@girardmedia/bootspring 2.1.2 → 2.2.0

package/cli/auth.js

@@ -1,896 +0,0 @@
-/**
- * Bootspring Auth CLI Command
- *
- * Handles login, logout, and authentication status.
- */
-
-const readline = require('readline');
-const { exec } = require('child_process');
-const os = require('os');
-const https = require('https');
-const http = require('http');
-const auth = require('../core/auth');
-const api = require('../core/api-client');
-const session = require('../core/session');
-const { redactErrorMessage, redactSensitiveString } = require('../core/redaction');
-
-const API_BASE = process.env.BOOTSPRING_API_URL || api.API_BASE || 'https://api.bootspring.com';
-
-/**
- * Make a direct API request (without v1 prefix)
- */
-async function directRequest(method, path, options = {}) {
-  const apiKey = options.apiKey || auth.getApiKey();
-  const token = apiKey ? null : (options.token || auth.getToken());
-  const deviceId = auth.getDeviceId();
-  const url = new URL(`/api${path}`, API_BASE);
-  const isHttps = url.protocol === 'https:';
-  const httpModule = isHttps ? https : http;
-
-  const headers = {
-    'Content-Type': 'application/json',
-    'User-Agent': `bootspring-cli/${require('../package.json').version}`,
-    'X-Device-Id': deviceId
-  };
-
-  if (apiKey) {
-    headers['X-API-Key'] = apiKey;
-  } else if (token) {
-    headers['Authorization'] = `Bearer ${token}`;
-  }
-
-  return new Promise((resolve, reject) => {
-    const req = httpModule.request(url, {
-      method,
-      headers,
-      timeout: 30000
-    }, (res) => {
-      let body = '';
-      res.on('data', chunk => body += chunk);
-      res.on('end', () => {
-        try {
-          const json = JSON.parse(body);
-          if (res.statusCode >= 400) {
-            const error = new Error(
-              redactSensitiveString(String(json.error || json.message || 'API Error'))
-            );
-            error.status = res.statusCode;
-            reject(error);
-          } else {
-            resolve(json);
-          }
-        } catch {
-          if (res.statusCode >= 400) {
-            reject(new Error(`API Error: ${res.statusCode}`));
-          } else {
-            resolve(body);
-          }
-        }
-      });
-    });
-
-    req.on('error', (error) => reject(new Error(redactSensitiveString(error.message || String(error)))));
-    req.on('timeout', () => {
-      req.destroy();
-      reject(new Error('Request timeout'));
-    });
-    req.end();
-  });
-}
-
-// ANSI colors
-const colors = {
-  reset: '\x1b[0m',
-  bold: '\x1b[1m',
-  dim: '\x1b[2m',
-  green: '\x1b[32m',
-  yellow: '\x1b[33m',
-  red: '\x1b[31m',
-  cyan: '\x1b[36m',
-  magenta: '\x1b[35m'
-};
-
-function getAuthIdentity() {
-  const user = auth.getUser();
-  const fallbackTier = typeof auth.getTier === 'function' ? String(auth.getTier() || 'free') : 'free';
-
-  return {
-    email: user?.email || (auth.isApiKeyAuth() ? '(api-key auth)' : '(unknown user)'),
-    name: user?.name || '(not set)',
-    tier: String(user?.tier || fallbackTier || 'free')
-  };
-}
-
-/**
- * Prompt for input
- */
-function prompt(question, hidden = false) {
-  return new Promise((resolve) => {
-    const rl = readline.createInterface({
-      input: process.stdin,
-      output: process.stdout
-    });
-
-    if (hidden) {
-      // Hide password input
-      process.stdout.write(question);
-      const stdin = process.stdin;
-      stdin.setRawMode(true);
-      stdin.resume();
-      stdin.setEncoding('utf8');
-
-      let password = '';
-      const onData = (char) => {
-        if (char === '\n' || char === '\r' || char === '\u0004') {
-          stdin.setRawMode(false);
-          stdin.removeListener('data', onData);
-          console.log();
-          rl.close();
-          resolve(password);
-        } else if (char === '\u0003') {
-          process.exit();
-        } else if (char === '\u007F' || char === '\b') {
-          password = password.slice(0, -1);
-          process.stdout.clearLine(0);
-          process.stdout.cursorTo(0);
-          process.stdout.write(question + '*'.repeat(password.length));
-        } else {
-          password += char;
-          process.stdout.write('*');
-        }
-      };
-
-      stdin.on('data', onData);
-    } else {
-      rl.question(question, (answer) => {
-        rl.close();
-        resolve(answer.trim());
-      });
-    }
-  });
-}
-
-/**
- * Open URL in default browser
- */
-function openBrowser(url) {
-  const platform = os.platform();
-  let cmd;
-
-  switch (platform) {
-    case 'darwin':
-      cmd = `open "${url}"`;
-      break;
-    case 'win32':
-      cmd = `start "" "${url}"`;
-      break;
-    default:
-      cmd = `xdg-open "${url}"`;
-  }
-
-  return new Promise((resolve) => {
-    exec(cmd, (error) => {
-      resolve(!error);
-    });
-  });
-}
-
-async function activateLinkedProjectSession(apiKey, projectId) {
-  if (!apiKey) {
-    return null;
-  }
-
-  return api.loginWithApiKey(apiKey, projectId ? { projectId } : {});
-}
-
-function getRetryAfterMs(error, fallbackMs) {
-  const retryAfterSeconds = Number.parseInt(String(error?.details?.retryAfter || ''), 10);
-  if (Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0) {
-    return retryAfterSeconds * 1000;
-  }
-
-  return fallbackMs;
-}
-
-async function fetchProjects(authApiKey = null) {
-  if (authApiKey) {
-    const response = await directRequest('GET', '/projects', { apiKey: authApiKey });
-    return response.projects || [];
-  }
-
-  const response = await api.listProjects();
-  return response.projects || [];
-}
-
-/**
- * Device authorization flow - browser-based login
- */
-async function loginWithBrowser(noBrowser = false) {
-  console.log(`${colors.dim}Requesting device code...${colors.reset}`);
-
-  let deviceResponse;
-  try {
-    deviceResponse = await api.requestDeviceCode();
-  } catch (error) {
-    console.log(`\n${colors.red}✗ Failed to start device flow: ${redactErrorMessage(error)}${colors.reset}`);
-    console.log(`\n${colors.dim}Try: bootspring auth login --password${colors.reset}`);
-    return;
-  }
-
-  const { device_code, user_code, verification_uri_complete, expires_in, interval } = deviceResponse;
-
-  // Show the URL
-  console.log(`\n${colors.bold}Opening browser to complete authentication...${colors.reset}`);
-  console.log(`${colors.cyan}${verification_uri_complete}${colors.reset}\n`);
-
-  // Open browser (unless --no-browser)
-  if (!noBrowser) {
-    const opened = await openBrowser(verification_uri_complete);
-    if (!opened) {
-      console.log(`${colors.yellow}Could not open browser. Please visit the URL above manually.${colors.reset}\n`);
-    }
-  } else {
-    console.log(`${colors.dim}Open the URL above in your browser to continue.${colors.reset}\n`);
-  }
-
-  console.log(`${colors.dim}Your code: ${colors.reset}${colors.bold}${user_code}${colors.reset}`);
-  console.log(`\n${colors.dim}Waiting for authorization... (press Ctrl+C to cancel)${colors.reset}`);
-
-  // Start polling
-  const pollInterval = (interval || 5) * 1000; // Convert to ms
-  const timeout = (expires_in || 900) * 1000; // Convert to ms
-  const startTime = Date.now();
-
-  // Spinner animation
-  const spinnerFrames = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
-  let spinnerIndex = 0;
-  let pollBackoffNotified = false;
-
-  const pollForToken = () => {
-    return new Promise((resolve, reject) => {
-      const poll = async () => {
-        // Check timeout
-        if (Date.now() - startTime > timeout) {
-          reject(new Error('Authorization timed out. Please try again.'));
-          return;
-        }
-
-        // Update spinner
-        process.stdout.write(`\r${colors.cyan}${spinnerFrames[spinnerIndex]}${colors.reset} Waiting for browser authorization...`);
-        spinnerIndex = (spinnerIndex + 1) % spinnerFrames.length;
-
-        try {
-          const response = await api.pollDeviceToken(device_code);
-
-          // Success!
-          process.stdout.write('\r' + ' '.repeat(50) + '\r'); // Clear line
-          if (response.api_key) {
-            resolve(response);
-          } else {
-            auth.login(response);
-            resolve(response);
-          }
-        } catch (error) {
-          if (error.message?.includes('authorization_pending') ||
-              error.code === 'authorization_pending' ||
-              error.status === 400 && error.details?.error === 'authorization_pending') {
-            // Still waiting, continue polling
-            setTimeout(poll, pollInterval);
-          } else if (error.status === 429 || error.code === 'too_many_attempts') {
-            const backoffMs = getRetryAfterMs(error, pollInterval * 4);
-            if (!pollBackoffNotified) {
-              process.stdout.write('\r' + ' '.repeat(80) + '\r');
-              console.log(`${colors.yellow}Rate limited while waiting for browser authorization. Keeping this session alive and retrying automatically...${colors.reset}`);
-              pollBackoffNotified = true;
-            }
-            setTimeout(poll, backoffMs);
-          } else if (error.message?.includes('access_denied') || error.code === 'access_denied') {
-            process.stdout.write('\r' + ' '.repeat(50) + '\r');
-            reject(new Error('Authorization was denied'));
-          } else if (error.message?.includes('expired') || error.code === 'expired_token') {
-            process.stdout.write('\r' + ' '.repeat(50) + '\r');
-            reject(new Error('Device code expired. Please try again.'));
-          } else {
-            // Continue polling for other errors (network issues, etc)
-            setTimeout(poll, pollInterval);
-          }
-        }
-      };
-
-      // Handle Ctrl+C
-      const cleanup = () => {
-        process.stdout.write('\r' + ' '.repeat(50) + '\r');
-        reject(new Error('Cancelled'));
-      };
-      process.once('SIGINT', cleanup);
-
-      // Start polling after initial delay
-      setTimeout(poll, pollInterval);
-    });
-  };
-
-  try {
-    const response = await pollForToken();
-
-    console.log(`${colors.green}✓ Login successful!${colors.reset}`);
-    console.log(`\n  ${colors.bold}Welcome, ${response.user.name || response.user.email}!${colors.reset}`);
-    console.log(`  ${colors.dim}Tier: ${colors.reset}${colors.cyan}${response.user.tier}${colors.reset}`);
-
-    console.log(`\n  ${colors.dim}Credentials stored in: ${auth.getCredentialsPath()}${colors.reset}`);
-
-    const existingConfig = session.findLocalConfig();
-    const hasLocalProjectLink = existingConfig && existingConfig._dir === process.cwd();
-
-    if (response.api_key && hasLocalProjectLink) {
-      await activateLinkedProjectSession(response.api_key, existingConfig.projectId || response.project?.id);
-    }
-
-    // Check if this directory already has a local config (already locked to a project)
-    if (hasLocalProjectLink) {
-      console.log(`\n  ${colors.dim}Project: ${colors.reset}${colors.green}${existingConfig.projectName}${colors.reset} ${colors.dim}(from local config)${colors.reset}`);
-    } else if (response.project) {
-      // Project was selected on web during device flow - use it automatically
-      console.log(`\n  ${colors.dim}Project: ${colors.reset}${colors.green}${response.project.name}${colors.reset} ${colors.dim}(selected on web)${colors.reset}`);
-
-      // Save to session
-      session.setCurrentProject(response.project);
-      session.addRecentProject(response.project);
-
-      // Create local config to lock directory
-      try {
-        const configPath = session.createLocalConfig(process.cwd(), response.project);
-        if (response.api_key) {
-          await activateLinkedProjectSession(response.api_key, response.project.id);
-        }
-        console.log(`  ${colors.dim}Locked directory to "${response.project.name}"${colors.reset}`);
-        console.log(`  ${colors.dim}Config: ${configPath}${colors.reset}`);
-      } catch (error) {
-        console.log(`  ${colors.yellow}Warning: Could not create local config: ${redactErrorMessage(error)}${colors.reset}`);
-      }
-    } else {
-      // No project selected on web - prompt for selection
-      await requireProjectSelection({ force: true, lockToDirectory: true, authApiKey: response.api_key });
-    }
-  } catch (error) {
-    console.log(`\n${colors.red}✗ ${redactErrorMessage(error)}${colors.reset}`);
-  }
-}
-
-/**
- * Email/password login (legacy)
- */
-async function loginWithPassword() {
-  const email = await prompt(`${colors.cyan}Email:${colors.reset} `);
-  if (!email) {
-    console.log(`${colors.red}Email is required${colors.reset}`);
-    return;
-  }
-
-  const password = await prompt(`${colors.cyan}Password:${colors.reset} `, true);
-  if (!password) {
-    console.log(`${colors.red}Password is required${colors.reset}`);
-    return;
-  }
-
-  console.log(`\n${colors.dim}Logging in...${colors.reset}`);
-
-  try {
-    const response = await api.login(email, password);
-
-    console.log(`\n${colors.green}✓ Login successful!${colors.reset}`);
-    console.log(`\n  ${colors.bold}Welcome, ${response.user.name || response.user.email}!${colors.reset}`);
-    console.log(`  ${colors.dim}Tier: ${colors.reset}${colors.cyan}${response.user.tier}${colors.reset}`);
-    console.log(`\n  ${colors.dim}Credentials stored in: ${auth.getCredentialsPath()}${colors.reset}`);
-
-    // Check if this directory already has a local config
-    const existingConfig = session.findLocalConfig();
-    if (existingConfig && existingConfig._dir === process.cwd()) {
-      console.log(`\n  ${colors.dim}Project: ${colors.reset}${colors.green}${existingConfig.projectName}${colors.reset} ${colors.dim}(from local config)${colors.reset}`);
-    } else {
-      // Force project selection for new directories
-      await requireProjectSelection({ force: true, lockToDirectory: true });
-    }
-  } catch (error) {
-    console.log(`\n${colors.red}✗ Login failed: ${redactErrorMessage(error)}${colors.reset}`);
-
-    if (error.code === 'unauthorized') {
-      console.log(`\n${colors.dim}Forgot your password? Visit https://bootspring.com/forgot-password${colors.reset}`);
-    }
-  }
-}
-
-/**
- * Login with API key
- */
-async function loginWithApiKey(apiKey) {
-  // Validate API key format
-  if (!apiKey.match(/^(bs|sk)_(live|test)_[A-Za-z0-9_-]{16,}$/)) {
-    console.log(`${colors.red}Invalid API key format${colors.reset}`);
-    console.log(`${colors.dim}API keys should start with bs_live_ or bs_test_${colors.reset}`);
-    return;
-  }
-
-  console.log(`${colors.dim}Validating API key...${colors.reset}`);
-
-  try {
-    const response = await api.validateApiKey(apiKey);
-
-    console.log(`\n${colors.green}✓ API key validated!${colors.reset}`);
-    console.log(`\n  ${colors.dim}Tier: ${colors.reset}${colors.cyan}${response.tier}${colors.reset}`);
-    console.log(`  ${colors.dim}Auth: ${colors.reset}${colors.magenta}API Key${colors.reset}`);
-
-    // Show project info if key is project-scoped
-    if (response.project) {
-      console.log(`  ${colors.dim}Project: ${colors.reset}${colors.green}${response.project.name}${colors.reset} ${colors.dim}(auto-set from key)${colors.reset}`);
-    }
-
-    console.log(`\n  ${colors.dim}Credentials stored in: ${auth.getCredentialsPath()}${colors.reset}`);
-
-    // Always prompt for project selection in new directories
-    // API key scope determines permissions, but user chooses which project to link
-    const existingConfig = session.findLocalConfig();
-    if (existingConfig && existingConfig._dir === process.cwd()) {
-      await activateLinkedProjectSession(apiKey, existingConfig.projectId || response.project?.id);
-      console.log(`\n  ${colors.dim}Project: ${colors.reset}${colors.green}${existingConfig.projectName}${colors.reset} ${colors.dim}(from local config)${colors.reset}`);
-    } else {
-      await requireProjectSelection({ force: true, lockToDirectory: true, authApiKey: apiKey });
-    }
-  } catch (error) {
-    console.log(`\n${colors.red}✗ API key validation failed: ${redactErrorMessage(error)}${colors.reset}`);
-    console.log(`\n${colors.dim}Generate API keys at: https://bootspring.com/dashboard/keys${colors.reset}`);
-  }
-}
-
-/**
- * Login command
- */
-async function login(args = []) {
-  console.log(`\n${colors.bold}Bootspring Login${colors.reset}\n`);
-
-  // Parse flags
-  const hasApiKey = args.includes('--api-key') || args.includes('-k');
-  const hasPassword = args.includes('--password') || args.includes('-p');
-  const noBrowser = args.includes('--no-browser');
-
-  // Get API key value if provided
-  const apiKeyIndex = args.findIndex(a => a === '--api-key' || a === '-k');
-  const apiKey = apiKeyIndex !== -1 ? args[apiKeyIndex + 1] : null;
-
-  // Check if already logged in
-  if (auth.isAuthenticated()) {
-    const identity = getAuthIdentity();
-
-    // Check if this directory already has a local config
-    const existingConfig = session.findLocalConfig();
-    if (existingConfig && existingConfig._dir === process.cwd()) {
-      // Directory already linked to a project
-      console.log(`${colors.green}Already authenticated as ${identity.email}${colors.reset}`);
-      console.log(`${colors.dim}Project: ${colors.reset}${colors.green}${existingConfig.projectName}${colors.reset} ${colors.dim}(from .bootspring.json)${colors.reset}`);
-      console.log(`\n${colors.dim}To switch projects, run: bootspring switch <project>${colors.reset}`);
-      console.log(`${colors.dim}To use a different account, run: bootspring auth logout${colors.reset}`);
-      return;
-    }
-
-    // Directory not linked - link locally first to avoid unnecessary reauthentication.
-    console.log(`${colors.green}Authenticated as ${identity.email}${colors.reset}`);
-    console.log(`${colors.dim}This directory is not linked to a project yet.${colors.reset}\n`);
-    console.log(`${colors.dim}Fetching your available projects so this folder can be linked without a new browser login...${colors.reset}\n`);
-
-    const linked = await requireProjectSelection({
-      force: true,
-      lockToDirectory: true,
-      authApiKey: auth.isApiKeyAuth() ? auth.getApiKey() : null
-    });
-
-    if (!linked) {
-      console.log(`\n${colors.dim}Falling back to browser project selection...${colors.reset}\n`);
-      await loginWithBrowser(noBrowser);
-    }
-    return;
-  }
-
-  // Route to appropriate login method
-  if (hasApiKey && apiKey) {
-    await loginWithApiKey(apiKey);
-  } else if (hasPassword) {
-    await loginWithPassword();
-  } else {
-    // Default: browser-based device flow
-    await loginWithBrowser(noBrowser);
-  }
-}
-
-/**
- * Register command
- */
-async function register() {
-  console.log(`\n${colors.bold}Create Bootspring Account${colors.reset}\n`);
-
-  // Check if already logged in
-  if (auth.isAuthenticated()) {
-    const identity = getAuthIdentity();
-    console.log(`${colors.yellow}You are already logged in as ${identity.email}${colors.reset}`);
-    console.log('Run \'bootspring auth logout\' first to create a new account.');
-    return;
-  }
-
-  // Get registration info
-  const name = await prompt(`${colors.cyan}Name (optional):${colors.reset} `);
-
-  const email = await prompt(`${colors.cyan}Email:${colors.reset} `);
-  if (!email) {
-    console.log(`${colors.red}Email is required${colors.reset}`);
-    return;
-  }
-
-  const password = await prompt(`${colors.cyan}Password:${colors.reset} `, true);
-  if (!password) {
-    console.log(`${colors.red}Password is required${colors.reset}`);
-    return;
-  }
-
-  if (password.length < 8) {
-    console.log(`${colors.red}Password must be at least 8 characters${colors.reset}`);
-    return;
-  }
-
-  const confirmPassword = await prompt(`${colors.cyan}Confirm Password:${colors.reset} `, true);
-  if (password !== confirmPassword) {
-    console.log(`${colors.red}Passwords do not match${colors.reset}`);
-    return;
-  }
-
-  console.log(`\n${colors.dim}Creating account...${colors.reset}`);
-
-  try {
-    const response = await api.register(email, password, name || null);
-
-    console.log(`\n${colors.green}✓ Account created successfully!${colors.reset}`);
-    console.log(`\n  ${colors.bold}Welcome to Bootspring, ${response.user.name || response.user.email}!${colors.reset}`);
-    console.log(`  ${colors.dim}Your tier: ${colors.reset}${colors.cyan}free${colors.reset}`);
-    console.log(`\n  ${colors.dim}Upgrade to Pro for unlimited access: https://bootspring.com/pricing${colors.reset}`);
-  } catch (error) {
-    console.log(`\n${colors.red}✗ Registration failed: ${redactErrorMessage(error)}${colors.reset}`);
-  }
-}
-
-/**
- * Logout command
- */
-async function logoutCmd() {
-  if (!auth.isAuthenticated()) {
-    console.log(`${colors.yellow}You are not logged in${colors.reset}`);
-    return;
-  }
-
-  const user = auth.getUser() || {};
-  console.log(`${colors.dim}Logging out ${user.email || '(unknown user)'}...${colors.reset}`);
-
-  let remoteLogoutSucceeded = false;
-  try {
-    await api.logout();
-    remoteLogoutSucceeded = true;
-  } catch {
-    // Best-effort remote logout
-  }
-
-  auth.logout();
-  if (session.clearSession) {
-    session.clearSession();
-  }
-
-  console.log(
-    remoteLogoutSucceeded
-      ? `${colors.green}✓ Logged out successfully${colors.reset}`
-      : `${colors.green}✓ Logged out locally${colors.reset}`
-  );
-}
-
-/**
- * Whoami command - show current user
- */
-async function whoami() {
-  if (!auth.isAuthenticated()) {
-    console.log(`${colors.yellow}Not logged in${colors.reset}`);
-    console.log(`${colors.dim}Run 'bootspring auth login' to authenticate${colors.reset}`);
-    return;
-  }
-
-  const identity = getAuthIdentity();
-  const isApiKey = auth.isApiKeyAuth();
-  console.log(`\n${colors.bold}Current User${colors.reset}\n`);
-  console.log(`  ${colors.cyan}Email:${colors.reset}  ${identity.email}`);
-  console.log(`  ${colors.cyan}Name:${colors.reset}   ${identity.name}`);
-  console.log(`  ${colors.cyan}Tier:${colors.reset}   ${identity.tier}`);
-  console.log(`  ${colors.cyan}Auth:${colors.reset}   ${isApiKey ? colors.magenta + 'API Key' : colors.green + 'Session'}${colors.reset}`);
-
-  // Try to get fresh data from API
-  try {
-    const response = await api.me();
-    console.log(`\n${colors.bold}Usage This Month${colors.reset}\n`);
-    console.log(`  ${colors.cyan}API Calls:${colors.reset}      ${response.usage?.apiCalls || 0}`);
-    console.log(`  ${colors.cyan}Agents Used:${colors.reset}    ${response.usage?.agentsInvoked || 0}`);
-    console.log(`  ${colors.cyan}Skills Accessed:${colors.reset} ${response.usage?.skillsAccessed || 0}`);
-
-    if (response.subscription) {
-      console.log(`\n${colors.bold}Subscription${colors.reset}\n`);
-      console.log(`  ${colors.cyan}Status:${colors.reset}  ${response.subscription.status}`);
-      console.log(`  ${colors.cyan}Renews:${colors.reset}  ${new Date(response.subscription.currentPeriodEnd).toLocaleDateString()}`);
-    }
-  } catch (error) {
-    if (error.code === 'token_expired') {
-      console.log(`\n${colors.yellow}Session expired. Please login again.${colors.reset}`);
-    }
-  }
-}
-
-/**
- * Status command - check API connectivity
- */
-async function status() {
-  console.log(`\n${colors.bold}Bootspring Status${colors.reset}\n`);
-
-  // Check authentication
-  const isAuth = auth.isAuthenticated();
-  const isApiKey = auth.isApiKeyAuth();
-  console.log(`  ${colors.cyan}Authenticated:${colors.reset} ${isAuth ? colors.green + 'Yes' : colors.yellow + 'No'}${colors.reset}`);
-
-  let keyProject = null;
-
-  if (isAuth) {
-    const identity = getAuthIdentity();
-    console.log(`  ${colors.cyan}User:${colors.reset}          ${identity.email || identity.tier}`);
-    console.log(`  ${colors.cyan}Tier:${colors.reset}          ${identity.tier}`);
-    console.log(`  ${colors.cyan}Auth Method:${colors.reset}   ${isApiKey ? colors.magenta + 'API Key' : colors.green + 'Session'}${colors.reset}`);
-
-    // If using API key, validate it and get the associated project
-    if (isApiKey) {
-      try {
-        const apiKey = auth.getApiKey();
-        const validation = await api.validateApiKey(apiKey);
-        if (validation && validation.project) {
-          keyProject = validation.project;
-        }
-      } catch {
-        // Ignore validation errors in status
-      }
-    }
-  }
-
-  // Check project context
-  const sessionState = session.getSessionState();
-  const currentProject = sessionState.project;
-
-  // Sync project from API key if there's a mismatch or no local project
-  if (keyProject && (!currentProject || currentProject.id !== keyProject.id)) {
-    session.setCurrentProject(keyProject);
-    session.addRecentProject(keyProject);
-    console.log(`\n${colors.bold}Project Context${colors.reset} ${colors.dim}(synced from API key)${colors.reset}`);
-    console.log(`  ${colors.cyan}Project:${colors.reset}       ${keyProject.name}`);
-    if (keyProject.slug) {
-      console.log(`  ${colors.cyan}Slug:${colors.reset}          ${keyProject.slug}`);
-    }
-    console.log(`  ${colors.cyan}Source:${colors.reset}        ${colors.dim}api-key${colors.reset}`);
-  } else if (currentProject) {
-    console.log(`\n${colors.bold}Project Context${colors.reset}`);
-    const isSessionOnlyContext = sessionState.source === 'session' && !sessionState.hasLocalConfig;
-    const projectLabel = isSessionOnlyContext ? 'Last Session Project:' : 'Project:';
-    console.log(`  ${colors.cyan}${projectLabel}${colors.reset} ${currentProject.name}`);
-    if (currentProject.slug) {
-      console.log(`  ${colors.cyan}Slug:${colors.reset}          ${currentProject.slug}`);
-    }
-    const sourceLabel = isSessionOnlyContext
-      ? 'last session (directory not linked)'
-      : sessionState.source === 'local'
-        ? 'local config'
-        : 'session';
-    console.log(`  ${colors.cyan}Source:${colors.reset}        ${colors.dim}${sourceLabel}${colors.reset}`);
-    if (sessionState.hasLocalConfig) {
-      console.log(`  ${colors.cyan}Config:${colors.reset}        ${colors.dim}${sessionState.localConfigPath}${colors.reset}`);
-    } else if (isSessionOnlyContext) {
-      console.log(`  ${colors.dim}               Run 'bootspring auth login' or 'bootspring switch --init' to link this directory.${colors.reset}`);
-    }
-  } else {
-    console.log(`\n  ${colors.yellow}No project context${colors.reset}`);
-    console.log(`  ${colors.dim}Run 'bootspring switch <project>' to set a project${colors.reset}`);
-  }
-
-  // Check API connectivity
-  console.log(`\n  ${colors.dim}Checking API connection...${colors.reset}`);
-
-  try {
-    const health = await api.healthCheck();
-    if (health.connected) {
-      console.log(`  ${colors.cyan}API Status:${colors.reset}    ${colors.green}Connected${colors.reset}`);
-    } else {
-      console.log(`  ${colors.cyan}API Status:${colors.reset}    ${colors.red}Disconnected${colors.reset}`);
-      console.log(`  ${colors.dim}Error: ${redactSensitiveString(String(health.error || 'Unknown error'))}${colors.reset}`);
-    }
-  } catch (error) {
-    console.log(`  ${colors.cyan}API Status:${colors.reset}    ${colors.red}Error${colors.reset}`);
-    console.log(`  ${colors.dim}${redactErrorMessage(error)}${colors.reset}`);
-  }
-
-  console.log(`\n  ${colors.cyan}API URL:${colors.reset}       ${api.API_BASE}`);
-}
-
-/**
- * Switch project command - delegates to switch module
- */
-async function switchProject(args) {
-  const switchModule = require('./switch');
-  await switchModule.run(args);
-}
-
-/**
- * Require user to select a project interactively
- * Project context is required for all Bootspring commands
- * @param {object} options - Options
- * @param {boolean} options.force - Force project selection even if session has a project
- * @param {boolean} options.lockToDirectory - Create .bootspring.json after selection
- */
-async function requireProjectSelection(options = {}) {
-  const { force = false, lockToDirectory = false, authApiKey = null } = options;
-
-  // If not forcing, check if project context already exists
-  if (!force) {
-    // Check if project context already exists
-    if (session.getEffectiveProject && session.getEffectiveProject()) {
-      return true;
-    }
-
-    // Check legacy hasProjectContext
-    if (session.hasProjectContext && session.hasProjectContext()) {
-      return true;
-    }
-
-    // Check local .bootspring.json
-    const localConfig = session.findLocalConfig && session.findLocalConfig();
-    if (localConfig?.projectId) {
-      return true;
-    }
-  }
-
-  console.log(`\n${colors.yellow}Select a project for this directory${colors.reset}`);
-  console.log(`${colors.dim}This directory will be locked to the selected project.${colors.reset}\n`);
-
-  // Fetch projects
-  console.log(`${colors.dim}Fetching projects...${colors.reset}`);
-
-  let projects = [];
-  try {
-    projects = await fetchProjects(authApiKey);
-  } catch (error) {
-    console.log(`${colors.red}Failed to fetch projects: ${redactErrorMessage(error)}${colors.reset}`);
-    console.log(`${colors.dim}Run 'bootspring switch <project>' manually to set project${colors.reset}`);
-    return false;
-  }
-
-  if (projects.length === 0) {
-    console.log(`${colors.yellow}No projects found${colors.reset}`);
-    console.log(`${colors.dim}Create a project at https://bootspring.com/dashboard/projects${colors.reset}`);
-    return false;
-  }
-  let selectedProject = null;
-
-  if (projects.length === 1) {
-    selectedProject = projects[0];
-    console.log(`\n${colors.dim}Only one project is available. Linking automatically...${colors.reset}`);
-  } else {
-    console.log(`\n${colors.bold}Your Projects${colors.reset}\n`);
-    for (let i = 0; i < projects.length; i++) {
-      const project = projects[i];
-      console.log(`  ${colors.cyan}[${i + 1}]${colors.reset} ${colors.bold}${project.name}${colors.reset} ${colors.dim}(${project.slug})${colors.reset}`);
-    }
-
-    const selection = await prompt(`\n${colors.cyan}Enter number or name:${colors.reset} `);
-
-    if (!selection) {
-      console.log(`${colors.yellow}No project selected${colors.reset}`);
-      console.log(`${colors.dim}Run 'bootspring switch <project>' to set project later${colors.reset}`);
-      return false;
-    }
-
-    const num = parseInt(selection, 10);
-
-    if (!isNaN(num) && num >= 1 && num <= projects.length) {
-      selectedProject = projects[num - 1];
-    } else {
-      selectedProject = projects.find(
-        p => p.name.toLowerCase() === selection.toLowerCase() ||
-             p.slug === selection.toLowerCase()
-      );
-    }
-  }
-
-  if (!selectedProject) {
-    console.log(`${colors.red}Project not found${colors.reset}`);
-    console.log(`${colors.dim}Run 'bootspring switch <project>' to try again${colors.reset}`);
-    return false;
-  }
-
-  // Set project in session
-  session.setCurrentProject(selectedProject);
-  session.addRecentProject(selectedProject);
-
-  console.log(`\n${colors.green}Selected: ${selectedProject.name}${colors.reset}`);
-
-  // Create local config to lock directory
-  if (lockToDirectory) {
-    try {
-      const configPath = session.createLocalConfig(process.cwd(), selectedProject);
-      if (authApiKey) {
-        await activateLinkedProjectSession(authApiKey, selectedProject.id);
-      }
-      console.log(`${colors.dim}Locked directory to "${selectedProject.name}"${colors.reset}`);
-      console.log(`${colors.dim}Config: ${configPath}${colors.reset}`);
-    } catch (error) {
-      console.log(`${colors.yellow}Warning: Could not create local config: ${redactErrorMessage(error)}${colors.reset}`);
-    }
-  }
-
-  return true;
-}
-
-// Alias for backwards compatibility (exported for potential external use)
-const _promptForProjectIfNeeded = requireProjectSelection;
-
-/**
- * Main command handler
- */
-async function run(args) {
-  const subcommand = args[0] || 'status';
-
-  switch (subcommand) {
-    case 'login':
-      await login(args.slice(1));
-      break;
-
-    case 'register':
-    case 'signup':
-      await register();
-      break;
-
-    case 'logout':
-      await logoutCmd();
-      break;
-
-    case 'whoami':
-    case 'me':
-      await whoami();
-      break;
-
-    case 'status':
-      await status();
-      break;
-
-    case 'switch':
-    case 'project':
-      await switchProject(args.slice(1));
-      break;
-
-    default:
-      console.log(`\n${colors.bold}Bootspring Authentication${colors.reset}\n`);
-      console.log(`${colors.cyan}Usage:${colors.reset} bootspring auth <command>\n`);
-      console.log(`${colors.bold}Commands:${colors.reset}`);
-      console.log(`  ${colors.green}login${colors.reset}     Login to your Bootspring account`);
-      console.log(`  ${colors.green}register${colors.reset}  Create a new account`);
-      console.log(`  ${colors.green}logout${colors.reset}    Log out and clear credentials`);
-      console.log(`  ${colors.green}whoami${colors.reset}    Show current user and usage`);
-      console.log(`  ${colors.green}status${colors.reset}    Check authentication and API status`);
-      console.log(`  ${colors.green}switch${colors.reset}    Switch current project context`);
-      console.log(`\n${colors.bold}Login Options:${colors.reset}`);
-      console.log(`  ${colors.dim}(default)${colors.reset}      Browser-based login (opens browser)`);
-      console.log(`  ${colors.green}--password, -p${colors.reset} Use email/password login`);
-      console.log(`  ${colors.green}--api-key, -k${colors.reset}  Login with an API key`);
-      console.log(`  ${colors.green}--no-browser${colors.reset}   Show URL without opening browser`);
-      console.log(`\n${colors.dim}Examples:${colors.reset}`);
-      console.log('  bootspring auth login              # Opens browser for SSO');
-      console.log('  bootspring auth login --password   # Email/password prompt');
-      console.log('  bootspring auth login --api-key bs_live_xxxxx');
-      console.log('  bootspring auth whoami');
-      console.log('  bootspring switch my-project       # Switch project context');
-  }
-}
-
-module.exports = { run, requireProjectSelection };