fix(cli): persist auth token to ~/.aegis/auth-token file (#3369) (#3386)

- ag init now writes auth token to ~/.aegis/auth-token (mode 0600)
- ag run resolveAuthToken() checks ~/.aegis/auth-token as fallback
- Non-fatal: token still available in config.yaml as clientAuthToken
- Fixes user lockout when terminal output scrolls past token

Co-authored-by: aegis-gh-agent[bot] <272581873+aegis-gh-agent[bot]@users.noreply.github.com>

Author: OneStepAt4time

src/commands/init.ts

@@ -6,8 +6,9 @@
  * Also handles `--list-templates` and `--from-template`.
  */
 
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { copyFile, mkdir, readFile, readdir, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
 import { dirname, join, relative, resolve, sep } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { fileURLToPath } from 'node:url';
@@ -46,6 +47,23 @@ interface InitSummary {
   identityScaffolded: boolean;
 }
 
+/**
+ * Persist the auth token to ~/.aegis/auth-token for easy access.
+ * File is created with 0600 permissions (owner read/write only).
+ * Non-fatal on failure — token remains in config.yaml as clientAuthToken.
+ */
+function persistAuthTokenFile(token: string): void {
+  const tokenDir = join(homedir(), '.aegis');
+  const tokenPath = join(tokenDir, 'auth-token');
+  try {
+    if (!existsSync(tokenDir)) mkdirSync(tokenDir, { recursive: true });
+    writeFileSync(tokenPath, token, { encoding: 'utf-8', mode: 0o600 });
+  } catch {
+    // Non-fatal — token is still in config.yaml as clientAuthToken
+  }
+}
+
+
 type TemplateType = 'agent' | 'skill' | 'slash-command';
 
 interface TemplateManifestEntry {
@@ -785,6 +803,11 @@ export async function handleInit(args: string[], io: CliIO): Promise<number> {
     }
   }
 
+  // #3369: Persist token to ~/.aegis/auth-token for easy scripting access
+  if (authToken) {
+    persistAuthTokenFile(authToken);
+  }
+
   printInitSummary(io, {
     authToken,
     baseUrl,

src/commands/run.ts

@@ -11,7 +11,7 @@
  */
 
 import { spawn, type ChildProcess } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 
@@ -31,7 +31,16 @@ function writeLine(stream: NodeJS.WritableStream, text: string = ''): void {
 }
 
 function resolveAuthToken(): string | undefined {
-  return process.env.AEGIS_AUTH_TOKEN || process.env.AEGIS_TOKEN || undefined;
+  const envToken = process.env.AEGIS_AUTH_TOKEN || process.env.AEGIS_TOKEN;
+  if (envToken) return envToken;
+
+  // #3369: Check ~/.aegis/auth-token file as fallback
+  try {
+    const tokenPath = join(homedir(), '.aegis', 'auth-token');
+    return readFileSync(tokenPath, 'utf-8').trim() || undefined;
+  } catch {
+    return undefined;
+  }
 }
 
 /**