@cargo-ai/cli 1.0.56 → 1.0.58

package/README.md

@@ -42,7 +42,7 @@ cargo-ai login --token <your-api-token>
 
 `--email` and `--oauth` save the signed-in session — a short-lived access token plus the refresh token that renews it — to `~/.config/cargo-ai/credentials.json` (file mode `0600`). The CLI renews it in the background as it expires, so you stay signed in and no API token is created per machine. `--token` saves the API token you supplied instead. The same file backs `cargo-cdk`, so one login serves both.
 
-`cargo-ai logout` revokes the session at the identity provider, so signing out is final. A token you supplied yourself with `--token` is only forgotten locally, since it may be in use elsewhere; pass `--keep-token` to force that behaviour for a session too.
+`cargo-ai logout` revokes the session at the identity provider, so signing out is final. A token you supplied yourself with `--token` is only forgotten locally, since it may be in use elsewhere; pass `--keep-token` to force that behaviour for a session too. If a credentials file cannot be deleted — a read-only config directory, or one owned by another user — `logout` fails and names the file rather than reporting a sign-out the next command would contradict.
 
 Treat the file as you would a password. A saved session acts as you across **every** workspace you belong to — unlike an API token, which is limited to one workspace and to the permissions it was created with — and it stays valid until you run `cargo-ai logout` or the identity provider expires it. On a shared or long-lived machine (CI, a build box), prefer an API token created under **Settings → API** and passed via `CARGO_API_TOKEN`, which you can scope down and revoke from the dashboard.
 

package/build/commands/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,OAAO,EAAU,MAAM,WAAW,CAAC;AAGjD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAwBxD,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAkGN;AAmFD,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,IAAI,EAAE,aAAa,GAClB,cAAc,CAchB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,OAAO,EAAU,MAAM,WAAW,CAAC;AAGjD,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAyBxD,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GAAG,GAChB,IAAI,CAyGN;AAiGD,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpE;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,WAAW,EAAE,WAAW,GAAG,SAAS,EACpC,IAAI,EAAE,aAAa,GAClB,cAAc,CAchB"}

package/build/commands/auth/index.js

@@ -2,7 +2,7 @@ import { revokeSession } from "@cargo-ai/cdk/cli";
 import { Option } from "commander";
 import { AGENT_SKILLS_NEXT_STEP } from "../../agentSkills.js";
 import { getConfig } from "../../config.js";
-import { clearCredentials, getCredentialsPath, loadCredentials, saveCredentials, } from "../../credentials.js";
+import { clearCredentials, CredentialsNotClearedError, getCredentialsPath, loadCredentials, saveCredentials, } from "../../credentials.js";
 import { ExitCodes, failWith, handleApiCall, info, outputJson, success, } from "../runHandler.js";
 import { runEmailLogin } from "./email.js";
 import { selectLoginChannel } from "./loginChannel.js";
@@ -40,8 +40,11 @@ that name when one exists, so this is safe to re-run.
 
 --email and --oauth save the signed-in session to
 ~/.config/cargo-ai/credentials.json and renew it automatically, so you stay
-signed in without a token being created for each machine. Switch workspace at
-any time with CARGO_WORKSPACE_UUID or by signing in again with
+signed in without a token being created for each machine. CARGO_CONFIG_DIR
+(or XDG_CONFIG_HOME) moves that file; where the home directory is not writable
+— agent sandboxes usually run that way — the session is saved under the system
+temp directory instead, which lasts only as long as the sandbox. Switch
+workspace at any time with CARGO_WORKSPACE_UUID or by signing in again with
 --workspace-uuid <uuid>. An API token passed with --token stays pinned to its
 own workspace, so the override does not apply to it.
 
@@ -59,7 +62,11 @@ Environment variables (CARGO_API_TOKEN, CARGO_WORKSPACE_UUID, CARGO_BASE_URL) ta
         .addHelpText("after", `
 A session from "cargo-ai login --email" or "--oauth" is revoked at the identity
 provider, so signing out is final. Tokens you supplied yourself with --token are
-only forgotten locally, since they may be in use elsewhere.`)
+only forgotten locally, since they may be in use elsewhere.
+
+Signing out fails, naming the file, when a credentials file cannot be deleted —
+a read-only config directory, or one owned by another user — because the next
+command would otherwise read it and still be signed in.`)
         .action(async (opts) => {
         await runLogout(opts);
     });
@@ -123,7 +130,20 @@ async function runLogout(opts) {
     const credentials = loadCredentials();
     const plan = planRevocation(credentials, opts);
     const revoked = await applyRevocation(plan, credentials);
-    const removed = clearCredentials();
+    let removed;
+    try {
+        removed = clearCredentials();
+    }
+    catch (error) {
+        if (error instanceof CredentialsNotClearedError) {
+            // Revocation already happened, so say so: re-running logout will not
+            // revoke a second time, and the file is all that is left to deal with.
+            failWith(error.message, {
+                extra: { revoked, credentialsFiles: error.paths },
+            });
+        }
+        throw error;
+    }
     if (removed === true) {
         success(revoked === true ? "Signed out and revoked access." : "Signed out.");
     }

package/build/credentials.d.ts

@@ -1,2 +1,2 @@
-export { clearCredentials, type StoredCredentials as Credentials, getConfigDir, getCredentialsPath, loadCredentials, type RefreshableSession, saveCredentials, } from "@cargo-ai/cdk/cli";
+export { clearCredentials, type StoredCredentials as Credentials, CredentialsNotClearedError, getConfigDir, getCredentialsPath, loadCredentials, type RefreshableSession, saveCredentials, } from "@cargo-ai/cdk/cli";
 //# sourceMappingURL=credentials.d.ts.map

package/build/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,IAAI,WAAW,EACrC,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,KAAK,kBAAkB,EACvB,eAAe,GAChB,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,gBAAgB,EAChB,KAAK,iBAAiB,IAAI,WAAW,EACrC,0BAA0B,EAC1B,YAAY,EACZ,kBAAkB,EAClB,eAAe,EACf,KAAK,kBAAkB,EACvB,eAAe,GAChB,MAAM,mBAAmB,CAAC"}

package/build/credentials.js

@@ -1,4 +1,4 @@
 // The credentials file is shared with `cargo-cdk`, so its format and access
 // live in @cargo-ai/cdk/cli — one login serves both binaries and neither can
 // drift from the other's idea of what is on disk.
-export { clearCredentials, getConfigDir, getCredentialsPath, loadCredentials, saveCredentials, } from "@cargo-ai/cdk/cli";
+export { clearCredentials, CredentialsNotClearedError, getConfigDir, getCredentialsPath, loadCredentials, saveCredentials, } from "@cargo-ai/cdk/cli";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cargo-ai/cli",
-  "version": "1.0.56",
+  "version": "1.0.58",
   "private": false,
   "license": "UNLICENSED",
   "homepage": "https://getcargo.ai",
@@ -59,10 +59,10 @@
     "format:check": "prettier --check ."
   },
   "dependencies": {
-    "@cargo-ai/api": "^1.0.60",
+    "@cargo-ai/api": "^1.0.62",
     "@cargo-ai/app-sdk": "^1.0.6",
-    "@cargo-ai/cdk": "^1.0.45",
-    "@cargo-ai/types": "^1.0.57",
+    "@cargo-ai/cdk": "^1.0.47",
+    "@cargo-ai/types": "^1.0.60",
     "@cargo-ai/worker-sdk": "^1.0.12",
     "@modelcontextprotocol/sdk": "1.29.0",
     "commander": "^12.1.0",