@gopherhole/cli 0.1.20 → 0.1.22

package/dist/index.js

@@ -60,7 +60,7 @@ program
 
 ${chalk_1.default.bold('Quick Start:')}
   $ gopherhole quickstart        # Interactive setup wizard
-  $ gopherhole signup            # Create an account
+  $ gopherhole login             # Log in or create account
   $ gopherhole agents create     # Create your first agent
 
 ${chalk_1.default.bold('Examples:')}
@@ -106,80 +106,55 @@ ${chalk_1.default.bold('Example:')}
         console.log(brand.green(`✓ Already logged in as ${user?.email}\n`));
     }
     else {
-        console.log(chalk_1.default.bold('Step 1: Create an account\n'));
-        const { action } = await inquirer_1.default.prompt([
-            {
-                type: 'list',
-                name: 'action',
-                message: 'Do you have a GopherHole account?',
-                choices: [
-                    { name: 'No, create one for me', value: 'signup' },
-                    { name: 'Yes, log me in', value: 'login' },
-                ],
-            },
+        console.log(chalk_1.default.bold('Step 1: Sign in\n'));
+        // OTP-based auth flow
+        const { email } = await inquirer_1.default.prompt([
+            { type: 'input', name: 'email', message: 'Email:', validate: (v) => v.includes('@') || 'Enter a valid email' },
         ]);
-        if (action === 'signup') {
-            const { name, email, password } = await inquirer_1.default.prompt([
-                { type: 'input', name: 'name', message: 'Your name:' },
-                { type: 'input', name: 'email', message: 'Email:' },
-                { type: 'password', name: 'password', message: 'Password (min 8 chars):' },
-            ]);
-            const spinner = (0, ora_1.default)('Creating your account...').start();
-            log('POST /auth/signup', { email });
-            try {
-                const res = await fetch(`${API_URL}/auth/signup`, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ name, email, password }),
-                });
-                if (!res.ok) {
-                    const err = await res.json();
-                    logError('signup', err);
-                    throw new Error(err.error || 'Signup failed');
-                }
-                const data = await res.json();
-                config.set('sessionId', data.sessionId);
-                config.set('user', data.user);
-                config.set('tenant', data.tenant);
-                sessionId = data.sessionId;
-                spinner.succeed('Account created!');
-                log('Session ID stored');
+        let spinner = (0, ora_1.default)('Sending verification code...').start();
+        log('POST /auth/send-code', { email });
+        try {
+            const sendRes = await fetch(`${API_URL}/auth/send-code`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ email }),
+            });
+            if (!sendRes.ok) {
+                const err = await sendRes.json();
+                logError('send-code', err);
+                throw new Error(err.error || 'Failed to send code');
             }
-            catch (err) {
-                spinner.fail(chalk_1.default.red(err.message));
-                process.exit(1);
+            const sendData = await sendRes.json();
+            spinner.succeed('Code sent! Check your email.');
+            if (sendData.isNewUser) {
+                console.log(chalk_1.default.gray('  No account found - we\'ll create one for you.\n'));
             }
-        }
-        else {
-            const { email, password } = await inquirer_1.default.prompt([
-                { type: 'input', name: 'email', message: 'Email:' },
-                { type: 'password', name: 'password', message: 'Password:' },
+            const { code } = await inquirer_1.default.prompt([
+                { type: 'input', name: 'code', message: 'Enter 6-digit code:', validate: (v) => /^\d{6}$/.test(v) || 'Enter 6 digits' },
             ]);
-            const spinner = (0, ora_1.default)('Logging in...').start();
-            log('POST /auth/login', { email });
-            try {
-                const res = await fetch(`${API_URL}/auth/login`, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ email, password }),
-                });
-                if (!res.ok) {
-                    const err = await res.json();
-                    logError('login', err);
-                    throw new Error(err.error || 'Login failed');
-                }
-                const data = await res.json();
-                config.set('sessionId', data.sessionId);
-                config.set('user', data.user);
-                config.set('tenant', data.tenant);
-                sessionId = data.sessionId;
-                spinner.succeed('Logged in!');
-                log('Session ID stored');
-            }
-            catch (err) {
-                spinner.fail(chalk_1.default.red(err.message));
-                process.exit(1);
+            spinner = (0, ora_1.default)('Verifying...').start();
+            log('POST /auth/verify-code', { email, code });
+            const verifyRes = await fetch(`${API_URL}/auth/verify-code`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ email, code }),
+            });
+            if (!verifyRes.ok) {
+                const err = await verifyRes.json();
+                logError('verify-code', err);
+                throw new Error(err.error || 'Verification failed');
             }
+            const data = await verifyRes.json();
+            config.set('sessionId', data.sessionId);
+            config.set('user', data.user);
+            config.set('tenant', data.tenant);
+            sessionId = data.sessionId;
+            spinner.succeed(data.isNewUser ? 'Account created!' : 'Logged in!');
+            log('Session ID stored');
+        }
+        catch (err) {
+            spinner.fail(chalk_1.default.red(err.message));
+            process.exit(1);
         }
     }
     // Step 2: Create agent
@@ -333,52 +308,86 @@ ${chalk_1.default.bold('Example:')}
 // ========== AUTH COMMANDS ==========
 program
     .command('login')
-    .description(`Log in to GopherHole
+    .description(`Log in to GopherHole (creates account if needed)
 
 ${chalk_1.default.bold('Example:')}
   $ gopherhole login
 `)
     .action(async () => {
-    const { email, password } = await inquirer_1.default.prompt([
-        { type: 'input', name: 'email', message: 'Email:' },
-        { type: 'password', name: 'password', message: 'Password:' },
+    const { email } = await inquirer_1.default.prompt([
+        { type: 'input', name: 'email', message: 'Email:', validate: (v) => v.includes('@') || 'Enter a valid email' },
     ]);
-    const spinner = (0, ora_1.default)('Logging in...').start();
-    log('POST /auth/login', { email });
+    let spinner = (0, ora_1.default)('Sending verification code...').start();
+    log('POST /auth/send-code', { email });
     try {
-        const res = await fetch(`${API_URL}/auth/login`, {
+        const sendRes = await fetch(`${API_URL}/auth/send-code`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ email, password }),
+            body: JSON.stringify({ email }),
         });
-        if (!res.ok) {
-            const err = await res.json();
-            logError('login', err);
-            throw new Error(err.error || 'Login failed');
+        if (!sendRes.ok) {
+            const err = await sendRes.json();
+            logError('send-code', err);
+            throw new Error(err.error || 'Failed to send code');
+        }
+        const sendData = await sendRes.json();
+        spinner.succeed('Code sent! Check your email.');
+        if (sendData.isNewUser) {
+            console.log(chalk_1.default.gray('  No account found - we\'ll create one for you.\n'));
+        }
+        const { code } = await inquirer_1.default.prompt([
+            { type: 'input', name: 'code', message: 'Enter 6-digit code:', validate: (v) => /^\d{6}$/.test(v) || 'Enter 6 digits' },
+        ]);
+        spinner = (0, ora_1.default)('Verifying...').start();
+        log('POST /auth/verify-code', { email, code });
+        const verifyRes = await fetch(`${API_URL}/auth/verify-code`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email, code }),
+        });
+        if (!verifyRes.ok) {
+            const err = await verifyRes.json();
+            logError('verify-code', err);
+            throw new Error(err.error || 'Verification failed');
         }
-        const data = await res.json();
+        const data = await verifyRes.json();
         config.set('sessionId', data.sessionId);
         config.set('user', data.user);
         config.set('tenant', data.tenant);
-        spinner.succeed(`Logged in as ${brand.green(data.user.email)}`);
+        if (data.isNewUser) {
+            spinner.succeed(brand.green('Account created!'));
+            console.log(`\n${brand.green('✨ Welcome to GopherHole!')}\n`);
+            console.log('Next steps:');
+            console.log(chalk_1.default.gray('  $ gopherhole agents create    # Create your first agent'));
+            console.log(chalk_1.default.gray('  $ gopherhole discover search  # Find agents to talk to\n'));
+        }
+        else {
+            spinner.succeed(`Logged in as ${brand.green(data.user.email)}`);
+        }
         log('Session stored in:', config.path);
     }
     catch (err) {
         spinner.fail(chalk_1.default.red(err.message));
         console.log(chalk_1.default.gray('\nTroubleshooting:'));
-        console.log(chalk_1.default.gray('  • Check your email and password'));
-        console.log(chalk_1.default.gray('  • Try: gopherhole signup (to create account)'));
+        console.log(chalk_1.default.gray('  • Check your email for the code'));
+        console.log(chalk_1.default.gray('  • Codes expire after 10 minutes'));
         console.log(chalk_1.default.gray('  • Run with --verbose for more details'));
         process.exit(1);
     }
 });
+// Alias for backward compatibility
 program
     .command('signup')
-    .description(`Create a new GopherHole account
-
-${chalk_1.default.bold('Example:')}
-  $ gopherhole signup
-`)
+    .description(`Create a new GopherHole account (alias for login)`)
+    .action(async () => {
+    console.log(chalk_1.default.yellow('Note: signup and login are now unified. Running login...\n'));
+    // Re-run login command
+    await program.parseAsync(['node', 'gopherhole', 'login']);
+});
+// Legacy signup code removed - kept as hidden command for reference
+program
+    .command('signup-legacy', { hidden: true })
+    .description(`[DEPRECATED] Create account with password`)
     .action(async () => {
     const { name, email, password } = await inquirer_1.default.prompt([
         { type: 'input', name: 'name', message: 'Name:' },
@@ -886,62 +895,46 @@ ${chalk_1.default.bold('Example:')}
     // Check if logged in
     if (!sessionId) {
         console.log(chalk_1.default.yellow('Not logged in yet.\n'));
-        const { action } = await inquirer_1.default.prompt([
-            {
-                type: 'list',
-                name: 'action',
-                message: 'Choose:',
-                choices: [
-                    { name: 'Create account', value: 'signup' },
-                    { name: 'Log in', value: 'login' },
-                ],
-            },
+        // OTP-based auth flow
+        const { email } = await inquirer_1.default.prompt([
+            { type: 'input', name: 'email', message: 'Email:', validate: (v) => v.includes('@') || 'Enter a valid email' },
         ]);
-        if (action === 'signup') {
-            const { name, email, password } = await inquirer_1.default.prompt([
-                { type: 'input', name: 'name', message: 'Name:' },
-                { type: 'input', name: 'email', message: 'Email:' },
-                { type: 'password', name: 'password', message: 'Password:' },
-            ]);
-            const spinner = (0, ora_1.default)('Creating account...').start();
-            const res = await fetch(`${API_URL}/auth/signup`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ name, email, password }),
-            });
-            if (!res.ok) {
-                spinner.fail('Signup failed');
-                process.exit(1);
-            }
-            const data = await res.json();
-            config.set('sessionId', data.sessionId);
-            config.set('user', data.user);
-            config.set('tenant', data.tenant);
-            sessionId = data.sessionId;
-            spinner.succeed('Account created!');
+        let spinner = (0, ora_1.default)('Sending verification code...').start();
+        const sendRes = await fetch(`${API_URL}/auth/send-code`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email }),
+        });
+        if (!sendRes.ok) {
+            const err = await sendRes.json().catch(() => ({}));
+            spinner.fail(err.error || 'Failed to send code');
+            process.exit(1);
         }
-        else {
-            const { email, password } = await inquirer_1.default.prompt([
-                { type: 'input', name: 'email', message: 'Email:' },
-                { type: 'password', name: 'password', message: 'Password:' },
-            ]);
-            const spinner = (0, ora_1.default)('Logging in...').start();
-            const res = await fetch(`${API_URL}/auth/login`, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ email, password }),
-            });
-            if (!res.ok) {
-                spinner.fail('Login failed');
-                process.exit(1);
-            }
-            const data = await res.json();
-            config.set('sessionId', data.sessionId);
-            config.set('user', data.user);
-            config.set('tenant', data.tenant);
-            sessionId = data.sessionId;
-            spinner.succeed('Logged in!');
+        const sendData = await sendRes.json();
+        spinner.succeed('Code sent! Check your email.');
+        if (sendData.isNewUser) {
+            console.log(chalk_1.default.gray('  No account found - we\'ll create one for you.\n'));
         }
+        const { code } = await inquirer_1.default.prompt([
+            { type: 'input', name: 'code', message: 'Enter 6-digit code:', validate: (v) => /^\d{6}$/.test(v) || 'Enter 6 digits' },
+        ]);
+        spinner = (0, ora_1.default)('Verifying...').start();
+        const verifyRes = await fetch(`${API_URL}/auth/verify-code`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email, code }),
+        });
+        if (!verifyRes.ok) {
+            const err = await verifyRes.json().catch(() => ({}));
+            spinner.fail(err.error || 'Verification failed');
+            process.exit(1);
+        }
+        const data = await verifyRes.json();
+        config.set('sessionId', data.sessionId);
+        config.set('user', data.user);
+        config.set('tenant', data.tenant);
+        sessionId = data.sessionId;
+        spinner.succeed(data.isNewUser ? 'Account created!' : 'Logged in!');
     }
     console.log('');
     // Create agent

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gopherhole/cli",
-  "version": "0.1.20",
+  "version": "0.1.22",
   "description": "GopherHole CLI - Connect AI agents to the world",
   "main": "dist/index.js",
   "bin": {

package/src/index.ts

@@ -67,7 +67,7 @@ program
 
 ${chalk.bold('Quick Start:')}
   $ gopherhole quickstart        # Interactive setup wizard
-  $ gopherhole signup            # Create an account
+  $ gopherhole login             # Log in or create account
   $ gopherhole agents create     # Create your first agent
 
 ${chalk.bold('Examples:')}
@@ -116,87 +116,65 @@ ${chalk.bold('Example:')}
       const user = config.get('user') as { email: string } | undefined;
       console.log(brand.green(`✓ Already logged in as ${user?.email}\n`));
     } else {
-      console.log(chalk.bold('Step 1: Create an account\n'));
+      console.log(chalk.bold('Step 1: Sign in\n'));
       
-      const { action } = await inquirer.prompt([
-        {
-          type: 'list',
-          name: 'action',
-          message: 'Do you have a GopherHole account?',
-          choices: [
-            { name: 'No, create one for me', value: 'signup' },
-            { name: 'Yes, log me in', value: 'login' },
-          ],
-        },
+      // OTP-based auth flow
+      const { email } = await inquirer.prompt([
+        { type: 'input', name: 'email', message: 'Email:', validate: (v: string) => v.includes('@') || 'Enter a valid email' },
       ]);
 
-      if (action === 'signup') {
-        const { name, email, password } = await inquirer.prompt([
-          { type: 'input', name: 'name', message: 'Your name:' },
-          { type: 'input', name: 'email', message: 'Email:' },
-          { type: 'password', name: 'password', message: 'Password (min 8 chars):' },
-        ]);
+      let spinner = ora('Sending verification code...').start();
+      log('POST /auth/send-code', { email });
 
-        const spinner = ora('Creating your account...').start();
-        log('POST /auth/signup', { email });
-        
-        try {
-          const res = await fetch(`${API_URL}/auth/signup`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ name, email, password }),
-          });
-
-          if (!res.ok) {
-            const err = await res.json();
-            logError('signup', err);
-            throw new Error(err.error || 'Signup failed');
-          }
+      try {
+        const sendRes = await fetch(`${API_URL}/auth/send-code`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ email }),
+        });
 
-          const data = await res.json();
-          config.set('sessionId', data.sessionId);
-          config.set('user', data.user);
-          config.set('tenant', data.tenant);
-          sessionId = data.sessionId;
-          spinner.succeed('Account created!');
-          log('Session ID stored');
-        } catch (err) {
-          spinner.fail(chalk.red((err as Error).message));
-          process.exit(1);
+        if (!sendRes.ok) {
+          const err = await sendRes.json();
+          logError('send-code', err);
+          throw new Error(err.error || 'Failed to send code');
         }
-      } else {
-        const { email, password } = await inquirer.prompt([
-          { type: 'input', name: 'email', message: 'Email:' },
-          { type: 'password', name: 'password', message: 'Password:' },
-        ]);
 
-        const spinner = ora('Logging in...').start();
-        log('POST /auth/login', { email });
+        const sendData = await sendRes.json();
+        spinner.succeed('Code sent! Check your email.');
+        
+        if (sendData.isNewUser) {
+          console.log(chalk.gray('  No account found - we\'ll create one for you.\n'));
+        }
 
-        try {
-          const res = await fetch(`${API_URL}/auth/login`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json' },
-            body: JSON.stringify({ email, password }),
-          });
+        const { code } = await inquirer.prompt([
+          { type: 'input', name: 'code', message: 'Enter 6-digit code:', validate: (v: string) => /^\d{6}$/.test(v) || 'Enter 6 digits' },
+        ]);
 
-          if (!res.ok) {
-            const err = await res.json();
-            logError('login', err);
-            throw new Error(err.error || 'Login failed');
-          }
+        spinner = ora('Verifying...').start();
+        log('POST /auth/verify-code', { email, code });
 
-          const data = await res.json();
-          config.set('sessionId', data.sessionId);
-          config.set('user', data.user);
-          config.set('tenant', data.tenant);
-          sessionId = data.sessionId;
-          spinner.succeed('Logged in!');
-          log('Session ID stored');
-        } catch (err) {
-          spinner.fail(chalk.red((err as Error).message));
-          process.exit(1);
+        const verifyRes = await fetch(`${API_URL}/auth/verify-code`, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ email, code }),
+        });
+
+        if (!verifyRes.ok) {
+          const err = await verifyRes.json();
+          logError('verify-code', err);
+          throw new Error(err.error || 'Verification failed');
         }
+
+        const data = await verifyRes.json();
+        config.set('sessionId', data.sessionId);
+        config.set('user', data.user);
+        config.set('tenant', data.tenant);
+        sessionId = data.sessionId;
+        spinner.succeed(data.isNewUser ? 'Account created!' : 'Logged in!');
+        log('Session ID stored');
+      } catch (err) {
+        spinner.fail(chalk.red((err as Error).message));
+        process.exit(1);
       }
     }
 
@@ -364,57 +342,97 @@ ${chalk.bold('Example:')}
 
 program
   .command('login')
-  .description(`Log in to GopherHole
+  .description(`Log in to GopherHole (creates account if needed)
 
 ${chalk.bold('Example:')}
   $ gopherhole login
 `)
   .action(async () => {
-    const { email, password } = await inquirer.prompt([
-      { type: 'input', name: 'email', message: 'Email:' },
-      { type: 'password', name: 'password', message: 'Password:' },
+    const { email } = await inquirer.prompt([
+      { type: 'input', name: 'email', message: 'Email:', validate: (v: string) => v.includes('@') || 'Enter a valid email' },
     ]);
 
-    const spinner = ora('Logging in...').start();
-    log('POST /auth/login', { email });
+    let spinner = ora('Sending verification code...').start();
+    log('POST /auth/send-code', { email });
 
     try {
-      const res = await fetch(`${API_URL}/auth/login`, {
+      const sendRes = await fetch(`${API_URL}/auth/send-code`, {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ email, password }),
+        body: JSON.stringify({ email }),
       });
 
-      if (!res.ok) {
-        const err = await res.json();
-        logError('login', err);
-        throw new Error(err.error || 'Login failed');
+      if (!sendRes.ok) {
+        const err = await sendRes.json();
+        logError('send-code', err);
+        throw new Error(err.error || 'Failed to send code');
       }
 
-      const data = await res.json();
+      const sendData = await sendRes.json();
+      spinner.succeed('Code sent! Check your email.');
+      
+      if (sendData.isNewUser) {
+        console.log(chalk.gray('  No account found - we\'ll create one for you.\n'));
+      }
+
+      const { code } = await inquirer.prompt([
+        { type: 'input', name: 'code', message: 'Enter 6-digit code:', validate: (v: string) => /^\d{6}$/.test(v) || 'Enter 6 digits' },
+      ]);
+
+      spinner = ora('Verifying...').start();
+      log('POST /auth/verify-code', { email, code });
+
+      const verifyRes = await fetch(`${API_URL}/auth/verify-code`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email, code }),
+      });
+
+      if (!verifyRes.ok) {
+        const err = await verifyRes.json();
+        logError('verify-code', err);
+        throw new Error(err.error || 'Verification failed');
+      }
+
+      const data = await verifyRes.json();
       config.set('sessionId', data.sessionId);
       config.set('user', data.user);
       config.set('tenant', data.tenant);
 
-      spinner.succeed(`Logged in as ${brand.green(data.user.email)}`);
+      if (data.isNewUser) {
+        spinner.succeed(brand.green('Account created!'));
+        console.log(`\n${brand.green('✨ Welcome to GopherHole!')}\n`);
+        console.log('Next steps:');
+        console.log(chalk.gray('  $ gopherhole agents create    # Create your first agent'));
+        console.log(chalk.gray('  $ gopherhole discover search  # Find agents to talk to\n'));
+      } else {
+        spinner.succeed(`Logged in as ${brand.green(data.user.email)}`);
+      }
       log('Session stored in:', config.path);
     } catch (err) {
       spinner.fail(chalk.red((err as Error).message));
       console.log(chalk.gray('\nTroubleshooting:'));
-      console.log(chalk.gray('  • Check your email and password'));
-      console.log(chalk.gray('  • Try: gopherhole signup (to create account)'));
+      console.log(chalk.gray('  • Check your email for the code'));
+      console.log(chalk.gray('  • Codes expire after 10 minutes'));
       console.log(chalk.gray('  • Run with --verbose for more details'));
       process.exit(1);
     }
   });
 
+// Alias for backward compatibility
 program
   .command('signup')
-  .description(`Create a new GopherHole account
+  .description(`Create a new GopherHole account (alias for login)`)
+  .action(async () => {
+    console.log(chalk.yellow('Note: signup and login are now unified. Running login...\n'));
+    // Re-run login command
+    await program.parseAsync(['node', 'gopherhole', 'login']);
+  });
 
-${chalk.bold('Example:')}
-  $ gopherhole signup
-`)
+// Legacy signup code removed - kept as hidden command for reference
+program
+  .command('signup-legacy', { hidden: true })
+  .description(`[DEPRECATED] Create account with password`)
   .action(async () => {
     const { name, email, password } = await inquirer.prompt([
       { type: 'input', name: 'name', message: 'Name:' },
@@ -981,68 +999,56 @@ ${chalk.bold('Example:')}
     if (!sessionId) {
       console.log(chalk.yellow('Not logged in yet.\n'));
       
-      const { action } = await inquirer.prompt([
-        {
-          type: 'list',
-          name: 'action',
-          message: 'Choose:',
-          choices: [
-            { name: 'Create account', value: 'signup' },
-            { name: 'Log in', value: 'login' },
-          ],
-        },
+      // OTP-based auth flow
+      const { email } = await inquirer.prompt([
+        { type: 'input', name: 'email', message: 'Email:', validate: (v: string) => v.includes('@') || 'Enter a valid email' },
       ]);
 
-      if (action === 'signup') {
-        const { name, email, password } = await inquirer.prompt([
-          { type: 'input', name: 'name', message: 'Name:' },
-          { type: 'input', name: 'email', message: 'Email:' },
-          { type: 'password', name: 'password', message: 'Password:' },
-        ]);
+      let spinner = ora('Sending verification code...').start();
 
-        const spinner = ora('Creating account...').start();
-        const res = await fetch(`${API_URL}/auth/signup`, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ name, email, password }),
-        });
+      const sendRes = await fetch(`${API_URL}/auth/send-code`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email }),
+      });
 
-        if (!res.ok) {
-          spinner.fail('Signup failed');
-          process.exit(1);
-        }
+      if (!sendRes.ok) {
+        const err = await sendRes.json().catch(() => ({}));
+        spinner.fail(err.error || 'Failed to send code');
+        process.exit(1);
+      }
 
-        const data = await res.json();
-        config.set('sessionId', data.sessionId);
-        config.set('user', data.user);
-        config.set('tenant', data.tenant);
-        sessionId = data.sessionId;
-        spinner.succeed('Account created!');
-      } else {
-        const { email, password } = await inquirer.prompt([
-          { type: 'input', name: 'email', message: 'Email:' },
-          { type: 'password', name: 'password', message: 'Password:' },
-        ]);
+      const sendData = await sendRes.json();
+      spinner.succeed('Code sent! Check your email.');
+      
+      if (sendData.isNewUser) {
+        console.log(chalk.gray('  No account found - we\'ll create one for you.\n'));
+      }
 
-        const spinner = ora('Logging in...').start();
-        const res = await fetch(`${API_URL}/auth/login`, {
-          method: 'POST',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ email, password }),
-        });
+      const { code } = await inquirer.prompt([
+        { type: 'input', name: 'code', message: 'Enter 6-digit code:', validate: (v: string) => /^\d{6}$/.test(v) || 'Enter 6 digits' },
+      ]);
 
-        if (!res.ok) {
-          spinner.fail('Login failed');
-          process.exit(1);
-        }
+      spinner = ora('Verifying...').start();
 
-        const data = await res.json();
-        config.set('sessionId', data.sessionId);
-        config.set('user', data.user);
-        config.set('tenant', data.tenant);
-        sessionId = data.sessionId;
-        spinner.succeed('Logged in!');
+      const verifyRes = await fetch(`${API_URL}/auth/verify-code`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email, code }),
+      });
+
+      if (!verifyRes.ok) {
+        const err = await verifyRes.json().catch(() => ({}));
+        spinner.fail(err.error || 'Verification failed');
+        process.exit(1);
       }
+
+      const data = await verifyRes.json();
+      config.set('sessionId', data.sessionId);
+      config.set('user', data.user);
+      config.set('tenant', data.tenant);
+      sessionId = data.sessionId;
+      spinner.succeed(data.isNewUser ? 'Account created!' : 'Logged in!');
     }
 
     console.log('');