PR #30 removed `auth refresh` (it was a passive no-op that leaked a token prefix). The subcommand is correctly gone from `auth --help`, but invoking it still succeeds:
```
$ withings-export auth refresh
Authentication commands
Usage:
withings-export auth [flags]
...
$ echo $?
0
```
Cobra is treating `refresh` as a positional arg on the parent `auth` command (no Args validator) and falling through to the help text. Bare `auth` (no positional) correctly exits 1 with help on stderr per PR #29 — but `auth refresh` does the opposite.
Expected: exit non-zero, error to stderr (`Error: unknown command "refresh" for "withings-export auth"`).
Caught during pre-release sanity check on commit `5bbfc67`.
Severity: cosmetic (user transitioning from prior versions)
PR #30 removed `auth refresh` (it was a passive no-op that leaked a token prefix). The subcommand is correctly gone from `auth --help`, but invoking it still succeeds:
```
$ withings-export auth refresh
Authentication commands
Usage:
withings-export auth [flags]
...
$ echo $?
0
```
Cobra is treating `refresh` as a positional arg on the parent `auth` command (no Args validator) and falling through to the help text. Bare `auth` (no positional) correctly exits 1 with help on stderr per PR #29 — but `auth refresh` does the opposite.
Expected: exit non-zero, error to stderr (`Error: unknown command "refresh" for "withings-export auth"`).
Caught during pre-release sanity check on commit `5bbfc67`.
Severity: cosmetic (user transitioning from prior versions)