feat(cli): non-interactive foundation + ssh-keys add

crates/basilica-cli/CHANGELOG.md

@@ -7,6 +7,24 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+- Non-interactive mode for agent and CI usage. Auto-detected when stdin
+  is not a TTY, or forced with `BASILICA_NON_INTERACTIVE=1`. In this
+  mode every interactive prompt surfaces a structured error instead of
+  blocking on stdin.
+  - Errors carry a `field` identifier and a `hint` naming the flag or
+    command to run. Rendered as single-line JSON on stderr when
+    `--json` is set, and as human-readable text otherwise.
+
+### Changed
+- OAuth auto-login is skipped in non-interactive mode: commands that
+  need authentication now exit with a `missing_prerequisite` error
+  pointing at `basilica login` (or `BASILICA_API_TOKEN`) instead of
+  starting a callback server that would block for 300s.
+- `basilica ssh-keys add` no longer silently generates a new key under
+  `~/.ssh` in non-interactive mode when no local public keys are
+  present; pass `--file <path>` to an existing public key instead.
+
 ## [0.29.0] - 2026-05-04
 
 ### Added

crates/basilica-cli/Cargo.toml

@@ -75,3 +75,5 @@ basilica-sdk = { path = "../basilica-sdk" }
 basilica-validator = { path = "../basilica-validator", features = ["client", "cli"] }
 
 [dev-dependencies]
+serial_test = "3"
+assert_cmd = "2"

crates/basilica-cli/src/cli/args.rs

@@ -101,6 +101,19 @@ impl Args {
             Err(err) => {
                 // Check if this is specifically a login_required error
                 if matches!(&err, CliError::Auth(_)) {
+                    // In non-interactive mode, never start an OAuth flow — the
+                    // callback server / device flow will block on user action
+                    // (300s timeout). Surface a structured error instead.
+                    if matches!(
+                        crate::interactive::gate::current(),
+                        crate::interactive::gate::Interactivity::NonInteractive
+                    ) {
+                        return Err(CliError::MissingPrerequisite {
+                            field: "authentication".into(),
+                            hint: "Not authenticated. Run `basilica login` (or `basilica login --device-code` on headless hosts), or set BASILICA_API_TOKEN.".into(),
+                        });
+                    }
+
                     // Inform user we need to authenticate
                     println!("You need to authenticate to continue.");
                     println!();