Context(), auth.Contexts, auth.RefreshedLoginToken)
            if err != nil {
                return err
            }
            if target.token == "" {
                cmd.SilenceUsage = true
                fmt.Fprintln(cmd.ErrOrStderr(), "Not logged in. Run 'entire login' to authenticate.")
                return NewSilentError(errors.New("not logged in"))
            }
            fmt.Fprintln(cmd.OutOrStdout(), target.token)
            return nil
        },
    }
    addInsecureHTTPAuthFlag(cmd, &insecureHTTPAuth)
    return cmd
}

// --- status -----------------------------------------------------------------

func newAuthStatusCmd() *cobra.Command {
}