diff --git a/apps/cli/tests/golden/whoami.test.ts b/apps/cli/tests/golden/whoami.test.ts
index ad96e10..c81fd65 100644
--- a/apps/cli/tests/golden/whoami.test.ts
+++ b/apps/cli/tests/golden/whoami.test.ts
@@ -1,14 +1,18 @@
 import { describe, it, expect } from "vitest";
-import { execSync } from "node:child_process";
+import { spawnSync } from "node:child_process";
 import { resolve } from "node:path";
 
 const CLI = resolve(__dirname, "../../dist/entrypoints/cli.js");
 
 describe("golden: whoami --json", () => {
   it("outputs schema_version 1.0 when not signed in", () => {
+    // `whoami --json` exits 2 (EXIT.AUTH_FAILED) when not signed in.
+    // The JSON is still valid output and the contract under test —
+    // capture stdout independently of exit code.
     const env = { ...process.env, CLAUDEMESH_CONFIG_DIR: "/tmp/claudemesh-golden-test-" + Date.now() };
-    const output = execSync(`node ${CLI} whoami --json`, { encoding: "utf-8", env }).trim();
-    const json = JSON.parse(output);
+    const result = spawnSync("node", [CLI, "whoami", "--json"], { encoding: "utf-8", env });
+    expect([0, 2]).toContain(result.status);
+    const json = JSON.parse(result.stdout.trim());
     expect(json.schema_version).toBe("1.0");
     expect(json.signed_in).toBe(false);
   });