vigthoria-cli 1.8.19 → 1.9.5

package/dist/commands/auth.js

@@ -1,367 +1,478 @@
 "use strict";
-/**
- * Auth Command - Authentication management
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthCommand = void 0;
+exports.loadAuthConfig = loadAuthConfig;
+exports.saveAuthConfig = saveAuthConfig;
+exports.clearAuthConfig = clearAuthConfig;
+exports.getAuthToken = getAuthToken;
+exports.login = login;
+exports.logout = logout;
+exports.whoami = whoami;
+exports.doctor = doctor;
+exports.handleLogin = handleLogin;
+exports.handleLogout = handleLogout;
+exports.statusAction = statusAction;
+exports.registerAuthCommands = registerAuthCommands;
 const chalk_1 = __importDefault(require("chalk"));
-const readline = __importStar(require("readline"));
-const logger_js_1 = require("../utils/logger.js");
-const api_js_1 = require("../utils/api.js");
-/**
- * Prompt helpers using Node's built-in readline.
- * inquirer 9.x destroys the readline interface after each prompt() call
- * which triggers ERR_USE_AFTER_CLOSE on Node 20 Windows TTY when a second
- * prompt is attempted on the same process.stdin.  Using raw readline avoids
- * this entirely.
- *
- * IMPORTANT: We reuse a single readline.Interface for all prompts in the
- * login flow to avoid the triple-rl stdin contention that causes stalls
- * on Windows TTY and piped terminals.
- */
-function ask(rl, question) {
-    return new Promise((resolve) => rl.question(question, resolve));
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path_1 = __importDefault(require("path"));
+const readline_1 = __importDefault(require("readline"));
+const DEFAULT_API_URL = 'https://coder.vigthoria.io';
+const CONFIG_DIR = path_1.default.join((0, os_1.homedir)(), '.vigthoria');
+const CONFIG_FILE = path_1.default.join(CONFIG_DIR, 'config.json');
+const KNOWN_AUTH_BASE_URLS = ['https://coder.vigthoria.io', 'https://api.vigthoria.io'];
+class HttpError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
 }
-function askHidden(rl, question) {
-    // In non-interactive (piped) terminals, fall back to plain rl.question
-    // because raw data events won't fire after stdin reaches EOF.
-    if (!process.stdin.isTTY) {
-        return new Promise((resolve) => {
-            rl.question(question, (answer) => {
-                resolve(answer.trim());
-            });
-        });
-    }
-    return new Promise((resolve) => {
-        const stdout = process.stdout;
-        let answer = '';
-        // Pause rl so it doesn't compete for stdin data events
-        rl.pause();
-        stdout.write(question);
-        process.stdin.setRawMode(true);
-        process.stdin.resume();
-        const onData = (ch) => {
-            const c = ch.toString('utf8');
-            if (c === '\n' || c === '\r' || c === '\u0004') {
-                process.stdin.setRawMode(false);
-                process.stdin.removeListener('data', onData);
-                stdout.write('\n');
-                rl.resume();
-                resolve(answer);
-            }
-            else if (c === '\u007f' || c === '\b') {
-                if (answer.length > 0) {
-                    answer = answer.slice(0, -1);
-                    stdout.write('\b \b');
-                }
-            }
-            else if (c === '\u0003') {
-                rl.close();
-                process.exit(1);
-            }
-            else {
-                answer += c;
-                stdout.write('*');
-            }
+function trimTrailingSlash(value) {
+    return value.replace(/\/+$/, '');
+}
+function uniqueStrings(values) {
+    return [...new Set(values.filter(Boolean))];
+}
+function getApiUrl() {
+    return trimTrailingSlash(process.env.VIGTHORIA_API_URL || DEFAULT_API_URL);
+}
+function derivePeerHost(baseUrl) {
+    if (baseUrl.includes('://api.vigthoria.io')) {
+        return baseUrl.replace('://api.vigthoria.io', '://coder.vigthoria.io');
+    }
+    if (baseUrl.includes('://coder.vigthoria.io')) {
+        return baseUrl.replace('://coder.vigthoria.io', '://api.vigthoria.io');
+    }
+    return undefined;
+}
+function getAuthBaseCandidates(seedBaseUrl) {
+    const seed = trimTrailingSlash(seedBaseUrl || getApiUrl());
+    const peer = derivePeerHost(seed);
+    return uniqueStrings([seed, ...(peer ? [peer] : []), ...KNOWN_AUTH_BASE_URLS]).map(trimTrailingSlash);
+}
+function ensureConfigDir() {
+    if (!(0, fs_1.existsSync)(CONFIG_DIR)) {
+        (0, fs_1.mkdirSync)(CONFIG_DIR, { recursive: true, mode: 0o700 });
+    }
+    try {
+        (0, fs_1.chmodSync)(CONFIG_DIR, 0o700);
+    }
+    catch {
+        // Best-effort on non-POSIX filesystems.
+    }
+}
+function humanMessage(error) {
+    const raw = error instanceof Error ? error.message : String(error);
+    if (/^\s*</.test(raw) || /<!doctype html/i.test(raw)) {
+        return 'The Vigthoria service returned an unexpected HTML response. This usually means auth routes are misconfigured server-side.';
+    }
+    return raw || 'Unknown authentication error.';
+}
+function extractAuthToken(payload) {
+    if (!payload || typeof payload !== 'object') {
+        return undefined;
+    }
+    const body = payload;
+    return body.token || body.accessToken || body.tokens?.access_token;
+}
+function extractAuthUser(payload, fallbackEmail) {
+    if (!payload || typeof payload !== 'object') {
+        return fallbackEmail ? { email: fallbackEmail } : undefined;
+    }
+    const body = payload;
+    const user = body.user;
+    if (user && typeof user === 'object') {
+        const typed = user;
+        return {
+            id: typed.id ? String(typed.id) : undefined,
+            email: typed.email ? String(typed.email) : fallbackEmail,
+            name: typed.name ? String(typed.name) : typed.username ? String(typed.username) : undefined,
         };
-        process.stdin.on('data', onData);
-    });
+    }
+    if (body.email || body.id || body.username) {
+        return {
+            id: body.id ? String(body.id) : undefined,
+            email: body.email ? String(body.email) : fallbackEmail,
+            name: body.username ? String(body.username) : body.name ? String(body.name) : undefined,
+        };
+    }
+    return fallbackEmail ? { email: fallbackEmail } : undefined;
 }
-class AuthCommand {
-    config;
-    logger;
-    api;
-    constructor(config, logger) {
-        this.config = config;
-        this.logger = logger;
-        this.api = new api_js_1.APIClient(config, logger);
-    }
-    async login(options) {
-        // If token provided, use token auth
-        if (options.token) {
-            await this.loginWithToken(options.token);
-            return;
-        }
-        console.log();
-        console.log(chalk_1.default.cyan(`${logger_js_1.CH.hDouble.repeat(3)} Vigthoria Login ${logger_js_1.CH.hDouble.repeat(3)}`));
-        console.log();
-        // Use Node's built-in readline instead of inquirer.
-        // inquirer 9.x destroys and recreates readline interfaces per prompt
-        // which causes ERR_USE_AFTER_CLOSE on Node 20 Windows TTY.
-        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+function loadAuthConfig() {
+    if (!(0, fs_1.existsSync)(CONFIG_FILE)) {
+        return { apiUrl: getApiUrl() };
+    }
+    try {
+        const parsed = JSON.parse((0, fs_1.readFileSync)(CONFIG_FILE, 'utf8'));
+        return {
+            apiUrl: trimTrailingSlash(parsed.apiUrl || getApiUrl()),
+            token: parsed.token || parsed.authToken,
+            user: parsed.user,
+        };
+    }
+    catch (error) {
+        console.warn(chalk_1.default.yellow(`Warning: could not read auth config: ${humanMessage(error)}`));
+        return { apiUrl: getApiUrl() };
+    }
+}
+function saveAuthConfig(config) {
+    ensureConfigDir();
+    (0, fs_1.writeFileSync)(CONFIG_FILE, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
+    try {
+        (0, fs_1.chmodSync)(CONFIG_FILE, 0o600);
+    }
+    catch {
+        // Best-effort on non-POSIX filesystems.
+    }
+}
+function clearAuthConfig() {
+    if ((0, fs_1.existsSync)(CONFIG_FILE)) {
+        (0, fs_1.rmSync)(CONFIG_FILE, { force: true });
+    }
+}
+function getAuthToken() {
+    return process.env.VIGTHORIA_TOKEN || loadAuthConfig().token;
+}
+async function requestJson(url, init) {
+    const response = await fetch(url, {
+        ...init,
+        headers: {
+            accept: 'application/json',
+            'content-type': 'application/json',
+            ...(init.headers || {}),
+        },
+    });
+    const text = await response.text();
+    let body = {};
+    if (text.trim()) {
         try {
-            console.log(chalk_1.default.white('  1) Email & Password'));
-            console.log(chalk_1.default.white('  2) API Token'));
-            console.log(chalk_1.default.white('  3) Browser Login'));
-            console.log();
-            const choice = (await ask(rl, chalk_1.default.cyan('? ') + 'Choose login method (1/2/3): ')).trim();
-            switch (choice) {
-                case '1':
-                case 'credentials': {
-                    const email = (await ask(rl, chalk_1.default.cyan('? ') + 'Email: ')).trim();
-                    const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-                    if (!emailRegex.test(email)) {
-                        this.logger.error('Please enter a valid email');
-                        rl.close();
-                        return;
-                    }
-                    const password = await askHidden(rl, chalk_1.default.cyan('? ') + 'Password: ');
-                    rl.close();
-                    if (password.length < 6) {
-                        this.logger.error('Password must be at least 6 characters');
-                        return;
-                    }
-                    await this.doCredentialLogin(email, password);
-                    break;
-                }
-                case '2':
-                case 'token': {
-                    const token = await askHidden(rl, chalk_1.default.cyan('? ') + 'API Token: ');
-                    rl.close();
-                    if (!token) {
-                        this.logger.error('Please enter your API token');
-                        return;
-                    }
-                    await this.loginWithToken(token);
-                    break;
-                }
-                case '3':
-                case 'browser':
-                    rl.close();
-                    await this.loginWithBrowser();
-                    break;
-                default:
-                    rl.close();
-                    this.logger.error('Invalid choice. Please enter 1, 2, or 3.');
-                    break;
-            }
+            body = JSON.parse(text);
         }
-        catch (err) {
-            rl.close();
-            throw err;
+        catch {
+            if (/^\s*</.test(text) || /<!doctype html/i.test(text)) {
+                throw new HttpError(response.status, 'The Vigthoria service returned an unexpected HTML response. Please verify auth routes.');
+            }
+            throw new HttpError(response.status, text.slice(0, 240));
         }
     }
-    async doCredentialLogin(email, password) {
-        const spinner = (0, logger_js_1.createSpinner)('Logging in...').start();
-        const success = await this.api.login(email, password);
-        spinner.stop();
-        if (success) {
-            this.printLoginSuccess();
+    if (!response.ok) {
+        const message = typeof body === 'object' && body && 'error' in body
+            ? String(body.error)
+            : typeof body === 'object' && body && 'message' in body
+                ? String(body.message)
+                : `Request failed with status ${response.status}`;
+        throw new HttpError(response.status, message);
+    }
+    return body;
+}
+async function ask(question, hidden = false) {
+    const rl = readline_1.default.createInterface({ input: process.stdin, output: process.stdout });
+    if (!hidden) {
+        try {
+            return await new Promise((resolve) => rl.question(question, resolve));
         }
-        else {
-            this.logger.error('Login failed. Please check your credentials.');
+        finally {
+            rl.close();
         }
     }
-    async loginWithToken(token) {
-        const spinner = (0, logger_js_1.createSpinner)('Validating token...').start();
-        const success = await this.api.loginWithToken(token);
-        spinner.stop();
-        if (success) {
-            this.printLoginSuccess();
+    const output = process.stdout;
+    const mutableRl = rl;
+    const originalWrite = mutableRl._writeToOutput;
+    mutableRl._writeToOutput = function writeMasked(value) {
+        if (value.includes('\n') || value.includes('\r')) {
+            output.write(value);
         }
         else {
-            this.logger.error('Invalid token. Please check and try again.');
+            output.write('*');
         }
+    };
+    try {
+        return await new Promise((resolve) => rl.question(question, resolve));
     }
-    async loginWithBrowser() {
-        console.log();
-        console.log(chalk_1.default.gray('Opening browser for authentication...'));
-        console.log();
-        console.log(chalk_1.default.cyan('Visit: https://coder.vigthoria.io/cli-auth'));
-        console.log();
-        console.log(chalk_1.default.gray('After authenticating, copy the token and run:'));
-        console.log(chalk_1.default.white('  vigthoria login --token YOUR_TOKEN'));
-        console.log();
-    }
-    async logout() {
-        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-        const answer = await ask(rl, chalk_1.default.cyan('? ') + 'Are you sure you want to logout? (y/N): ');
-        rl.close();
-        const confirm = /^y(es)?$/i.test(answer.trim());
-        if (confirm) {
-            this.config.clearAuth();
-            this.logger.success('Logged out successfully');
+    finally {
+        if (originalWrite) {
+            mutableRl._writeToOutput = originalWrite;
         }
+        output.write('\n');
+        rl.close();
     }
-    async status() {
-        console.log();
-        console.log(chalk_1.default.cyan(`${logger_js_1.CH.hDouble.repeat(3)} Account Status ${logger_js_1.CH.hDouble.repeat(3)}`));
-        console.log();
-        if (!this.config.isAuthenticated()) {
-            this.logger.warn('Not logged in');
-            console.log();
-            console.log(chalk_1.default.gray('Run `vigthoria login` to authenticate'));
-            this.api.destroy();
-            return;
+}
+function markSuccessExit() {
+    process.exitCode = 0;
+}
+function markErrorExit() {
+    process.exitCode = 1;
+}
+async function login(email, password) {
+    try {
+        const resolvedEmail = (email || '').trim();
+        const resolvedPassword = password || '';
+        if (!resolvedEmail || !resolvedPassword) {
+            throw new Error('Email and password are required. Pass --email and --password or run login interactively.');
         }
-        const email = this.config.get('email');
-        const sub = this.config.get('subscription');
-        // Account info
-        console.log(chalk_1.default.white('Account:'));
-        console.log(chalk_1.default.gray('  Email: ') + chalk_1.default.cyan(email));
-        console.log(chalk_1.default.gray('  User ID: ') + chalk_1.default.gray(this.config.get('userId')));
-        console.log();
-        // Subscription info
-        console.log(chalk_1.default.white('Subscription:'));
-        const planDisplay = sub.plan ? chalk_1.default.green(sub.plan.toUpperCase()) : chalk_1.default.yellow('FREE');
-        const statusDisplay = sub.status === 'active' ? chalk_1.default.green('Active') : chalk_1.default.red(sub.status || 'N/A');
-        console.log(chalk_1.default.gray('  Plan: ') + planDisplay);
-        console.log(chalk_1.default.gray('  Status: ') + statusDisplay);
-        console.log(chalk_1.default.gray('  Cloud Models: ') + (this.config.hasCloudAccess() ? chalk_1.default.green('Enabled') : chalk_1.default.yellow('Local only')));
-        console.log(chalk_1.default.gray('  Operator Mode: ') + (this.config.hasOperatorAccess() ? chalk_1.default.green('Enabled') : chalk_1.default.yellow('Enterprise/Admin only')));
-        if (sub.expiresAt) {
-            const expiresDate = new Date(sub.expiresAt);
-            const daysLeft = Math.ceil((expiresDate.getTime() - Date.now()) / (1000 * 60 * 60 * 24));
-            const expiresColor = daysLeft > 7 ? chalk_1.default.green : daysLeft > 0 ? chalk_1.default.yellow : chalk_1.default.red;
-            console.log(chalk_1.default.gray('  Expires: ') + expiresColor(`${expiresDate.toLocaleDateString()} (${daysLeft} days)`));
+        const authBases = getAuthBaseCandidates(getApiUrl());
+        const endpointVariants = [
+            { path: '/auth/login', body: { email: resolvedEmail, password: resolvedPassword } },
+            { path: '/api/auth/login', body: { email: resolvedEmail, password: resolvedPassword } },
+            { path: '/api/login-json', body: { identifier: resolvedEmail, password: resolvedPassword } },
+            { path: '/api/login', body: { email: resolvedEmail, password: resolvedPassword } },
+        ];
+        const attempted = [];
+        const failures = [];
+        for (const base of authBases) {
+            for (const variant of endpointVariants) {
+                const endpoint = `${trimTrailingSlash(base)}${variant.path}`;
+                attempted.push(endpoint);
+                try {
+                    const result = await requestJson(endpoint, {
+                        method: 'POST',
+                        body: JSON.stringify(variant.body),
+                    });
+                    const token = extractAuthToken(result);
+                    if (!token) {
+                        failures.push(`${endpoint} -> success without token`);
+                        continue;
+                    }
+                    const config = {
+                        apiUrl: trimTrailingSlash(base),
+                        token,
+                        user: extractAuthUser(result, resolvedEmail),
+                        success: true,
+                    };
+                    saveAuthConfig(config);
+                    markSuccessExit();
+                    return config;
+                }
+                catch (error) {
+                    const message = humanMessage(error);
+                    failures.push(`${endpoint} -> ${message}`);
+                }
+            }
         }
-        console.log();
-        // Available models
-        console.log(chalk_1.default.white('Available Models:'));
-        const models = this.config.getAvailableModels();
-        models.forEach(m => {
-            console.log(chalk_1.default.gray(`  ${logger_js_1.CH.bullet} `) + chalk_1.default.cyan(m.id) + chalk_1.default.gray(' -> ') + chalk_1.default.white(m.name));
-            const runtimeLabel = m.tier === 'cloud' ? 'cloud' : 'blackwell';
-            console.log(chalk_1.default.gray(`      ${m.tier === 'cloud' ? logger_js_1.CH.cloud : logger_js_1.CH.home} ${m.description}`));
-            console.log(chalk_1.default.gray(`      Backend: ${m.backendModel} (${runtimeLabel})`));
-        });
-        console.log();
-        // Run ALL three probes in parallel — they are independent.
-        const spinner = (0, logger_js_1.createSpinner)('Checking API, capabilities and auth...').start();
-        let capabilityTimeout = null;
-        const [apiStatus, capabilityStatus, tokenValidation] = await Promise.all([
-            this.api.getHealthStatus(),
-            Promise.race([
-                this.api.getCapabilityTruthStatus({
-                    workspacePath: process.cwd(),
-                    projectPath: process.cwd(),
-                    targetPath: process.cwd(),
-                }),
-                new Promise(resolve => {
-                    capabilityTimeout = setTimeout(() => resolve({
-                        overallOk: false,
-                        v3Agent: { name: 'V3 Agent', endpoint: '', ok: false, error: 'Timed out (8s)' },
-                        hyperLoop: { name: 'Hyper Loop', endpoint: '', ok: false, error: 'Timed out (8s)' },
-                        repoMemory: { name: 'Repo Memory', endpoint: '', ok: false, error: 'Timed out (8s)' },
-                        devtoolsBridge: { name: 'DevTools Bridge', endpoint: '', ok: false, error: 'Timed out (8s)' },
-                    }), 8000);
-                }),
-            ]),
-            this.api.validateToken(),
-        ]);
-        if (capabilityTimeout)
-            clearTimeout(capabilityTimeout);
-        spinner.stop();
-        // --- Display API Status ---
-        console.log(chalk_1.default.white('API Status:'));
-        console.log(chalk_1.default.gray('  Overall: ') + (apiStatus.overallOk ? chalk_1.default.green('Healthy') : chalk_1.default.yellow('Degraded')));
-        console.log(chalk_1.default.gray('  Coder API: ') + (apiStatus.coder.ok ? chalk_1.default.green('Online') : chalk_1.default.red('Offline')) + chalk_1.default.gray(` (${apiStatus.coder.endpoint})`));
-        if (apiStatus.coder.error) {
-            console.log(chalk_1.default.gray('    Error: ') + chalk_1.default.red(apiStatus.coder.error));
+        throw new Error([
+            'Login failed on all known auth endpoints.',
+            `Tried: ${attempted.join(', ')}`,
+            `Last errors: ${failures.slice(-4).join(' | ')}`,
+        ].join(' '));
+    }
+    catch (error) {
+        const message = humanMessage(error);
+        markErrorExit();
+        throw new Error(message);
+    }
+}
+async function logout() {
+    const config = loadAuthConfig();
+    if (config.token) {
+        const bases = getAuthBaseCandidates(config.apiUrl || getApiUrl());
+        const logoutPaths = ['/auth/logout', '/api/auth/logout', '/api/logout'];
+        let remoteLogoutDone = false;
+        for (const base of bases) {
+            for (const route of logoutPaths) {
+                try {
+                    await requestJson(`${trimTrailingSlash(base)}${route}`, {
+                        method: 'POST',
+                        headers: { authorization: `Bearer ${config.token}` },
+                    });
+                    remoteLogoutDone = true;
+                    break;
+                }
+                catch {
+                    // Continue trying known routes.
+                }
+            }
+            if (remoteLogoutDone) {
+                break;
+            }
         }
-        console.log(chalk_1.default.gray('  Models API: ') + (apiStatus.models.ok ? chalk_1.default.green('Online') : chalk_1.default.red('Offline')) + chalk_1.default.gray(` (${apiStatus.models.endpoint})`));
-        if (apiStatus.models.details?.modelCount !== undefined) {
-            console.log(chalk_1.default.gray('    Models Available: ') + chalk_1.default.cyan(String(apiStatus.models.details.modelCount)));
+        if (!remoteLogoutDone) {
+            console.warn(chalk_1.default.yellow('Remote logout endpoint not reachable; local credentials were still cleared.'));
         }
-        if (apiStatus.models.error) {
-            console.log(chalk_1.default.gray('    Error: ') + chalk_1.default.red(apiStatus.models.error));
+    }
+    clearAuthConfig();
+    process.exitCode = 0;
+}
+async function whoami() {
+    const config = loadAuthConfig();
+    if (!config.token) {
+        return undefined;
+    }
+    const bases = getAuthBaseCandidates(config.apiUrl || getApiUrl());
+    const attempted = [];
+    for (const base of bases) {
+        const normalizedBase = trimTrailingSlash(base);
+        const getRoutes = ['/auth/me', '/api/auth/me', '/api/user/info', '/api/profile'];
+        for (const route of getRoutes) {
+            const endpoint = `${normalizedBase}${route}`;
+            attempted.push(endpoint);
+            try {
+                const result = await requestJson(endpoint, {
+                    method: 'GET',
+                    headers: { authorization: `Bearer ${config.token}` },
+                });
+                const user = extractAuthUser(result) || extractAuthUser(result.user);
+                if (user) {
+                    saveAuthConfig({ ...config, apiUrl: normalizedBase, user });
+                    return user;
+                }
+            }
+            catch {
+                // continue fallback route probing
+            }
         }
-        if (apiStatus.selfHosted) {
-            console.log(chalk_1.default.gray('  Self-hosted Models: ') + (apiStatus.selfHosted.ok ? chalk_1.default.green('Online') : chalk_1.default.yellow('Unavailable')) + chalk_1.default.gray(` (${apiStatus.selfHosted.endpoint})`));
-            if (apiStatus.selfHosted.error) {
-                console.log(chalk_1.default.gray('    Error: ') + chalk_1.default.yellow(apiStatus.selfHosted.error));
+        const verifyEndpoint = `${normalizedBase}/api/auth/verify`;
+        attempted.push(verifyEndpoint);
+        try {
+            const result = await requestJson(verifyEndpoint, {
+                method: 'POST',
+                headers: { authorization: `Bearer ${config.token}` },
+                body: JSON.stringify({ token: config.token }),
+            });
+            const user = extractAuthUser(result) || extractAuthUser(result.user);
+            if (user) {
+                saveAuthConfig({ ...config, apiUrl: normalizedBase, user });
+                return user;
             }
         }
-        else {
-            console.log(chalk_1.default.gray('  Self-hosted Models: ') + chalk_1.default.gray('disabled'));
+        catch {
+            // continue fallback route probing
         }
-        // --- Display Capability Truth ---
-        console.log();
-        console.log(chalk_1.default.white('Capability Truth:'));
-        const coreOk = apiStatus.overallOk;
-        console.log(chalk_1.default.gray('  Overall: ') + (coreOk ? chalk_1.default.green('Verified') : chalk_1.default.yellow('Partial')));
-        // V3 Agent — used by agent/chat commands (routed through model API)
-        console.log(chalk_1.default.gray('  V3 Agent: ') + (capabilityStatus.v3Agent.ok ? chalk_1.default.green('Reachable') : chalk_1.default.gray('Not deployed (routed through model API)')));
-        if (capabilityStatus.v3Agent.error && capabilityStatus.v3Agent.ok === false) {
-            const err = capabilityStatus.v3Agent.error;
-            if (!/timed? out|not reachable|No V3 agent/i.test(err)) {
-                console.log(chalk_1.default.gray('    Error: ') + chalk_1.default.red(err));
-            }
+    }
+    throw new Error(`Unable to verify account on known auth endpoints. Tried ${attempted.join(', ')}`);
+}
+async function doctor() {
+    const config = loadAuthConfig();
+    const report = {
+        nodeVersion: process.version,
+        platform: process.platform,
+        arch: process.arch,
+        configFile: CONFIG_FILE,
+        loggedIn: Boolean(config.token),
+        apiUrl: config.apiUrl,
+    };
+    process.exitCode = 0;
+    return report;
+}
+async function handleLogin(options = {}) {
+    try {
+        if (options.token) {
+            const config = {
+                apiUrl: getApiUrl(),
+                token: options.token,
+                success: true,
+            };
+            saveAuthConfig(config);
+            console.log(chalk_1.default.green('Logged in successfully with API token.'));
+            process.exitCode = 0;
+            return config;
+        }
+        let email = options.email?.trim();
+        let password = options.password;
+        if (options.device) {
+            console.log(chalk_1.default.yellow('Device-code login is not enabled by this Vigthoria service. Falling back to email and password authentication.'));
+        }
+        if (!email) {
+            email = (await ask('Email: ')).trim();
         }
-        // Hyper Loop — optional orchestration layer
-        console.log(chalk_1.default.gray('  Hyper Loop: ') + (capabilityStatus.hyperLoop.ok ? chalk_1.default.green('Reachable') : chalk_1.default.gray('Not deployed (optional)')));
-        // Repo Memory — separate auth scope, only affects repo commands
-        console.log(chalk_1.default.gray('  Repo Memory: ') + (capabilityStatus.repoMemory.ok ? chalk_1.default.green('Active') : chalk_1.default.gray('Not deployed (optional)')));
-        if (capabilityStatus.repoMemory.details?.compactContextLength !== undefined) {
-            console.log(chalk_1.default.gray('    Compact Context: ') + chalk_1.default.cyan(`${capabilityStatus.repoMemory.details.compactContextLength} chars`));
+        if (!password) {
+            password = await ask('Password: ', true);
         }
-        // DevTools Bridge — local service, not required
-        console.log(chalk_1.default.gray('  DevTools Bridge: ') + (capabilityStatus.devtoolsBridge.ok ? chalk_1.default.green('Connected') : chalk_1.default.gray('Not running (optional)')));
-        // --- Display Auth Scopes ---
-        console.log();
-        console.log(chalk_1.default.white('Auth Scopes:'));
-        console.log(chalk_1.default.gray('  Model Auth: ') + (tokenValidation.valid ? chalk_1.default.green('Valid') : chalk_1.default.red('Invalid')) + chalk_1.default.gray(' (used by chat, agent, review, explain, generate, fix)'));
-        if (!tokenValidation.valid && tokenValidation.error) {
-            console.log(chalk_1.default.gray('    ') + chalk_1.default.red(tokenValidation.error));
+        if (!email || !password) {
+            throw new Error('Email and password are required. Use --email and --password, or run vigthoria login interactively.');
         }
-        console.log(chalk_1.default.gray('  Repo Auth: ') + (capabilityStatus.repoMemory.ok ? chalk_1.default.green('Active') : chalk_1.default.gray('N/A — repo memory not deployed')) + chalk_1.default.gray(' (used by repo push/pull/list only)'));
-        console.log(chalk_1.default.gray('  Bridge Auth: ') + (capabilityStatus.devtoolsBridge.ok ? chalk_1.default.green('Connected') : chalk_1.default.gray('N/A — bridge not running')) + chalk_1.default.gray(' (used by --bridge flag only)'));
-        console.log();
-        // Graceful exit — destroy keep-alive agents so the event loop drains
-        // naturally.  Setting exitCode (not calling process.exit()) avoids the
-        // libuv UV_HANDLE_CLOSING assertion on Windows that occurs when
-        // process.exit() is invoked while socket handles are mid-close.
-        this.api.destroy();
+        const config = await login(email, password);
+        console.log(chalk_1.default.green('Logged in successfully.'));
+        if (config.user?.email) {
+            console.log(`Account: ${config.user.email}`);
+        }
+        console.log(`API: ${config.apiUrl}`);
         process.exitCode = 0;
+        return config;
+    }
+    catch (error) {
+        console.error(chalk_1.default.red(`Login failed: ${humanMessage(error)}`));
+        process.exitCode = 1;
+        return undefined;
     }
-    printLoginSuccess() {
-        const email = this.config.get('email');
-        const sub = this.config.get('subscription');
-        console.log();
-        this.logger.success(`Logged in as ${chalk_1.default.cyan(email)}`);
-        if (sub.plan) {
-            console.log(chalk_1.default.gray(`  Plan: ${chalk_1.default.green(sub.plan.toUpperCase())}`));
+}
+async function handleLogout(_options) {
+    try {
+        await logout();
+        console.log(chalk_1.default.green('Logged out successfully.'));
+        process.exitCode = 0;
+    }
+    catch (error) {
+        console.error(chalk_1.default.red(`Logout failed: ${humanMessage(error)}`));
+        process.exitCode = 1;
+    }
+}
+async function statusAction() {
+    try {
+        const config = loadAuthConfig();
+        if (!config.token) {
+            console.log(chalk_1.default.yellow('Not logged in.'));
+            process.exitCode = 0;
+            return;
+        }
+        let user = config.user;
+        try {
+            user = await whoami();
+        }
+        catch {
+            // Keep local status available even if remote whoami endpoint is down.
         }
-        console.log();
-        console.log(chalk_1.default.gray('You can now use all Vigthoria CLI features.'));
-        console.log(chalk_1.default.gray('Run `vigthoria chat` or `npx vigthoria-chat` to start coding with AI!'));
-        console.log();
+        console.log(chalk_1.default.green('Logged in.'));
+        if (user?.email) {
+            console.log(`Account: ${user.email}`);
+        }
+        console.log(`API: ${config.apiUrl}`);
+        process.exitCode = 0;
     }
+    catch (error) {
+        console.error(chalk_1.default.red(`Unable to read status: ${humanMessage(error)}`));
+        process.exitCode = 1;
+    }
+}
+function registerAuthCommands(program) {
+    const auth = program.command('auth').description('Manage Vigthoria CLI authentication');
+    auth
+        .command('login')
+        .description('Sign in with your Vigthoria account')
+        .option('-t, --token <token>', 'API token for token-based authentication')
+        .option('-e, --email <email>', 'Account email address')
+        .option('-p, --password <password>', 'Account password')
+        .option('--device', 'Use OAuth device flow (requires server support)')
+        .action(async (options) => {
+        await handleLogin(options);
+    });
+    auth
+        .command('logout')
+        .description('Sign out and remove saved credentials')
+        .action(async () => {
+        await handleLogout();
+    });
+    auth
+        .command('whoami')
+        .description('Show the authenticated Vigthoria account')
+        .action(async () => {
+        try {
+            const user = await whoami();
+            if (!user) {
+                console.log(chalk_1.default.yellow('Not logged in.'));
+                process.exitCode = 0;
+                return;
+            }
+            console.log(chalk_1.default.green('Logged in.'));
+            console.log(user.email || user.name || user.id || 'Authenticated user');
+            process.exitCode = 0;
+        }
+        catch (error) {
+            console.error(chalk_1.default.red(`Unable to fetch account: ${humanMessage(error)}`));
+            process.exitCode = 1;
+        }
+    });
 }
-exports.AuthCommand = AuthCommand;