feat: Add auth config file with login/status/logout commands

[gnapse]

Summary

Add interactive authentication flow with config file persistence. Users can now save credentials via bob auth login and the CLI will use them if environment variables are not set. Environment variables still take priority, maintaining full backward compatibility.

Implementation

• Config file: ~/.config/bob-cli/config.json (JSON format with service_id and api_token)
• Auth priority: Environment variables → Config file → Error with guidance
• Commands: bob auth login (interactive), bob auth status (show source), bob auth logout (delete config)
• Async auth: Made getAuthHeader() async to support config file reads
• Test coverage: 21 new tests (8 config tests, 13 auth tests)

Design Decisions

Env vars take priority so automation/CI/CD flows remain unchanged. Config file acts as a convenient fallback for local development. Both can be in use simultaneously (e.g., env var for service ID, config file for token).

[Copilot]

Pull request overview

Adds a persisted, interactive authentication flow to the bob CLI by introducing a local config file fallback (while keeping environment variables as the highest-priority source), and wires this into API requests and new bob auth * commands.

Changes:

• Introduces ~/.config/bob-cli/config.json read/write/delete utilities for persisted credentials.
• Updates auth resolution to prefer env vars, otherwise fall back to config; makes getAuthHeader() async and updates API request code accordingly.
• Adds bob auth login/status/logout CLI commands plus new unit tests for config/auth behavior.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
src/lib/config.ts	New config persistence helpers for auth credentials.
src/lib/config.test.ts	Tests for config path, read/write/delete behavior.
src/lib/auth.ts	Auth resolution updated to include config fallback; getAuthHeader() becomes async; adds auth-source reporting.
src/lib/auth.test.ts	Tests for env vs config precedence and auth-source detection.
src/lib/api.ts	Awaits async getAuthHeader() when building request headers.
src/index.ts	Registers new auth command group with commander.
src/commands/auth.ts	Implements bob auth login/status/logout.
package-lock.json	Updates Node engine metadata in lockfile to match package settings.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[henningmu]

✅