@maverick006/vibeguard 1.0.11 → 1.0.12

package/dist/index.js

@@ -9,78 +9,101 @@ const commander_1 = require("commander");
 const chalk_1 = __importDefault(require("chalk"));
 const ora_1 = __importDefault(require("ora"));
 const ai_engine_1 = require("@maverick006/ai-engine");
-const types_1 = require("@maverick006/types");
+const security_engine_1 = require("@maverick006/security-engine");
 const fs_1 = require("fs");
 const path_1 = require("path");
 const formatter_1 = require("./formatter");
+const credentials_1 = require("./credentials");
+const readline_1 = __importDefault(require("readline"));
 const program = new commander_1.Command();
 program
     .name('vibeguard')
-    .description('AI-Powered DevSecOps Orchestrator CLI')
-    .version('1.0.11');
+    .description('VIBEGUARD: Cloud + Security Posture CLI')
+    .version('1.0.12');
 program
     .command('scan [path]')
     .description('Run a security scan on the current directory or target path')
     .option('-d, --dir <path>', 'Directory to scan', process.cwd())
-    .option('--fix', 'Automatically generate AI remediation fixes and interactive diff')
+    .option('--fix', 'Generate optional advisory AI remediation suggestion')
     .option('--ci', 'Run in non-interactive CI mode and exit with policy status code')
+    .option('--json', 'Output machine-readable JSON summary')
+    .option('-v, --verbose', 'Show detailed scanner telemetry, install hints, and diagnostics')
+    .option('--fail-on <severity>', 'Severity threshold to trigger non-zero exit in CI (critical, high, medium, low)', 'high')
+    .option('--sync', 'Sync scan telemetry and findings with authenticated VibeGuard Cloud account')
     .action(async (targetPath, options) => {
     const scanDir = (0, path_1.resolve)(targetPath || options.dir || process.cwd());
     const startTime = Date.now();
     let hasSystemError = false;
-    // Use a minimal spinner if in CI mode, or bypass ora entirely if preferred.
-    // For simplicity, we just won't render the interactive dashboard if --ci is set.
+    const isJson = Boolean(options.json);
+    const isSilent = options.ci || isJson;
     const spinner = (0, ora_1.default)({
-        text: chalk_1.default.hex('#00E5FF')('Scanning repository for vulnerabilities (SAST, SCA, Secrets, IaC)...'),
+        text: chalk_1.default.hex('#00E5FF')('Orchestrating security scanners across repository...'),
         spinner: 'dots',
-        isSilent: options.ci
+        isSilent
     }).start();
     let findings = [];
+    let scannerResults = [];
+    let coverageData = {
+        code: false,
+        dependencies: false,
+        secrets: false,
+        containers: false,
+        iac: false,
+        web: false,
+        cloud: false
+    };
     try {
-        // Initialize the security orchestrator and scanners
         const { Orchestrator } = require('@maverick006/security-engine');
         const scanners = [];
-        try {
-            const { NpmAuditScanner } = require('@maverick006/scanner-npm-audit');
-            scanners.push(new NpmAuditScanner());
-        }
-        catch (e) { }
-        try {
-            const { TrivyScanner } = require('@maverick006/scanner-trivy');
-            scanners.push(new TrivyScanner());
-        }
-        catch (e) { }
         try {
             const { SemgrepScanner } = require('@maverick006/scanner-semgrep');
             scanners.push(new SemgrepScanner());
         }
-        catch (e) { }
+        catch { }
         try {
             const { GitleaksScanner } = require('@maverick006/scanner-gitleaks');
             scanners.push(new GitleaksScanner());
         }
-        catch (e) { }
+        catch { }
+        try {
+            const { NpmAuditScanner } = require('@maverick006/scanner-npm-audit');
+            scanners.push(new NpmAuditScanner());
+        }
+        catch { }
+        try {
+            const { TrivyScanner } = require('@maverick006/scanner-trivy');
+            scanners.push(new TrivyScanner());
+        }
+        catch { }
         try {
             const { CheckovScanner } = require('@maverick006/scanner-checkov');
             scanners.push(new CheckovScanner());
         }
-        catch (e) { }
+        catch { }
         try {
             const { ZapScanner } = require('@maverick006/scanner-zap');
             scanners.push(new ZapScanner());
         }
-        catch (e) { }
-        const orchestrator = new Orchestrator(scanners);
+        catch { }
+        try {
+            const { AwsCspmScanner } = require('@maverick006/scanner-aws-cspm');
+            scanners.push(new AwsCspmScanner());
+        }
+        catch { }
+        const orchestrator = new Orchestrator(scanners, { concurrencyLimit: 3 });
         const scanResult = await orchestrator.runScan({
             scanId: `scan-${Date.now()}`,
-            repositoryUrl: 'local',
             repositoryPath: scanDir,
             branch: 'main'
         });
         findings = scanResult.findings || [];
+        scannerResults = scanResult.scannerResults || [];
+        coverageData = scanResult.coverage || coverageData;
     }
     catch (err) {
-        console.error(chalk_1.default.red('Orchestrator failed to run scans.'), err);
+        if (!isJson) {
+            console.error(chalk_1.default.red('Orchestrator encountered an execution error:'), err.message || err);
+        }
         hasSystemError = true;
     }
     spinner.stop();
@@ -88,108 +111,295 @@ program
     const duration = elapsedMs > 60000
         ? `${Math.floor(elapsedMs / 60000)}m ${Math.floor((elapsedMs % 60000) / 1000)}s`
         : `${(elapsedMs / 1000).toFixed(1)}s`;
+    // Ensure all findings follow the consistent VG-FIND-001 format
+    findings.forEach((f, idx) => {
+        if (!f.id || !f.id.startsWith('VG-FIND-')) {
+            f.id = `VG-FIND-${String(idx + 1).padStart(3, '0')}`;
+        }
+    });
+    const deterministicScore = (0, security_engine_1.calculateScore)(findings, coverageData);
     const stats = (0, formatter_1.calculateScore)(findings);
     const gitInfo = (0, formatter_1.getGitInfo)(scanDir);
+    // Structure AI remediation (advisory only)
     let remediationData = undefined;
-    // Generate AI Remediation only if not in CI mode to save time, or if explicitly asked
-    if (findings.length > 0 && !options.ci && (options.fix || true)) {
-        try {
-            const explainer = new ai_engine_1.ContextualExplainer();
-            const primaryFinding = findings[0];
-            let snippet = primaryFinding.codeSnippet || '';
-            if (primaryFinding.file && (0, fs_1.existsSync)((0, path_1.join)(scanDir, primaryFinding.file))) {
-                const content = (0, fs_1.readFileSync)((0, path_1.join)(scanDir, primaryFinding.file), 'utf-8');
-                const lines = content.split('\n');
-                const targetLine = primaryFinding.line || 1;
-                snippet = lines.slice(Math.max(0, targetLine - 3), targetLine + 3).join('\n');
-            }
-            const explanation = await explainer.explainFinding(primaryFinding, { codeContext: snippet });
+    if (findings.length > 0 && !options.ci && !isJson && (options.fix || true)) {
+        const primaryFinding = findings[0];
+        const hasAiKey = Boolean(process.env.NVIDIA_API_KEY);
+        if (!hasAiKey) {
             remediationData = {
-                findingId: primaryFinding.id,
-                issue: explanation.summary,
-                impact: explanation.details || 'Potential security impact based on context.',
-                recommendation: explanation.remediation,
-                diffSnippet: explanation.codeFix || '',
-                confidence: 90
+                findingId: primaryFinding.id || 'VG-FIND-001',
+                severity: primaryFinding.severity,
+                issue: primaryFinding.title || 'Security finding identified',
+                hasConcretePatch: false,
+                status: 'UNAVAILABLE',
+                unavailableReason: 'NVIDIA_API_KEY not configured.'
             };
         }
-        catch (e) {
-            if (!options.ci) {
-                console.error(chalk_1.default.yellow('AI Remediation generation failed.'), e);
+        else {
+            try {
+                const explainer = new ai_engine_1.ContextualExplainer();
+                let snippet = primaryFinding.codeSnippet || '';
+                if (primaryFinding.file && (0, fs_1.existsSync)((0, path_1.join)(scanDir, primaryFinding.file))) {
+                    const content = (0, fs_1.readFileSync)((0, path_1.join)(scanDir, primaryFinding.file), 'utf-8');
+                    const lines = content.split('\n');
+                    const targetLine = primaryFinding.line || 1;
+                    snippet = lines.slice(Math.max(0, targetLine - 3), targetLine + 3).join('\n');
+                }
+                const explanation = await explainer.explainFinding(primaryFinding, { codeContext: snippet });
+                const hasConcretePatch = Boolean(explanation.codeFix &&
+                    explanation.codeFix.trim() &&
+                    !explanation.codeFix.toLowerCase().includes('no patch'));
+                remediationData = {
+                    findingId: primaryFinding.id || 'VG-FIND-001',
+                    severity: primaryFinding.severity,
+                    issue: explanation.summary,
+                    impact: explanation.details,
+                    recommendation: explanation.remediation,
+                    suggestedFix: hasConcretePatch ? explanation.codeFix : undefined,
+                    hasConcretePatch,
+                    confidence: hasConcretePatch ? 90 : undefined,
+                    status: hasConcretePatch ? 'AWAITING REVIEW' : 'GUIDANCE ONLY'
+                };
+            }
+            catch {
+                remediationData = {
+                    findingId: primaryFinding.id || 'VG-FIND-001',
+                    severity: primaryFinding.severity,
+                    issue: primaryFinding.title,
+                    hasConcretePatch: false,
+                    status: 'UNAVAILABLE',
+                    unavailableReason: 'AI service temporarily unavailable.'
+                };
+            }
+        }
+    }
+    // Policy verification
+    const failThreshold = (options.failOn || 'high').toLowerCase();
+    const policyEvaluation = (0, formatter_1.evaluatePolicy)(failThreshold, deterministicScore.breakdown, findings.length);
+    const policyPassed = policyEvaluation.passed;
+    const thresholdBreached = !policyPassed;
+    // Cloud synchronization tracking
+    let syncStatus = 'SKIPPED';
+    if (options.sync) {
+        const creds = (0, credentials_1.loadCredentials)();
+        if (!creds || !creds.token) {
+            syncStatus = 'FAILED';
+            if (!isJson && !options.ci) {
+                console.log(chalk_1.default.red('\n✖ Authentication required for cloud sync.'));
+                console.log(chalk_1.default.yellow("  Run 'vibeguard login' to authenticate with VibeGuard Cloud, or omit --sync for 100% offline local scanning.\n"));
+            }
+        }
+        else {
+            try {
+                const API_URL = creds.apiUrl || process.env.VIBEGUARD_API_URL || 'https://vibeguard-eep3.onrender.com';
+                const repoName = gitInfo.name || 'Local Project';
+                const repoUrl = gitInfo.remoteUrl || gitInfo.name || 'local';
+                const response = await fetch(`${API_URL}/api/scans/upload`, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json',
+                        'Authorization': `Bearer ${creds.token}`
+                    },
+                    body: JSON.stringify({
+                        repositoryName: repoName,
+                        repositoryUrl: repoUrl,
+                        numericScore: deterministicScore.score,
+                        score: deterministicScore.grade,
+                        findings
+                    })
+                });
+                syncStatus = response.ok ? 'SYNCED' : 'FAILED';
+            }
+            catch {
+                syncStatus = 'FAILED';
             }
         }
     }
-    if (!options.ci) {
-        // Render the beautiful cyber dashboard interactively
-        (0, formatter_1.renderDashboard)({
+    // Transform scanner telemetry
+    const scannerTelemetryList = scannerResults.map(s => ({
+        scanner: s.scanner,
+        state: s.state,
+        durationMs: s.durationMs,
+        findingsCount: s.findings ? s.findings.length : 0,
+        reason: s.reason
+    }));
+    const activeDomainsCount = Object.values(coverageData).filter(Boolean).length;
+    const postureStatus = activeDomainsCount === 7 ? 'COMPLETE' : 'PARTIAL';
+    // 1. JSON Mode (Directive 17: Pure, machine-readable JSON)
+    if (isJson) {
+        const jsonOutput = (0, formatter_1.generateJsonOutput)({
+            deterministicScore,
             findings,
-            stats,
+            coverageData,
+            activeDomainsCount,
+            postureStatus,
+            scanners: scannerTelemetryList,
             gitInfo,
-            duration,
-            remediation: remediationData
+            policyPassed,
+            failThreshold,
+            durationMs: elapsedMs
         });
+        console.log(JSON.stringify(jsonOutput, null, 2));
+        process.exit(thresholdBreached ? 1 : (hasSystemError ? 2 : 0));
+        return;
     }
-    else {
-        // CI Output
-        console.log(`VibeGuard CI Scan Complete. Duration: ${duration}`);
-        console.log(`Findings: ${findings.length}`);
-        console.log(`Risk Score: ${stats.score}/100 (${stats.riskLevel})`);
-        const critical = findings.filter(f => (f.severity || '').toUpperCase() === types_1.Severity.CRITICAL).length;
-        const high = findings.filter(f => (f.severity || '').toUpperCase() === types_1.Severity.HIGH).length;
-        console.log(`Critical: ${critical}, High: ${high}`);
-    }
-    // Sync with Web Dashboard
-    const syncSpinner = (0, ora_1.default)({
-        text: chalk_1.default.dim('Syncing results to VibeGuard Dashboard...'),
-        spinner: 'dots',
-        isSilent: options.ci
-    }).start();
-    try {
-        const API_URL = process.env.VIBEGUARD_API_URL || 'https://vibeguard-eep3.onrender.com';
-        const API_KEY = process.env.VIBEGUARD_API_KEY || 'dev-api-key-123';
-        const repoName = gitInfo.name || 'Local Project';
-        const repoUrl = gitInfo.remoteUrl || gitInfo.name || 'local';
-        const response = await fetch(`${API_URL}/api/scans/upload`, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'Authorization': `Bearer ${API_KEY}`
-            },
-            body: JSON.stringify({
-                repositoryName: repoName,
-                repositoryUrl: repoUrl,
-                numericScore: stats.score,
-                score: stats.riskLevel,
-                findings: findings
-            })
+    // 2. CI Mode (Directive 18: Minimal, clean, automation-friendly)
+    if (options.ci) {
+        const ciLines = (0, formatter_1.renderCIOutput)({
+            deterministicScore,
+            findings,
+            policyPassed,
+            failThreshold,
+            scanners: scannerTelemetryList,
+            verbose: Boolean(options.verbose)
         });
-        if (response.ok) {
-            const dashboardUrl = `https://vibeguard-web-eight.vercel.app/dashboard?repo=${encodeURIComponent(repoName)}`;
-            syncSpinner.succeed(chalk_1.default.green(`Results synced to dashboard: ${chalk_1.default.cyan.underline(dashboardUrl)}`));
-        }
-        else {
-            syncSpinner.fail(chalk_1.default.red(`Failed to sync results to dashboard (${response.status} ${response.statusText}).`));
+        for (const line of ciLines) {
+            console.log(line);
         }
+        process.exit(thresholdBreached ? 1 : (hasSystemError ? 2 : 0));
+        return;
     }
-    catch (e) {
-        syncSpinner.warn(chalk_1.default.yellow('Dashboard API unreachable. Skipping sync.'));
+    // 3. Verbose Mode Diagnostics (Directive 19)
+    if (options.verbose) {
+        console.log(chalk_1.default.cyan('▶ VERBOSE DIAGNOSTICS'));
+        for (const sr of scannerTelemetryList) {
+            let hint = '';
+            if (sr.state === 'NOT_INSTALLED') {
+                if (sr.scanner === 'Semgrep')
+                    hint = ' (Install: pip install semgrep or brew install semgrep)';
+                else if (sr.scanner === 'Gitleaks')
+                    hint = ' (Install: brew install gitleaks or download from GitHub)';
+                else if (sr.scanner === 'Trivy')
+                    hint = ' (Install: brew install trivy or see aquasecurity.github.io)';
+                else if (sr.scanner === 'Checkov')
+                    hint = ' (Install: pip install checkov)';
+            }
+            console.log(`  • ${sr.scanner.padEnd(12)} -> ${sr.state} in ${sr.durationMs || 0}ms (${sr.findingsCount} findings)${hint}`);
+        }
+        console.log('');
     }
-    // Exit codes
+    // 4. Interactive Terminal Dashboard
+    (0, formatter_1.renderDashboard)({
+        findings,
+        stats,
+        deterministicScore,
+        coverage: coverageData,
+        gitInfo,
+        duration,
+        scanners: scannerTelemetryList,
+        remediation: remediationData,
+        syncStatus,
+        policyThreshold: failThreshold,
+        verbose: Boolean(options.verbose)
+    });
     if (hasSystemError) {
         process.exit(2);
     }
-    // Policy fail if we have CRITICAL or HIGH findings
-    const criticalOrHighCount = findings.filter(f => {
-        const s = (f.severity || '').toUpperCase();
-        return s === types_1.Severity.CRITICAL || s === types_1.Severity.HIGH;
-    }).length;
-    if (criticalOrHighCount > 0) {
-        if (options.ci)
-            console.error(chalk_1.default.red('Security Policy FAILED.'));
+    if (thresholdBreached) {
         process.exit(1);
     }
-    if (options.ci)
-        console.log(chalk_1.default.green('Security Policy PASSED.'));
     process.exit(0);
 });
+program
+    .command('login')
+    .description('Authenticate CLI with VibeGuard Cloud')
+    .option('-e, --email <email>', 'Account email')
+    .option('-p, --password <password>', 'Account password')
+    .option('--api-url <url>', 'VibeGuard API URL', process.env.VIBEGUARD_API_URL || 'https://vibeguard-eep3.onrender.com')
+    .action(async (options) => {
+    let email = options.email;
+    let password = options.password;
+    const apiUrl = options.apiUrl || process.env.VIBEGUARD_API_URL || 'https://vibeguard-eep3.onrender.com';
+    // Interactive prompt if flags not passed and TTY is active
+    if ((!email || !password) && process.stdin.isTTY) {
+        const rl = readline_1.default.createInterface({
+            input: process.stdin,
+            output: process.stdout
+        });
+        const question = (query) => new Promise((res) => rl.question(query, res));
+        if (!email) {
+            email = await question(chalk_1.default.cyan('Enter VibeGuard Email: '));
+        }
+        if (!password) {
+            password = await question(chalk_1.default.cyan('Enter VibeGuard Password: '));
+        }
+        rl.close();
+    }
+    if (!email || !password) {
+        console.error(chalk_1.default.red('Error: Email and password are required. Use --email and --password flags.'));
+        process.exit(1);
+    }
+    const spinner = (0, ora_1.default)(chalk_1.default.cyan('Authenticating with VibeGuard Cloud...')).start();
+    try {
+        const response = await fetch(`${apiUrl}/api/auth/login`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email: email.trim(), password })
+        });
+        const data = await response.json();
+        if (!response.ok) {
+            spinner.fail(chalk_1.default.red(`Authentication failed: ${data.error || 'Invalid credentials'}`));
+            process.exit(1);
+        }
+        (0, credentials_1.saveCredentials)({
+            token: data.token,
+            user: data.user,
+            apiUrl
+        });
+        spinner.succeed(chalk_1.default.green('Successfully authenticated with VibeGuard Cloud!'));
+        console.log('');
+        console.log(chalk_1.default.gray('  Account:  ') + chalk_1.default.white.bold(data.user.email) + (data.user.name ? chalk_1.default.gray(` (${data.user.name})`) : ''));
+        console.log(chalk_1.default.gray('  API Host: ') + chalk_1.default.cyan(apiUrl));
+        console.log(chalk_1.default.gray('  Stored:   ') + chalk_1.default.dim((0, credentials_1.getCredentialsPath)()));
+        console.log('');
+        console.log(chalk_1.default.white('Cloud sync is now enabled. Run scans with ') + chalk_1.default.cyan('vibeguard scan --sync') + chalk_1.default.white(' to stream telemetry.'));
+        console.log('');
+    }
+    catch (err) {
+        spinner.fail(chalk_1.default.red(`Connection error: Could not reach VibeGuard API at ${apiUrl}`));
+        console.error(chalk_1.default.dim(err.message || err));
+        process.exit(1);
+    }
+});
+program
+    .command('logout')
+    .description('Log out and remove local VibeGuard Cloud credentials')
+    .action(() => {
+    (0, credentials_1.clearCredentials)();
+    console.log(chalk_1.default.green('\n✓ Successfully logged out from VibeGuard Cloud.'));
+    console.log(chalk_1.default.gray('  Stored session cleared. Local scanning remains 100% operational.\n'));
+});
+program
+    .command('whoami')
+    .description('Display currently authenticated user and VibeGuard Cloud status')
+    .action(() => {
+    const creds = (0, credentials_1.loadCredentials)();
+    if (!creds || !creds.token) {
+        console.log(chalk_1.default.yellow('\n○ VibeGuard Cloud Status: NOT AUTHENTICATED'));
+        console.log(chalk_1.default.gray("  Run 'vibeguard login' to connect your CLI with VibeGuard Cloud.\n"));
+        return;
+    }
+    console.log(chalk_1.default.green('\n● VibeGuard Cloud Status: AUTHENTICATED'));
+    console.log(chalk_1.default.gray('  User:     ') + chalk_1.default.white.bold(creds.user.email) + (creds.user.name ? chalk_1.default.gray(` (${creds.user.name})`) : ''));
+    console.log(chalk_1.default.gray('  API URL:  ') + chalk_1.default.cyan(creds.apiUrl));
+    console.log(chalk_1.default.gray('  Saved:    ') + chalk_1.default.dim(creds.savedAt || 'Unknown'));
+    console.log('');
+});
+const authCmd = program.command('auth').description('Manage VibeGuard Cloud authentication');
+authCmd
+    .command('status')
+    .description('Display current VibeGuard Cloud authentication status')
+    .action(async () => {
+    const creds = (0, credentials_1.loadCredentials)();
+    if (!creds || !creds.token) {
+        console.log(chalk_1.default.yellow('\n○ VibeGuard Cloud Status: NOT AUTHENTICATED'));
+        console.log(chalk_1.default.gray("  Run 'vibeguard login' to connect your CLI with VibeGuard Cloud.\n"));
+        return;
+    }
+    console.log(chalk_1.default.green('\n● VibeGuard Cloud Status: AUTHENTICATED'));
+    console.log(chalk_1.default.gray('  User:     ') + chalk_1.default.white.bold(creds.user.email) + (creds.user.name ? chalk_1.default.gray(` (${creds.user.name})`) : ''));
+    console.log(chalk_1.default.gray('  API URL:  ') + chalk_1.default.cyan(creds.apiUrl));
+    console.log(chalk_1.default.gray('  Saved:    ') + chalk_1.default.dim(creds.savedAt || 'Unknown'));
+    console.log('');
+});
 program.parse(process.argv);

package/jest.config.js

@@ -0,0 +1,5 @@
+/** @type {import('ts-jest').JestConfigWithTsJest} */
+module.exports = {
+  preset: 'ts-jest',
+  testEnvironment: 'node',
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maverick006/vibeguard",
-  "version": "1.0.11",
+  "version": "1.0.12",
   "description": "VibeGuard CLI",
   "main": "dist/index.js",
   "bin": {
@@ -9,7 +9,8 @@
   "scripts": {
     "build": "tsc",
     "dev": "ts-node src/index.ts",
-    "start": "node dist/index.js"
+    "start": "node dist/index.js",
+    "test": "jest"
   },
   "dependencies": {
     "@maverick006/ai-engine": "*",
@@ -23,6 +24,9 @@
   },
   "devDependencies": {
     "@types/node": "^20.0.0",
-    "typescript": "^5.0.0"
+    "typescript": "^5.0.0",
+    "jest": "^29.5.0",
+    "@types/jest": "^29.5.0",
+    "ts-jest": "^29.1.0"
   }
 }

package/src/credentials.ts

@@ -0,0 +1,74 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+
+export interface StoredCredentials {
+  token: string;
+  user: {
+    id: string;
+    email: string;
+    name?: string | null;
+  };
+  apiUrl: string;
+  savedAt: string;
+}
+
+export function getCredentialsDir(): string {
+  return path.join(os.homedir(), '.vibeguard');
+}
+
+export function getCredentialsPath(): string {
+  return path.join(getCredentialsDir(), 'credentials.json');
+}
+
+export function saveCredentials(creds: {
+  token: string;
+  user: { id: string; email: string; name?: string | null };
+  apiUrl?: string;
+}): void {
+  const dir = getCredentialsDir();
+  if (!fs.existsSync(dir)) {
+    fs.mkdirSync(dir, { recursive: true });
+  }
+
+  const credsPath = getCredentialsPath();
+  const payload: StoredCredentials = {
+    token: creds.token,
+    user: creds.user,
+    apiUrl: creds.apiUrl || process.env.VIBEGUARD_API_URL || 'https://vibeguard-eep3.onrender.com',
+    savedAt: new Date().toISOString()
+  };
+
+  fs.writeFileSync(credsPath, JSON.stringify(payload, null, 2), { encoding: 'utf-8', mode: 0o600 });
+}
+
+export function loadCredentials(): StoredCredentials | null {
+  const credsPath = getCredentialsPath();
+  if (!fs.existsSync(credsPath)) {
+    return null;
+  }
+
+  try {
+    const raw = fs.readFileSync(credsPath, 'utf-8');
+    const parsed = JSON.parse(raw);
+    if (!parsed.token || !parsed.user?.email) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+
+export function clearCredentials(): boolean {
+  const credsPath = getCredentialsPath();
+  if (fs.existsSync(credsPath)) {
+    try {
+      fs.unlinkSync(credsPath);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return true;
+}