bring generic 2fa handling into main command runner