feat: add developer command to copy raw JWT to clipboard

New command `artemis.showJwtToken` ("Artemis: Show JWT Token
(Developer)") copies the currently active JWT to the clipboard for
curl/Postman-based server testing.

Scope:
- Hidden from the Command Palette unless `artemis.developerMode`
  is enabled (via `when: config.artemis.developerMode` clause).
- Additionally gated at runtime so direct invocation via
  `vscode.commands.executeCommand` also respects the setting.
- Works in both auth modes: Desktop (Cookie) and Theia (Bearer).
  The `jwt=` cookie prefix is stripped so the clipboard contains
  the raw JWT value, ready to paste into a `Cookie: jwt=<value>`
  or `Authorization: Bearer <value>` header.

Security:
- Full token is NEVER shown in the UI — only a masked preview
  (first 20 chars) appears in the warning notification.
- Full token is NEVER logged — only the masked preview lands
  in the Artemis Extension output channel.
- Notification wording explicitly warns "Do not share, do not
  commit".

Also adds a new public helper `AuthManager.getRawJwt()` that
extracts the raw JWT, intended for developer/debug surfaces only.

Author: Predixx

extension/package.json

@@ -82,12 +82,18 @@
       {
         "command": "artemis.clearTrustedDomains",
         "title": "Artemis: Clear Trusted Domains"
+      },
+      {
+        "command": "artemis.showJwtToken",
+        "title": "Artemis: Show JWT Token (Developer)",
+        "icon": "$(key)"
       }
     ],
     "menus": {
       "commandPalette": [
         { "command": "artemis.login", "when": "!iris:managedEnvironment" },
-        { "command": "artemis.logout", "when": "!iris:managedEnvironment" }
+        { "command": "artemis.logout", "when": "!iris:managedEnvironment" },
+        { "command": "artemis.showJwtToken", "when": "config.artemis.developerMode" }
       ]
     },
     "viewsContainers": {

extension/src/extension/activation/extensionCommands.ts

@@ -6,7 +6,7 @@ import type { IProviderRegistry } from '../services/ui';
 import type { TelemetryManager } from '../services/telemetry';
 import type { ArtemisWebviewProvider, ChatWebviewProvider } from '../provider';
 import { logger, LogCategory } from '../services/loggingService';
-import { processPlantUml, normalizeRelativePath, extractErrorMessage } from '../utils';
+import { processPlantUml, normalizeRelativePath, extractErrorMessage, VSCODE_CONFIG } from '../utils';
 import { executeReplayCommand } from '../services/telemetry/replay';
 
 // ── Individual command registrations ─────────────────────────────────
@@ -422,6 +422,50 @@ function registerReplaySessionCommand(globalStorageUri: vscode.Uri): vscode.Disp
     });
 }
 
+/**
+ * Developer-only command: copy the current raw JWT to the clipboard for use
+ * in curl/Postman based server testing. Gated on the `artemis.developerMode`
+ * setting both at the menu level (commandPalette `when` clause) and at runtime
+ * (defense-in-depth against direct invocation via `vscode.commands.executeCommand`).
+ *
+ * The full token is NEVER shown in the UI or written to logs — only a masked
+ * preview appears in the notification, and the full value lands in the clipboard.
+ */
+function registerShowJwtTokenCommand(authManager: AuthManager): vscode.Disposable {
+    return vscode.commands.registerCommand('artemis.showJwtToken', async () => {
+        const config = vscode.workspace.getConfiguration(VSCODE_CONFIG.ARTEMIS_SECTION);
+        const developerMode = config.get<boolean>(VSCODE_CONFIG.DEVELOPER_MODE_KEY, false);
+        if (!developerMode) {
+            vscode.window.showErrorMessage(
+                `Enable '${VSCODE_CONFIG.ARTEMIS_SECTION}.${VSCODE_CONFIG.DEVELOPER_MODE_KEY}' in settings to use this command.`
+            );
+            return;
+        }
+
+        const hasToken = await authManager.hasAuthToken();
+        if (!hasToken) {
+            vscode.window.showInformationMessage('Not logged in to Artemis — no JWT to show.');
+            return;
+        }
+
+        const rawJwt = await authManager.getRawJwt();
+        if (!rawJwt) {
+            vscode.window.showErrorMessage('Failed to retrieve JWT token from secret storage.');
+            logger.error('getRawJwt returned undefined despite hasAuthToken=true', LogCategory.AUTH);
+            return;
+        }
+
+        await vscode.env.clipboard.writeText(rawJwt);
+
+        const preview = `${rawJwt.substring(0, 20)}...`;
+        logger.info(`JWT copied to clipboard via developer command (preview: ${preview})`, LogCategory.AUTH);
+
+        vscode.window.showWarningMessage(
+            `JWT copied to clipboard (${preview}). Do not share, do not commit.`
+        );
+    });
+}
+
 // ── Aggregate registration ───────────────────────────────────────────
 
 export interface CommandDeps {
@@ -449,5 +493,6 @@ export function registerAllCommands(deps: CommandDeps): vscode.Disposable {
         registerClearTrustedDomainsCommand(deps.context),
         registerStruggleScoreCommand(deps.telemetryManager),
         registerReplaySessionCommand(deps.context.globalStorageUri),
+        registerShowJwtTokenCommand(deps.authManager),
     );
 }

extension/src/extension/services/auth/authManager.ts

@@ -57,6 +57,26 @@ export class AuthManager {
         return this.getStoredToken();
     }
 
+    /**
+     * Returns the raw JWT string (without any "jwt=" cookie prefix), suitable
+     * for use in a `Cookie: jwt=<value>` or `Authorization: Bearer <value>` header.
+     *
+     * Intended for developer/debug commands only — normal code paths should use
+     * `getAuthHeaders()` instead so auth-mode handling stays centralized.
+     *
+     * Returns `undefined` if not authenticated.
+     */
+    public async getRawJwt(): Promise<string | undefined> {
+        const stored = await this.getStoredToken();
+        if (!stored) {
+            return undefined;
+        }
+        // Desktop mode stores the token as "jwt=<value>" (cookie string).
+        // Theia mode stores the raw JWT directly. Strip the prefix if present.
+        const prefix = `${CONFIG.AUTH_COOKIE_NAME}=`;
+        return stored.startsWith(prefix) ? stored.substring(prefix.length) : stored;
+    }
+
     /**
      * Returns the stored token string.
      * In Desktop mode this is a cookie string ("jwt=<token>"),