Reference
login starts WorkOS PKCE in a browser, receives the loopback callback, hydrates all current
workspace memberships, and stores only the rotating WorkOS session in ~/.helix/credentials.
The CLI refreshes tokens within 60 seconds of expiry and serializes refreshes across processes.
status verifies the session and reports its user and membership count. logout asks WFE to
revoke the session when possible and always deletes the local file.
The credential file is mode 0600 and rejects old key fields. Cloud commands do not accept
environment API keys, service credentials, legacy user/admin keys, or custom authorization headers.