fix(cli): exit non-zero from whoami and login when unauthenticated - #3654

The lie

veryfront whoami prints ✗ Not logged in and exits 0.

Reproduced against the published npm artifact veryfront@0.1.1232, in a sandbox outside the monorepo, with the exit code captured directly (no pipe, which would mask it):

$ env -u VERYFRONT_API_TOKEN ./node_modules/.bin/veryfront whoami

  ✗ Not logged in
  Run 'veryfront login' to authenticate
EXIT=0

$ env -u VERYFRONT_API_TOKEN ./node_modules/.bin/veryfront whoami --json
{
  "success": true,
  "command": "whoami",
  "data": { "authenticated": false }
}
EXIT=0

The exit code is the machine-readable contract. Any CI step, shell script, or agent that gates on veryfront whoami believes it is authenticated when it is not, then fails later somewhere unrelated and much harder to diagnose. A human used veryfront whoami exactly this way — to confirm auth before starting a task — during the dogfood session that found this.

Sibling check

Swept the neighbouring commands for the same class of defect:

login is the same shape as whoami and lives in the same router entry group and auth module, so it is fixed here. doctor's warning-exits-0 behaviour is deliberate and opt-in via --strict; left alone.

Cause

cli/router.ts awaited the auth functions and discarded their return values:

"whoami": async () => async () => {
  const { whoami } = await import("./auth/index.ts");
  await whoami();          // returns AuthIdentity | null — null was dropped
},

whoami() already reports "no usable credential" by returning null. That signal simply never reached the process exit code. Same for login().

Fix

Both handlers now exit 1 when no credential was obtained.

Exit code: 1, not 2. The CLI output style guide's exit-code table reserves 2 for invalid usage (wrong args, missing required) and 1 for a general error; 130 is interrupt. veryfront whoami with no credential is well-formed usage that answers "no", so it is 1. This also matches the precedent of tools like grep and git diff --quiet, where 1 means "the answer is no" rather than "you called me wrong".

Human-readable output is unchanged — it still names the problem plainly and points at veryfront login. --json still emits the authenticated: false envelope, now alongside the non-zero exit. Both whoami and login help text now document the exit codes.

Tests

cli/auth/exit-code.integration.test.ts drives the real CLI entry point in a subprocess and asserts on the process exit code itself — the thing that was wrong. Each run gets a throwaway XDG_CONFIG_HOME and a temp cwd so neither a developer's stored token nor a repository .env can leak in.

Red, before the fix:

running 1 test from ./cli/auth/exit-code.integration.test.ts
cli/auth exit codes ...
  whoami exits non-zero when no credential is available ... FAILED
error: AssertionError: Values are not equal.
    [Diff] Actual / Expected
-   0
+   1

  whoami --json exits non-zero and still reports authenticated: false ... FAILED
  login exits non-zero when it cannot obtain a credential ... FAILED

FAILED | 0 passed | 1 failed (3 steps) (6s)

Green, after:

running 1 test from ./cli/auth/exit-code.integration.test.ts
cli/auth exit codes ...
  whoami exits non-zero when no credential is available ... ok (2s)
  whoami --json exits non-zero and still reports authenticated: false ... ok (2s)
  login exits non-zero when it cannot obtain a credential ... ok (2s)
  whoami still exits zero when a credential validates ... ok (2s)

ok | 1 passed (4 steps) | 0 failed (8s)

The fourth case points the CLI at a stub /me server and asserts exit 0 plus the identity in the output, so the fix cannot degenerate into always exiting 1.

Also run clean: deno fmt --check, deno lint, deno check on the changed files, and deno test cli/router.test.ts cli/auth/ cli/help/ (17 passed, 226 steps).

Summary by CodeRabbit

• New Features
  • Added clear exit-code behavior for authentication commands.
  • login returns exit code 1 when authentication fails.
  • whoami returns exit code 1 when no valid credentials are available and 0 when authentication succeeds.
• Documentation
  • Updated command help text to explain authentication-related exit codes.