@jacebenson/jsn 1.0.7 → 2.0.1

package/src/auth.js

@@ -0,0 +1,517 @@
+// OAuth 2.0 with PKCE authentication
+// Credentials are stored in the OS keyring (shared with Go version via libsecret/secret-tool)
+// Falls back to file-based storage when keyring is unavailable.
+
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import readline from 'node:readline';
+import { execSync } from 'node:child_process';
+import { globalConfigDir, normalizeInstanceURL } from './config.js';
+import { errAuth } from './errors.js';
+
+// ─── PKCE state persistence (shared with Go version) ───
+
+function pkceStatePath(instance) {
+  const dir = path.join(globalConfigDir(), 'pkce');
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const filename = instance.replace(/:\/\//g, '_').replace(/\//g, '_').replace(/:/g, '_') + '.json';
+  return path.join(dir, filename);
+}
+
+function savePKCEState(instance, pkce) {
+  const filePath = pkceStatePath(instance);
+  fs.writeFileSync(filePath, JSON.stringify(pkce, null, 2), { mode: 0o600 });
+}
+
+function loadPKCEState(instance) {
+  try {
+    const data = fs.readFileSync(pkceStatePath(instance), 'utf-8');
+    return JSON.parse(data);
+  } catch {
+    return null;
+  }
+}
+
+function removePKCEState(instance) {
+  try {
+    fs.unlinkSync(pkceStatePath(instance));
+  } catch {
+    // ignore
+  }
+}
+
+const DEFAULT_OAUTH_CLIENT_ID = '543e5655f77746a28228c6009a599dfb';
+const REDIRECT_URI = '/sdk-oauth.do';
+
+// ─── Basic auth from environment variables ───
+// SN_USERNAME / SN_PASSWORD — global credentials
+// SN_<INSTANCE>_USERNAME / SN_<INSTANCE>_PASSWORD — instance-specific (e.g. SN_DEV328604_USERNAME)
+
+function envVarName(instance) {
+  // Normalize instance URL to an env-var-safe name
+  // e.g. https://dev328604.service-now.com → DEV328604
+  const host = instance.replace(/https?:\/\//, '').replace(/\/.*$/, '').replace(/\.service-now\.com.*/, '').replace(/[^a-zA-Z0-9]/g, '').toUpperCase();
+  return host;
+}
+
+function getBasicAuthFromEnv(instance) {
+  if (!instance) {
+    // Try global env vars
+    const username = process.env.SN_USERNAME;
+    const password = process.env.SN_PASSWORD;
+    if (username && password) return { auth_method: 'basic', username, password };
+    return null;
+  }
+
+  // Try instance-specific env vars first (e.g. SN_DEV328604_USERNAME)
+  const host = envVarName(instance);
+  const instanceUser = process.env[`SN_${host}_USERNAME`];
+  const instancePass = process.env[`SN_${host}_PASSWORD`];
+  if (instanceUser && instancePass) return { auth_method: 'basic', username: instanceUser, password: instancePass };
+
+  // Fall back to global env vars
+  const globalUser = process.env.SN_USERNAME;
+  const globalPass = process.env.SN_PASSWORD;
+  if (globalUser && globalPass) return { auth_method: 'basic', username: globalUser, password: globalPass };
+
+  return null;
+}
+
+// Keychain constants — same as Go version (internal/auth/store.go)
+const KEYRING_SERVICE = 'servicenow-cli';
+const KEYRING_ATTR_SERVICE = 'service';
+const KEYRING_ATTR_USERNAME = 'username';
+
+function credentialsPath(instance) {
+  const dir = path.join(globalConfigDir(), 'credentials');
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  // Match Go's filename encoding: replace :// and / and : with _
+  const filename = instance.replace(/:\/\//g, '_').replace(/\//g, '_').replace(/:/g, '_') + '.json';
+  return path.join(dir, filename);
+}
+
+function getOAuthClientID() {
+  return process.env.SERVICENOW_OAUTH_CLIENT_ID || DEFAULT_OAUTH_CLIENT_ID;
+}
+
+function generatePKCE() {
+  const verifier = crypto.randomBytes(32).toString('base64url');
+  const challenge = crypto.createHash('sha256').update(verifier).digest('base64url');
+  const state = crypto.randomBytes(16).toString('base64url');
+  return { code_verifier: verifier, code_challenge: challenge, state };
+}
+
+function buildAuthURL(instanceURL, clientID, pkce) {
+  const u = new URL('/oauth_auth.do', instanceURL);
+  u.searchParams.set('response_type', 'code');
+  u.searchParams.set('client_id', clientID);
+  u.searchParams.set('redirect_uri', REDIRECT_URI);
+  u.searchParams.set('state', pkce.state);
+  u.searchParams.set('code_challenge', pkce.code_challenge);
+  u.searchParams.set('code_challenge_method', 'S256');
+  u.searchParams.set('scope', 'openid');
+  u.searchParams.set('approval_prompt', 'force');
+  return u.toString();
+}
+
+// ─── Keyring via secret-tool (libsecret, same backend as Go's go-keyring) ───
+
+function keyringLookup(instance) {
+  try {
+    const result = execSync(
+      `secret-tool lookup ${KEYRING_ATTR_SERVICE} ${KEYRING_SERVICE} ${KEYRING_ATTR_USERNAME} "${instance}"`,
+      { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8' }
+    );
+    const trimmed = result.trim();
+    if (!trimmed) return null;
+    const parsed = JSON.parse(trimmed);
+    // Normalize field names from Go's format to Node.js format
+    return {
+      auth_method: parsed.auth_method || 'oauth',
+      access_token: parsed.access_token || parsed.AccessToken || '',
+      refresh_token: parsed.refresh_token || parsed.RefreshToken || '',
+      expires_at: parsed.expires_at || parsed.ExpiresAt || 0,
+      created_at: parsed.created_at || parsed.CreatedAt || 0,
+    };
+  } catch {
+    return null;
+  }
+}
+
+function keyringStore(instance, creds) {
+  try {
+    execSync(
+      `secret-tool store --label="Password for '${instance}' on '${KEYRING_SERVICE}'" ` +
+      `${KEYRING_ATTR_SERVICE} ${KEYRING_SERVICE} ${KEYRING_ATTR_USERNAME} "${instance}"`,
+      { stdio: ['pipe', 'ignore', 'ignore'], input: JSON.stringify(creds) }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function keyringDelete(instance) {
+  try {
+    execSync(
+      `secret-tool clear ${KEYRING_ATTR_SERVICE} ${KEYRING_SERVICE} ${KEYRING_ATTR_USERNAME} "${instance}"`,
+      { stdio: 'ignore' }
+    );
+  } catch {
+    // ignore
+  }
+}
+
+// ─── File-based storage (fallback) ───
+
+function loadCredentials(instance) {
+  // Try keyring first (shared with Go version)
+  const keyringCreds = keyringLookup(instance);
+  if (keyringCreds) return keyringCreds;
+
+  // Fall back to file-based storage
+  try {
+    const data = fs.readFileSync(credentialsPath(instance), 'utf-8');
+    return JSON.parse(data);
+  } catch {
+    return null;
+  }
+}
+
+function saveCredentials(instance, creds) {
+  // Try keyring first, fall back to file
+  if (!keyringStore(instance, creds)) {
+    fs.writeFileSync(credentialsPath(instance), JSON.stringify(creds, null, 2), { mode: 0o600 });
+  }
+}
+
+function deleteCredentials(instance) {
+  keyringDelete(instance);
+  try {
+    fs.unlinkSync(credentialsPath(instance));
+  } catch {
+    // ignore
+  }
+}
+
+function askHidden(promptText) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
+
+    const stdin = process.stdin;
+    const stdout = process.stdout;
+
+    if (!stdin.isTTY) {
+    rl.question(promptText, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+    return;
+  }
+
+    stdout.write(promptText);
+
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding('utf-8');
+
+    let input = '';
+    const onData = (key) => {
+      if (key === '\r' || key === '\n') {
+        stdin.removeListener('data', onData);
+        stdin.setRawMode(false);
+        stdin.pause();
+        stdout.write('\n');
+        rl.close();
+        resolve(input);
+      } else if (key === '\u0003') {
+        process.exit();
+      } else if (key === '\u007f') {
+        if (input.length > 0) {
+          input = input.slice(0, -1);
+          stdout.write('\b \b');
+        }
+      } else {
+        input += key;
+        stdout.write('*');
+      }
+    };
+    stdin.on('data', onData);
+  });
+}
+
+export class AuthManager {
+  constructor(configProvider) {
+    this.configProvider = configProvider;
+    this.httpClient = { timeout: 30000 };
+  }
+
+  isAuthenticated() {
+    if (process.env.SERVICENOW_OAUTH_TOKEN) return true;
+    if (getBasicAuthFromEnv()) return true;
+    const instance = this.configProvider.getEffectiveInstance();
+    if (!instance) return false;
+    try {
+      this.getCredentialsFor(instance);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  isAuthenticatedFor(instance) {
+    if (!instance) return false;
+    if (getBasicAuthFromEnv(instance)) return true;
+    const creds = loadCredentials(instance);
+    if (!creds) return false;
+    if (creds.expires_at && Date.now() >= creds.expires_at * 1000) return false;
+    return !!creds.access_token;
+  }
+
+  async getCredentials() {
+    if (process.env.SERVICENOW_OAUTH_TOKEN) {
+      return { auth_method: 'oauth', access_token: process.env.SERVICENOW_OAUTH_TOKEN };
+    }
+    const instance = this.configProvider.getEffectiveInstance();
+    if (!instance) {
+      throw errAuth('No instance configured');
+    }
+    // Check basic auth from env vars first
+    const basicCreds = getBasicAuthFromEnv(instance);
+    if (basicCreds) return basicCreds;
+    return this.getCredentialsFor(instance);
+  }
+
+  getCredentialsFor(instance) {
+    // Check basic auth from env vars first
+    const basicCreds = getBasicAuthFromEnv(instance);
+    if (basicCreds) return basicCreds;
+    const creds = loadCredentials(instance);
+    if (!creds) {
+      throw errAuth(`Not authenticated for ${instance}`);
+    }
+    // Check expiry — refresh if less than 5 minutes remaining
+    if (creds.expires_at && Date.now() >= (creds.expires_at - 300) * 1000) {
+      if (creds.refresh_token) {
+        return this.refreshToken(instance, creds);
+      }
+      throw errAuth('Token expired, please login again');
+    }
+    return creds;
+  }
+
+  async login(instanceURL) {
+    instanceURL = normalizeInstanceURL(instanceURL);
+    const clientID = getOAuthClientID();
+    const pkce = generatePKCE();
+    const authURL = buildAuthURL(instanceURL, clientID, pkce);
+
+    console.log();
+    console.log('Opening browser for OAuth authentication...');
+    console.log('If the browser does not open automatically, visit:');
+    console.log(authURL);
+    console.log();
+
+    // Try to open browser
+    const open = (await import('node:child_process')).spawn;
+    const platform = process.platform;
+    let cmd, args;
+    if (platform === 'darwin') {
+      cmd = 'open';
+      args = [authURL];
+    } else if (platform === 'win32') {
+      cmd = 'cmd';
+      args = ['/c', 'start', authURL];
+    } else {
+      cmd = 'xdg-open';
+      args = [authURL];
+    }
+    const child = open(cmd, args, { detached: true, stdio: 'ignore' });
+    child.on('error', () => {
+      // Browser open command not available — user will open the URL manually
+    });
+    child.unref();
+
+    console.log('After authenticating in the browser, copy the authorization code shown on the page.');
+    console.log('(input is hidden for security — just paste and press Enter)');
+    console.log();
+
+    const authCode = await askHidden('Authorization code (hidden on paste for security): ');
+    const code = authCode.trim();
+    if (!code) {
+      throw errAuth('Authorization code is required');
+    }
+
+    console.log('\nExchanging authorization code for tokens...');
+    const newCreds = await this.exchangeCode(instanceURL, clientID, code, pkce);
+    saveCredentials(instanceURL, newCreds);
+    return newCreds;
+  }
+
+  /**
+   * Build an OAuth authorization URL and persist PKCE state for later use.
+   * After calling this, the user can visit the URL in a browser and then
+   * call loginWithCode() with the resulting authorization code.
+   * If waitFile is provided, the method will read the code from that file
+   * (waits for file to appear, polling every 2 seconds, up to 5 minutes).
+   */
+  buildAuthURL(instanceURL, waitFile) {
+    instanceURL = normalizeInstanceURL(instanceURL);
+    const clientID = getOAuthClientID();
+    const pkce = generatePKCE();
+    savePKCEState(instanceURL, pkce);
+    const url = buildAuthURL(instanceURL, clientID, pkce);
+    if (waitFile) {
+      console.log(url);
+      console.log();
+      console.log(`Waiting for authorization code in file: ${waitFile}`);
+      console.log('(polling every 2 seconds — write the code to the file to complete login)');
+      return this._waitForCodeFile(instanceURL, clientID, pkce, waitFile);
+    }
+    return url;
+  }
+
+  async _waitForCodeFile(instanceURL, clientID, pkce, filePath, timeout = 300000) {
+    const start = Date.now();
+    const pollInterval = 2000;
+    while (Date.now() - start < timeout) {
+      try {
+        const code = fs.readFileSync(filePath, 'utf-8').trim();
+        if (code) {
+          console.log(`\nAuthorization code found in ${filePath}`);
+          removePKCEState(instanceURL);
+          const newCreds = await this.exchangeCode(instanceURL, clientID, code, pkce);
+          saveCredentials(instanceURL, newCreds);
+          console.log('Token exchange successful!\n');
+          return newCreds;
+        }
+      } catch {
+        // File not ready yet
+      }
+      await new Promise(r => setTimeout(r, pollInterval));
+    }
+    throw errAuth(`Timed out waiting for authorization code in ${filePath} (${timeout / 1000}s)`);
+  }
+
+  /**
+   * Authenticate with basic auth via environment variables.
+   * Reads SN_USERNAME/SN_PASSWORD (or SN_<INSTANCE>_USERNAME/SN_<INSTANCE>_PASSWORD).
+   * Stores the basic auth credentials so they persist across sessions.
+   */
+  async loginWithPassword(instanceURL) {
+    instanceURL = normalizeInstanceURL(instanceURL);
+    const creds = getBasicAuthFromEnv(instanceURL);
+    if (!creds) {
+      throw errAuth(
+        `No basic auth credentials found in environment.\n\n` +
+        `Set the following environment variables:\n` +
+        `  SN_USERNAME=admin           (or SN_${envVarName(instanceURL)}_USERNAME)\n` +
+        `  SN_PASSWORD=<password>      (or SN_${envVarName(instanceURL)}_PASSWORD)\n\n` +
+        `Then run:\n` +
+        `  jsn auth login --password ${instanceURL}`
+      );
+    }
+    saveCredentials(instanceURL, creds);
+    console.log(`✓ Basic auth credentials saved for ${instanceURL}`);
+    return creds;
+  }
+
+  /**
+   * Complete login using an authorization code obtained from a prior buildAuthURL() call.
+   * The PKCE state must have been saved by an earlier buildAuthURL() call.
+   */
+  async loginWithCode(instanceURL, code) {
+    instanceURL = normalizeInstanceURL(instanceURL);
+    const clientID = getOAuthClientID();
+    const pkce = loadPKCEState(instanceURL);
+    if (!pkce) {
+      throw errAuth(
+        `No pending login session for ${instanceURL}.\n\n` +
+        'Run without --code first to generate one:\n' +
+        `  jsn auth login ${instanceURL} --print-url\n\n` +
+        'This generates the PKCE challenge and saves it. Then call:\n' +
+        `  jsn auth login ${instanceURL} --code CODE`
+      );
+    }
+    removePKCEState(instanceURL);
+
+    const newCreds = await this.exchangeCode(instanceURL, clientID, code, pkce);
+    saveCredentials(instanceURL, newCreds);
+    return newCreds;
+  }
+
+  async exchangeCode(instanceURL, clientID, code, pkce) {
+    const tokenURL = `${instanceURL.replace(/\/$/, '')}/oauth_token.do`;
+    const body = new URLSearchParams();
+    body.set('grant_type', 'authorization_code');
+    body.set('client_id', clientID);
+    body.set('code', code);
+    body.set('redirect_uri', REDIRECT_URI);
+    body.set('code_verifier', pkce.code_verifier);
+
+    const resp = await fetch(tokenURL, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: body.toString(),
+    });
+
+    const text = await resp.text();
+    if (!resp.ok) {
+      throw errAuth(`Token exchange failed (status ${resp.status}): ${text}`);
+    }
+
+    const tokenResp = JSON.parse(text);
+    const expiresAt = tokenResp.expires_in ? Math.floor(Date.now() / 1000) + tokenResp.expires_in : 0;
+    return {
+      auth_method: 'oauth',
+      access_token: tokenResp.access_token,
+      refresh_token: tokenResp.refresh_token,
+      expires_at: expiresAt,
+      created_at: Math.floor(Date.now() / 1000),
+    };
+  }
+
+  async refreshToken(instance, creds) {
+    const tokenURL = `${instance.replace(/\/$/, '')}/oauth_token.do`;
+    const clientID = getOAuthClientID();
+    const body = new URLSearchParams();
+    body.set('grant_type', 'refresh_token');
+    body.set('client_id', clientID);
+    body.set('refresh_token', creds.refresh_token);
+
+    const resp = await fetch(tokenURL, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: body.toString(),
+    });
+
+    if (!resp.ok) {
+      const text = await resp.text();
+      throw errAuth(`Token refresh failed: ${text}`);
+    }
+
+    const tokenResp = await resp.json();
+    const newCreds = {
+      auth_method: 'oauth',
+      access_token: tokenResp.access_token,
+      refresh_token: tokenResp.refresh_token,
+      created_at: Math.floor(Date.now() / 1000),
+    };
+    if (tokenResp.expires_in) {
+      newCreds.expires_at = Math.floor(Date.now() / 1000) + tokenResp.expires_in;
+    }
+    saveCredentials(instance, newCreds);
+    return newCreds;
+  }
+
+  logout(instance) {
+    if (!instance) {
+      throw errAuth('No instance specified');
+    }
+    deleteCredentials(instance);
+  }
+}

package/src/cli.js

@@ -0,0 +1,174 @@
+// Root CLI using yargs
+
+import yargs from 'yargs';
+import { hideBin } from 'yargs/helpers';
+import process from 'node:process';
+import { loadConfig, getEffectiveInstance } from './config.js';
+import { App } from './app.js';
+import { renderHelp } from './help.js';
+
+// Command modules
+import { setupCmd } from './commands/setup.js';
+import { authCmd } from './commands/auth.js';
+import { profilesCmd } from './commands/profiles.js';
+import { recordsCmd } from './commands/records.js';
+import { catalogCmd } from './commands/catalog.js';
+import { incidentsCmd } from './commands/incidents.js';
+import { changesCmd } from './commands/changes.js';
+import { requestsCmd } from './commands/requests.js';
+import { tasksCmd } from './commands/tasks.js';
+import { usersCmd } from './commands/users.js';
+import { groupsCmd } from './commands/groups.js';
+import { groupMembersCmd } from './commands/groupmembers.js';
+import { groupRolesCmd } from './commands/grouproles.js';
+import { ticketsCmd } from './commands/tickets.js';
+import { versionCmd } from './commands/version.js';
+import { devCmd } from './commands/dev.js';
+import { skillCmd, checkSkill } from './commands/skill.js';
+
+function wrap(handler) {
+  return async (argv) => {
+    try {
+      const app = argv.app;
+      if (!app) {
+        process.stderr.write('Error: App context not initialized.\n');
+        process.exit(1);
+      }
+      await handler(argv, app);
+    } catch (err) {
+      const app = argv.app;
+      if (app) {
+        app.err(err);
+      } else {
+        process.stderr.write(`Error: ${err.message || err}\n`);
+      }
+      process.exit(1);
+    }
+  };
+}
+
+export const cli = yargs(hideBin(process.argv))
+  .scriptName('jsn')
+  .usage('Usage: $0 <command> [options]')
+  .option('instance', {
+    describe: 'ServiceNow instance URL (e.g., https://dev12345.service-now.com)',
+    type: 'string',
+    global: true,
+  })
+  .option('profile', {
+    alias: 'p',
+    describe: 'Configuration profile to use',
+    type: 'string',
+    global: true,
+  })
+  .option('format', {
+    describe: 'Output format: auto, json, markdown, styled, quiet',
+    type: 'string',
+    global: true,
+  })
+  .option('json', {
+    describe: 'Output in JSON format',
+    type: 'boolean',
+    global: true,
+  })
+  .option('quiet', {
+    alias: 'q',
+    describe: 'Output only data, no envelope',
+    type: 'boolean',
+    global: true,
+  })
+  .option('styled', {
+    describe: 'Force styled output',
+    type: 'boolean',
+    global: true,
+  })
+  .option('markdown', {
+    describe: 'Output in Markdown format',
+    type: 'boolean',
+    global: true,
+  })
+  .option('no-skill-check', {
+    describe: 'Skip the automatic skill version check',
+    type: 'boolean',
+    global: true,
+  })
+  .middleware(async (argv) => {
+    // Determine format from flags
+    let format = 'auto';
+    if (argv.json) format = 'json';
+    else if (argv.quiet) format = 'quiet';
+    else if (argv.styled) format = 'styled';
+    else if (argv.markdown) format = 'markdown';
+    else if (argv.format) format = argv.format;
+
+    const cfg = loadConfig({
+      instance: argv.instance,
+      profile: argv.profile,
+      format,
+    });
+
+    argv.app = new App(cfg);
+
+    // Check auth for non-auth commands
+    const cmd = argv._[0];
+    const skipAuth = ['help', 'version', 'setup', 'auth', 'profiles', 'profile', 'skill', undefined].includes(cmd);
+    if (!skipAuth) {
+      const instance = getEffectiveInstance(cfg);
+      if (!argv.app.auth.isAuthenticated() && instance) {
+        process.stderr.write(`\n⚠️  Not authenticated to ${instance}\n\n`);
+        process.stderr.write('To get started, run:\n');
+        process.stderr.write('  jsn setup           # Interactive setup\n');
+        process.stderr.write(`  jsn auth login ${instance}   # Login to instance\n\n`);
+      }
+    }
+
+    // Auto-check skill on every command (fire-and-forget, non-blocking)
+    const skipSkillCheck = ['help', 'version', 'completion', 'skill'].includes(cmd)
+      || process.env.JSN_NO_SKILL_CHECK === '1'
+      || argv['no-skill-check'];
+    if (!skipSkillCheck) {
+      // Fire check but don't await — it runs in background
+      checkSkill().then(result => {
+        if (result && !result.current && result.error) {
+          process.stderr.write(`\n⚠ ${result.error}\n\n`);
+        }
+      }).catch(() => {});
+    }
+
+    // Print context header for interactive terminals (at the TOP, before command output)
+    if (!['help', 'version', 'completion', 'skill'].includes(cmd)) {
+      await argv.app.printContextHeader();
+    }
+  })
+  .command(setupCmd(wrap))
+  .command(authCmd(wrap))
+  .command(profilesCmd(wrap))
+  .command(recordsCmd(wrap))
+  .command(catalogCmd(wrap))
+  .command(incidentsCmd(wrap))
+  .command(changesCmd(wrap))
+  .command(requestsCmd(wrap))
+  .command(tasksCmd(wrap))
+  .command(usersCmd(wrap))
+  .command(groupsCmd(wrap))
+  .command(groupMembersCmd(wrap))
+  .command(groupRolesCmd(wrap))
+  .command(ticketsCmd(wrap))
+  .command(devCmd(wrap))
+  .command(skillCmd(wrap))
+  .command(versionCmd(wrap))
+  .demandCommand(1, 'You must specify a command')
+  .help('help', 'Show help')
+  .version(false)
+  .strictCommands()
+  .strictOptions(false)
+  .fail((msg, err) => {
+    if (err) throw err;
+    // No command given → show custom grouped help instead of yargs error
+    if (msg === 'You must specify a command') {
+      process.stdout.write(renderHelp());
+      process.exit(0);
+    }
+    process.stderr.write(`Error: ${msg}\n`);
+    process.exit(1);
+  });