vibecheck-ai 1.0.7 → 1.0.8

package/dist/index.js

@@ -5,6 +5,8 @@ import * as path18 from 'path';
 import path18__default, { resolve, join, basename, dirname, isAbsolute, extname, sep } from 'path';
 import * as fs102 from 'fs/promises';
 import fs102__default, { readFile, copyFile, unlink, stat, mkdir, readdir, writeFile, access, constants } from 'fs/promises';
+import * as os5 from 'os';
+import os5__default from 'os';
 import * as crypto52 from 'crypto';
 import { randomUUID, createHash, createHmac } from 'crypto';
 import { glob } from 'glob';
@@ -12,8 +14,6 @@ import fg from 'fast-glob';
 import * as fs15 from 'fs';
 import fs15__default, { existsSync, promises, realpathSync } from 'fs';
 import { spawn, execSync, exec, execFileSync } from 'child_process';
-import * as os5 from 'os';
-import os5__default from 'os';
 import { promisify } from 'util';
 import { gzip, gunzip } from 'zlib';
 import * as net from 'net';
@@ -34,7 +34,7 @@ import 'ink';
 import 'react/jsx-runtime';
 import 'ink-spinner';
 import 'react';
-import * as p2 from '@clack/prompts';
+import * as p4 from '@clack/prompts';
 import { createConsola } from 'consola';
 import { Listr } from 'listr2';
 import ora from 'ora';
@@ -1080,6 +1080,457 @@ var init_config = __esm({
   }
 });
 
+// src/lib/credentials.ts
+var credentials_exports = {};
+__export(credentials_exports, {
+  clearCredentials: () => clearCredentials,
+  getApiUrl: () => getApiUrl,
+  getAuthToken: () => getAuthToken,
+  getCredentialsPath: () => getCredentialsPath,
+  getCurrentUser: () => getCurrentUser,
+  getWebUrl: () => getWebUrl,
+  hasCredentials: () => hasCredentials,
+  isLoggedIn: () => isLoggedIn,
+  loadCredentials: () => loadCredentials,
+  loginWithApiKey: () => loginWithApiKey,
+  loginWithEmailPassword: () => loginWithEmailPassword,
+  loginWithOAuth: () => loginWithOAuth,
+  loginWithOAuthToken: () => loginWithOAuthToken,
+  requestMagicLink: () => requestMagicLink,
+  saveCredentials: () => saveCredentials,
+  verifyMagicLink: () => verifyMagicLink
+});
+function obfuscate(data) {
+  const key = crypto52.createHash("sha256").update(OBFUSCATION_KEY).digest();
+  const iv = crypto52.randomBytes(16);
+  const cipher = crypto52.createCipheriv("aes-256-cbc", key, iv);
+  let encrypted = cipher.update(data, "utf8", "base64");
+  encrypted += cipher.final("base64");
+  return iv.toString("base64") + ":" + encrypted;
+}
+function deobfuscate(data) {
+  try {
+    const [ivBase64, encrypted] = data.split(":");
+    if (!ivBase64 || !encrypted) return data;
+    const key = crypto52.createHash("sha256").update(OBFUSCATION_KEY).digest();
+    const iv = Buffer.from(ivBase64, "base64");
+    const decipher = crypto52.createDecipheriv("aes-256-cbc", key, iv);
+    let decrypted = decipher.update(encrypted, "base64", "utf8");
+    decrypted += decipher.final("utf8");
+    return decrypted;
+  } catch {
+    return data;
+  }
+}
+async function ensureConfigDir() {
+  await fs102.mkdir(CONFIG_DIR, { recursive: true });
+}
+async function saveCredentials(credentials) {
+  await ensureConfigDir();
+  const toSave = {
+    ...credentials,
+    authToken: credentials.authToken ? obfuscate(credentials.authToken) : void 0,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  await fs102.writeFile(
+    CREDENTIALS_PATH,
+    JSON.stringify(toSave, null, 2),
+    { mode: 384 }
+    // Owner read/write only
+  );
+}
+async function loadCredentials() {
+  try {
+    const content = await fs102.readFile(CREDENTIALS_PATH, "utf-8");
+    const stored = JSON.parse(content);
+    if (stored.expiresAt && new Date(stored.expiresAt) < /* @__PURE__ */ new Date()) {
+      return {
+        valid: false,
+        error: "Token has expired. Please run `vibecheck login` to re-authenticate."
+      };
+    }
+    const credentials = {
+      ...stored,
+      authToken: stored.authToken ? deobfuscate(stored.authToken) : void 0
+    };
+    return {
+      valid: Boolean(credentials.authToken),
+      credentials
+    };
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      return {
+        valid: false,
+        error: "Not logged in. Run `vibecheck login` to authenticate."
+      };
+    }
+    return {
+      valid: false,
+      error: `Failed to load credentials: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+async function clearCredentials() {
+  try {
+    await fs102.unlink(CREDENTIALS_PATH);
+  } catch {
+  }
+}
+async function hasCredentials() {
+  try {
+    await fs102.access(CREDENTIALS_PATH);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function getAuthToken() {
+  if (process.env.VIBECHECK_AUTH_TOKEN) {
+    return process.env.VIBECHECK_AUTH_TOKEN;
+  }
+  const result = await loadCredentials();
+  return result.credentials?.authToken;
+}
+async function getApiUrl() {
+  if (process.env.VIBECHECK_API_URL) {
+    return process.env.VIBECHECK_API_URL;
+  }
+  if (process.env.API_URL) {
+    return process.env.API_URL;
+  }
+  const result = await loadCredentials();
+  return result.credentials?.apiUrl ?? DEFAULT_API_URL;
+}
+async function getWebUrl() {
+  if (process.env.VIBECHECK_WEB_URL) {
+    return process.env.VIBECHECK_WEB_URL;
+  }
+  if (process.env.WEB_URL) {
+    return process.env.WEB_URL;
+  }
+  const result = await loadCredentials();
+  return result.credentials?.webUrl ?? DEFAULT_WEB_URL;
+}
+async function getCurrentUser() {
+  const result = await loadCredentials();
+  if (!result.valid || !result.credentials) {
+    return null;
+  }
+  return {
+    userId: result.credentials.userId,
+    email: result.credentials.email,
+    name: result.credentials.name,
+    tier: result.credentials.tier
+  };
+}
+async function isLoggedIn() {
+  const token = await getAuthToken();
+  return Boolean(token);
+}
+async function requestMagicLink(email, options = {}) {
+  const apiUrl = options.apiUrl ?? DEFAULT_API_URL;
+  try {
+    const response = await fetch(`${apiUrl}/api/v1/auth/magic-link/request`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ email })
+    });
+    const data = await response.json();
+    if (!response.ok || !data.success) {
+      return {
+        success: false,
+        error: data.error?.message ?? "Failed to send magic link"
+      };
+    }
+    return { success: true };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("ECONNREFUSED") || message.includes("fetch failed")) {
+      return { success: false, error: `Cannot connect to API at ${apiUrl}` };
+    }
+    return { success: false, error: message };
+  }
+}
+async function verifyMagicLink(token, options = {}) {
+  const apiUrl = options.apiUrl ?? DEFAULT_API_URL;
+  const webUrl = options.webUrl ?? DEFAULT_WEB_URL;
+  try {
+    const response = await fetch(`${apiUrl}/api/v1/auth/magic-link/verify`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ token })
+    });
+    const data = await response.json();
+    if (!response.ok || !data.success) {
+      return {
+        success: false,
+        error: data.error?.message ?? "Invalid or expired magic link"
+      };
+    }
+    const { accessToken, expiresIn, user } = data.data;
+    const credentials = {
+      authToken: accessToken,
+      apiUrl,
+      webUrl,
+      userId: user.id,
+      email: user.email,
+      name: user.name,
+      tier: user.tier,
+      expiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
+    };
+    await saveCredentials(credentials);
+    return { success: true, user: credentials };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("ECONNREFUSED") || message.includes("fetch failed")) {
+      return { success: false, error: `Cannot connect to API at ${apiUrl}` };
+    }
+    return { success: false, error: message };
+  }
+}
+async function loginWithEmailPassword(email, password2, options = {}) {
+  const apiUrl = options.apiUrl ?? DEFAULT_API_URL;
+  const webUrl = options.webUrl ?? DEFAULT_WEB_URL;
+  try {
+    const response = await fetch(`${apiUrl}/api/v1/auth/login`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ email, password: password2 })
+    });
+    const data = await response.json();
+    if (!response.ok || !data.success) {
+      return {
+        success: false,
+        error: data.error?.message ?? "Invalid email or password"
+      };
+    }
+    const { accessToken, expiresIn, user } = data.data;
+    const credentials = {
+      authToken: accessToken,
+      apiUrl,
+      webUrl,
+      userId: user.id,
+      email: user.email,
+      name: user.name,
+      tier: user.tier,
+      expiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
+    };
+    await saveCredentials(credentials);
+    return { success: true, user: credentials };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("ECONNREFUSED") || message.includes("fetch failed")) {
+      return { success: false, error: `Cannot connect to API at ${apiUrl}` };
+    }
+    return { success: false, error: message };
+  }
+}
+async function loginWithApiKey(apiKey, options = {}) {
+  const apiUrl = options.apiUrl ?? DEFAULT_API_URL;
+  const webUrl = options.webUrl ?? DEFAULT_WEB_URL;
+  try {
+    const response = await fetch(`${apiUrl}/api/v1/auth/me`, {
+      headers: {
+        "Authorization": `Bearer ${apiKey}`
+      }
+    });
+    if (!response.ok) {
+      if (response.status === 401) {
+        return { success: false, error: "Invalid API key. Please check and try again." };
+      }
+      return { success: false, error: `Authentication failed: ${response.status}` };
+    }
+    const userData = await response.json();
+    const credentials = {
+      authToken: apiKey,
+      apiUrl,
+      webUrl,
+      userId: userData.id,
+      email: userData.email,
+      name: userData.name,
+      tier: userData.tier,
+      // API keys don't expire unless revoked
+      expiresAt: void 0
+    };
+    await saveCredentials(credentials);
+    return { success: true, user: credentials };
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (message.includes("ECONNREFUSED") || message.includes("fetch failed")) {
+      return { success: false, error: `Cannot connect to API at ${apiUrl}` };
+    }
+    return { success: false, error: message };
+  }
+}
+async function loginWithOAuth(provider, options = {}) {
+  const apiUrl = options.apiUrl ?? DEFAULT_API_URL;
+  const webUrl = options.webUrl ?? DEFAULT_WEB_URL;
+  const http2 = await import('http');
+  const { URL: URL2 } = await import('url');
+  return new Promise((resolve6) => {
+    const server = http2.createServer(async (req, res) => {
+      const url = new URL2(req.url ?? "/", `http://localhost`);
+      if (url.pathname === "/callback") {
+        const code = url.searchParams.get("code");
+        const error = url.searchParams.get("error");
+        if (error) {
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(`
+            <html>
+              <body style="font-family: system-ui; padding: 40px; text-align: center;">
+                <h1>\u274C Authentication Failed</h1>
+                <p>Error: ${error}</p>
+                <p>You can close this window and try again.</p>
+              </body>
+            </html>
+          `);
+          server.close();
+          resolve6({ success: false, error: `OAuth error: ${error}` });
+          return;
+        }
+        if (!code) {
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(`
+            <html>
+              <body style="font-family: system-ui; padding: 40px; text-align: center;">
+                <h1>\u274C Missing Authorization Code</h1>
+                <p>You can close this window and try again.</p>
+              </body>
+            </html>
+          `);
+          server.close();
+          resolve6({ success: false, error: "Missing authorization code" });
+          return;
+        }
+        try {
+          const exchangeResponse = await fetch(`${apiUrl}/api/v1/auth/${provider}/exchange`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ code, redirect_uri: "http://localhost:9876/callback" })
+          });
+          const data = await exchangeResponse.json();
+          if (!exchangeResponse.ok || !data.success) {
+            res.writeHead(200, { "Content-Type": "text/html" });
+            res.end(`
+              <html>
+                <body style="font-family: system-ui; padding: 40px; text-align: center;">
+                  <h1>\u274C Authentication Failed</h1>
+                  <p>${data.error?.message ?? "Unknown error"}</p>
+                  <p>You can close this window and try again.</p>
+                </body>
+              </html>
+            `);
+            server.close();
+            resolve6({ success: false, error: data.error?.message ?? "Token exchange failed" });
+            return;
+          }
+          const { accessToken, expiresIn, user } = data.data;
+          const credentials = {
+            authToken: accessToken,
+            apiUrl,
+            webUrl,
+            userId: user.id,
+            email: user.email,
+            name: user.name,
+            tier: user.tier,
+            expiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
+          };
+          await saveCredentials(credentials);
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(`
+            <html>
+              <body style="font-family: system-ui; padding: 40px; text-align: center; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); color: white; min-height: 100vh; margin: 0;">
+                <h1>\u2705 Authentication Successful!</h1>
+                <p>Welcome, ${user.name ?? user.email}!</p>
+                <p>You can close this window and return to the CLI.</p>
+              </body>
+            </html>
+          `);
+          server.close();
+          resolve6({ success: true, user: credentials });
+        } catch (err) {
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(`
+            <html>
+              <body style="font-family: system-ui; padding: 40px; text-align: center;">
+                <h1>\u274C Authentication Failed</h1>
+                <p>${err instanceof Error ? err.message : "Unknown error"}</p>
+                <p>You can close this window and try again.</p>
+              </body>
+            </html>
+          `);
+          server.close();
+          resolve6({ success: false, error: err instanceof Error ? err.message : "Unknown error" });
+        }
+      } else {
+        res.writeHead(404);
+        res.end("Not found");
+      }
+    });
+    server.listen(9876, "127.0.0.1", async () => {
+      const redirectUri = "http://localhost:9876/callback";
+      let authUrl;
+      if (provider === "github") {
+        const params = new URLSearchParams({
+          client_id: process.env.GITHUB_CLIENT_ID ?? "",
+          redirect_uri: `${apiUrl}/api/v1/auth/github/callback?cli_redirect=${encodeURIComponent(redirectUri)}`,
+          scope: "user:email read:user"
+        });
+        authUrl = `https://github.com/login/oauth/authorize?${params}`;
+      } else {
+        const params = new URLSearchParams({
+          client_id: process.env.GOOGLE_CLIENT_ID ?? "",
+          redirect_uri: `${apiUrl}/api/v1/auth/google/callback?cli_redirect=${encodeURIComponent(redirectUri)}`,
+          response_type: "code",
+          scope: "openid email profile",
+          access_type: "offline",
+          prompt: "consent"
+        });
+        authUrl = `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
+      }
+      const open = (await import('open')).default;
+      await open(authUrl);
+    });
+    setTimeout(() => {
+      server.close();
+      resolve6({ success: false, error: "Authentication timed out. Please try again." });
+    }, 5 * 60 * 1e3);
+  });
+}
+async function loginWithOAuthToken(accessToken, refreshToken, expiresIn, user, options = {}) {
+  const credentials = {
+    authToken: accessToken,
+    apiUrl: options.apiUrl ?? DEFAULT_API_URL,
+    webUrl: options.webUrl ?? DEFAULT_WEB_URL,
+    userId: user.id,
+    email: user.email,
+    name: user.name,
+    tier: user.tier,
+    expiresAt: new Date(Date.now() + expiresIn * 1e3).toISOString()
+  };
+  await saveCredentials(credentials);
+}
+function getCredentialsPath() {
+  return CREDENTIALS_PATH;
+}
+var CONFIG_DIR, CREDENTIALS_FILE, CREDENTIALS_PATH, OBFUSCATION_KEY, DEFAULT_API_URL, DEFAULT_WEB_URL;
+var init_credentials = __esm({
+  "src/lib/credentials.ts"() {
+    CONFIG_DIR = path18.join(os5.homedir(), ".config", "vibecheck");
+    CREDENTIALS_FILE = "credentials.json";
+    CREDENTIALS_PATH = path18.join(CONFIG_DIR, CREDENTIALS_FILE);
+    OBFUSCATION_KEY = "vibecheck-cli-v1";
+    DEFAULT_API_URL = "https://api.vibecheckai.dev";
+    DEFAULT_WEB_URL = "https://app.vibecheckai.dev";
+  }
+});
+
 // ../../packages/shared-types/dist/index.js
 function tierMeetsRequirement(userTier, requiredTier) {
   const userIndex = TIER_ORDER.indexOf(userTier);
@@ -70142,8 +70593,8 @@ async function runInitWizard() {
       configContent: generateConfigTemplate("standard")
     };
   }
-  p2.intro(chalk8.cyan("vibecheck init"));
-  const template = await p2.select({
+  p4.intro(chalk8.cyan("vibecheck init"));
+  const template = await p4.select({
     message: "Choose a configuration template:",
     options: [
       {
@@ -70164,11 +70615,11 @@ async function runInitWizard() {
     ],
     initialValue: "standard"
   });
-  if (p2.isCancel(template)) {
-    p2.cancel("Setup cancelled.");
+  if (p4.isCancel(template)) {
+    p4.cancel("Setup cancelled.");
     return null;
   }
-  const rules = await p2.multiselect({
+  const rules = await p4.multiselect({
     message: "Select scanners to enable:",
     options: [
       { value: "routes", label: "Routes", hint: "API routes and endpoints" },
@@ -70180,20 +70631,20 @@ async function runInitWizard() {
     initialValues: template === "minimal" ? ["routes", "env"] : ["routes", "env", "auth", "contracts"],
     required: true
   });
-  if (p2.isCancel(rules)) {
-    p2.cancel("Setup cancelled.");
+  if (p4.isCancel(rules)) {
+    p4.cancel("Setup cancelled.");
     return null;
   }
-  const strict = await p2.confirm({
+  const strict = await p4.confirm({
     message: "Enable strict mode?",
     initialValue: template === "strict"
   });
-  if (p2.isCancel(strict)) {
-    p2.cancel("Setup cancelled.");
+  if (p4.isCancel(strict)) {
+    p4.cancel("Setup cancelled.");
     return null;
   }
   const configContent = generateConfigTemplate(template);
-  p2.outro(chalk8.green("Configuration ready!"));
+  p4.outro(chalk8.green("Configuration ready!"));
   return {
     template,
     rules,
@@ -70205,11 +70656,11 @@ async function confirmOverwrite(path28) {
   if (!shouldPrompt()) {
     return false;
   }
-  const confirmed = await p2.confirm({
+  const confirmed = await p4.confirm({
     message: `Config file already exists at ${chalk8.cyan(path28)}. Overwrite?`,
     initialValue: false
   });
-  if (p2.isCancel(confirmed)) {
+  if (p4.isCancel(confirmed)) {
     return false;
   }
   return confirmed;
@@ -70224,13 +70675,13 @@ async function runConfigWizard(currentConfig) {
   if (!shouldPrompt()) {
     return null;
   }
-  p2.intro(chalk8.cyan("vibecheck config"));
-  const section = await p2.select({
+  p4.intro(chalk8.cyan("vibecheck config"));
+  const section = await p4.select({
     message: "What would you like to configure?",
     options: [...CONFIG_SECTIONS]
   });
-  if (p2.isCancel(section)) {
-    p2.cancel("Configuration cancelled.");
+  if (p4.isCancel(section)) {
+    p4.cancel("Configuration cancelled.");
     return null;
   }
   switch (section) {
@@ -70255,37 +70706,37 @@ var SCANNER_OPTIONS = [
   { value: "ui", label: "UI Graph", hint: "Component relationships" }
 ];
 async function configureRules(currentConfig) {
-  const rules = await p2.multiselect({
+  const rules = await p4.multiselect({
     message: "Select scanners to enable:",
     options: [...SCANNER_OPTIONS],
     initialValues: currentConfig.rules,
     required: true
   });
-  if (p2.isCancel(rules)) {
-    p2.cancel("Scanner configuration cancelled.");
+  if (p4.isCancel(rules)) {
+    p4.cancel("Scanner configuration cancelled.");
     return null;
   }
-  p2.outro(chalk8.green("Rules updated!"));
+  p4.outro(chalk8.green("Rules updated!"));
   return { rules };
 }
 async function configureValidation(currentConfig) {
-  const strict = await p2.confirm({
+  const strict = await p4.confirm({
     message: "Enable strict mode?",
     initialValue: currentConfig.strict
   });
-  if (p2.isCancel(strict)) {
-    p2.cancel("Validation configuration cancelled.");
+  if (p4.isCancel(strict)) {
+    p4.cancel("Validation configuration cancelled.");
     return null;
   }
-  const failFast = await p2.confirm({
+  const failFast = await p4.confirm({
     message: "Stop on first error (fail-fast)?",
     initialValue: currentConfig.validation.failFast
   });
-  if (p2.isCancel(failFast)) {
-    p2.cancel("Validation configuration cancelled.");
+  if (p4.isCancel(failFast)) {
+    p4.cancel("Validation configuration cancelled.");
     return null;
   }
-  const maxErrorsStr = await p2.text({
+  const maxErrorsStr = await p4.text({
     message: "Maximum errors to report:",
     initialValue: String(currentConfig.validation.maxErrors),
     validate: (value) => {
@@ -70299,11 +70750,11 @@ async function configureValidation(currentConfig) {
       return void 0;
     }
   });
-  if (p2.isCancel(maxErrorsStr)) {
-    p2.cancel("Validation configuration cancelled.");
+  if (p4.isCancel(maxErrorsStr)) {
+    p4.cancel("Validation configuration cancelled.");
     return null;
   }
-  p2.outro(chalk8.green("Validation settings updated!"));
+  p4.outro(chalk8.green("Validation settings updated!"));
   return {
     strict,
     validation: {
@@ -70314,7 +70765,7 @@ async function configureValidation(currentConfig) {
   };
 }
 async function configureWatch(currentConfig) {
-  const includeStr = await p2.text({
+  const includeStr = await p4.text({
     message: "Include patterns (comma-separated):",
     initialValue: currentConfig.watch.include.join(", "),
     placeholder: "src/**/*.ts, src/**/*.tsx",
@@ -70325,20 +70776,20 @@ async function configureWatch(currentConfig) {
       return void 0;
     }
   });
-  if (p2.isCancel(includeStr)) {
-    p2.cancel("Watch configuration cancelled.");
+  if (p4.isCancel(includeStr)) {
+    p4.cancel("Watch configuration cancelled.");
     return null;
   }
-  const excludeStr = await p2.text({
+  const excludeStr = await p4.text({
     message: "Exclude patterns (comma-separated):",
     initialValue: currentConfig.watch.exclude.join(", "),
     placeholder: "node_modules, dist, build"
   });
-  if (p2.isCancel(excludeStr)) {
-    p2.cancel("Watch configuration cancelled.");
+  if (p4.isCancel(excludeStr)) {
+    p4.cancel("Watch configuration cancelled.");
     return null;
   }
-  const debounceStr = await p2.text({
+  const debounceStr = await p4.text({
     message: "Debounce delay (ms):",
     initialValue: String(currentConfig.watch.debounce),
     validate: (value) => {
@@ -70355,11 +70806,11 @@ async function configureWatch(currentConfig) {
       return void 0;
     }
   });
-  if (p2.isCancel(debounceStr)) {
-    p2.cancel("Watch configuration cancelled.");
+  if (p4.isCancel(debounceStr)) {
+    p4.cancel("Watch configuration cancelled.");
     return null;
   }
-  p2.outro(chalk8.green("Watch settings updated!"));
+  p4.outro(chalk8.green("Watch settings updated!"));
   const includePatterns = includeStr.split(",").map((s) => s.trim()).filter(Boolean);
   const excludePatterns = excludeStr.split(",").map((s) => s.trim()).filter(Boolean);
   return {
@@ -70375,16 +70826,16 @@ var OUTPUT_FORMAT_OPTIONS = [
   { value: "json", label: "JSON", hint: "Machine-readable JSON" }
 ];
 async function configureOutput(currentConfig) {
-  const output = await p2.select({
+  const output = await p4.select({
     message: "Default output format:",
     options: [...OUTPUT_FORMAT_OPTIONS],
     initialValue: currentConfig.output
   });
-  if (p2.isCancel(output)) {
-    p2.cancel("Output configuration cancelled.");
+  if (p4.isCancel(output)) {
+    p4.cancel("Output configuration cancelled.");
     return null;
   }
-  const truthpackPath = await p2.text({
+  const truthpackPath = await p4.text({
     message: "Truthpack storage path:",
     initialValue: currentConfig.truthpackPath,
     placeholder: ".vibecheck/truthpack",
@@ -70396,16 +70847,22 @@ async function configureOutput(currentConfig) {
       return void 0;
     }
   });
-  if (p2.isCancel(truthpackPath)) {
-    p2.cancel("Output configuration cancelled.");
+  if (p4.isCancel(truthpackPath)) {
+    p4.cancel("Output configuration cancelled.");
     return null;
   }
-  p2.outro(chalk8.green("Output settings updated!"));
+  p4.outro(chalk8.green("Output settings updated!"));
   return {
     output,
     truthpackPath: truthpackPath.trim()
   };
 }
+
+// src/lib/version.ts
+var CLI_VERSION = "1.0.8" ;
+var CLI_NAME = "vibecheck-ai" ;
+
+// src/ui/command-header.tsx
 var VIBECHECK_BANNER = [
   "\u2588\u2588\u2557   \u2588\u2588\u2557\u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557  \u2588\u2588\u2557\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2557 \u2588\u2588\u2588\u2588\u2588\u2588\u2557\u2588\u2588\u2557  \u2588\u2588\u2557",
   "\u2588\u2588\u2551   \u2588\u2588\u2551\u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2588\u2588\u2557\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2551  \u2588\u2588\u2551\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2554\u2550\u2550\u2550\u2550\u255D\u2588\u2588\u2551 \u2588\u2588\u2554\u255D",
@@ -70561,7 +71018,7 @@ function getCommandAscii(command) {
   return COMMAND_ASCII[key] || [`[ ${key} ]`];
 }
 function renderCommandHeader(options) {
-  const { command, version = "1.0.0", target, sessionId, elapsedTime = 0 } = options;
+  const { command, version = CLI_VERSION, target, sessionId, elapsedTime = 0 } = options;
   const session = sessionId || `${Math.random().toString(36).substring(2, 4).toUpperCase()}-${Math.floor(Math.random() * 1e3)}`;
   const commandAscii = getCommandAscii(command);
   const integrityStatus = options.vitals && options.vitals.length > 0 ? options.vitals[0].status.toUpperCase() : "READY";
@@ -71120,7 +71577,7 @@ function getStatusIndicator() {
 }
 async function showInteractiveMenu() {
   await printWelcome();
-  const selection = await p2.select({
+  const selection = await p4.select({
     message: chalk8.cyan.bold("What would you like to do?"),
     options: MAIN_MENU_ITEMS.filter((item) => !item.value.startsWith("divider")).map((item) => ({
       value: item.value,
@@ -71128,7 +71585,7 @@ async function showInteractiveMenu() {
       hint: chalk8.dim(item.hint)
     }))
   });
-  if (p2.isCancel(selection)) {
+  if (p4.isCancel(selection)) {
     console.log("");
     console.log(chalk8.dim("  \u{1F44B} See you next time, Vibecoder!"));
     console.log("");
@@ -71146,152 +71603,14 @@ function printError(message) {
   console.log(chalk8.red.bold("  \u2717 ") + chalk8.white(message));
   console.log("");
 }
-var CONFIG_DIR = path18.join(os5.homedir(), ".config", "vibecheck");
-var CREDENTIALS_FILE = "credentials.json";
-var CREDENTIALS_PATH = path18.join(CONFIG_DIR, CREDENTIALS_FILE);
-var OBFUSCATION_KEY = "vibecheck-cli-v1";
-var DEFAULT_API_URL = "https://api.vibecheckai.dev";
-var DEFAULT_WEB_URL = "https://app.vibecheckai.dev";
-function obfuscate(data) {
-  const key = crypto52.createHash("sha256").update(OBFUSCATION_KEY).digest();
-  const iv = crypto52.randomBytes(16);
-  const cipher = crypto52.createCipheriv("aes-256-cbc", key, iv);
-  let encrypted = cipher.update(data, "utf8", "base64");
-  encrypted += cipher.final("base64");
-  return iv.toString("base64") + ":" + encrypted;
-}
-function deobfuscate(data) {
-  try {
-    const [ivBase64, encrypted] = data.split(":");
-    if (!ivBase64 || !encrypted) return data;
-    const key = crypto52.createHash("sha256").update(OBFUSCATION_KEY).digest();
-    const iv = Buffer.from(ivBase64, "base64");
-    const decipher = crypto52.createDecipheriv("aes-256-cbc", key, iv);
-    let decrypted = decipher.update(encrypted, "base64", "utf8");
-    decrypted += decipher.final("utf8");
-    return decrypted;
-  } catch {
-    return data;
-  }
-}
-async function ensureConfigDir() {
-  await fs102.mkdir(CONFIG_DIR, { recursive: true });
-}
-async function saveCredentials(credentials) {
-  await ensureConfigDir();
-  const toSave = {
-    ...credentials,
-    authToken: credentials.authToken ? obfuscate(credentials.authToken) : void 0,
-    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  await fs102.writeFile(
-    CREDENTIALS_PATH,
-    JSON.stringify(toSave, null, 2),
-    { mode: 384 }
-    // Owner read/write only
-  );
-}
-async function loadCredentials() {
-  try {
-    const content = await fs102.readFile(CREDENTIALS_PATH, "utf-8");
-    const stored = JSON.parse(content);
-    if (stored.expiresAt && new Date(stored.expiresAt) < /* @__PURE__ */ new Date()) {
-      return {
-        valid: false,
-        error: "Token has expired. Please run `vibecheck login` to re-authenticate."
-      };
-    }
-    const credentials = {
-      ...stored,
-      authToken: stored.authToken ? deobfuscate(stored.authToken) : void 0
-    };
-    return {
-      valid: Boolean(credentials.authToken),
-      credentials
-    };
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      return {
-        valid: false,
-        error: "Not logged in. Run `vibecheck login` to authenticate."
-      };
-    }
-    return {
-      valid: false,
-      error: `Failed to load credentials: ${error instanceof Error ? error.message : String(error)}`
-    };
-  }
-}
-async function getAuthToken() {
-  if (process.env.VIBECHECK_AUTH_TOKEN) {
-    return process.env.VIBECHECK_AUTH_TOKEN;
-  }
-  const result = await loadCredentials();
-  return result.credentials?.authToken;
-}
-async function getApiUrl() {
-  if (process.env.VIBECHECK_API_URL) {
-    return process.env.VIBECHECK_API_URL;
-  }
-  if (process.env.API_URL) {
-    return process.env.API_URL;
-  }
-  const result = await loadCredentials();
-  return result.credentials?.apiUrl ?? DEFAULT_API_URL;
-}
-async function getWebUrl() {
-  if (process.env.VIBECHECK_WEB_URL) {
-    return process.env.VIBECHECK_WEB_URL;
-  }
-  if (process.env.WEB_URL) {
-    return process.env.WEB_URL;
-  }
-  const result = await loadCredentials();
-  return result.credentials?.webUrl ?? DEFAULT_WEB_URL;
-}
-async function isLoggedIn() {
-  const token = await getAuthToken();
-  return Boolean(token);
-}
-async function loginWithApiKey(apiKey, options = {}) {
-  const apiUrl = options.apiUrl ?? DEFAULT_API_URL;
-  const webUrl = options.webUrl ?? DEFAULT_WEB_URL;
-  try {
-    const response = await fetch(`${apiUrl}/api/v1/auth/me`, {
-      headers: {
-        "Authorization": `Bearer ${apiKey}`
-      }
-    });
-    if (!response.ok) {
-      if (response.status === 401) {
-        return { success: false, error: "Invalid API key. Please check and try again." };
-      }
-      return { success: false, error: `Authentication failed: ${response.status}` };
-    }
-    const userData = await response.json();
-    const credentials = {
-      authToken: apiKey,
-      apiUrl,
-      webUrl,
-      userId: userData.id,
-      email: userData.email,
-      name: userData.name,
-      tier: userData.tier,
-      // API keys don't expire unless revoked
-      expiresAt: void 0
-    };
-    await saveCredentials(credentials);
-    return { success: true, user: credentials };
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (message.includes("ECONNREFUSED") || message.includes("fetch failed")) {
-      return { success: false, error: `Cannot connect to API at ${apiUrl}` };
-    }
-    return { success: false, error: message };
-  }
+function printWarning(message) {
+  console.log("");
+  console.log(chalk8.yellow.bold("  \u26A0 ") + chalk8.white(message));
+  console.log("");
 }
 
 // src/ui/login.ts
+init_credentials();
 var loginGradient = gradient(["#667eea", "#764ba2", "#f093fb"]);
 var successGradient = gradient(["#00ff88", "#00d9ff", "#a855f7"]);
 gradient(["#ff416c", "#ff4b2b"]);
@@ -71359,7 +71678,7 @@ async function showLoginScreen() {
   console.log("");
   console.log(chalk8.dim("  \u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550"));
   console.log("");
-  const authMethod = await p2.select({
+  const authMethod = await p4.select({
     message: chalk8.cyan("How would you like to authenticate?"),
     options: [
       {
@@ -71399,7 +71718,7 @@ async function showLoginScreen() {
       }
     ]
   });
-  if (p2.isCancel(authMethod) || authMethod === "cancel") {
+  if (p4.isCancel(authMethod) || authMethod === "cancel") {
     return null;
   }
   switch (authMethod) {
@@ -71426,7 +71745,7 @@ async function apiKeyLogin() {
   console.log("  " + chalk8.cyan("Get your API key from:"));
   console.log("  " + chalk8.white("https://app.vibecheckai.dev/api-keys"));
   console.log("");
-  const apiKey = await p2.password({
+  const apiKey = await p4.password({
     message: chalk8.cyan("\u{1F511} Paste your API key"),
     validate: (value) => {
       if (!value) return "API key is required";
@@ -71434,18 +71753,18 @@ async function apiKeyLogin() {
       return void 0;
     }
   });
-  if (p2.isCancel(apiKey)) return null;
-  const s = p2.spinner();
+  if (p4.isCancel(apiKey)) return null;
+  const s = p4.spinner();
   s.start(chalk8.cyan("Validating API key..."));
   const result = await loginWithApiKey(apiKey);
   if (!result.success) {
     s.stop(chalk8.red(`\u2717 ${result.error}`));
     console.log("");
-    const retry = await p2.confirm({
+    const retry = await p4.confirm({
       message: chalk8.cyan("Would you like to try again?"),
       initialValue: true
     });
-    if (p2.isCancel(retry) || !retry) return null;
+    if (p4.isCancel(retry) || !retry) return null;
     return apiKeyLogin();
   }
   s.stop(chalk8.green("\u2713 API key validated!"));
@@ -71462,7 +71781,7 @@ async function emailLogin() {
   console.log("");
   console.log(chalk8.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   console.log("");
-  const email = await p2.text({
+  const email = await p4.text({
     message: chalk8.cyan("\u{1F4E7} Email address"),
     placeholder: "you@example.com",
     validate: (value) => {
@@ -71471,8 +71790,8 @@ async function emailLogin() {
       return void 0;
     }
   });
-  if (p2.isCancel(email)) return null;
-  const password2 = await p2.password({
+  if (p4.isCancel(email)) return null;
+  const password2 = await p4.password({
     message: chalk8.cyan("\u{1F511} Password"),
     validate: (value) => {
       if (!value) return "Password is required";
@@ -71480,49 +71799,103 @@ async function emailLogin() {
       return void 0;
     }
   });
-  if (p2.isCancel(password2)) return null;
+  if (p4.isCancel(password2)) return null;
+  const s = p4.spinner();
+  s.start(chalk8.cyan("Authenticating..."));
+  const result = await loginWithEmailPassword(email, password2);
+  if (!result.success) {
+    s.stop(chalk8.red(`\u2717 ${result.error}`));
+    console.log("");
+    const retry = await p4.confirm({
+      message: chalk8.cyan("Would you like to try again?"),
+      initialValue: true
+    });
+    if (p4.isCancel(retry) || !retry) return null;
+    return emailLogin();
+  }
+  s.stop(chalk8.green("\u2713 Authentication successful!"));
   console.log("");
   await showSecurityAnimation();
+  const user = result.user;
   return showLoginSuccess({
-    email,
-    name: email.split("@")[0],
-    tier: "pro"
+    email: user.email ?? email,
+    name: user.name ?? email.split("@")[0],
+    tier: user.tier ?? "free"
   });
 }
 async function oauthLogin(provider) {
   console.log("");
   console.log(chalk8.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   console.log("");
-  const email = await p2.text({
-    message: chalk8.cyan(`\u{1F4E7} Enter your email to link with ${provider}`),
-    placeholder: "you@example.com",
+  console.log(chalk8.cyan(`  ${provider} OAuth for CLI:`));
+  console.log("");
+  console.log(chalk8.white("  1. We'll open your browser to sign in with " + provider));
+  console.log(chalk8.white("  2. After signing in, go to Settings \u2192 API Keys"));
+  console.log(chalk8.white("  3. Create an API key and paste it here"));
+  console.log("");
+  const proceed = await p4.confirm({
+    message: chalk8.cyan(`Open browser to sign in with ${provider}?`),
+    initialValue: true
+  });
+  if (p4.isCancel(proceed) || !proceed) return null;
+  const s = p4.spinner();
+  s.start(chalk8.cyan(`Opening ${provider} login page...`));
+  try {
+    const open = (await import('open')).default;
+    const webUrl = process.env.VIBECHECK_WEB_URL ?? "https://app.vibecheckai.dev";
+    const providerLower = provider.toLowerCase();
+    await open(`${webUrl}/auth/login?provider=${providerLower}`);
+    s.stop(chalk8.green(`\u2713 Browser opened!`));
+  } catch {
+    s.stop(chalk8.yellow("\u26A0 Could not open browser automatically"));
+    console.log("");
+    console.log(chalk8.white("  Please visit: https://app.vibecheckai.dev/auth/login"));
+  }
+  console.log("");
+  console.log(chalk8.dim("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
+  console.log(chalk8.dim("  \u2502") + chalk8.white("  Complete sign-in in your browser, then:               ") + chalk8.dim("\u2502"));
+  console.log(chalk8.dim("  \u2502") + chalk8.white("  1. Go to Settings \u2192 API Keys                          ") + chalk8.dim("\u2502"));
+  console.log(chalk8.dim("  \u2502") + chalk8.white("  2. Create a new API key                               ") + chalk8.dim("\u2502"));
+  console.log(chalk8.dim("  \u2502") + chalk8.white("  3. Copy and paste it below                            ") + chalk8.dim("\u2502"));
+  console.log(chalk8.dim("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
+  console.log("");
+  const apiKey = await p4.password({
+    message: chalk8.cyan("\u{1F511} Paste your API key"),
     validate: (value) => {
-      if (!value) return "Email is required";
-      if (!value.includes("@")) return "Please enter a valid email";
+      if (!value) return "API key is required";
+      if (value.length < 20) return "Invalid API key format";
       return void 0;
     }
   });
-  if (p2.isCancel(email)) return null;
-  const s = p2.spinner();
-  s.start(chalk8.cyan(`Opening ${provider} authorization page...`));
-  await new Promise((resolve6) => setTimeout(resolve6, 1500));
-  s.message(chalk8.cyan(`Waiting for ${provider} authorization...`));
-  await new Promise((resolve6) => setTimeout(resolve6, 2e3));
-  s.stop(chalk8.green(`\u2713 ${provider} authorization successful!`));
+  if (p4.isCancel(apiKey)) return null;
+  const s2 = p4.spinner();
+  s2.start(chalk8.cyan("Validating API key..."));
+  const result = await loginWithApiKey(apiKey);
+  if (!result.success) {
+    s2.stop(chalk8.red(`\u2717 ${result.error}`));
+    console.log("");
+    const retry = await p4.confirm({
+      message: chalk8.cyan("Would you like to try again?"),
+      initialValue: true
+    });
+    if (p4.isCancel(retry) || !retry) return null;
+    return oauthLogin(provider);
+  }
+  s2.stop(chalk8.green("\u2713 API key validated!"));
   console.log("");
   await showSecurityAnimation();
-  const userName = email.split("@")[0];
+  const user = result.user;
   return showLoginSuccess({
-    email,
-    name: userName.charAt(0).toUpperCase() + userName.slice(1),
-    tier: "pro"
+    email: user.email ?? "user@vibecheck.dev",
+    name: user.name ?? user.email?.split("@")[0] ?? "User",
+    tier: user.tier ?? "free"
   });
 }
 async function magicLinkLogin() {
   console.log("");
   console.log(chalk8.dim("  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   console.log("");
-  const email = await p2.text({
+  const email = await p4.text({
     message: chalk8.cyan("\u{1F4E7} Enter your email for a magic link"),
     placeholder: "you@example.com",
     validate: (value) => {
@@ -71531,27 +71904,60 @@ async function magicLinkLogin() {
       return void 0;
     }
   });
-  if (p2.isCancel(email)) return null;
-  const s = p2.spinner();
+  if (p4.isCancel(email)) return null;
+  const s = p4.spinner();
   s.start(chalk8.cyan("Sending magic link..."));
-  await new Promise((resolve6) => setTimeout(resolve6, 1500));
+  const result = await requestMagicLink(email);
+  if (!result.success) {
+    s.stop(chalk8.red(`\u2717 ${result.error}`));
+    console.log("");
+    const retry = await p4.confirm({
+      message: chalk8.cyan("Would you like to try again?"),
+      initialValue: true
+    });
+    if (p4.isCancel(retry) || !retry) return null;
+    return magicLinkLogin();
+  }
   s.stop(chalk8.green("\u2713 Magic link sent!"));
   console.log("");
   console.log(chalk8.dim("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510"));
   console.log(chalk8.dim("  \u2502") + chalk8.white("  \u{1F4EC} Check your inbox!                                    ") + chalk8.dim("\u2502"));
   console.log(chalk8.dim("  \u2502") + chalk8.dim(`     We sent a login link to ${email}`) + " ".repeat(Math.max(0, 26 - email.length)) + chalk8.dim("\u2502"));
-  console.log(chalk8.dim("  \u2502") + chalk8.dim("     Click the link to complete login.                    ") + chalk8.dim("\u2502"));
+  console.log(chalk8.dim("  \u2502") + chalk8.white("                                                          ") + chalk8.dim("\u2502"));
+  console.log(chalk8.dim("  \u2502") + chalk8.white("  Click the link in your email, then paste the           ") + chalk8.dim("\u2502"));
+  console.log(chalk8.dim("  \u2502") + chalk8.white("  verification code below.                               ") + chalk8.dim("\u2502"));
   console.log(chalk8.dim("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518"));
   console.log("");
-  const s2 = p2.spinner();
-  s2.start(chalk8.cyan("Waiting for magic link confirmation..."));
-  await new Promise((resolve6) => setTimeout(resolve6, 3e3));
-  s2.stop(chalk8.green("\u2713 Magic link confirmed!"));
+  const token = await p4.text({
+    message: chalk8.cyan("\u{1F511} Paste the verification code from the email"),
+    placeholder: "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
+    validate: (value) => {
+      if (!value) return "Verification code is required";
+      if (value.length < 20) return "Invalid verification code";
+      return void 0;
+    }
+  });
+  if (p4.isCancel(token)) return null;
+  const s2 = p4.spinner();
+  s2.start(chalk8.cyan("Verifying..."));
+  const verifyResult = await verifyMagicLink(token);
+  if (!verifyResult.success) {
+    s2.stop(chalk8.red(`\u2717 ${verifyResult.error}`));
+    console.log("");
+    const retry = await p4.confirm({
+      message: chalk8.cyan("Would you like to try again?"),
+      initialValue: true
+    });
+    if (p4.isCancel(retry) || !retry) return null;
+    return magicLinkLogin();
+  }
+  s2.stop(chalk8.green("\u2713 Verification successful!"));
   await showSecurityAnimation();
+  const user = verifyResult.user;
   return showLoginSuccess({
-    email,
-    name: email.split("@")[0],
-    tier: "free"
+    email: user.email ?? email,
+    name: user.name ?? email.split("@")[0],
+    tier: user.tier ?? "free"
   });
 }
 async function signupFlow() {
@@ -71571,7 +71977,7 @@ async function signupFlow() {
   console.log("  " + chalk8.white.bold("Create Your VibeCheck Account"));
   console.log("  " + chalk8.dim("Join thousands of developers preventing AI hallucinations"));
   console.log("");
-  const name = await p2.text({
+  const name = await p4.text({
     message: chalk8.cyan("\u{1F464} What should we call you?"),
     placeholder: "Your name",
     validate: (value) => {
@@ -71579,8 +71985,8 @@ async function signupFlow() {
       return void 0;
     }
   });
-  if (p2.isCancel(name)) return null;
-  const email = await p2.text({
+  if (p4.isCancel(name)) return null;
+  const email = await p4.text({
     message: chalk8.cyan("\u{1F4E7} Email address"),
     placeholder: "you@example.com",
     validate: (value) => {
@@ -71589,8 +71995,8 @@ async function signupFlow() {
       return void 0;
     }
   });
-  if (p2.isCancel(email)) return null;
-  const password2 = await p2.password({
+  if (p4.isCancel(email)) return null;
+  const password2 = await p4.password({
     message: chalk8.cyan("\u{1F511} Create a password"),
     validate: (value) => {
       if (!value) return "Password is required";
@@ -71600,20 +72006,20 @@ async function signupFlow() {
       return void 0;
     }
   });
-  if (p2.isCancel(password2)) return null;
+  if (p4.isCancel(password2)) return null;
   const strength = getPasswordStrength(password2);
   console.log("");
   console.log("  " + chalk8.dim("Password Strength:") + " " + strength.indicator);
-  const confirmPassword = await p2.password({
+  const confirmPassword = await p4.password({
     message: chalk8.cyan("\u{1F511} Confirm password"),
     validate: (value) => {
       if (value !== password2) return "Passwords do not match";
       return void 0;
     }
   });
-  if (p2.isCancel(confirmPassword)) return null;
+  if (p4.isCancel(confirmPassword)) return null;
   console.log("");
-  const tier = await p2.select({
+  const tier = await p4.select({
     message: chalk8.cyan("Choose your plan"),
     options: [
       {
@@ -71633,12 +72039,12 @@ async function signupFlow() {
       }
     ]
   });
-  if (p2.isCancel(tier)) return null;
-  const terms = await p2.confirm({
+  if (p4.isCancel(tier)) return null;
+  const terms = await p4.confirm({
     message: chalk8.cyan("I agree to the Terms of Service and Privacy Policy"),
     initialValue: false
   });
-  if (p2.isCancel(terms) || !terms) {
+  if (p4.isCancel(terms) || !terms) {
     console.log("");
     console.log(chalk8.yellow("  \u26A0 You must accept the terms to create an account."));
     return null;
@@ -71741,6 +72147,7 @@ init_dist();
 
 // src/lib/entitlements.ts
 init_dist();
+init_credentials();
 var currentSession = {
   tier: "free",
   authenticated: false
@@ -72954,6 +73361,7 @@ async function integrateWithCI(options) {
 
 // src/lib/reality-uploader.ts
 init_dist2();
+init_credentials();
 async function uploadVideoArtifacts(artifactsDir, projectId, checkId) {
   try {
     const storageService = createVideoStorageService();
@@ -73080,6 +73488,9 @@ async function isApiUploadConfigured() {
   return await isLoggedIn();
 }
 
+// src/lib/index.ts
+init_credentials();
+
 // src/commands/scan.ts
 init_truthpack();
 init_utils();
@@ -73354,7 +73765,6 @@ async function scanCommand(options) {
     if (env.isInteractive && !options.json && !options.quiet) {
       renderCommandHeader({
         command: "scan",
-        version: "1.0.0",
         target: process.cwd(),
         elapsedTime: results.duration,
         vitals: [
@@ -73421,7 +73831,6 @@ async function scanCommand(options) {
     if (options.json) {
       const commandResult = {
         commandName: "scan",
-        version: "1.0.0",
         repoRoot: process.cwd(),
         startedAt: new Date(startTime).toISOString(),
         durationMs: results.duration,
@@ -73605,7 +74014,6 @@ async function validateCommand(files, options) {
     if (env.isInteractive && !options.json && !options.quiet) {
       renderCommandHeader({
         command: "validate",
-        version: "1.0.0",
         target: process.cwd(),
         elapsedTime: 0
       });
@@ -73718,7 +74126,6 @@ async function validateCommand(files, options) {
       const warningScore = calculateHealthScore({ ...createEmptySeverityCounts(), medium: summary.warnings });
       renderCommandHeader({
         command: "validate",
-        version: "1.0.0",
         target: process.cwd(),
         elapsedTime: summary.duration,
         vitals: [
@@ -73752,7 +74159,6 @@ async function validateCommand(files, options) {
       };
       const commandResult = {
         commandName: "validate",
-        version: "1.0.0",
         repoRoot: process.cwd(),
         startedAt: new Date(startTime).toISOString(),
         durationMs: summary.duration,
@@ -73863,7 +74269,6 @@ async function checkCommand(options) {
     if (env.isInteractive && !options.json && !options.quiet) {
       renderCommandHeader({
         command: "check",
-        version: "1.0.0",
         target: process.cwd(),
         elapsedTime: 0
       });
@@ -73997,7 +74402,6 @@ async function checkCommand(options) {
       const driftScore = calculateHealthScore({ ...createEmptySeverityCounts(), medium: driftCount });
       renderCommandHeader({
         command: "check",
-        version: "1.0.0",
         target: process.cwd(),
         elapsedTime: result.duration,
         vitals: [
@@ -74049,7 +74453,6 @@ async function checkCommand(options) {
       };
       const commandResult = {
         commandName: "check",
-        version: "1.0.0",
         repoRoot: process.cwd(),
         startedAt: new Date(startTime).toISOString(),
         durationMs: result.duration,
@@ -74210,20 +74613,38 @@ function renderScoreBar2(score, maxScore = 20, width = 10) {
 function renderShipScoreBox(score, options = {}) {
   const env2 = getEnvironment();
   const width = options.width ?? Math.min(60, getSafeTerminalWidth(80));
-  const verdictColor = VERDICT_COLORS3[score.verdict];
-  const verdictIcon = env2.terminal.unicode ? VERDICT_ICONS2[score.verdict] : "";
+  const verdict = score?.verdict ?? "WARN";
+  const verdictColor = VERDICT_COLORS3[verdict] ?? chalk8.yellow;
+  const verdictIcon = env2.terminal.unicode ? VERDICT_ICONS2[verdict] ?? "" : "";
   const lines = [];
-  const scoreText = `Ship Score: ${score.total}/100`;
-  const verdictText = `${verdictIcon} ${score.verdict}`;
+  const totalScore = score?.total ?? 0;
+  const scoreText = `Ship Score: ${totalScore}/100`;
+  const verdictText = `${verdictIcon} ${verdict}`;
   lines.push(`  ${chalk8.bold(scoreText)}  ${verdictColor(verdictText)}`);
   lines.push("");
-  const dimensions = score.dimensions;
+  const dimensions = score?.dimensions ?? {};
   const dimEntries = Object.entries(dimensions);
-  for (const [key, value] of dimEntries) {
-    const label = DIMENSION_LABELS[key].padEnd(16);
-    const scoreStr = `${value}/20`.padStart(5);
-    const bar = renderScoreBar2(value, 20, 10);
-    lines.push(`  ${chalk8.dim(label)} ${scoreStr}  ${bar}`);
+  if (dimEntries.length === 0) {
+    const defaultDimensions = [
+      ["ghostRisk", 0],
+      ["authCoverage", 0],
+      ["envIntegrity", 0],
+      ["runtimeProof", 0],
+      ["contractsAlignment", 0]
+    ];
+    for (const [key, value] of defaultDimensions) {
+      const label = (DIMENSION_LABELS[key] ?? key).padEnd(16);
+      const scoreStr = `${value}/20`.padStart(5);
+      const bar = renderScoreBar2(value, 20, 10);
+      lines.push(`  ${chalk8.dim(label)} ${scoreStr}  ${bar}`);
+    }
+  } else {
+    for (const [key, value] of dimEntries) {
+      const label = (DIMENSION_LABELS[key] ?? key).padEnd(16);
+      const scoreStr = `${value ?? 0}/20`.padStart(5);
+      const bar = renderScoreBar2(value ?? 0, 20, 10);
+      lines.push(`  ${chalk8.dim(label)} ${scoreStr}  ${bar}`);
+    }
   }
   const boxContent = lines.join("\n");
   if (env2.terminal.unicode) {
@@ -74333,7 +74754,7 @@ async function initCommand(options) {
     if (env.isInteractive && !options.json) {
       renderCommandHeader({
         command: "init",
-        version: "1.0.0",
+        version: CLI_VERSION,
         target: process.cwd(),
         elapsedTime: 0
       });
@@ -74528,7 +74949,7 @@ async function initCommand(options) {
     if (env.isInteractive && !options.json) {
       renderCommandHeader({
         command: "init",
-        version: "1.0.0",
+        version: CLI_VERSION,
         target: process.cwd(),
         elapsedTime: duration,
         vitals: [
@@ -74793,8 +75214,9 @@ async function configCommand(options) {
       }
       const changes = await runConfigWizard(config);
       if (changes) {
-        logger2.info("Configuration changes would be applied.");
-        logger2.dim("Note: Writing config changes is not yet implemented.");
+        logger2.info("Configuration changes detected.");
+        logger2.dim("Use --set to apply changes: vibecheck config --set key=value");
+        logger2.dim("Example: vibecheck config --set strict=true");
       }
     }
   } catch (error) {
@@ -74984,7 +75406,6 @@ async function watchCommand(options) {
     if (env.isInteractive && !options.json && !options.quiet) {
       renderCommandHeader({
         command: "watch",
-        version: "1.0.0",
         target: process.cwd(),
         elapsedTime: 0,
         vitals: [
@@ -75499,7 +75920,7 @@ ${fix.description}`));
     console.log(chalk8.yellow("Diff:"));
     console.log(patchGenerator.formatAsUnifiedDiff(fix.patch));
     console.log();
-    const action = await p2.select({
+    const action = await p4.select({
       message: "What would you like to do?",
       options: [
         { value: "approve", label: "Approve and apply this fix" },
@@ -75507,7 +75928,7 @@ ${fix.description}`));
         { value: "skip", label: "Skip for now" }
       ]
     });
-    if (p2.isCancel(action)) {
+    if (p4.isCancel(action)) {
       logger2.warn("Review cancelled");
       break;
     }
@@ -75576,10 +75997,10 @@ async function handleRollback(transactionId, logger2, options) {
       return;
     }
     if (env.isInteractive && !options.json && !options.quiet) {
-      const confirm6 = await p2.confirm({
+      const confirm6 = await p4.confirm({
         message: `Rollback ${transaction.fixes.length} file(s)?`
       });
-      if (p2.isCancel(confirm6) || !confirm6) {
+      if (p4.isCancel(confirm6) || !confirm6) {
         logger2.warn("Rollback cancelled");
         return;
       }
@@ -75723,7 +76144,6 @@ async function shipCommand(options) {
     if (env.isInteractive && !options.json && !options.quiet) {
       renderCommandHeader({
         command: "ship",
-        version: "1.0.0",
         target: projectRoot,
         elapsedTime: 0,
         vitals: [
@@ -76830,7 +77250,6 @@ function printResults2(result, logger2, isForced) {
   } : void 0;
   renderCommandHeader({
     command: result.ready || isForced ? "ship" : "no ship",
-    version: "1.0.0",
     target: process.cwd(),
     elapsedTime: result.duration,
     vitals,
@@ -76995,7 +77414,6 @@ async function doctorCommand(options) {
   if (!options.json) {
     renderCommandHeader({
       command: "doctor",
-      version: "1.0.0",
       target: process.cwd(),
       elapsedTime: 0
     });
@@ -77061,7 +77479,6 @@ async function doctorCommand(options) {
     } : void 0;
     renderCommandHeader({
       command: "doctor",
-      version: "1.0.0",
       target: process.cwd(),
       elapsedTime: duration,
       vitals: [
@@ -77144,7 +77561,6 @@ async function doctorCommand(options) {
     } : void 0;
     renderCommandHeader({
       command: "doctor",
-      version: "1.0.0",
       target: process.cwd(),
       elapsedTime: duration,
       vitals: [
@@ -77248,7 +77664,6 @@ async function reportCommand(options) {
     if (env.isInteractive && !options.json && !options.quiet) {
       renderCommandHeader({
         command: "report",
-        version: "1.0.0",
         target: projectRoot,
         elapsedTime: 0,
         vitals: [
@@ -77284,8 +77699,7 @@ async function reportCommand(options) {
           title: "Transforming data for report",
           task: async (ctx2) => {
             ctx2.reportData = transformToEnterpriseData(ctx2.scanInput, {
-              reportType,
-              version: "1.0.0"
+              reportType
             });
           }
         },
@@ -77370,8 +77784,7 @@ async function reportCommand(options) {
       scanInput = await collectScanData(projectRoot, config);
       logger2.step("Transforming data...");
       const reportData = transformToEnterpriseData(scanInput, {
-        reportType,
-        version: "1.0.0"
+        reportType
       });
       logger2.step(`Generating ${format.toUpperCase()} report...`);
       const reportConfig = {
@@ -77458,7 +77871,6 @@ async function reportCommand(options) {
       if (env.isInteractive && !options.quiet) {
         renderCommandHeader({
           command: "report",
-          version: "1.0.0",
           target: projectRoot,
           elapsedTime: result.duration,
           vitals: [
@@ -77614,8 +78026,8 @@ function buildCommandString(options) {
 init_config();
 init_errors();
 var pkg = {
-  name: "@vibecheck/cli",
-  version: "1.0.0"
+  name: CLI_NAME,
+  version: CLI_VERSION
 };
 var isShuttingDown = false;
 var cleanupCallbacks = [];
@@ -77875,6 +78287,13 @@ program2.command("login").description("Login to VibeCheck Cloud").action(async (
   }
 });
 program2.command("logout").description("Logout from VibeCheck Cloud").action(async () => {
+  const { clearCredentials: clearCredentials2, hasCredentials: hasCredentials2 } = await Promise.resolve().then(() => (init_credentials(), credentials_exports));
+  const wasLoggedIn = await hasCredentials2();
+  if (!wasLoggedIn) {
+    printWarning("You are not currently logged in.");
+    return;
+  }
+  await clearCredentials2();
   printSuccess("Logged out successfully. See you next time!");
 });
 program2.helpOption("-h, --help", "Display gorgeous help");