First two leaf commands and the auth/ command group, registered under
the root command tree.
auth login:
- Email + password (interactive huh prompter) OR --with-token (read API
key from stdin) for headless / CI use
- Validates --host (required, must be http/https URL)
- Persists access + refresh tokens (password mode) or api_key (token mode)
into the secrets store wired in PR-3 — uses Store.Ref to record the
URI scheme without leaking concrete backend type
- Writes the named context to ~/.config/weknora/config.yaml and sets it
as current_context
- Typed loginResult payload for --json output (no map[string]any)
auth status:
- Calls client.GetCurrentUser -> /auth/me, prints context / host / user /
tenant. --json emits a typed statusResult envelope with _meta.context
and tenant_id populated for agents.
- Service interface narrowed to just GetCurrentUser; tests inject fakes
by overriding Factory.Client (no runF gymnastics).
cmd/root.go: register \`auth\` parent under the root tree.
nullkey