feat: headless token-only invocation (no configured --project alias)

[padak]

Context

jasnost's local bridge is a long-running daemon that calls kbagent storage file-upload
(and would call kbagent stream detail) non-interactively. It currently requires a
pre-configured --project <alias> in the local ConfigStore, which is awkward for a
daemon / container / CI that just has a token in the environment.

Request

Support a fully headless invocation, e.g. one of:

• honor KBC_TOKEN + KBC_STORAGE_API_URL so storage/stream commands run without a
  configured --project alias; or
• add a --token / --storage-url passthrough to the storage/stream commands; or
• a non-interactive kbagent project add that seeds an alias from env in a single command.

Why

So an embedded daemon (jasnost bridge), a CI job, or a container can use kbagent with just a
token in the environment — no interactive profile setup required.

[padak]

Resolved by #363 — headless __env__ project

Implemented as option 1 from the request (honor KBC_TOKEN + KBC_STORAGE_API_URL), with an explicit opt-in so it never surprises a dev machine.

How it works

Set three env vars in the daemon / container / CI environment:

export KBAGENT_PROJECT_FROM_ENV=1
export KBC_TOKEN=<storage-api-token>
export KBC_STORAGE_API_URL=https://connection.<region>.keboola.com   # bare host / full project link also accepted

kbagent then synthesizes an in-memory project under the reserved alias __env__ — no kbagent project add, no config.json on disk. Use it as --project __env__:

kbagent --json storage file-upload --project __env__ --file screenshot.png

Because both the CLI and kbagent serve resolve projects through the same ConfigStore.load(), the same env setup also powers a headless serve (POST endpoints take project=__env__).

Properties

• Token never persisted. __env__ is marked ephemeral and stripped on any config.json write — the env token stays in memory only.
• Explicit opt-in. Only KBAGENT_PROJECT_FROM_ENV (truthy) triggers it; KBC_TOKEN alone stays a project add fallback. Avoids a phantom project on a dev box that exported KBC_TOKEN for an unrelated project add.
• Fail fast. Flag set but creds missing → exit 5 with a clear message.
• Forgiving URL. KBC_STORAGE_API_URL accepts a bare host, a trailing slash, or a full project deep-link (.../admin/projects/123/dashboard) and normalizes to https://<host>. Explicit http:///file:// still rejected.
• project list shows project_id (recovered offline from the token prefix) and a blank name; project status --project __env__ verifies against the API and shows the real name.

Ships in 0.50.0.

jasnost bridge follow-up (separate repo)

The bridge shells out to kbagent ... --project <alias> and currently requires a pre-configured alias. To go headless, no bridge code change is needed — only environment + config:

1. Set KBAGENT_PROJECT_FROM_ENV=1, KBC_TOKEN, KBC_STORAGE_API_URL in the daemon environment.
2. Set KBAGENT_PROJECT_ALIAS=__env__.

(Update bridge env.example / docs accordingly when 0.50.0 is released.)

The note about kbagent stream detail from the original request is unaffected: once such a command exists it resolves through the same chokepoint, so --project __env__ will work for it too without further changes.