@neocompose/cli 0.26.5 → 0.27.0

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## [0.27.0] - 2026-08-10
+
+### Added
+
+- `neo logout [--api <url>]`: targeted local credential deletion for exactly
+  one API origin — the namespaced OS-keychain entry and the credentials-file
+  row — plus best-effort server session revocation. Other origins, other
+  namespaces, and the rest of the config home are never touched.
+- `NEO_COMPOSE_CONFIG_HOME`: an absolute directory that replaces
+  `$XDG_CONFIG_HOME/neo-compose` for Neo credential state only, so isolated
+  environments (P53 agent rigs) keep their own credential store without
+  changing the ambient XDG configuration of unrelated tools.
+- `NEO_COMPOSE_CREDENTIAL_NAMESPACE`: scopes the OS-keychain account
+  (`<namespace>::<api origin>`) so isolated environments sharing one OS user
+  cannot read or delete each other's tokens.
+
+### Fixed
+
+- The credential-store docstring described a two-level precedence with the
+  OS keychain "layering in later"; the keychain layer has existed for some
+  time. The docstring now matches the real precedence (env var, then
+  keychain, then credentials file) and documents that the metadata row is
+  written even when the keychain holds the token.
+
 ## [0.26.5] - 2026-08-10
 
 ### Changed

package/README.md

@@ -419,6 +419,7 @@ authorization boundary.
 | `--version`                                           | Print the installed CLI package version.                                  |
 | `login`                                               | Authenticate the selected profile.                                        |
 | `whoami`                                              | Inspect the selected profile.                                             |
+| `logout [--api <url>]`                                | Delete the stored credential for one API origin and revoke its session.   |
 | `init --project <id> [--version <id>]`                | Create a format-4 working copy and perform its first reset pull.          |
 | `doctor`                                              | Validate format/compiler/editor/source/file contracts; no .NET discovery. |
 | `pull [--force\|--reset] [--regenerate-source-names]` | Merge remote changes or regenerate canonical source, names, and binaries. |

package/dist/neo.mjs

@@ -44,7 +44,12 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 // src/token-store.ts
 var token_store_exports = {};
 __export(token_store_exports, {
+  NEO_CONFIG_HOME_ENV_VAR: () => NEO_CONFIG_HOME_ENV_VAR,
+  NEO_CREDENTIAL_NAMESPACE_ENV_VAR: () => NEO_CREDENTIAL_NAMESPACE_ENV_VAR,
   NEO_TOKEN_ENV_VAR: () => NEO_TOKEN_ENV_VAR,
+  credentialsDir: () => credentialsDir,
+  deleteCredential: () => deleteCredential,
+  keychainAccount: () => keychainAccount,
   loadCredential: () => loadCredential,
   loadToken: () => loadToken,
   saveCredential: () => saveCredential
@@ -54,12 +59,22 @@ import {
   existsSync,
   mkdirSync,
   readFileSync,
+  rmSync,
   writeFileSync
 } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { isAbsolute, join } from "node:path";
 function credentialsDir() {
+  const configHome = process.env[NEO_CONFIG_HOME_ENV_VAR];
+  if (configHome !== void 0 && configHome !== "") {
+    if (!isAbsolute(configHome)) {
+      throw new Error(
+        `${NEO_CONFIG_HOME_ENV_VAR} must be an absolute directory path, got "${configHome}".`
+      );
+    }
+    return configHome;
+  }
   const xdg = process.env.XDG_CONFIG_HOME;
   const base = xdg !== void 0 && xdg !== "" ? xdg : join(homedir(), ".config");
   return join(base, "neo-compose");
@@ -80,6 +95,11 @@ function readCredentialsFile() {
   }
   return file;
 }
+function keychainAccount(apiBaseUrl) {
+  const namespace = process.env[NEO_CREDENTIAL_NAMESPACE_ENV_VAR];
+  if (namespace === void 0 || namespace === "") return apiBaseUrl;
+  return `${namespace}::${apiBaseUrl}`;
+}
 function keychainSet(account, secret) {
   if (process.platform !== "darwin") return false;
   try {
@@ -116,8 +136,24 @@ function keychainGet(account) {
     return null;
   }
 }
+function keychainDelete(account) {
+  if (process.platform !== "darwin") return false;
+  try {
+    execFileSync(
+      "security",
+      ["delete-generic-password", "-s", KEYCHAIN_SERVICE, "-a", account],
+      { stdio: "ignore" }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
 function saveCredential(credential) {
-  const inKeychain = keychainSet(credential.apiBaseUrl, credential.token);
+  const inKeychain = keychainSet(
+    keychainAccount(credential.apiBaseUrl),
+    credential.token
+  );
   mkdirSync(credentialsDir(), { recursive: true, mode: 448 });
   const file = readCredentialsFile();
   file.credentials[credential.apiBaseUrl] = inKeychain ? { ...credential, token: "" } : credential;
@@ -132,7 +168,7 @@ function saveCredential(credential) {
 function loadToken(apiBaseUrl) {
   const envToken = process.env[NEO_TOKEN_ENV_VAR];
   if (envToken !== void 0 && envToken !== "") return envToken;
-  const fromKeychain = keychainGet(apiBaseUrl);
+  const fromKeychain = keychainGet(keychainAccount(apiBaseUrl));
   if (fromKeychain !== null) return fromKeychain;
   const file = readCredentialsFile();
   const credential = file.credentials[apiBaseUrl];
@@ -143,11 +179,38 @@ function loadCredential(apiBaseUrl) {
   const file = readCredentialsFile();
   return file.credentials[apiBaseUrl] ?? null;
 }
-var NEO_TOKEN_ENV_VAR, KEYCHAIN_SERVICE;
+function deleteCredential(apiBaseUrl) {
+  const account = keychainAccount(apiBaseUrl);
+  const fromKeychain = keychainGet(account);
+  const file = readCredentialsFile();
+  const fileEntry = file.credentials[apiBaseUrl];
+  const token = fromKeychain ?? (fileEntry !== void 0 && fileEntry.token !== "" ? fileEntry.token : null);
+  const deletedKeychainEntry = keychainDelete(account);
+  let deletedFileEntry = false;
+  if (fileEntry !== void 0) {
+    delete file.credentials[apiBaseUrl];
+    deletedFileEntry = true;
+    const path = credentialsPath();
+    if (Object.keys(file.credentials).length === 0) {
+      rmSync(path, { force: true });
+    } else {
+      writeFileSync(path, `${JSON.stringify(file, null, 2)}
+`, {
+        encoding: "utf8",
+        mode: 384
+      });
+      chmodSync(path, 384);
+    }
+  }
+  return { token, deletedKeychainEntry, deletedFileEntry };
+}
+var NEO_TOKEN_ENV_VAR, NEO_CONFIG_HOME_ENV_VAR, NEO_CREDENTIAL_NAMESPACE_ENV_VAR, KEYCHAIN_SERVICE;
 var init_token_store = __esm({
   "src/token-store.ts"() {
     "use strict";
     NEO_TOKEN_ENV_VAR = "NEO_COMPOSE_TOKEN";
+    NEO_CONFIG_HOME_ENV_VAR = "NEO_COMPOSE_CONFIG_HOME";
+    NEO_CREDENTIAL_NAMESPACE_ENV_VAR = "NEO_COMPOSE_CREDENTIAL_NAMESPACE";
     KEYCHAIN_SERVICE = "neo-compose-cli";
   }
 });
@@ -427,6 +490,44 @@ async function runLogin(options) {
     return;
   }
 }
+async function runLogout(apiBaseUrl) {
+  const { deleteCredential: deleteCredential2 } = await Promise.resolve().then(() => (init_token_store(), token_store_exports));
+  const deleted = deleteCredential2(apiBaseUrl);
+  if (deleted.token === null && !deleted.deletedKeychainEntry && !deleted.deletedFileEntry) {
+    console.log(`No credentials stored for "${apiBaseUrl}".`);
+    return;
+  }
+  if (deleted.token !== null) {
+    try {
+      const response = await fetch(new URL("/api/auth/sign-out", apiBaseUrl), {
+        body: "{}",
+        headers: {
+          Authorization: `Bearer ${deleted.token}`,
+          "Content-Type": "application/json"
+        },
+        method: "POST"
+      });
+      if (response.ok) {
+        console.log(`Revoked the server session at ${apiBaseUrl}.`);
+      } else {
+        console.log(
+          `Server session revocation returned ${response.status}; the local credential was still deleted.`
+        );
+      }
+    } catch {
+      console.log(
+        "Server session revocation was unreachable; the local credential was still deleted."
+      );
+    }
+  }
+  const surfaces = [
+    deleted.deletedKeychainEntry ? "Keychain entry" : null,
+    deleted.deletedFileEntry ? "credentials file entry" : null
+  ].filter((surface) => surface !== null);
+  console.log(
+    `Logged out of ${apiBaseUrl}${surfaces.length > 0 ? ` (removed ${surfaces.join(" and ")})` : ""}.`
+  );
+}
 async function runWhoami(apiBaseUrl) {
   const { loadToken: loadToken2 } = await Promise.resolve().then(() => (init_token_store(), token_store_exports));
   const token = loadToken2(apiBaseUrl);
@@ -93879,7 +93980,7 @@ import {
   readFileSync as readFileSync6,
   readdirSync,
   renameSync as renameSync4,
-  rmSync,
+  rmSync as rmSync2,
   writeFileSync as writeFileSync6
 } from "node:fs";
 import { basename, dirname as dirname5, extname, join as join6, relative, sep } from "node:path";
@@ -94159,7 +94260,7 @@ function writeVerifiedBinaryDownloadV4(destination, bytes, expectedSha256) {
     writeFileSync6(temporary, bytes);
     renameSync4(temporary, destination);
   } finally {
-    rmSync(temporary, { force: true });
+    rmSync2(temporary, { force: true });
   }
 }
 function writeBinaryConflictArtifactV4(root, fileId, fileName2, bytes, expectedSha256) {
@@ -95284,7 +95385,7 @@ import {
   mkdirSync as mkdirSync7,
   readFileSync as readFileSync8,
   readdirSync as readdirSync3,
-  rmSync as rmSync2,
+  rmSync as rmSync3,
   writeFileSync as writeFileSync7,
   statSync
 } from "node:fs";
@@ -95296,14 +95397,14 @@ function resetWorkspaceToProjectSourcesV4(workspace, document, options = {}) {
   const previous = managedFilesBeforeReset(workspace.root);
   const preservedSpecs = preserveManagedSpecs(workspace.root);
   for (const directory of FORMAT_4_MANAGED_DIRECTORIES) {
-    rmSync2(join8(workspace.root, directory), { recursive: true, force: true });
+    rmSync3(join8(workspace.root, directory), { recursive: true, force: true });
   }
-  rmSync2(join8(workspace.root, "Scripts"), { recursive: true, force: true });
+  rmSync3(join8(workspace.root, "Scripts"), { recursive: true, force: true });
   for (const file of LEGACY_ROOT_FILES) {
-    rmSync2(join8(workspace.root, file), { force: true });
+    rmSync3(join8(workspace.root, file), { force: true });
   }
   for (const privatePath of LEGACY_PRIVATE_PATHS) {
-    rmSync2(join8(workspace.root, privatePath), { recursive: true, force: true });
+    rmSync3(join8(workspace.root, privatePath), { recursive: true, force: true });
   }
   for (const [path, bytes] of preservedSpecs) {
     const absolute = join8(workspace.root, path);
@@ -95559,7 +95660,7 @@ var init_http = __esm({
 });
 
 // src/project-source/project-file-pull.ts
-import { existsSync as existsSync6, rmSync as rmSync3 } from "node:fs";
+import { existsSync as existsSync6, rmSync as rmSync4 } from "node:fs";
 import { join as join9 } from "node:path";
 async function pullProjectBinariesV4(args) {
   let client = args.client ?? null;
@@ -95688,7 +95789,7 @@ async function pullProjectBinariesV4(args) {
       conflicted += 1;
       continue;
     }
-    rmSync3(absolute, { force: true });
+    rmSync4(absolute, { force: true });
     removePreviousConflict(args.workspace.root, previous.projectBinary);
   }
   return { states, downloaded, conflicted, conflicts };
@@ -95758,7 +95859,7 @@ function fileName(data) {
 }
 function removePreviousConflict(root, state) {
   if (state?.conflict?.artifactPath === void 0) return;
-  rmSync3(join9(root, state.conflict.artifactPath), { force: true });
+  rmSync4(join9(root, state.conflict.artifactPath), { force: true });
 }
 var init_project_file_pull = __esm({
   "src/project-source/project-file-pull.ts"() {
@@ -95823,7 +95924,7 @@ __export(pull_exports, {
 import {
   mkdirSync as mkdirSync8,
   writeFileSync as writeFileSync8,
-  rmSync as rmSync4,
+  rmSync as rmSync5,
   existsSync as existsSync7,
   readFileSync as readFileSync9
 } from "node:fs";
@@ -96212,7 +96313,7 @@ async function finishFormat4Pull(args) {
     if (previousPath === void 0 || emittedPaths.has(previousPath)) continue;
     const absolute = join10(workspace.root, previousPath);
     if (existsSync7(absolute)) {
-      rmSync4(absolute);
+      rmSync5(absolute);
       removed += 1;
     }
   }
@@ -100378,7 +100479,7 @@ import { createHash as createHash10, randomUUID as randomUUID2 } from "node:cryp
 import {
   mkdirSync as mkdirSync10,
   writeFileSync as writeFileSync10,
-  rmSync as rmSync5,
+  rmSync as rmSync6,
   existsSync as existsSync11,
   readFileSync as readFileSync15
 } from "node:fs";
@@ -101174,7 +101275,7 @@ async function runPush(workspace, options, preparationOverride) {
       });
     } finally {
       if (preparedBuildDir !== void 0) {
-        rmSync5(preparedBuildDir, { recursive: true, force: true });
+        rmSync6(preparedBuildDir, { recursive: true, force: true });
       }
     }
   } else {
@@ -102387,7 +102488,7 @@ ${finalErrors.map(
     const previousPath = recordState.file;
     if (previousPath === void 0 || emittedPaths.has(previousPath)) continue;
     const absolute = join15(workspace.root, previousPath);
-    if (existsSync11(absolute)) rmSync5(absolute);
+    if (existsSync11(absolute)) rmSync6(absolute);
   }
   for (const file of files) {
     const absolute = join15(workspace.root, file.path);
@@ -103197,7 +103298,7 @@ var init_registry2 = __esm({
     PROJECT_SCHEMA_CONTRACT = Object.freeze({
       formatVersion: 3,
       contractVersion: "3.9",
-      cliVersion: "0.26.5",
+      cliVersion: "0.27.0",
       projectFileUploadBatchSize: 32,
       documentRecords: {
         member: {
@@ -104498,14 +104599,14 @@ import {
   readFileSync as readFileSync16,
   realpathSync,
   renameSync as renameSync5,
-  rmSync as rmSync6,
+  rmSync as rmSync7,
   statSync as statSync2,
   writeFileSync as writeFileSync11
 } from "node:fs";
 import {
   basename as basename3,
   dirname as dirname9,
-  isAbsolute,
+  isAbsolute as isAbsolute2,
   join as join16,
   relative as relative5,
   resolve as resolve3,
@@ -104706,7 +104807,7 @@ function preparedHookCandidate(workspace) {
       "test-build"
     );
     const pathFromRoot = relative5(cacheRoot, directory);
-    if (isAbsolute(pathFromRoot)) {
+    if (isAbsolute2(pathFromRoot)) {
       throw new NeoTestPreparedCandidateError(
         "NEO_PREPARED_BUILD_DIR must not resolve to an absolute path outside this workspace's .neo/test-build directory."
       );
@@ -104906,7 +105007,7 @@ function selectedSpecPaths(workspace, selectors) {
   );
   for (const selector of normalizedSelectors) {
     if (/[*?]/u.test(selector)) continue;
-    if (isAbsolute(selector)) {
+    if (isAbsolute2(selector)) {
       throw new Error(
         `Spec selector ${JSON.stringify(selector)} must be workspace-relative.`
       );
@@ -105691,16 +105792,16 @@ function maintainNeoTestBuildCache(root, maxBytes = TEST_BUILD_CACHE_LIMIT_BYTES
   const resolvedProtected = protectedDirectory === void 0 ? null : resolve3(protectedDirectory);
   const protectedInsideRoot = resolvedProtected !== null && (() => {
     const fromRoot = relative5(resolvedRoot, resolvedProtected);
-    return fromRoot === "" || !fromRoot.startsWith(`..${sep5}`) && fromRoot !== ".." && !isAbsolute(fromRoot);
+    return fromRoot === "" || !fromRoot.startsWith(`..${sep5}`) && fromRoot !== ".." && !isAbsolute2(fromRoot);
   })();
   const isProtected = (path) => {
     if (!protectedInsideRoot || resolvedProtected === null) return false;
     const fromProtected = relative5(resolvedProtected, resolve3(path));
-    return fromProtected === "" || !fromProtected.startsWith(`..${sep5}`) && fromProtected !== ".." && !isAbsolute(fromProtected);
+    return fromProtected === "" || !fromProtected.startsWith(`..${sep5}`) && fromProtected !== ".." && !isAbsolute2(fromProtected);
   };
   for (const file of testBuildFiles(root)) {
     if (!isProtected(file.path) && basename3(file.path).includes(".tmp-") && now - file.modifiedMs >= ABANDONED_TEMP_MAX_AGE_MS) {
-      rmSync6(file.path, { force: true });
+      rmSync7(file.path, { force: true });
     }
   }
   const files = testBuildFiles(root);
@@ -105710,7 +105811,7 @@ function maintainNeoTestBuildCache(root, maxBytes = TEST_BUILD_CACHE_LIMIT_BYTES
   ).sort((left, right) => left.modifiedMs - right.modifiedMs);
   for (const file of removable) {
     if (total <= maxBytes) break;
-    rmSync6(file.path, { force: true });
+    rmSync7(file.path, { force: true });
     total -= file.size;
   }
 }
@@ -106004,7 +106105,7 @@ async function runTest(workspace, options, dependencies = {}) {
   if (options.outputFile !== null) {
     try {
       atomicWrite(
-        isAbsolute(options.outputFile) ? options.outputFile : join16(workspace.root, options.outputFile),
+        isAbsolute2(options.outputFile) ? options.outputFile : join16(workspace.root, options.outputFile),
         serialized
       );
     } catch (error) {
@@ -106217,7 +106318,7 @@ import {
   existsSync as existsSync13,
   readFileSync as readFileSync17
 } from "node:fs";
-import { extname as extname2, isAbsolute as isAbsolute2, join as join17, relative as relative6, sep as sep6 } from "node:path";
+import { extname as extname2, isAbsolute as isAbsolute3, join as join17, relative as relative6, sep as sep6 } from "node:path";
 function inspectNeoDoctor(workspace) {
   const formatCompatible = workspace.config.formatVersion === CURRENT_FORMAT_VERSION;
   const compiler = inspectCompilerContract();
@@ -106397,7 +106498,7 @@ function inspectTrackedBinary(root, record3, errors) {
   const binary = record3.projectBinary;
   if (!binary) return;
   const path = binary.path.replaceAll("\\", "/");
-  if (isAbsolute2(path) || path.split("/").includes("..")) {
+  if (isAbsolute3(path) || path.split("/").includes("..")) {
     errors.push(
       `Project file ${record3.recordId} has unsafe tracked path ${JSON.stringify(binary.path)}.`
     );
@@ -109474,7 +109575,7 @@ __export(resolve_exports, {
   runResolve: () => runResolve,
   workspaceFilePath: () => workspaceFilePath
 });
-import { readFileSync as readFileSync19, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "node:fs";
+import { readFileSync as readFileSync19, rmSync as rmSync8, writeFileSync as writeFileSync14 } from "node:fs";
 import { join as join21 } from "node:path";
 function runResolve(workspace, side) {
   let resolvedFiles = 0;
@@ -109500,12 +109601,12 @@ function runResolve(workspace, side) {
         );
         binary.sha256 = conflict2.remoteSha256;
       } else {
-        rmSync7(destination, { force: true });
+        rmSync8(destination, { force: true });
         binary.sha256 = null;
       }
     }
     if (conflict2.artifactPath !== void 0) {
-      rmSync7(join21(workspace.root, conflict2.artifactPath), { force: true });
+      rmSync8(join21(workspace.root, conflict2.artifactPath), { force: true });
     }
     delete binary.conflict;
     resolvedBinaries += 1;
@@ -109604,6 +109705,7 @@ ${h("Start")}
   login     ${d("[--api <url>] [--profile editor|release] [--save-project <id>]")}
   init      ${d("[--project <id>] [--version <id>] [--dir <path>]  (interactive pickers)")}
   whoami    ${d("[--api <url>]")}
+  logout    ${d("[--api <url>]  delete the stored credential for one API origin")}
   help      ${d("show this command overview")}
   --version ${d("print the installed CLI version")}
 
@@ -109762,7 +109864,7 @@ There is no --keep-current: preserving current semantic state defines flatten.
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   if (args.command === "--version") {
-    console.log("0.26.5");
+    console.log("0.27.0");
     return;
   }
   if (args.command === null || args.command === "help" || args.command === "--help" || args.command === "-h") {
@@ -109787,6 +109889,9 @@ async function main() {
     case "whoami":
       await runWhoami(apiBaseUrl);
       return;
+    case "logout":
+      await runLogout(apiBaseUrl);
+      return;
     case "init":
       {
         const { runInit: runInit2 } = await Promise.resolve().then(() => (init_init(), init_exports));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neocompose/cli",
-  "version": "0.26.5",
+  "version": "0.27.0",
   "description": "Neo Compose native project-source CLI with bidirectional sync.",
   "license": "MIT",
   "type": "module",

package/skills/neocompose-cli/SKILL.md

@@ -9,7 +9,7 @@ description: >-
   `@neocompose/cli` or `node cli/bin/neo.mjs` in the neo-compose repository.
 ---
 
-<!-- reviewed-through-cli: 0.26.5 -->
+<!-- reviewed-through-cli: 0.27.0 -->
 
 # Neo Compose CLI
 

package/skills/neocompose-cli/references/cli-development.md

@@ -83,7 +83,7 @@ wrappers.
 The marker near the top of `SKILL.md` must exactly match the package version:
 
 ```html
-<!-- reviewed-through-cli: 0.26.5 -->
+<!-- reviewed-through-cli: 0.27.0 -->
 ```
 
 The quoted version above is checked too, so this instruction cannot go stale

package/skills/neocompose-cli/references/commands-and-sync.md

@@ -145,5 +145,16 @@ and a protected file only as fallback. Use `NEO_COMPOSE_TOKEN` or
 `--token-stdin` in CI. The editor profile cannot publish releases; server
 scopes remain the security boundary.
 
+`neo logout [--api <url>]` deletes the stored credential for exactly one API
+origin (keychain entry and credentials-file row) and revokes the server
+session best-effort. It never clears other origins or the whole store.
+
+Isolated environments (P53 agent rigs) set `NEO_COMPOSE_CONFIG_HOME` (an
+absolute directory replacing `$XDG_CONFIG_HOME/neo-compose` for Neo state
+only) and `NEO_COMPOSE_CREDENTIAL_NAMESPACE` (scopes the OS-keychain account)
+so concurrent environments sharing one OS user cannot read, overwrite, or
+delete each other's tokens. Login, logout, and authenticated commands all
+honor both variables.
+
 Pass explicit project/version IDs and flags in automation. Prefer `--json` for
 machine-readable output and do not depend on interactive pickers or confirms.