perf: move token refresh to a detached subprocess

[angeloashmore]

Resolves: #132

Description

Move token refresh out of the main process to prevent CLI commands from hanging after completion.

• Only refresh when the JWT token expires within 1 hour (most commands skip refresh entirely)
• When refresh is needed, run it in a detached subprocess matching the existing pattern used by Segment and the update notifier
• Subprocess files are thin entry points that parse argv and call domain functions (e.g. sendSegmentEvents(), updateVersionState(), refreshToken())
• Inline subprocess scripts extracted into dedicated TypeScript files with camelCase naming

User identification (profile fetch) stays in-process as fire-and-forget using the current token. If the token is expired, identification is skipped — the next command will have a fresh token from the background refresh.

Checklist

• A comprehensive Linear ticket, providing sufficient context and details to facilitate the review of the PR, is linked to the PR.
• If my changes require tests, I added them.
• If my changes affect backward compatibility, it has been discussed.
• If my changes require an update to the CONTRIBUTING.md guide, I updated it.

Preview

How to QA ¹

1. Build with node --run build
2. Run ./dist/index.mjs whoami — should exit immediately after printing
3. Run ./dist/index.mjs repo list — should exit immediately after listing

---

Note

Medium Risk
Touches auth token lifecycle and background process spawning, so regressions could impact login state, telemetry delivery, or CLI exit behavior across commands.

Overview
Prevents CLI hang by moving token refresh off the main process. The CLI now inspects the JWT exp (via new decodePayload in lib/jwt) and, if the token is missing/near expiry (≤1h), schedules a detached refreshToken subprocess on process exit; user identification/profile fetch remains in-process and is skipped when the token is expired.

Standardizes background tasks into dedicated subprocess modules. Segment telemetry flushing and the update-notifier background version check are refactored from inline node -e scripts into compiled src/subprocesses/* entrypoints (plus exported sendSegmentEvents/updateVersionState helpers), and npm registry version lookup is routed through the shared request helper with schema validation. Build config (tsdown.config.ts) is updated to emit these extra subprocess entry files.

^{Reviewed by Cursor Bugbot for commit e660351. Bugbot is set up for automated code reviews on this repo. Configure here.}

Footnotes

1. Please use these labels when submitting a review:
   ❓ #ask: Ask a question.
   💡 #idea: Suggest an idea.
   ⚠️ #issue: Strongly suggest a change.
   🎉 #nice: Share a compliment. ↩

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit eb53960. Configure here.}