feat(output): pretty whoami + token-refresh fix + renderer cleanups

[yurenju]

Companion to sadcoderlabs/wspc#350 which adds the upstream x-cli hints this branch consumes.

What this changes

Three handwritten commands move off raw JSON dumps onto the renderer:

• wspc whoami — now a sectioned ENV / USER / ORG overview. Local env config (name, api_base, actor, agent_label) sits next to /auth/me and /auth/me/org. Org fetch is best-effort; --json / pipe emits a combined { env, user, org? } object.
• wspc todo done — pretty path now mirrors wspc todo update (id-short, status badge, relative timestamps).
• wspc config show — table of envs with green ✓ next to current, hides token contents entirely, shows auth mode (api_key / oauth / none).

Real bug fix in whoami:

runWhoami used to make a raw fetch to /auth/me with the persisted access_token. When that token had expired, the call 401'd and we returned { status: \"logged_out\" } — even though refresh_token + client_id were sitting right there in config. Any subsequent command going through loadSdkClient would refresh transparently and rewrite config.json, after which whoami suddenly worked again. Net effect: whoami's correctness depended on the order commands were run in.

Fix: route whoami through the same SDK + auth-interceptor pipeline as every other command. runWhoami is deleted (not part of the public SDK surface). WspcAuthExpiredError is caught locally and shown as logged_out — for a status-check command, auto-triggering re-login via dispatch() is too aggressive.

Renderer:

• renderObject is now exported so handwritten renderers can compose sections without duplicating the field/format pipeline (used by whoami).
• New codegen output: wspc auth me + wspc org show, driven by the upstream x-cli hints.

Commits

• 8bfa1b6 chore: regenerate from wspc spec with auth_me + org_get x-cli
• 59e8715 feat(output): route whoami, todo done, config show through the renderer
• a086be5 fix(whoami): refresh expired access tokens instead of reporting logged_out

Verification

• typecheck ✓
• 14 test files / 52 tests ✓ (3 fetch-mock tests for the removed runWhoami dropped; SDK auth flow is already covered by sdk-auth.test.ts)
• tsup build ✓
• Smoke-tested in worktree: config show pretty (table with ✓), whoami logged_out (dim message + exit 1), config show --json (clean shape for jq)

Depends on

sadcoderlabs/wspc#350 needs to merge first if the spec ever needs to be re-synced from the live API — but the spec change is already committed to this branch (spec/openapi.json updated in 8bfa1b6), so this PR is independently mergeable today.

🤖 Generated with Claude Code