very-happy-cli 0.2.159 → 0.2.160

package/dist/auth-BDOVh5h5.cjs

@@ -0,0 +1,220 @@
+'use strict';
+
+var chalk = require('chalk');
+var persistence = require('./persistence-yKTH3-5X.cjs');
+var auth = require('./auth-ba4WMYrN.cjs');
+var configuration = require('./configuration-BSYpcPwE.cjs');
+var node_fs = require('node:fs');
+var node_readline = require('node:readline');
+var controlClient = require('./controlClient-Bcwv3D21.cjs');
+var logger = require('./logger-CS0mw3fa.cjs');
+var os = require('node:os');
+var authRelay = require('./authRelay-BdYkC1Po.cjs');
+require('node:fs/promises');
+require('zod');
+require('node:path');
+require('./package-BwMrPwqH.cjs');
+require('node:crypto');
+require('tweetnacl');
+require('node:util');
+require('axios');
+require('./time-DCuTyook.cjs');
+require('./browser-Y6Bl8L_O.cjs');
+require('open');
+
+function localMachineIdentityStatus(machineId) {
+  if (machineId) {
+    return {
+      configured: true,
+      label: "Local machine identity configured (relay registration not checked)"
+    };
+  }
+  return {
+    configured: false,
+    label: "Local machine identity missing",
+    nextStep: 'Run "very-happy auth login --force" to create and register one'
+  };
+}
+
+const DEFAULT_SERVER_URL = "https://veryhappy.dev";
+async function handleAuthCommand(args) {
+  const subcommand = args[0];
+  if (!subcommand || subcommand === "help" || subcommand === "--help" || subcommand === "-h") {
+    showAuthHelp();
+    return;
+  }
+  switch (subcommand) {
+    case "login":
+      await handleAuthLogin(args.slice(1));
+      break;
+    case "logout":
+      await handleAuthLogout();
+      break;
+    case "status":
+      await handleAuthStatus();
+      break;
+    default:
+      console.error(chalk.red(`Unknown auth subcommand: ${subcommand}`));
+      showAuthHelp();
+      process.exit(1);
+  }
+}
+function showAuthHelp() {
+  console.log(`
+${chalk.bold("very-happy auth")} - Authentication management
+
+${chalk.bold("Usage:")}
+  very-happy auth login [--force]    Authenticate with Very Happy
+  very-happy auth logout             Remove authentication and machine data
+  very-happy auth status             Show authentication status
+  very-happy auth help               Show this help message
+
+${chalk.bold("Options:")}
+  --force    Clear credentials, machine ID, and stop daemon before re-auth
+
+${chalk.gray("Security: the configured Very Happy server is a trusted relay and account service.")}
+${chalk.gray("It can recover account material, access relayed content, and act through capabilities")}
+${chalk.gray("exposed by an online daemon. Use a server you trust.")}
+`);
+}
+function printDaemonNextStep() {
+  console.log(chalk.bold("\nNext: start the machine daemon"));
+  if (process.env.HAPPY_SERVER_URL || process.env.HAPPY_WEBAPP_URL) {
+    console.log(chalk.yellow("  Keep the same HAPPY_SERVER_URL and HAPPY_WEBAPP_URL environment when starting it."));
+  }
+  console.log(`  ${chalk.cyan("very-happy daemon start")}`);
+  console.log(chalk.gray("  It starts in the background and keeps this machine available in Web."));
+}
+async function handleAuthLogin(args) {
+  const forceAuth = args.includes("--force") || args.includes("-f");
+  if (forceAuth) {
+    console.log(chalk.yellow("Force authentication requested."));
+    console.log(chalk.gray("This will:"));
+    console.log(chalk.gray("  \u2022 Clear existing credentials"));
+    console.log(chalk.gray("  \u2022 Clear machine ID"));
+    console.log(chalk.gray("  \u2022 Stop daemon if running"));
+    console.log(chalk.gray("  \u2022 Re-authenticate and register machine\n"));
+    try {
+      logger.logger.debug("Stopping daemon for force auth...");
+      await controlClient.stopDaemon();
+      console.log(chalk.gray("\u2713 Stopped daemon"));
+    } catch (error) {
+      logger.logger.debug("Daemon was not running or failed to stop:", error);
+    }
+    await persistence.clearCredentials();
+    console.log(chalk.gray("\u2713 Cleared credentials"));
+    await persistence.clearMachineId();
+    console.log(chalk.gray("\u2713 Cleared machine ID"));
+    console.log("");
+  }
+  if (!forceAuth) {
+    const existingCreds = await persistence.readCredentials();
+    const settings = await persistence.readSettings();
+    if (existingCreds && settings?.machineId) {
+      const relayProblem = authRelay.credentialRelayProblem(existingCreds.authServerUrl, configuration.configuration.serverUrl);
+      if (relayProblem) {
+        console.log(chalk.red(`\u2717 ${relayProblem}`));
+        console.log(chalk.yellow("  Use a separate HAPPY_HOME_DIR for each relay (recommended),"));
+        console.log(chalk.yellow("  or run 'very-happy auth login --force' to replace this home's credentials."));
+        process.exitCode = 1;
+        return;
+      }
+      console.log(chalk.green("\u2713 Already authenticated"));
+      console.log(chalk.gray(`  Machine ID: ${settings.machineId}`));
+      console.log(chalk.gray(`  Host: ${os.hostname()}`));
+      console.log(chalk.gray(`  Use 'very-happy auth login --force' to re-authenticate`));
+      printDaemonNextStep();
+      return;
+    } else if (existingCreds && !settings?.machineId) {
+      console.log(chalk.yellow("\u26A0\uFE0F  Credentials exist but machine ID is missing"));
+      console.log(chalk.gray("  This can happen if --auth flag was used previously"));
+      console.log(chalk.gray("  Fixing by setting up machine...\n"));
+    }
+  }
+  try {
+    const result = await auth.authAndSetupMachineIfNeeded();
+    console.log(chalk.green("\n\u2713 Authentication successful"));
+    console.log(chalk.gray(`  Machine ID: ${result.machineId}`));
+    printDaemonNextStep();
+  } catch (error) {
+    console.error(chalk.red("Authentication failed:"), error instanceof Error ? error.message : "Unknown error");
+    process.exit(1);
+  }
+}
+async function handleAuthLogout() {
+  const happyDir = configuration.configuration.happyHomeDir;
+  const credentials = await persistence.readCredentials();
+  if (!credentials) {
+    console.log(chalk.yellow("Not currently authenticated"));
+    return;
+  }
+  console.log(chalk.blue("This will log you out of Happy"));
+  console.log(chalk.yellow("\u26A0\uFE0F  You will need to re-authenticate to use Happy again"));
+  const rl = node_readline.createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  const answer = await new Promise((resolve) => {
+    rl.question(chalk.yellow("Are you sure you want to log out? (y/N): "), resolve);
+  });
+  rl.close();
+  if (answer.toLowerCase() === "y" || answer.toLowerCase() === "yes") {
+    try {
+      try {
+        await controlClient.stopDaemon();
+        console.log(chalk.gray("Stopped daemon"));
+      } catch {
+      }
+      if (node_fs.existsSync(happyDir)) {
+        node_fs.rmSync(happyDir, { recursive: true, force: true });
+      }
+      console.log(chalk.green("\u2713 Successfully logged out"));
+      console.log(chalk.gray('  Run "very-happy auth login" to authenticate again'));
+    } catch (error) {
+      throw new Error(`Failed to logout: ${error instanceof Error ? error.message : "Unknown error"}`);
+    }
+  } else {
+    console.log(chalk.blue("Logout cancelled"));
+  }
+}
+async function handleAuthStatus() {
+  const credentials = await persistence.readCredentials();
+  const settings = await persistence.readSettings();
+  console.log(chalk.bold("\nAuthentication Status\n"));
+  if (!credentials) {
+    console.log(chalk.red("\u2717 Not authenticated"));
+    console.log(chalk.gray('  Run "very-happy auth login" to authenticate'));
+    return;
+  }
+  const relayProblem = authRelay.credentialRelayProblem(credentials.authServerUrl, configuration.configuration.serverUrl);
+  if (relayProblem) {
+    console.log(chalk.red(`\u2717 Credentials found, but not valid for the configured relay: ${relayProblem}`));
+    console.log(chalk.gray("  Use another HAPPY_HOME_DIR or run 'very-happy auth login --force'."));
+  } else {
+    console.log(chalk.green("\u2713 Authenticated to the configured relay"));
+    console.log(chalk.gray(`  Relay: ${credentials.authServerUrl ?? DEFAULT_SERVER_URL}`));
+  }
+  const machineIdentity = localMachineIdentityStatus(settings?.machineId);
+  if (machineIdentity.configured) {
+    console.log(chalk.green(`\u2713 ${machineIdentity.label}`));
+    console.log(chalk.gray(`  Machine ID: ${settings.machineId}`));
+    console.log(chalk.gray(`  Host: ${os.hostname()}`));
+  } else {
+    console.log(chalk.yellow(`\u26A0\uFE0F  ${machineIdentity.label}`));
+    console.log(chalk.gray(`  ${machineIdentity.nextStep}`));
+  }
+  console.log(chalk.gray(`
+  Data directory: ${configuration.configuration.happyHomeDir}`));
+  try {
+    const running = await controlClient.checkIfDaemonRunningAndCleanupStaleState();
+    if (running) {
+      console.log(chalk.green("\u2713 Daemon running"));
+    } else {
+      console.log(chalk.gray("\u2717 Daemon not running"));
+    }
+  } catch {
+    console.log(chalk.gray("\u2717 Daemon not running"));
+  }
+}
+
+exports.handleAuthCommand = handleAuthCommand;

package/dist/auth-Cwutmdsa.mjs

@@ -0,0 +1,225 @@
+import { e as encodeBase64, c as credentialRelayProblem, f as encodeBase64Url, d as decodeBase64 } from './authRelay-DSAvg1uv.mjs';
+import { c as configuration } from './configuration-RfeNjFmd.mjs';
+import { randomUUID, randomBytes } from 'node:crypto';
+import tweetnacl from 'tweetnacl';
+import axios from 'axios';
+import { d as delay } from './time-D0XyHOid.mjs';
+import { readCredentials, readSettingsOutcome, updateSettings, writeCredentialsLegacy, writeCredentialsDataKey } from './persistence-HGW_ZVs9.mjs';
+import { o as openBrowser } from './browser-jh2P0UVZ.mjs';
+import { l as logger } from './logger-6HYUEXNk.mjs';
+
+function generateWebAuthUrl(publicKey) {
+  const publicKeyBase64 = encodeBase64(publicKey, "base64url");
+  return `${configuration.webappUrl}/terminal/connect#key=${publicKeyBase64}`;
+}
+
+function decideMachineId(input) {
+  const { read, newAuth } = input;
+  if (read.kind === "unreadable") {
+    return {
+      action: "refuse",
+      reason: `settings exist but could not be read (${read.error}); refusing to mint a new machine id \u2014 fix or remove the settings file, or run \`very-happy auth login --force\` to deliberately re-register this machine`
+    };
+  }
+  if (newAuth) return { action: "mint", reason: "new-auth" };
+  if (read.kind === "absent") return { action: "mint", reason: "no-settings-file" };
+  const existing = read.settings.machineId;
+  if (typeof existing === "string" && existing.length > 0) {
+    return { action: "reuse", machineId: existing };
+  }
+  return { action: "mint", reason: "no-machine-id" };
+}
+
+async function doAuth() {
+  console.clear();
+  const secret = new Uint8Array(randomBytes(32));
+  const keypair = tweetnacl.box.keyPair.fromSecretKey(secret);
+  const claimSecret = encodeBase64Url(randomBytes(32));
+  try {
+    if (process.env.DEBUG) {
+      console.log(`[AUTH DEBUG] Sending auth request to: ${configuration.serverUrl}/v1/auth/request`);
+    }
+    const createResponse = await axios.post(`${configuration.serverUrl}/v1/auth/request`, {
+      publicKey: encodeBase64(keypair.publicKey),
+      supportsV2: true,
+      supportsClaimSecret: true,
+      claimSecret,
+      pairingAction: "create"
+    }, {
+      headers: {
+        "X-Happy-Client": `cli/${configuration.currentCliVersion}`
+      }
+    });
+    if (createResponse.data?.protocolVersion !== 3 || createResponse.data?.claimSecretRequired !== true) {
+      console.log("This server does not support secure CLI pairing. Upgrade the server before signing in.");
+      return null;
+    }
+    if (process.env.DEBUG) {
+      console.log(`[AUTH DEBUG] Auth request sent successfully`);
+    }
+  } catch {
+    if (process.env.DEBUG) {
+      console.log("[AUTH DEBUG] Failed to send secure auth request");
+    }
+    console.log("Failed to create authentication request, please try again later.");
+    return null;
+  }
+  return await doWebAuth(keypair, claimSecret);
+}
+async function doWebAuth(keypair, claimSecret) {
+  console.clear();
+  console.log("\nWeb Authentication\n");
+  const webUrl = generateWebAuthUrl(keypair.publicKey);
+  console.log("Opening your browser...");
+  const browserOpened = await openBrowser(webUrl);
+  if (browserOpened) {
+    console.log("\u2713 Browser opened\n");
+    console.log("Complete authentication in your browser window.");
+  } else {
+    console.log("Could not open browser automatically.");
+  }
+  console.log("\nIf the browser did not open, please copy and paste this URL:");
+  console.log(webUrl);
+  console.log("");
+  return await waitForAuthentication(keypair, claimSecret);
+}
+async function waitForAuthentication(keypair, claimSecret) {
+  process.stdout.write("Waiting for authentication");
+  let dots = 0;
+  let cancelled = false;
+  const handleInterrupt = () => {
+    cancelled = true;
+    console.log("\n\nAuthentication cancelled.");
+    process.exit(0);
+  };
+  process.on("SIGINT", handleInterrupt);
+  try {
+    while (!cancelled) {
+      try {
+        const response = await axios.post(`${configuration.serverUrl}/v1/auth/request`, {
+          publicKey: encodeBase64(keypair.publicKey),
+          supportsV2: true,
+          supportsClaimSecret: true,
+          claimSecret,
+          pairingAction: "poll"
+        }, {
+          headers: {
+            "X-Happy-Client": `cli/${configuration.currentCliVersion}`
+          }
+        });
+        if (response.data?.protocolVersion !== 3 || response.data?.claimSecretRequired !== true) {
+          console.log("\n\nThis server does not support secure CLI pairing. Upgrade the server before signing in.");
+          return null;
+        }
+        if (response.data.state === "authorized") {
+          let token = response.data.token;
+          let r = decodeBase64(response.data.response);
+          let decrypted = decryptWithEphemeralKey(r, keypair.secretKey);
+          if (decrypted) {
+            if (decrypted.length === 32) {
+              const credentials = {
+                secret: decrypted,
+                token
+              };
+              await writeCredentialsLegacy(credentials);
+              console.log("\n\n\u2713 Authentication successful\n");
+              return {
+                encryption: {
+                  type: "legacy",
+                  secret: decrypted
+                },
+                token
+              };
+            } else {
+              if (decrypted[0] === 0) {
+                const credentials = {
+                  publicKey: decrypted.slice(1, 33),
+                  machineKey: randomBytes(32),
+                  token
+                };
+                await writeCredentialsDataKey(credentials);
+                console.log("\n\n\u2713 Authentication successful\n");
+                return {
+                  encryption: {
+                    type: "dataKey",
+                    publicKey: credentials.publicKey,
+                    machineKey: credentials.machineKey
+                  },
+                  token
+                };
+              } else {
+                console.log("\n\nFailed to decrypt response. Please try again.");
+                return null;
+              }
+            }
+          } else {
+            console.log("\n\nFailed to decrypt response. Please try again.");
+            return null;
+          }
+        }
+      } catch (error) {
+        console.log("\n\nFailed to check authentication status. Please try again.");
+        return null;
+      }
+      process.stdout.write("\rWaiting for authentication" + ".".repeat(dots % 3 + 1) + "   ");
+      dots++;
+      await delay(1e3);
+    }
+  } finally {
+    process.off("SIGINT", handleInterrupt);
+  }
+  return null;
+}
+function decryptWithEphemeralKey(encryptedBundle, recipientSecretKey) {
+  const ephemeralPublicKey = encryptedBundle.slice(0, 32);
+  const nonce = encryptedBundle.slice(32, 32 + tweetnacl.box.nonceLength);
+  const encrypted = encryptedBundle.slice(32 + tweetnacl.box.nonceLength);
+  const decrypted = tweetnacl.box.open(encrypted, nonce, ephemeralPublicKey, recipientSecretKey);
+  if (!decrypted) {
+    return null;
+  }
+  return decrypted;
+}
+async function authAndSetupMachineIfNeeded() {
+  logger.debug("[AUTH] Starting auth and machine setup...");
+  let credentials = await readCredentials();
+  let newAuth = false;
+  if (credentials) {
+    const relayProblem = credentialRelayProblem(credentials.authServerUrl, configuration.serverUrl);
+    if (relayProblem) {
+      throw new Error(
+        `${relayProblem} Use a separate HAPPY_HOME_DIR for this relay, or run \`very-happy auth login --force\` before starting an agent or daemon.`
+      );
+    }
+  }
+  if (!credentials) {
+    logger.debug("[AUTH] No credentials found, starting authentication flow...");
+    const authResult = await doAuth();
+    if (!authResult) {
+      throw new Error("Authentication failed or was cancelled");
+    }
+    credentials = authResult;
+    newAuth = true;
+  } else {
+    logger.debug("[AUTH] Using existing credentials");
+  }
+  const decision = decideMachineId({
+    read: await readSettingsOutcome(),
+    newAuth
+  });
+  if (decision.action === "refuse") {
+    throw new Error(`Cannot establish this machine's identity: ${decision.reason}`);
+  }
+  let machineId;
+  if (decision.action === "reuse") {
+    machineId = decision.machineId;
+  } else {
+    machineId = randomUUID();
+    logger.warn(`[AUTH] Registering a NEW machine id (${decision.reason})`);
+    await updateSettings(async (s) => ({ ...s, machineId }));
+  }
+  logger.debug(`[AUTH] Machine ID: ${machineId}`);
+  return { credentials, machineId };
+}
+
+export { authAndSetupMachineIfNeeded as a };

package/dist/auth-PYHZQNPp.mjs

@@ -0,0 +1,218 @@
+import chalk from 'chalk';
+import { readCredentials, readSettings, clearCredentials, clearMachineId } from './persistence-HGW_ZVs9.mjs';
+import { a as authAndSetupMachineIfNeeded } from './auth-Cwutmdsa.mjs';
+import { c as configuration } from './configuration-RfeNjFmd.mjs';
+import { existsSync, rmSync } from 'node:fs';
+import { createInterface } from 'node:readline';
+import { c as checkIfDaemonRunningAndCleanupStaleState, a as stopDaemon } from './controlClient-BGbDcgWS.mjs';
+import { l as logger } from './logger-6HYUEXNk.mjs';
+import os from 'node:os';
+import { c as credentialRelayProblem } from './authRelay-DSAvg1uv.mjs';
+import 'node:fs/promises';
+import 'zod';
+import 'node:path';
+import './package-BhaKlnxz.mjs';
+import 'node:crypto';
+import 'tweetnacl';
+import 'node:util';
+import 'axios';
+import './time-D0XyHOid.mjs';
+import './browser-jh2P0UVZ.mjs';
+import 'open';
+
+function localMachineIdentityStatus(machineId) {
+  if (machineId) {
+    return {
+      configured: true,
+      label: "Local machine identity configured (relay registration not checked)"
+    };
+  }
+  return {
+    configured: false,
+    label: "Local machine identity missing",
+    nextStep: 'Run "very-happy auth login --force" to create and register one'
+  };
+}
+
+const DEFAULT_SERVER_URL = "https://veryhappy.dev";
+async function handleAuthCommand(args) {
+  const subcommand = args[0];
+  if (!subcommand || subcommand === "help" || subcommand === "--help" || subcommand === "-h") {
+    showAuthHelp();
+    return;
+  }
+  switch (subcommand) {
+    case "login":
+      await handleAuthLogin(args.slice(1));
+      break;
+    case "logout":
+      await handleAuthLogout();
+      break;
+    case "status":
+      await handleAuthStatus();
+      break;
+    default:
+      console.error(chalk.red(`Unknown auth subcommand: ${subcommand}`));
+      showAuthHelp();
+      process.exit(1);
+  }
+}
+function showAuthHelp() {
+  console.log(`
+${chalk.bold("very-happy auth")} - Authentication management
+
+${chalk.bold("Usage:")}
+  very-happy auth login [--force]    Authenticate with Very Happy
+  very-happy auth logout             Remove authentication and machine data
+  very-happy auth status             Show authentication status
+  very-happy auth help               Show this help message
+
+${chalk.bold("Options:")}
+  --force    Clear credentials, machine ID, and stop daemon before re-auth
+
+${chalk.gray("Security: the configured Very Happy server is a trusted relay and account service.")}
+${chalk.gray("It can recover account material, access relayed content, and act through capabilities")}
+${chalk.gray("exposed by an online daemon. Use a server you trust.")}
+`);
+}
+function printDaemonNextStep() {
+  console.log(chalk.bold("\nNext: start the machine daemon"));
+  if (process.env.HAPPY_SERVER_URL || process.env.HAPPY_WEBAPP_URL) {
+    console.log(chalk.yellow("  Keep the same HAPPY_SERVER_URL and HAPPY_WEBAPP_URL environment when starting it."));
+  }
+  console.log(`  ${chalk.cyan("very-happy daemon start")}`);
+  console.log(chalk.gray("  It starts in the background and keeps this machine available in Web."));
+}
+async function handleAuthLogin(args) {
+  const forceAuth = args.includes("--force") || args.includes("-f");
+  if (forceAuth) {
+    console.log(chalk.yellow("Force authentication requested."));
+    console.log(chalk.gray("This will:"));
+    console.log(chalk.gray("  \u2022 Clear existing credentials"));
+    console.log(chalk.gray("  \u2022 Clear machine ID"));
+    console.log(chalk.gray("  \u2022 Stop daemon if running"));
+    console.log(chalk.gray("  \u2022 Re-authenticate and register machine\n"));
+    try {
+      logger.debug("Stopping daemon for force auth...");
+      await stopDaemon();
+      console.log(chalk.gray("\u2713 Stopped daemon"));
+    } catch (error) {
+      logger.debug("Daemon was not running or failed to stop:", error);
+    }
+    await clearCredentials();
+    console.log(chalk.gray("\u2713 Cleared credentials"));
+    await clearMachineId();
+    console.log(chalk.gray("\u2713 Cleared machine ID"));
+    console.log("");
+  }
+  if (!forceAuth) {
+    const existingCreds = await readCredentials();
+    const settings = await readSettings();
+    if (existingCreds && settings?.machineId) {
+      const relayProblem = credentialRelayProblem(existingCreds.authServerUrl, configuration.serverUrl);
+      if (relayProblem) {
+        console.log(chalk.red(`\u2717 ${relayProblem}`));
+        console.log(chalk.yellow("  Use a separate HAPPY_HOME_DIR for each relay (recommended),"));
+        console.log(chalk.yellow("  or run 'very-happy auth login --force' to replace this home's credentials."));
+        process.exitCode = 1;
+        return;
+      }
+      console.log(chalk.green("\u2713 Already authenticated"));
+      console.log(chalk.gray(`  Machine ID: ${settings.machineId}`));
+      console.log(chalk.gray(`  Host: ${os.hostname()}`));
+      console.log(chalk.gray(`  Use 'very-happy auth login --force' to re-authenticate`));
+      printDaemonNextStep();
+      return;
+    } else if (existingCreds && !settings?.machineId) {
+      console.log(chalk.yellow("\u26A0\uFE0F  Credentials exist but machine ID is missing"));
+      console.log(chalk.gray("  This can happen if --auth flag was used previously"));
+      console.log(chalk.gray("  Fixing by setting up machine...\n"));
+    }
+  }
+  try {
+    const result = await authAndSetupMachineIfNeeded();
+    console.log(chalk.green("\n\u2713 Authentication successful"));
+    console.log(chalk.gray(`  Machine ID: ${result.machineId}`));
+    printDaemonNextStep();
+  } catch (error) {
+    console.error(chalk.red("Authentication failed:"), error instanceof Error ? error.message : "Unknown error");
+    process.exit(1);
+  }
+}
+async function handleAuthLogout() {
+  const happyDir = configuration.happyHomeDir;
+  const credentials = await readCredentials();
+  if (!credentials) {
+    console.log(chalk.yellow("Not currently authenticated"));
+    return;
+  }
+  console.log(chalk.blue("This will log you out of Happy"));
+  console.log(chalk.yellow("\u26A0\uFE0F  You will need to re-authenticate to use Happy again"));
+  const rl = createInterface({
+    input: process.stdin,
+    output: process.stdout
+  });
+  const answer = await new Promise((resolve) => {
+    rl.question(chalk.yellow("Are you sure you want to log out? (y/N): "), resolve);
+  });
+  rl.close();
+  if (answer.toLowerCase() === "y" || answer.toLowerCase() === "yes") {
+    try {
+      try {
+        await stopDaemon();
+        console.log(chalk.gray("Stopped daemon"));
+      } catch {
+      }
+      if (existsSync(happyDir)) {
+        rmSync(happyDir, { recursive: true, force: true });
+      }
+      console.log(chalk.green("\u2713 Successfully logged out"));
+      console.log(chalk.gray('  Run "very-happy auth login" to authenticate again'));
+    } catch (error) {
+      throw new Error(`Failed to logout: ${error instanceof Error ? error.message : "Unknown error"}`);
+    }
+  } else {
+    console.log(chalk.blue("Logout cancelled"));
+  }
+}
+async function handleAuthStatus() {
+  const credentials = await readCredentials();
+  const settings = await readSettings();
+  console.log(chalk.bold("\nAuthentication Status\n"));
+  if (!credentials) {
+    console.log(chalk.red("\u2717 Not authenticated"));
+    console.log(chalk.gray('  Run "very-happy auth login" to authenticate'));
+    return;
+  }
+  const relayProblem = credentialRelayProblem(credentials.authServerUrl, configuration.serverUrl);
+  if (relayProblem) {
+    console.log(chalk.red(`\u2717 Credentials found, but not valid for the configured relay: ${relayProblem}`));
+    console.log(chalk.gray("  Use another HAPPY_HOME_DIR or run 'very-happy auth login --force'."));
+  } else {
+    console.log(chalk.green("\u2713 Authenticated to the configured relay"));
+    console.log(chalk.gray(`  Relay: ${credentials.authServerUrl ?? DEFAULT_SERVER_URL}`));
+  }
+  const machineIdentity = localMachineIdentityStatus(settings?.machineId);
+  if (machineIdentity.configured) {
+    console.log(chalk.green(`\u2713 ${machineIdentity.label}`));
+    console.log(chalk.gray(`  Machine ID: ${settings.machineId}`));
+    console.log(chalk.gray(`  Host: ${os.hostname()}`));
+  } else {
+    console.log(chalk.yellow(`\u26A0\uFE0F  ${machineIdentity.label}`));
+    console.log(chalk.gray(`  ${machineIdentity.nextStep}`));
+  }
+  console.log(chalk.gray(`
+  Data directory: ${configuration.happyHomeDir}`));
+  try {
+    const running = await checkIfDaemonRunningAndCleanupStaleState();
+    if (running) {
+      console.log(chalk.green("\u2713 Daemon running"));
+    } else {
+      console.log(chalk.gray("\u2717 Daemon not running"));
+    }
+  } catch {
+    console.log(chalk.gray("\u2717 Daemon not running"));
+  }
+}
+
+export { handleAuthCommand };