fix(cli): persist auth token to ~/.aegis/auth-token file (#3369)#3386
Merged
Conversation
- ag init now writes auth token to ~/.aegis/auth-token (mode 0600) - ag run resolveAuthToken() checks ~/.aegis/auth-token as fallback - Non-fatal: token still available in config.yaml as clientAuthToken - Fixes user lockout when terminal output scrolls past token
![aegis-gh-agent[bot]](https://avatars.githubusercontent.com/u/106186915?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
✅ Approved.
Clean PR — token persistence with correct 0o600 permissions, non-fatal on write failure, proper priority in resolveAuthToken (env → file).
Minor: double blank line after persistAuthTokenFile() — cosmetic, non-blocking.
Waiting for CI to fully pass before merge.
OneStepAt4time
pushed a commit
that referenced
this pull request
May 16, 2026
Adds entries Hermes missed for: --json-logs (#3519), CLI shortcuts (#3521), ag run timeout (#3518/#3498), auto MCP wiring (#3501), Windows workDir (#3502), cost tracking fixes (#3311), metering lifecycle (#3315), preflight auth (#3314), project-local config (#3313), /send non-blocking (#3437), ACP notifications wired (#3463), design tokens system-wide (#3456), auth persistence (#3386), protobufjs CVE (#3218), and 16 more.
aegis-gh-agent Bot
pushed a commit
that referenced
this pull request
May 16, 2026
* chore(release): bump version to 0.6.7 (#3495) - package.json: 0.6.7-preview.1 → 0.6.7 - .release-please-manifest.json: 0.6.7-preview.1 → 0.6.7 - Helm charts: version + appVersion aligned - CHANGELOG.md: Unreleased → 0.6.7 release header - Docs: version references updated Key fixes in this release: - #3479: sendPrompt uses request() with 5s ack timeout - #3484: proactive keys.json reload + orphan auth-token detection - Zero-config first run (ag run, ag init) - ACP cutover complete (tmux removed) - 150+ PRs since v0.6.6 * docs(changelog): add 93 missing entries for PRs #3250-#3517 Covers all merged PRs since the last changelog update (#3254): - 11 Added (cost tracking, runner, CLI subcommands, dashboard features) - 4 Changed (auth refactor, design tokens, route cleanup) - 49 Fixed (ACP, CLI, API, dashboard, deploy, security, CI) - 26 Documentation (RBAC, competitive, guides, README, ADR) - 2 Dependencies (dashboard deps, OTel) Requested by Scribe after review identified ~80+ missing entries. * docs(changelog): editorial follow-up — 36 remaining PRs from Scribe pass Adds entries Hermes missed for: --json-logs (#3519), CLI shortcuts (#3521), ag run timeout (#3518/#3498), auto MCP wiring (#3501), Windows workDir (#3502), cost tracking fixes (#3311), metering lifecycle (#3315), preflight auth (#3314), project-local config (#3313), /send non-blocking (#3437), ACP notifications wired (#3463), design tokens system-wide (#3456), auth persistence (#3386), protobufjs CVE (#3218), and 16 more. * docs(changelog): comprehensive 0.6.7 changelog — all 141 PRs, Boss's categories Complete rewrite of the 0.6.7 section: - 150 commits, 141 unique PRs — every single one listed - Organized by Boss's requested categories: Security (21), Features (19), Bug Fixes — ACP (14), Bug Fixes — CLI (13), Bug Fixes — API (12), Bug Fixes — Dashboard (14), Bug Fixes — Other (8), Documentation (42), Dependencies & Chore (6) - No summarization — each PR gets its own bullet - All PR references verified against git log Co-authored-by: Scribe <scribe@openclaw.ai> --------- Co-authored-by: Argus <argus@openclaw.ai> Co-authored-by: Hephaestus <hep@aegis.dev> Co-authored-by: Scribe <scribe@openclaw.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #3369
ag initnow persists the auth token to~/.aegis/auth-token(mode 0600) so users can easily retrieve it for scripting without scrolling terminal output.ag runresolveAuthToken()now checks~/.aegis/auth-tokenas a fallback after env vars.Changes
persistAuthTokenFile()— writes token to~/.aegis/auth-tokenwith 0600 permissions. Non-fatal on failure (token still in config.yaml).resolveAuthToken()now falls back to reading~/.aegis/auth-tokenfile.Verification
tsc --noEmit: ✅ Zero errorsnpm run build: ✅ Successnpm test: ✅ cli-init 13/13 passed (1 pre-existing flaky timeout on develop too)