@vigilbase/cli 0.1.0 → 0.1.2

package/README.md

@@ -1,12 +1,14 @@
 # @vigilbase/cli
 
-Terminal client for Vigilbase — public scanners/tools without login, plus Vigilbase One after [device authorization](https://better-auth.com/docs/plugins/device-authorization).
+Terminal client for Vigilbase — public scanners and tools without login, plus Vigilbase One after device authorization.
 
-The binary name is **`vigilbase`** — after a global install you run:
+Binary name: **`vigilbase`**
 
 ```bash
 vigilbase help
 vigilbase run security-headers https://vigilbase.com
+vigilbase login
+vigilbase account --json
 ```
 
 ## Install
@@ -27,25 +29,11 @@ npx @vigilbase/cli help
 npx @vigilbase/cli run email-security vigilbase.com --json
 ```
 
-### From this monorepo
-
-```bash
-pnpm install
-pnpm link:vigilbase
-# builds dist/ and symlinks `vigilbase` into PATH
-
-vigilbase help
-```
-
-Unlink later with `pnpm unlink:vigilbase`.
-
-## Commands
-
-### Public tools (no auth)
+## Public tools (no auth)
 
 | Command | Purpose |
 | --- | --- |
-| `vigilbase list` | Catalog from `GET /api/agent/tools` |
+| `vigilbase list` | Public catalog + auth-required tool names |
 | `vigilbase run <tool> <target>` | Execute a scan |
 | `vigilbase headers <url>` | Shortcut for `security-headers` |
 | `vigilbase email <domain>` | Shortcut for `email-security` |
@@ -53,17 +41,9 @@ Unlink later with `pnpm unlink:vigilbase`.
 | `vigilbase badge <domain>` | Public badge URL |
 | `vigilbase doctor` | Connectivity + auth status |
 
-Currently allowlisted for autonomous execution: `security-headers`, `email-security`.
-
-### Auth (Vigilbase One)
+Public allowlist: `security-headers`, `email-security`.
 
-| Command | Purpose |
-| --- | --- |
-| `vigilbase login` | Device-code sign-in (RFC 8628) at `one.vigilbase.com/device` |
-| `vigilbase logout` | Clear `~/.config/vigilbase/credentials.json` |
-| `vigilbase whoami` | Show local / live One session |
-
-Sensitive tools unlocked after login:
+## Auth-required tools (after login)
 
 ```bash
 vigilbase login
@@ -72,14 +52,34 @@ vigilbase run react2shell https://app.example.com
 vigilbase run fortibleed-check example.com
 ```
 
-Public tools stay usable while signed out. Sensitive tools route through Vigilbase One after `vigilbase login`.
+## Account & One management (login required)
+
+```bash
+vigilbase account
+vigilbase account services
+vigilbase account org
+vigilbase account endpoints
+vigilbase account sessions
+vigilbase account invites
+vigilbase account invites create --email user@example.com --confirm
+vigilbase billing summary
+vigilbase billing portal
+vigilbase runs list
+vigilbase runs get <id>
+vigilbase cf zones
+vigilbase cf checkup status
+vigilbase watchdog list
+```
+
+Every command supports `-j` / `--json`. Async work shows a spinner on TTY (disabled for `--json`, CI, and non-TTY).
 
 ## Agent-friendly mode
 
 ```bash
 vigilbase list --json
 vigilbase run security-headers https://vigilbase.com --json
-vigilbase email vigilbase.com --json
+vigilbase account --json
+vigilbase runs list --json
 ```
 
 | Exit code | Meaning |
@@ -87,52 +87,3 @@ vigilbase email vigilbase.com --json
 | `0` | Success |
 | `1` | Error |
 | `2` | Rate limited (`HTTP 429`) |
-
-## Local development
-
-For pointing the CLI at local servers (not shown in `vigilbase help`):
-
-| Env / flag | Description |
-| --- | --- |
-| `VIGILBASE_BASE_URL` / `--base-url` | Public API (default `https://vigilbase.com`) |
-| `VIGILBASE_ONE_URL` / `--one-url` | One API (default `https://one.vigilbase.com`) |
-| `VIGILBASE_CLIENT_ID` / `--client-id` | OAuth client id for device auth |
-| `VIGILBASE_CONFIG_DIR` | Override `~/.config/vigilbase` |
-
-```bash
-vigilbase doctor --base-url http://localhost:3001
-vigilbase login --one-url http://localhost:3000
-```
-
-## Architecture notes
-
-- **Public surface** (`VigilbaseClient`) talks only to vigilbase.com agent/tool endpoints — no credentials.
-- **One surface** stores tokens from Better Auth `POST /api/auth/device/code` + `/device/token` under `~/.config/vigilbase/credentials.json`.
-- Headless / CI: `vigilbase login --token "$VIGILBASE_ONE_TOKEN"` or `--no-open` and approve the printed URL elsewhere.
-
-## Smoke test
-
-```bash
-VIGILBASE_BASE_URL=https://vigilbase.com pnpm --filter @vigilbase/cli smoke:e2e
-```
-
-## Publishing
-
-See [PUBLISH.md](./PUBLISH.md) for npm org setup and `npm publish` steps.
-
-## Library API
-
-```ts
-import { runCli, VigilbaseClient, createConfig } from '@vigilbase/cli'
-
-await runCli({ argv: ['list', '--json'] })
-
-const client = new VigilbaseClient(createConfig())
-await client.listTools()
-```
-
-## Related
-
-- OpenAPI: https://vigilbase.com/openapi.json
-- Skills index: https://vigilbase.com/.well-known/agent-skills/index.json
-- Device auth docs: https://better-auth.com/docs/plugins/device-authorization

package/dist/cli.d.ts

@@ -1,12 +1,12 @@
 import { createConfig } from './lib/config.js';
 import { type ExitCode } from './types.js';
-export declare const CLI_VERSION = "0.1.0";
+import { CLI_VERSION } from './version.js';
+export { CLI_VERSION };
 export type RunCliOptions = {
     argv?: string[];
     stdout?: NodeJS.WritableStream;
     stderr?: NodeJS.WritableStream;
     env?: NodeJS.ProcessEnv;
-    /** Injected for tests — skip real device-auth polling. */
     loginHandler?: (config: ReturnType<typeof createConfig>) => Promise<ExitCode>;
 };
 export declare function runCli(options?: RunCliOptions): Promise<ExitCode>;

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAwB9C,OAAO,EAA4B,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAA;AAEpE,eAAO,MAAM,WAAW,UAAU,CAAA;AAsFlC,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9E,CAAA;AAED,wBAAsB,MAAM,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4hB3E"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAM9C,OAAO,EAA4B,KAAK,QAAQ,EAAE,MAAM,YAAY,CAAA;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAE1C,OAAO,EAAE,WAAW,EAAE,CAAA;AAmFtB,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAA;IAC9B,MAAM,CAAC,EAAE,MAAM,CAAC,cAAc,CAAA;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,YAAY,CAAC,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAC9E,CAAA;AAED,wBAAsB,MAAM,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,QAAQ,CAAC,CA6G3E"}

package/dist/cli.js

@@ -1,15 +1,14 @@
 import { parseArgs } from 'node:util';
-import { clearOneCredentials, DeviceAuthError, getOneAccessToken, readCredentials, requestDeviceCode, waitForDeviceAuthorization, writeOneCredentials, } from './auth/index.js';
+import { DeviceAuthError } from './auth/index.js';
 import { VigilbaseApiError, VigilbaseClient } from './lib/client.js';
 import { createConfig } from './lib/config.js';
-import { isOneAuthRequiredTool, isOneExecutableTool, ONE_AUTH_REQUIRED_TOOLS, resolveToolDefinition, VigilbaseOneClient, } from './lib/one-client.js';
 import { renderBanner, shouldShowBanner } from './lib/banner.js';
-import { createWriter, formatError, formatExecuteResult, formatToolDescription, formatToolsList, } from './lib/format.js';
+import { createWriter, formatError } from './lib/format.js';
 import { HELP_TAGLINE, HELP_TEXT, helpForCommand } from './lib/help.js';
-import { formatUserCode, isHeadlessEnvironment, openUrlInBrowser, resolveDeviceVerificationUrl, } from './lib/open-url.js';
-import { shouldShowProgress, startProgress, withProgress } from './lib/progress.js';
+import { getCommandHandler } from './commands/index.js';
 import { EXIT } from './types.js';
-export const CLI_VERSION = '0.1.0';
+import { CLI_VERSION } from './version.js';
+export { CLI_VERSION };
 function parseCli(argv) {
     const { values, positionals } = parseArgs({
         args: argv,
@@ -29,9 +28,15 @@ function parseCli(argv) {
             public: { type: 'boolean', default: false },
             token: { type: 'string' },
             'no-open': { type: 'boolean', default: false },
+            email: { type: 'string' },
+            role: { type: 'string' },
+            confirm: { type: 'boolean', default: false },
+            'account-id': { type: 'string' },
+            tool: { type: 'string' },
+            limit: { type: 'string' },
+            'target-id': { type: 'string' },
         },
     });
-    // Map parseArgs flag names onto is*/has* props (CLI flags stay --json/--help/…).
     return {
         positionals,
         values: {
@@ -48,6 +53,15 @@ function parseCli(argv) {
             isPublic: Boolean(values.public),
             token: typeof values.token === 'string' ? values.token : undefined,
             isNoOpen: Boolean(values['no-open']),
+            email: typeof values.email === 'string' ? values.email : undefined,
+            role: typeof values.role === 'string' ? values.role : undefined,
+            isConfirm: Boolean(values.confirm),
+            'account-id': typeof values['account-id'] === 'string'
+                ? values['account-id']
+                : undefined,
+            tool: typeof values.tool === 'string' ? values.tool : undefined,
+            limit: typeof values.limit === 'string' ? values.limit : undefined,
+            'target-id': typeof values['target-id'] === 'string' ? values['target-id'] : undefined,
         },
     };
 }
@@ -117,376 +131,22 @@ export async function runCli(options = {}) {
             clientId: parsed.values['client-id'],
             timeoutMs: parseTimeout(parsed.values.timeout),
         });
-        const client = new VigilbaseClient(config);
-        switch (command) {
-            case 'list':
-            case 'tools': {
-                const catalog = await client.listTools();
-                const accessToken = await getOneAccessToken(config);
-                const authenticated = Boolean(accessToken);
-                if (mode === 'json') {
-                    writer.stdout(JSON.stringify({
-                        ...catalog,
-                        authenticated,
-                        oneAuthRequiredTools: [...ONE_AUTH_REQUIRED_TOOLS],
-                        oneExecutableTools: authenticated
-                            ? [
-                                ...new Set([
-                                    ...catalog.tools.map((tool) => tool.toolName),
-                                    ...ONE_AUTH_REQUIRED_TOOLS,
-                                ]),
-                            ]
-                            : catalog.tools.map((tool) => tool.toolName),
-                    }, null, 2));
-                }
-                else {
-                    formatToolsList(catalog, mode, writer, {
-                        sensitiveTools: ONE_AUTH_REQUIRED_TOOLS,
-                        isAuthenticated: authenticated,
-                    });
-                }
-                return EXIT.OK;
-            }
-            case 'run':
-            case 'headers':
-            case 'email': {
-                let toolName;
-                let target;
-                if (command === 'headers') {
-                    toolName = 'security-headers';
-                    target = rest[0] ?? '';
-                }
-                else if (command === 'email') {
-                    toolName = 'email-security';
-                    target = rest[0] ?? '';
-                }
-                else {
-                    toolName = rest[0] ?? '';
-                    target = rest[1] ?? '';
-                }
-                if (!toolName || !target) {
-                    throw new Error(command === 'run'
-                        ? 'Usage: vigilbase run <tool> <target>'
-                        : `Usage: vigilbase ${command} <target>`);
-                }
-                const via = parsed.values.via;
-                if (via && via !== 'one' && via !== 'public') {
-                    throw new Error('--via must be one of: public, one');
-                }
-                const accessToken = await getOneAccessToken(config);
-                const forcePublic = Boolean(parsed.values.isPublic) || via === 'public';
-                const forceOne = via === 'one';
-                // Default routing:
-                // - sensitive tools → One (requires login)
-                // - public tools → public agent API unless --via one
-                const useOne = !forcePublic && (forceOne || isOneAuthRequiredTool(toolName));
-                if (useOne) {
-                    if (!accessToken) {
-                        throw new Error(`Tool "${toolName}" requires Vigilbase One auth. Run \`vigilbase login\` first.`);
-                    }
-                    if (!isOneExecutableTool(toolName)) {
-                        throw new Error(`Tool "${toolName}" is not executable via Vigilbase One CLI yet.`);
-                    }
-                    const oneClient = new VigilbaseOneClient(config, accessToken);
-                    const oneResult = await withProgress(`Running ${toolName} against ${target}`, mode, () => oneClient.executeTool(toolName, target));
-                    formatExecuteResult({
-                        success: Boolean(oneResult.success),
-                        toolName,
-                        target,
-                        grade: oneResult.data?.grade ?? null,
-                        gradeScore: oneResult.data?.gradeScore ?? null,
-                        result: oneResult.data?.result ?? null,
-                        error: oneResult.error ?? null,
-                        uiUrl: `${config.oneBaseUrl}/dashboard/tools/${toolName}`,
-                    }, mode, writer);
-                    return oneResult.success ? EXIT.OK : EXIT.ERROR;
-                }
-                const result = await withProgress(`Running ${toolName} against ${target}`, mode, () => client.executeTool(toolName, target));
-                formatExecuteResult(result, mode, writer);
-                return result.success ? EXIT.OK : EXIT.ERROR;
-            }
-            case 'describe': {
-                const toolName = rest[0];
-                if (!toolName)
-                    throw new Error('Usage: vigilbase describe <tool>');
-                const catalog = await client.listTools();
-                const tool = resolveToolDefinition(toolName, catalog.tools, config.oneBaseUrl);
-                if (!tool) {
-                    throw new Error(`Unknown tool "${toolName}". Run \`vigilbase list\` for the allowlist.`);
-                }
-                let skillMarkdown;
-                if (!parsed.values.isNoSkill) {
-                    try {
-                        skillMarkdown = await client.fetchSkillMarkdown(tool.skillUrl);
-                    }
-                    catch {
-                        // Sensitive tools may not publish public skill docs yet.
-                    }
-                }
-                formatToolDescription(tool, mode, writer, skillMarkdown);
-                return EXIT.OK;
-            }
-            case 'skill': {
-                const toolName = rest[0];
-                if (!toolName)
-                    throw new Error('Usage: vigilbase skill <tool>');
-                const catalog = await client.listTools();
-                const definition = resolveToolDefinition(toolName, catalog.tools, config.oneBaseUrl);
-                if (!definition) {
-                    throw new Error(`Unknown tool "${toolName}". Run \`vigilbase list\` for the allowlist.`);
-                }
-                const skillMarkdown = await client.fetchSkillMarkdown(definition.skillUrl);
-                if (mode === 'json') {
-                    writer.stdout(JSON.stringify({
-                        toolName: definition.toolName,
-                        skillUrl: definition.skillUrl,
-                        content: skillMarkdown,
-                    }, null, 2));
-                }
-                else {
-                    writer.stdout(skillMarkdown.trimEnd());
-                }
-                return EXIT.OK;
-            }
-            case 'badge': {
-                const domain = rest[0];
-                if (!domain)
-                    throw new Error('Usage: vigilbase badge <domain>');
-                const styleRaw = parsed.values.style ?? 'default';
-                if (styleRaw !== 'default' && styleRaw !== 'compact' && styleRaw !== 'mini') {
-                    throw new Error('--style must be one of: default, compact, mini');
-                }
-                const url = client.badgeUrl(domain, styleRaw);
-                if (mode === 'json') {
-                    writer.stdout(JSON.stringify({ domain, style: styleRaw, url }, null, 2));
-                }
-                else {
-                    writer.stdout(url);
-                }
-                return EXIT.OK;
-            }
-            case 'doctor': {
-                try {
-                    const catalog = await client.listTools();
-                    const accessToken = await getOneAccessToken(config);
-                    const payload = {
-                        ok: true,
-                        publicBaseUrl: config.publicBaseUrl,
-                        oneBaseUrl: config.oneBaseUrl,
-                        clientId: config.clientId,
-                        authenticated: Boolean(accessToken),
-                        toolCount: catalog.tools.length,
-                        tools: catalog.tools.map((tool) => tool.toolName),
-                        openapi: catalog.openapi ?? null,
-                        skillsIndex: catalog.skillsIndex ?? null,
-                        rateLimit: catalog.rateLimit ?? null,
-                    };
-                    if (mode === 'json') {
-                        writer.stdout(JSON.stringify(payload, null, 2));
-                    }
-                    else {
-                        writer.stdout(`ok  public=${config.publicBaseUrl}  one=${config.oneBaseUrl}  auth=${payload.authenticated ? 'in' : 'out'}  tools=${payload.tools.join(',')}`);
-                    }
-                    return EXIT.OK;
-                }
-                catch (error) {
-                    formatError(error, mode, writer);
-                    return error instanceof VigilbaseApiError && error.status === 429
-                        ? EXIT.RATE_LIMITED
-                        : EXIT.ERROR;
-                }
-            }
-            case 'login': {
-                if (options.loginHandler) {
-                    return options.loginHandler(config);
-                }
-                const explicitToken = parsed.values.token?.trim() ||
-                    process.env.VIGILBASE_ONE_TOKEN?.trim() ||
-                    '';
-                // Headless / CI: accept a bearer session token directly.
-                if (explicitToken) {
-                    const oneClient = new VigilbaseOneClient(config, explicitToken);
-                    let user;
-                    try {
-                        const session = await oneClient.getSession();
-                        if (!session.user) {
-                            throw new Error('Token did not resolve to a Vigilbase One session.');
-                        }
-                        user = {
-                            id: session.user.id,
-                            email: session.user.email ?? undefined,
-                            name: session.user.name ?? undefined,
-                        };
-                    }
-                    catch (error) {
-                        throw new Error(error instanceof Error
-                            ? `Invalid --token / VIGILBASE_ONE_TOKEN: ${error.message}`
-                            : 'Invalid --token / VIGILBASE_ONE_TOKEN');
-                    }
-                    await writeOneCredentials(config, {
-                        accessToken: explicitToken,
-                        tokenType: 'Bearer',
-                        user,
-                        obtainedAt: new Date().toISOString(),
-                    });
-                    if (mode === 'json') {
-                        writer.stdout(JSON.stringify({
-                            success: true,
-                            mode: 'token',
-                            oneBaseUrl: config.oneBaseUrl,
-                            user: user ?? null,
-                            sensitiveTools: [...ONE_AUTH_REQUIRED_TOOLS],
-                        }, null, 2));
-                    }
-                    else {
-                        writer.stdout(`signed in${user?.email ? `  ${user.email}` : ''}  (token)`);
-                    }
-                    return EXIT.OK;
-                }
-                const preferNoOpen = Boolean(parsed.values.isNoOpen) || isHeadlessEnvironment(process.env);
-                writer.stderr(`login  ${config.oneBaseUrl}`);
-                const device = await requestDeviceCode(config);
-                const verifyUrl = resolveDeviceVerificationUrl(config.oneBaseUrl, device);
-                const prettyCode = formatUserCode(device.user_code);
-                writer.stderr(`code   ${prettyCode}`);
-                writer.stderr(`url    ${verifyUrl}`);
-                if (preferNoOpen) {
-                    writer.stderr('headless  approve the URL on any signed-in browser, or re-run with --token');
-                }
-                else {
-                    const opened = openUrlInBrowser(verifyUrl);
-                    if (opened.isOpened) {
-                        writer.stderr('browser opened — approve the device code');
-                    }
-                    else {
-                        writer.stderr(`browser not opened (${opened.reason ?? 'failed'}) — paste the URL above`);
-                    }
-                }
-                const showSpinner = shouldShowProgress(mode);
-                const progress = startProgress('waiting for approval', {
-                    isEnabled: showSpinner,
-                    expectedMs: Math.min(Math.max(device.expires_in, 30) * 1000, 180_000),
-                });
-                if (!showSpinner && mode !== 'json') {
-                    writer.stderr('waiting for approval…');
-                }
-                let token;
-                try {
-                    token = await waitForDeviceAuthorization(config, device);
-                    progress.stop('✓ approved');
-                }
-                catch (error) {
-                    progress.stop('✗ login failed');
-                    throw error;
-                }
-                const expiresAt = typeof token.expires_in === 'number'
-                    ? new Date(Date.now() + token.expires_in * 1000).toISOString()
-                    : undefined;
-                let user;
-                try {
-                    const oneClient = new VigilbaseOneClient(config, token.access_token);
-                    const session = await oneClient.getSession();
-                    if (session.user) {
-                        user = {
-                            id: session.user.id,
-                            email: session.user.email ?? undefined,
-                            name: session.user.name ?? undefined,
-                        };
-                    }
-                }
-                catch {
-                    // Session enrichment is best-effort; token storage still succeeds.
-                }
-                await writeOneCredentials(config, {
-                    accessToken: token.access_token,
-                    refreshToken: token.refresh_token,
-                    tokenType: token.token_type,
-                    scope: token.scope,
-                    expiresAt,
-                    user,
-                    obtainedAt: new Date().toISOString(),
-                });
-                if (mode === 'json') {
-                    writer.stdout(JSON.stringify({
-                        success: true,
-                        mode: 'device',
-                        oneBaseUrl: config.oneBaseUrl,
-                        expiresAt: expiresAt ?? null,
-                        scope: token.scope ?? null,
-                        user: user ?? null,
-                        sensitiveTools: [...ONE_AUTH_REQUIRED_TOOLS],
-                    }, null, 2));
-                }
-                else {
-                    writer.stdout(`signed in${user?.email ? `  ${user.email}` : ''}`);
-                }
-                return EXIT.OK;
-            }
-            case 'logout': {
-                const cleared = await clearOneCredentials(config);
-                if (mode === 'json') {
-                    writer.stdout(JSON.stringify({ success: true, cleared }, null, 2));
-                }
-                else if (cleared) {
-                    writer.stdout('Signed out. Local One credentials removed.');
-                }
-                else {
-                    writer.stdout('Already signed out.');
-                }
-                return EXIT.OK;
-            }
-            case 'whoami': {
-                const credentials = await readCredentials(config);
-                // Honor expiry the same way list/run do (getOneAccessToken).
-                const accessToken = await getOneAccessToken(config);
-                let liveUser = accessToken ? (credentials.one?.user ?? null) : null;
-                if (accessToken) {
-                    try {
-                        const session = await new VigilbaseOneClient(config, accessToken).getSession();
-                        if (session.user) {
-                            liveUser = {
-                                id: session.user.id,
-                                email: session.user.email ?? undefined,
-                                name: session.user.name ?? undefined,
-                            };
-                        }
-                    }
-                    catch {
-                        // Keep stored user if live session probe fails.
-                    }
-                }
-                const signedIn = Boolean(accessToken);
-                const payload = {
-                    authenticated: signedIn,
-                    oneBaseUrl: config.oneBaseUrl,
-                    user: liveUser,
-                    expiresAt: credentials.one?.expiresAt ?? null,
-                    scope: credentials.one?.scope ?? null,
-                    obtainedAt: credentials.one?.obtainedAt ?? null,
-                    sensitiveTools: signedIn ? [...ONE_AUTH_REQUIRED_TOOLS] : [],
-                };
-                if (mode === 'json') {
-                    writer.stdout(JSON.stringify(payload, null, 2));
-                }
-                else if (!signedIn) {
-                    writer.stdout('Not signed in. Public tools still work.');
-                    writer.stdout('Run `vigilbase login` to unlock website-security, react2shell, and fortibleed-check.');
-                }
-                else {
-                    writer.stdout(`Signed in to ${config.oneBaseUrl}`);
-                    if (liveUser?.email) {
-                        writer.stdout(`User: ${liveUser.email}`);
-                    }
-                    if (credentials.one?.expiresAt) {
-                        writer.stdout(`Expires: ${credentials.one.expiresAt}`);
-                    }
-                    writer.stdout(`Sensitive tools: ${ONE_AUTH_REQUIRED_TOOLS.join(', ')}`);
-                }
-                return EXIT.OK;
-            }
-            default:
-                throw new Error(`Unknown command "${command}". Run \`vigilbase help\` for usage.`);
+        const publicClient = new VigilbaseClient(config);
+        const handler = getCommandHandler(command);
+        if (!handler) {
+            throw new Error(`Unknown command "${command}". Run \`vigilbase help\` for usage.`);
         }
+        return await handler({
+            command,
+            rest,
+            values: parsed.values,
+            mode,
+            config,
+            writer,
+            publicClient,
+            env: process.env,
+            loginHandler: options.loginHandler,
+        });
     }
     catch (error) {
         const mode = argv.includes('--json') || argv.includes('-j') ? 'json' : 'text';