vibecheck-ai 2.0.1 → 5.0.0

package/bin/runners/runAuth.js

@@ -0,0 +1,731 @@
+/**
+ * vibecheck auth commands - Login, Logout, Whoami, Check, Refresh
+ * 
+ * ═══════════════════════════════════════════════════════════════════════════════
+ * World-Class Authentication Experience
+ * ═══════════════════════════════════════════════════════════════════════════════
+ * 
+ * Auth must be invisible when it works, explicit when it doesn't.
+ * - auth login: store API key securely
+ * - auth logout: remove credentials everywhere
+ * - auth me: show identity + plan + entitlements
+ * - auth --check: validate without prompting
+ * - auth --refresh: force entitlements refresh
+ */
+
+const readline = require("readline");
+const {
+  saveApiKey,
+  deleteApiKey,
+  getApiKey,
+  getEntitlements,
+} = require("./lib/auth");
+const {
+  redactApiKey,
+  redactOutput,
+  validateKeyFormat,
+  isValidKeyFormat,
+  sanitizeInput,
+  resolveApiKey,
+  formatSource,
+  clearAll,
+  checkAuth,
+  refreshEntitlements,
+  readCache,
+  hashApiKey,
+  getCacheAge,
+  auditLog,
+  trackFailedAttempt,
+  resetActivityTracker,
+  detectEnvironment,
+} = require("./lib/auth-shared");
+const { EXIT } = require("./lib/exit-codes");
+const { parseGlobalFlags, shouldSuppressOutput, isJsonMode } = require("./lib/global-flags");
+const { getTier, getLimits, FREE_FEATURES, PRO_FEATURES } = require("./lib/entitlements-v2");
+const { printActionableError } = require("./lib/error-messages");
+const {
+  ansi,
+  sym,
+  renderMinimalHeader,
+  renderSectionHeader,
+  renderSuccess,
+  renderError,
+  renderWarning,
+  renderKeyValue,
+  renderFooter,
+  Spinner,
+  getTierBadge,
+  TIER,
+} = require("./lib/unified-cli-output");
+
+async function prompt(question) {
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+
+  return new Promise((resolve) => {
+    rl.question(question, (answer) => {
+      rl.close();
+      resolve(answer.trim());
+    });
+  });
+}
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// LOGIN
+// ═══════════════════════════════════════════════════════════════════════════════
+
+async function runLogin(args) {
+  const { flags } = parseGlobalFlags(args);
+  const quiet = shouldSuppressOutput(flags);
+  const json = isJsonMode(flags);
+  const env = detectEnvironment();
+  
+  // Check for lockout
+  const lockout = trackFailedAttempt();
+  resetActivityTracker(); // Reset test attempt
+  if (lockout.locked) {
+    if (json) {
+      console.log(JSON.stringify({ 
+        success: false, 
+        error: `Too many failed attempts. Try again in ${lockout.lockoutRemaining}s`,
+        code: "LOCKED_OUT",
+      }));
+    } else {
+      renderError(`Too many failed attempts. Try again in ${Math.ceil(lockout.lockoutRemaining / 60)} minutes.`);
+    }
+    return EXIT.AUTH_FAILED;
+  }
+  
+  if (flags.help) {
+    console.log(`
+  ${ansi.bold}USAGE${ansi.reset}
+    ${ansi.cyan}vibecheck login${ansi.reset} [options]
+
+  ${ansi.dim}Aliases: auth, signin${ansi.reset}
+
+  Authenticate with your Vibecheck API key to unlock paid features
+  and sync with the dashboard.
+
+  ${ansi.bold}OPTIONS${ansi.reset}
+    ${ansi.cyan}--key <key>${ansi.reset}       Provide API key directly (non-interactive)
+    ${ansi.cyan}--json${ansi.reset}            Output result as JSON
+    ${ansi.cyan}--quiet, -q${ansi.reset}       Suppress non-essential output
+    ${ansi.cyan}--help, -h${ansi.reset}        Show this help
+
+  ${ansi.bold}EXAMPLES${ansi.reset}
+    ${ansi.dim}# Interactive login${ansi.reset}
+    vibecheck login
+
+    ${ansi.dim}# Non-interactive (CI/scripts)${ansi.reset}
+    vibecheck login --key YOUR_API_KEY
+
+    ${ansi.dim}# Using environment variable${ansi.reset}
+    VIBECHECK_API_KEY=xxx vibecheck whoami
+
+  ${ansi.bold}GET YOUR API KEY${ansi.reset}
+    https://vibecheckai.dev/settings/keys
+
+  ${ansi.dim}────────────────────────────────────────────────────────────────────${ansi.reset}
+  ${ansi.dim}Documentation: https://docs.vibecheckai.dev/authentication${ansi.reset}
+`);
+    return EXIT.SUCCESS;
+  }
+
+  try {
+    let key = null;
+    const keyIndex = args.indexOf("--key");
+    if (keyIndex !== -1 && args[keyIndex + 1]) {
+      key = args[keyIndex + 1];
+    }
+    
+    if (!quiet && !json) {
+      renderMinimalHeader("login", "free");
+    }
+
+    const existing = getApiKey();
+    if (existing.key && !key) {
+      if (!quiet && !json) {
+        renderWarning(`Already logged in (source: ${formatSource(existing.source)})`);
+      }
+      
+      if (process.env.CI || !process.stdin.isTTY) {
+        if (json) {
+          console.log(JSON.stringify({ success: true, message: "Already logged in", source: existing.source }));
+        }
+        return EXIT.SUCCESS;
+      }
+      
+      const answer = await prompt(`  Overwrite existing credentials? (y/N) `);
+      if (answer.toLowerCase() !== "y") {
+        if (!quiet && !json) console.log(`  ${ansi.dim}Cancelled.${ansi.reset}\n`);
+        if (json) console.log(JSON.stringify({ success: false, message: "Cancelled by user" }));
+        return EXIT.SUCCESS;
+      }
+    }
+
+    if (!key) {
+      if (process.env.CI || !process.stdin.isTTY) {
+        const errorMsg = "No API key provided. Use --key flag or set VIBECHECK_API_KEY environment variable.";
+        if (json) {
+          console.log(JSON.stringify({ success: false, error: errorMsg }));
+        } else {
+          renderError(errorMsg);
+        }
+        return EXIT.USER_ERROR;
+      }
+      
+      if (!quiet && !json) {
+        console.log(`  ${ansi.dim}Get your API key at: https://vibecheckai.dev/settings/keys${ansi.reset}\n`);
+      }
+      key = await prompt(`  ${sym.key} API Key: `);
+    }
+
+    if (!key) {
+      if (json) {
+        console.log(JSON.stringify({ success: false, error: "No API key provided" }));
+      } else {
+        renderError("No API key provided");
+      }
+      return EXIT.USER_ERROR;
+    }
+
+    // Sanitize input
+    key = sanitizeInput(key);
+
+    // Validate key format
+    const validation = validateKeyFormat(key);
+    if (!validation.valid) {
+      trackFailedAttempt();
+      auditLog("LOGIN_FAILED", key, "cli", { reason: validation.error });
+      if (json) {
+        console.log(JSON.stringify({ success: false, error: validation.error }));
+      } else {
+        printActionableError('INVALID_API_KEY', { command: 'login' });
+      }
+      return EXIT.AUTH_FAILED;
+    }
+
+    const spinner = !quiet && !json ? new Spinner("Verifying API key").start() : null;
+    
+    let entitlements;
+    try {
+      entitlements = await getEntitlements(key);
+    } catch (apiError) {
+      spinner?.fail(`Failed to verify: ${apiError.message}`);
+      if (json) {
+        console.log(JSON.stringify({ success: false, error: apiError.message }));
+      }
+      return EXIT.NETWORK_ERROR;
+    }
+
+    if (!entitlements) {
+      trackFailedAttempt();
+      auditLog("LOGIN_FAILED", key, "cli", { reason: "API validation failed" });
+      spinner?.fail("Invalid API key or server unreachable");
+      if (json) {
+        console.log(JSON.stringify({ success: false, error: "Invalid API key" }));
+      }
+      return EXIT.AUTH_FAILED;
+    }
+
+    // Success - reset activity tracker and save
+    resetActivityTracker();
+    auditLog("LOGIN_SUCCESS", key, "cli", { tier: entitlements.tier || entitlements.plan });
+    saveApiKey(key);
+    
+    const result = {
+      success: true,
+      user: entitlements?.user?.name || "User",
+      plan: entitlements?.plan || "free",
+      keyMasked: redactApiKey(key),
+    };
+    
+    if (json) {
+      console.log(JSON.stringify(result));
+    } else if (!quiet) {
+      spinner?.succeed(`Logged in as ${ansi.bold}${result.user}${ansi.reset}`);
+      console.log(`  ${ansi.dim}Plan:${ansi.reset} ${getTierBadge(result.plan)}`);
+      console.log(`  ${ansi.dim}Key:${ansi.reset}  ${result.keyMasked}\n`);
+    }
+
+    return EXIT.SUCCESS;
+  } catch (error) {
+    if (json) {
+      console.log(JSON.stringify({ success: false, error: error.message }));
+    } else {
+      renderError(`Login failed: ${error.message}`);
+    }
+    return EXIT.INTERNAL_ERROR;
+  }
+}
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// LOGOUT
+// ═══════════════════════════════════════════════════════════════════════════════
+
+async function runLogout(args) {
+  const { flags } = parseGlobalFlags(args);
+  const quiet = shouldSuppressOutput(flags);
+  const json = isJsonMode(flags);
+  
+  if (flags.help) {
+    console.log(`
+  ${ansi.bold}USAGE${ansi.reset}
+    ${ansi.cyan}vibecheck logout${ansi.reset}
+
+  ${ansi.dim}Aliases: signout${ansi.reset}
+
+  Remove stored API credentials from ALL locations:
+    • ~/.vibecheck/auth.json
+    • ~/.vibecheck/entitlements-cache.json
+    • Legacy config files
+
+  ${ansi.bold}OPTIONS${ansi.reset}
+    ${ansi.cyan}--json${ansi.reset}            Output result as JSON
+    ${ansi.cyan}--quiet, -q${ansi.reset}       Suppress non-essential output
+    ${ansi.cyan}--help, -h${ansi.reset}        Show this help
+`);
+    return EXIT.SUCCESS;
+  }
+  
+  try {
+    if (!quiet && !json) {
+      renderMinimalHeader("logout", "free");
+    }
+    
+    // Clear ALL auth data
+    clearAll();
+    // Also use legacy delete for backward compat
+    deleteApiKey();
+    
+    if (json) {
+      console.log(JSON.stringify({ 
+        success: true, 
+        message: "Logged out",
+        cleared: [
+          "~/.vibecheck/auth.json",
+          "~/.vibecheck/entitlements-cache.json",
+          "Legacy config",
+        ],
+      }));
+    } else if (!quiet) {
+      renderSuccess("Credentials removed from:");
+      console.log(`    ${ansi.dim}•${ansi.reset} ~/.vibecheck/auth.json`);
+      console.log(`    ${ansi.dim}•${ansi.reset} Entitlements cache`);
+      console.log(`    ${ansi.dim}•${ansi.reset} Legacy config files`);
+      console.log();
+    }
+    
+    return EXIT.SUCCESS;
+  } catch (error) {
+    if (json) {
+      console.log(JSON.stringify({ success: false, error: error.message }));
+    } else {
+      renderError(`Logout failed: ${error.message}`);
+    }
+    return EXIT.INTERNAL_ERROR;
+  }
+}
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// WHOAMI / ME
+// ═══════════════════════════════════════════════════════════════════════════════
+
+async function runWhoami(args) {
+  const { flags } = parseGlobalFlags(args);
+  const quiet = shouldSuppressOutput(flags);
+  const json = isJsonMode(flags);
+  
+  if (flags.help) {
+    console.log(`
+  ${ansi.bold}USAGE${ansi.reset}
+    ${ansi.cyan}vibecheck whoami${ansi.reset}
+
+  ${ansi.dim}Aliases: me, user${ansi.reset}
+
+  Display information about the currently authenticated user,
+  including plan, limits, and available scopes.
+
+  ${ansi.bold}OPTIONS${ansi.reset}
+    ${ansi.cyan}--json${ansi.reset}            Output result as JSON
+    ${ansi.cyan}--quiet, -q${ansi.reset}       Suppress non-essential output
+    ${ansi.cyan}--help, -h${ansi.reset}        Show this help
+
+  ${ansi.bold}EXAMPLES${ansi.reset}
+    ${ansi.dim}# Check current user${ansi.reset}
+    vibecheck whoami
+
+    ${ansi.dim}# Get JSON for scripts${ansi.reset}
+    vibecheck whoami --json
+`);
+    return EXIT.SUCCESS;
+  }
+
+  try {
+    if (!quiet && !json) {
+      renderMinimalHeader("whoami", "free");
+    }
+
+    const { key, source } = getApiKey();
+
+    if (!key) {
+      const result = json ? {
+        success: false,
+        error: {
+          code: "AUTH_REQUIRED",
+          message: "Not logged in",
+        },
+      } : { authenticated: false, message: "Not logged in" };
+      
+      if (json) {
+        console.log(JSON.stringify(result, null, 2));
+      } else {
+        renderWarning("Not logged in");
+        console.log(`  ${ansi.dim}Run "vibecheck login" or set VIBECHECK_API_KEY.${ansi.reset}\n`);
+      }
+      return EXIT.AUTH_REQUIRED;
+    }
+
+    const spinner = !quiet && !json ? new Spinner("Fetching user info").start() : null;
+
+    let entitlements;
+    try {
+      entitlements = await getEntitlements(key);
+    } catch (apiError) {
+      spinner?.fail(`Failed to fetch: ${apiError.message}`);
+      if (json) {
+        console.log(JSON.stringify({
+          success: false,
+          error: {
+            code: "NETWORK_ERROR",
+            message: apiError.message,
+          },
+        }, null, 2));
+      }
+      return EXIT.NETWORK_ERROR;
+    }
+    
+    if (!entitlements) {
+      spinner?.fail("Invalid API key or server unreachable");
+      if (json) {
+        console.log(JSON.stringify({
+          success: false,
+          error: {
+            code: "AUTH_FAILED",
+            message: "Invalid API key",
+          },
+        }, null, 2));
+      } else {
+        console.log(`  ${ansi.dim}Run "vibecheck login" to re-authenticate.${ansi.reset}\n`);
+      }
+      return EXIT.AUTH_FAILED;
+    }
+
+    spinner?.stop(null, null, null);
+
+    // Determine tier
+    const plan = entitlements.plan || entitlements.tier || "free";
+    const tier = plan === "free" ? "free" : "pro";
+    const features = tier === "pro" ? PRO_FEATURES : FREE_FEATURES;
+    const tierLimits = getLimits(tier);
+    
+    // Build result
+    const result = {
+      success: true,
+      data: {
+        user: {
+          id: entitlements.user?.id || entitlements.userId,
+          email: entitlements.user?.email || entitlements.email,
+          name: entitlements.user?.name,
+        },
+        tier: tier,
+        source: source,
+        keyMasked: redactApiKey(key),
+        features: features,
+        limits: {
+          scansPerMonth: entitlements.limits?.scansPerMonth ?? tierLimits.maxScansPerMonth,
+          filesPerScan: entitlements.limits?.filesPerScan ?? tierLimits.maxFilesPerScan,
+          reportFormats: tierLimits.reportFormats,
+        },
+        usage: {
+          scansThisMonth: entitlements.usage?.scansThisMonth || 0,
+          filesScanned: entitlements.usage?.filesScanned || 0,
+        },
+      },
+      timestamp: new Date().toISOString(),
+    };
+
+    if (json) {
+      console.log(JSON.stringify(result, null, 2));
+    } else if (!quiet) {
+      renderSectionHeader("Account", sym.key);
+      
+      renderKeyValue([
+        { label: "User", value: `${ansi.bold}${result.data.user.name || 'Unknown'}${ansi.reset} ${ansi.dim}(${result.data.user.email || 'N/A'})${ansi.reset}` },
+        { label: "Tier", value: getTierBadge(tier) },
+        { label: "Source", value: formatSource(source) },
+        { label: "Key", value: result.data.keyMasked },
+        { label: "Scans", value: `${result.data.usage.scansThisMonth}/${result.data.limits.scansPerMonth === -1 ? '∞' : result.data.limits.scansPerMonth} this month` },
+      ]);
+      
+      const scopes = entitlements.scopes || [];
+      if (scopes.length > 0) {
+        console.log();
+        console.log(`  ${ansi.dim}Scopes:${ansi.reset}`);
+        scopes.forEach(s => console.log(`    ${ansi.gray}${sym.bullet}${ansi.reset} ${s}`));
+      }
+      
+      // Upsell for free tier
+      if (tier === "free") {
+        renderFooter({
+          nextSteps: [
+            { cmd: "vibecheck scan", desc: "analyze your codebase" },
+          ],
+          showUpsell: true,
+        });
+      } else {
+        console.log();
+      }
+    }
+
+    return EXIT.SUCCESS;
+  } catch (error) {
+    if (json) {
+      console.log(JSON.stringify({
+        success: false,
+        error: {
+          code: error.code || "INTERNAL_ERROR",
+          message: error.message,
+        },
+      }, null, 2));
+    } else {
+      renderError(`Whoami failed: ${error.message}`);
+    }
+    return EXIT.INTERNAL_ERROR;
+  }
+}
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// CHECK (--check flag)
+// ═══════════════════════════════════════════════════════════════════════════════
+
+async function runCheck(args) {
+  const { flags } = parseGlobalFlags(args);
+  const json = isJsonMode(flags);
+  
+  try {
+    const result = await checkAuth();
+    
+    if (json) {
+      console.log(JSON.stringify({
+        success: result.authenticated,
+        data: {
+          authenticated: result.authenticated,
+          tier: result.tier,
+          source: result.source,
+          keyMasked: result.keyMasked,
+          networkOk: result.networkOk,
+          cacheValid: result.cacheValid,
+          cacheAge: result.cacheAge,
+          user: result.user,
+        },
+        error: result.error,
+        timestamp: new Date().toISOString(),
+      }, null, 2));
+    } else {
+      if (result.authenticated) {
+        console.log(`  ${sym.success} API key valid (${result.keyMasked})`);
+        console.log(`  ${sym.success} Tier: ${result.tier.toUpperCase()}`);
+        console.log(`  ${result.networkOk ? sym.success : sym.warning} Network: ${result.networkOk ? 'API reachable' : 'Offline (using cache)'}`);
+        if (result.cacheAge !== undefined) {
+          const mins = Math.floor(result.cacheAge / 60);
+          console.log(`  ${ansi.dim}Cache: ${result.cacheValid ? 'valid' : 'stale'} (${mins}m old)${ansi.reset}`);
+        }
+        console.log();
+      } else {
+        console.log(`  ${sym.error} Not authenticated`);
+        if (result.error) {
+          console.log(`  ${ansi.dim}${result.error.recovery}${ansi.reset}`);
+        }
+        console.log();
+      }
+    }
+    
+    return result.authenticated ? EXIT.SUCCESS : EXIT.AUTH_REQUIRED;
+  } catch (error) {
+    if (json) {
+      console.log(JSON.stringify({ success: false, error: error.message }));
+    } else {
+      renderError(`Check failed: ${error.message}`);
+    }
+    return EXIT.INTERNAL_ERROR;
+  }
+}
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// REFRESH (--refresh flag)
+// ═══════════════════════════════════════════════════════════════════════════════
+
+async function runRefresh(args) {
+  const { flags } = parseGlobalFlags(args);
+  const quiet = shouldSuppressOutput(flags);
+  const json = isJsonMode(flags);
+  
+  try {
+    const resolved = resolveApiKey();
+    
+    if (!resolved.key) {
+      if (json) {
+        console.log(JSON.stringify({ success: false, error: "Not logged in" }));
+      } else {
+        renderError("Not logged in");
+        console.log(`  ${ansi.dim}Run "vibecheck login" first.${ansi.reset}\n`);
+      }
+      return EXIT.AUTH_REQUIRED;
+    }
+    
+    const spinner = !quiet && !json ? new Spinner("Refreshing entitlements").start() : null;
+    
+    const entitlements = await refreshEntitlements();
+    
+    if (entitlements) {
+      const tier = entitlements.plan === "free" ? "free" : "pro";
+      
+      if (json) {
+        console.log(JSON.stringify({
+          success: true,
+          data: {
+            tier,
+            user: entitlements.user,
+            refreshedAt: new Date().toISOString(),
+          },
+        }, null, 2));
+      } else if (!quiet) {
+        spinner?.succeed("Entitlements refreshed");
+        console.log(`  ${ansi.dim}Tier:${ansi.reset} ${getTierBadge(tier)}`);
+        console.log(`  ${ansi.dim}Cache updated (expires in 10m)${ansi.reset}\n`);
+      }
+      
+      return EXIT.SUCCESS;
+    } else {
+      spinner?.fail("Failed to refresh entitlements");
+      if (json) {
+        console.log(JSON.stringify({ success: false, error: "Could not reach API" }));
+      }
+      return EXIT.NETWORK_ERROR;
+    }
+  } catch (error) {
+    if (json) {
+      console.log(JSON.stringify({ success: false, error: error.message }));
+    } else {
+      renderError(`Refresh failed: ${error.message}`);
+    }
+    return EXIT.INTERNAL_ERROR;
+  }
+}
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// MAIN ROUTER
+// ═══════════════════════════════════════════════════════════════════════════════
+
+/**
+ * Unified auth command handler
+ * Handles: login, logout, whoami, --check, --refresh
+ */
+async function runAuth(args = []) {
+  const { flags, cleanArgs } = parseGlobalFlags(args);
+  
+  // Handle --check flag at top level
+  if (args.includes("--check")) {
+    return runCheck(args);
+  }
+  
+  // Handle --refresh flag at top level
+  if (args.includes("--refresh")) {
+    return runRefresh(args);
+  }
+  
+  // Get subcommand
+  const subcommand = cleanArgs[0];
+  const subArgs = cleanArgs.slice(1);
+  
+  // Handle help at top level
+  if (flags.help && !subcommand) {
+    console.log(`
+  ${ansi.bold}USAGE${ansi.reset}
+    ${ansi.cyan}vibecheck auth${ansi.reset} <subcommand> [options]
+
+  ${ansi.dim}Authentication management${ansi.reset}
+
+  ${ansi.bold}SUBCOMMANDS${ansi.reset}
+    ${ansi.cyan}login${ansi.reset}              Authenticate with API key
+    ${ansi.cyan}logout${ansi.reset}             Remove stored credentials
+    ${ansi.cyan}whoami${ansi.reset}             Show current user and plan (alias: me)
+
+  ${ansi.bold}FLAGS${ansi.reset}
+    ${ansi.cyan}--check${ansi.reset}            Validate auth without prompting (CI/scripts)
+    ${ansi.cyan}--refresh${ansi.reset}          Force refresh entitlements from API
+
+  ${ansi.bold}EXAMPLES${ansi.reset}
+    ${ansi.dim}# Interactive login${ansi.reset}
+    vibecheck auth login
+
+    ${ansi.dim}# Login with key${ansi.reset}
+    vibecheck auth login --key YOUR_API_KEY
+
+    ${ansi.dim}# Show current user${ansi.reset}
+    vibecheck auth whoami
+
+    ${ansi.dim}# Validate auth (for CI)${ansi.reset}
+    vibecheck auth --check
+
+    ${ansi.dim}# Force refresh${ansi.reset}
+    vibecheck auth --refresh
+
+    ${ansi.dim}# Logout${ansi.reset}
+    vibecheck auth logout
+
+  ${ansi.dim}────────────────────────────────────────────────────────────────────${ansi.reset}
+  ${ansi.dim}Get your API key: https://vibecheckai.dev/settings/keys${ansi.reset}
+`);
+    return EXIT.SUCCESS;
+  }
+  
+  // Route to subcommand
+  switch (subcommand) {
+    case "login":
+      return runLogin(subArgs);
+    case "logout":
+      return runLogout(subArgs);
+    case "whoami":
+    case "me":
+      return runWhoami(subArgs);
+    case "check":
+      return runCheck(subArgs);
+    case "refresh":
+      return runRefresh(subArgs);
+    default:
+      // Default to whoami if no subcommand
+      if (!subcommand) {
+        return runWhoami(args);
+      }
+      // If it's a flag, might be intended for login
+      if (subcommand.startsWith("--")) {
+        return runLogin(cleanArgs);
+      }
+      renderError(`Unknown subcommand: ${subcommand}`);
+      console.log(`\nRun ${ansi.cyan}vibecheck auth --help${ansi.reset} for usage.\n`);
+      return EXIT.USER_ERROR;
+  }
+}
+
+module.exports = { 
+  runLogin, 
+  runLogout, 
+  runWhoami, 
+  runCheck,
+  runRefresh,
+  runAuth,
+};