@vincentt-xr/cli 0.18.3 → 0.20.0

package/MIGRATION.md

@@ -3,12 +3,36 @@
 Per version, newest first. Read by the platform's own version surface and served to
 creators' agents. Accurate or absent, never speculative (B-F5-2).
 
+## 0.20.0
+
+required: false
+No action required. Behaviour that changed:
+- `vincentt login` signs in this machine on its own and leaves your other machines signed in. It sends a machine label, `"<OS> <arch>, <d Mon>"` by default (never the hostname), or the name given with `--label "<name>"`; a `--label` the platform would refuse (empty, over 64 characters, control or invisible characters, or a platform-reserved name) exits 1 before any browser opens.
+- The `vincentt login` success line names the machine: `✓ Signed in as <email> on this machine (<label>)`. Against an api older than machine sign-ins the line is unchanged.
+- When a login leaves more than 10 signed-in machines, the least recently used are signed out and each is named on its own line after the workspace line: `Signed out "<label>", the least recently used of your 10 signed-in machines (last used <d Mon>).`
+- `vincentt logout` also ends this machine's sign-in on the platform (best-effort, 5 seconds), then always removes the local token; when the api cannot be reached it says the machine stays listed in the console. `vincentt login --force` keeps the old token until the new one is saved, then ends the old sign-in.
+- A refused token now reads ``✗ This machine is no longer signed in to Vincentt. Run `vincentt login` to sign in again.`` (it read "Your Vincentt access token is no longer valid."). A script matching the old wording exactly needs updating. The exit code is unchanged (4).
+
+## 0.19.0
+
+required: false
+No action required for a project made from the Vincentt template. Behaviour that changed:
+- The platform caps how many previews one person runs at once (5 by default, across every workspace; a preview that is still connecting counts, viewers never do). Re-running `vincentt preview` in a folder that already has a preview is never refused by the cap.
+- `vincentt preview` past the preview cap exits 1, starts nothing and stops nothing, and says how many previews are running and how to stop one: Ctrl-C where it runs, `vincentt preview --stop` in its folder, or Stop on its project's Preview tab in the console.
+- A preview refusal the CLI does not recognise prints the platform's own message instead of "A preview is already running for this folder."
+- `vincentt preview` with no `vincentt.json`, `--port` or `--dev-command` starts the project's `dev` script on a free port, passed to it as `PORT`, instead of 5173, and never reuses a server it finds already listening. Two previews at once, or another server already on 5173, no longer share one app. The settings banner shows the chosen port. A port from `--port` or `vincentt.json` is kept, and a server already listening there is still reused.
+- A preview answers 404 for any path segment shaped like a Windows short name (one to six characters, then `~` and a digit, such as `GIT~1` or `ENVLOC~1`), on every platform. On Windows these names open the dotted files the preview already hides. Bundler chunk names such as `vendors~main` are unaffected.
+- The preview tunnel client is part of the CLI itself instead of being loaded from `@vincentt-xr/harness`. The preview behaves the same, and it works with any harness version a project has installed.
+- A preview answers 404 for files and folders named like credentials, with no opt-out: `credentials.json`, `service-account*.json`, `*firebase-adminsdk*.json`, `*.pem`, `*.key`, `*.p12`, `*.pfx`, `*.p8`, `*.ppk`, `id_rsa*`, `id_dsa*`, `id_ed25519*`, `id_ecdsa*`, `*.jks`, `*.keystore`, `*.env`, `*.tfstate`, `*.tfvars`, and their `~` or `.bak` backups, in any letter case. An app asset with one of these names (for example a `.key` file) needs a new name to load in a preview.
+- A preview also refuses a Windows stream name, a name with trailing dots or spaces, and a query or fragment carrying a parent-folder step, a backslash or an encoded slash. The 404 advisory names the path decoded, without control or bidirectional-override characters, and now ends `A preview never serves hidden or credential files from your project.`
+- `vincentt login` and the report consent prompt open a browser only for an `https:` address, or an `http:` address on `localhost`, `127.0.0.1` or `[::1]`; anything else is printed but not opened. On Windows the browser opens through `rundll32` instead of `cmd`.
+
 ## 0.18.3
 
 required: false
 No action required when the preview and the commands reading it (`logs`, `feedback`, `preview --stop`) come from the same CLI version. Behaviour that changed:
-- The local preview relay refuses web pages other than the preview itself. It answers only requests whose Host is `127.0.0.1:<port>` or `localhost:<port>`, accepts the diagnostics socket and feedback posts only from the preview's own address (or from a client that sends no Origin), and refuses a POST that is not `application/json` with 415.
-- The relay's diagnostics read and feedback long-poll now require a per-session token, which the preview writes to `.vincentt/relay.json` (now readable by the owner only). The CLI's own commands send it; a direct request to `/query` or `feedback/next` without the `x-vincentt-relay-token` header is refused with 401. A command from CLI 0.18.2 or older cannot read a preview started by this version, and the reverse still works.
+- The local preview relay refuses web pages other than the preview itself. It answers only requests whose Host is `127.0.0.1:<port>` or `localhost:<port>`, accepts the diagnostics socket and feedback posts only from the preview's own address (or from a client that sends no Origin), and refuses a POST whose content type is not JSON with 415.
+- The relay's diagnostics read and feedback long-poll now require a per-session token, which the preview writes to the project's relay record (now readable by the owner only). The CLI's own commands send it; a direct diagnostics or feedback request without the `x-vincentt-relay-token` header is refused with 401. A command from CLI 0.18.2 or older cannot read a preview started by this version, and the reverse still works.
 - `vincentt relay` prints the token it requires and accepts `--origin <url>` for a page it should accept; without it, only pages served from localhost or 127.0.0.1 can connect.
 
 ## 0.18.2

package/README.md

@@ -53,8 +53,9 @@ registers the project, which is what needs an account.
 
 ```
 Auth
-  login              Sign in; save an access token to ~/.vincentt/config.json
-  logout             Remove the saved access token
+  login              Sign in this machine; save an access token to ~/.vincentt/config.json
+                       [--label <name>] names this machine (default: OS, arch, date)
+  logout             Sign this machine out and remove the saved access token
   whoami             Show the signed-in account
 
 Project

package/dist/cli/index.js

@@ -15,8 +15,9 @@ import { createRequire } from "node:module";
 import os from "node:os";
 import path from "node:path";
 import { runPkceLogin } from "../login/pkceLogin.js";
-import { httpAuthBackend } from "../login/authBackend.js";
-import { loginCommand } from "../login/loginCommand.js";
+import { httpAuthBackend, revokeCurrent } from "../login/authBackend.js";
+import { resolveLoginLabel } from "../login/machineLabel.js";
+import { loginCommand, logoutLines as logoutCommand } from "../login/loginCommand.js";
 import { ensureLoggedIn } from "../login/ensure.js";
 import { clearMachineToken, loadMachineConfig, locateProjectBinding, machineApiUrl, resolveConfig, writeDxEnablement, MACHINE_CONFIG_PATH, } from "../shared/config.js";
 import { fileLocationStore } from "../shared/locationStore.js";
@@ -37,13 +38,14 @@ import { USAGE_TEXT } from "./usage-text.js";
 import { PreviewUi } from "../preview/command.js";
 import { httpRelayClient } from "../lib/diagnostics.js";
 import { readLivePreview, relayInfoDir } from "../lib/relayInfo.js";
-import { attachedToRunning, mintRateLimited, noDiagnosticsStatic, notSignedIn, previewConflict, settingsBanner, startBlock, } from "../preview/copy.js";
+import { attachedToRunning, mintRateLimited, noDiagnosticsStatic, notSignedIn, previewConflict, previewUserLimitRefused, settingsBanner, startBlock, } from "../preview/copy.js";
+import { chooseDevPort } from "../preview/devPort.js";
 import { isPortListening } from "../preview/net.js";
 import { readSettings, resolveSettings, SettingsError, TEMPLATE_DEFAULTS, validateField, } from "../lib/settings.js";
 import { settingsRefusal, sourceWords } from "../lib/settingsCopy.js";
 import { listsHarness } from "../lib/template.js";
 import { renderTerminalQr, shouldRenderQr } from "../preview/qr.js";
-import { PreviewConflictError, PreviewLimitError, PreviewRateLimitedError, } from "../preview/api.js";
+import { PreviewConflictError, PreviewLimitError, PreviewRateLimitedError, PreviewUserLimitError, } from "../preview/api.js";
 import { previewLimitRefused, resolveCountLimit, } from "../shared/countLimit.js";
 import { fetchNext, readCursor, writeCursor } from "../lib/feedback.js";
 import * as feedbackCopy from "../lib/feedbackCopy.js";
@@ -119,16 +121,33 @@ function machineCredentials(machine) {
     return pat ? { apiUrl: machineApiUrl(machine), pat } : undefined;
 }
 /** The PKCE loopback + code-exchange login (f1). The raw PAT never rides a redirect query. */
-async function runLoginFlow() {
+async function runLoginFlow(label) {
     const { consoleUrl, apiUrl } = await resolveAuthUrls();
     return runPkceLogin({
         consoleUrl,
         apiUrl,
+        label,
         onProgress: (line) => console.log(line),
     });
 }
-/** `vincentt login` [--force] — the L1/L2/L4 transcripts. */
+/** The label this login sends, or undefined when --label was refused (the refusal is printed). */
+function loginLabel() {
+    const eq = valueOfEqualsFlag(argv, "--label");
+    const resolved = resolveLoginLabel(has("--label") || eq !== undefined, flag("--label") ?? eq);
+    if (!resolved.ok) {
+        for (const line of resolved.lines)
+            console.log(line);
+        return undefined;
+    }
+    return resolved.label;
+}
+/** `vincentt login` [--force] [--label <name>] — the L1/L2/L4/L5 transcripts. */
 async function login() {
+    const label = loginLabel();
+    if (label === undefined) {
+        process.exitCode = EXIT.FAILED;
+        return;
+    }
     const { apiUrl } = await resolveAuthUrls();
     const code = await loginCommand({
         print: (line) => console.log(line),
@@ -139,10 +158,12 @@ async function login() {
                 throw new NotSignedInError();
             return httpAuthBackend(apiUrl).me(pat);
         },
-        runLogin: runLoginFlow,
+        runLogin: () => runLoginFlow(label),
         clearToken: async () => {
             await clearMachineToken();
         },
+        storedToken: async () => (await loadMachineConfig()).pat,
+        revokeToken: (pat) => revokeCurrent(apiUrl, pat),
         home: os.homedir(),
         configPath: MACHINE_CONFIG_PATH,
     }, { force: has("--force") });
@@ -168,8 +189,13 @@ async function requireLogin() {
     return ok;
 }
 async function logout() {
-    const { path: p, hadToken } = await clearMachineToken();
-    console.log(hadToken ? `✓ Signed out. Token removed from ${p}` : "Already signed out.");
+    const machine = await loadMachineConfig();
+    const outcome = machine.pat
+        ? await revokeCurrent(machineApiUrl(machine), machine.pat)
+        : "done";
+    const lines = await logoutCommand({ clear: clearMachineToken, outcome });
+    for (const line of lines)
+        console.log(line);
 }
 /**
  * `whoami` reads the MACHINE config's API host, never the folder's binding — it
@@ -531,14 +557,16 @@ async function preview() {
         return;
     }
     const devCommand = settings.devCommand.value;
-    const devPort = settings.devPort.value;
+    const { port: devPort, fresh: devPortFresh } = await chooseDevPort(settings);
+    // What the creator gets running the dev command by hand, without PORT.
+    const handRunUrl = `http://localhost:${settings.devPort.value}`;
     const localUrl = `http://localhost:${devPort}`;
     for (const l of settingsBanner({
         devCommand,
         devCommandSource: sourceWords(settings.devCommand),
         devPort,
         devPortSource: sourceWords(settings.devPort),
-        reused: await isPortListening(devPort),
+        reused: devPortFresh ? false : await isPortListening(devPort),
     })) {
         console.log(l);
     }
@@ -549,7 +577,7 @@ async function preview() {
     // The gate is LOCAL and NOTHING IS ATTEMPTED: no spinner, no partial mint, no
     // session left in `pending`. The command stops before it touches the network.
     if (!(await currentToken())) {
-        for (const l of notSignedIn(devCommand, localUrl))
+        for (const l of notSignedIn(devCommand, handRunUrl))
             console.log(l);
         process.exitCode = EXIT.NOT_AUTHENTICATED;
         return;
@@ -607,6 +635,7 @@ async function preview() {
     try {
         const started = await previewStart(cwd, (m) => console.error(`[preview] ${m}`), {
             appPort: devPort,
+            appPortFresh: devPortFresh,
             devCommand,
             onHiddenPath: (p) => ui.hiddenPath(p),
             appStdio: has("--verbose") ? "inherit" : "ignore",
@@ -842,6 +871,8 @@ function previewFailureLines(err, local) {
     if (err instanceof PreviewLimitError) {
         return previewLimitRefused(resolveCountLimit(err.detail, local));
     }
+    if (err instanceof PreviewUserLimitError)
+        return previewUserLimitRefused(err.detail);
     if (err instanceof PreviewConflictError)
         return previewConflict();
     if (err instanceof ProjectUnreachableError) {

package/dist/cli/usage-text.js

@@ -11,9 +11,10 @@ export const USAGE_TEXT = `Vincentt CLI: the local-first AR dev loop\n\n` +
     `     Wait for the developer to describe what to build.\n` +
     `  Full guide: npm view @vincentt-xr/cli readme\n\n` +
     `Auth\n` +
-    `  login              Sign in; save an access token to ~/.vincentt/config.json\n` +
+    `  login              Sign in this machine; save an access token to ~/.vincentt/config.json\n` +
+    `                       [--label <name>] names this machine (default: OS, arch, date)\n` +
     `                       [--api <url>] [--console <url>] to target a non-prod env\n` +
-    `  logout             Remove the saved access token\n` +
+    `  logout             Sign this machine out and remove the saved access token\n` +
     `  whoami             Show the signed-in account\n\n` +
     `Project\n` +
     `  init [dir]         Scaffold a Vincentt XR app; no account needed, ever\n` +
@@ -58,7 +59,7 @@ export const USAGE_TEXT = `Vincentt CLI: the local-first AR dev loop\n\n` +
     `                       [--port <n>] [--dev-command <cmd>] [--tester <id>]\n` +
     `                       [--no-qr] [--stop]\n` +
     `                       Runs dev.command and forwards dev.port from vincentt.json,\n` +
-    `                       else npm run dev on 5173.\n` +
+    `                       else npm run dev on a free port (passed as PORT).\n` +
     `                       Re-running prints the live link; --restart mints a new one.\n\n` +
     // f16. HELP TEACHES THE CANONICAL VERBS ONLY: `add` and `remove` are accepted
     // as silent aliases and are deliberately ABSENT here, because help, docs and

package/dist/lib/terminalText.d.ts

@@ -1,3 +1,5 @@
 export declare const CONTROL_CHARS: RegExp;
 /** Each C0/C1 control character as a visible `\uXXXX`, so nothing is hidden or redrawn. */
 export declare function escapeControl(text: string): string;
+/** Text with every C0/C1 control and bidi override or isolate removed. */
+export declare function terminalSafe(text: string): string;

package/dist/lib/terminalText.js

@@ -8,3 +8,10 @@ const CONTROL_CHARS_G = /[\u0000-\u001f\u007f-\u009f]/g;
 export function escapeControl(text) {
     return text.replace(CONTROL_CHARS_G, (c) => `\\u${c.charCodeAt(0).toString(16).padStart(4, "0")}`);
 }
+// U+202A..U+202E (embeddings, overrides) and U+2066..U+2069 (isolates) can
+// reorder a terminal line, so a crafted name could disguise what it says.
+const BIDI_CONTROLS_G = /[\u202a-\u202e\u2066-\u2069]/g;
+/** Text with every C0/C1 control and bidi override or isolate removed. */
+export function terminalSafe(text) {
+    return text.replace(CONTROL_CHARS_G, "").replace(BIDI_CONTROLS_G, "");
+}

package/dist/login/authBackend.d.ts

@@ -10,18 +10,43 @@ export interface Identity {
     /** All orgs the signed-in user belongs to (switcher source). */
     memberships: Membership[];
 }
+/** A machine sign-in the api signed out to stay within the 10-machine cap. */
+export interface EvictedMachine {
+    label: string;
+    /** ISO 8601, or null for a machine that was never used. */
+    lastUsedAt: string | null;
+}
+export interface ExchangeResult {
+    /** The raw PAT ("vct_…"), delivered once. */
+    token: string;
+    /** The label the api stored, echoed. Absent from an api older than machine sign-ins. */
+    label?: string;
+    /** Machines signed out by this login (the cap). Absent when none were. */
+    evicted?: EvictedMachine[];
+}
+/** How a self sign-out ended: the api ended it (or it had nothing to end), or it could not be reached. */
+export type RevokeOutcome = "done" | "unreachable";
 /**
  * The auth-flow backend seam. `exchange` redeems the PKCE code for a raw PAT; `me` confirms
  * identity + orgs with that PAT. Both are injected so a stub backend drives the CLI tests.
  */
 export interface AuthBackend {
-    /** POST /access-tokens/exchange {code, code_verifier} → the raw PAT ("vct_…"). */
-    exchange(code: string, codeVerifier: string): Promise<string>;
+    /** POST /access-tokens/exchange {code, code_verifier, label?} → the raw PAT and what the api reports. */
+    exchange(code: string, codeVerifier: string, label?: string): Promise<ExchangeResult>;
     /** GET /me with Bearer <pat> → identity + orgs. */
     me(pat: string): Promise<Identity>;
 }
+/** DELETE /access-tokens/current gives up after this long: sign-out never hangs on the api. */
+export declare const REVOKE_CURRENT_TIMEOUT_MS = 5000;
 /** The real HTTP-backed AuthBackend, pointed at a Vincentt API base URL. */
 export declare function httpAuthBackend(apiBase: string): AuthBackend;
+/**
+ * End THIS machine's sign-in on the platform (DELETE /access-tokens/current),
+ * best-effort. 204 is done; 400, 401, 403, 404 and 405 count as done too: an
+ * older api has no such route, or the sign-in had already ended. A network
+ * failure, a timeout or a 5xx is "unreachable".
+ */
+export declare function revokeCurrent(apiBase: string, pat: string, fetchImpl?: typeof fetch, timeoutMs?: number): Promise<RevokeOutcome>;
 /**
  * Map the /me response shape onto our Identity. The backend returns memberships with an org
  * name + kind; we keep the projection resilient to the exact field names the Go handler emits

package/dist/login/authBackend.js

@@ -3,12 +3,16 @@
 // backend (QA-F1-C2/C4/C5) without real HTTP.
 //
 // Note the CLI does NOT call POST /access-tokens — the browser/console does that (it holds
-// the JWT session; a PAT may not mint a PAT). The CLI only redeems the returned auth_code:
-//   POST /access-tokens/exchange {code, code_verifier} → {token}   (raw PAT, once, in body)
-//   GET  /me            Bearer <PAT>                    → identity + orgs (confirm)
+// the session; a PAT may not mint a PAT). The CLI only redeems the returned auth_code:
+//   POST /access-tokens/exchange {code, code_verifier, label}
+//                                    → {token, label, evicted?}  (raw PAT, once, in body)
+//   GET  /me            Bearer <PAT> → identity + orgs (confirm)
+// and, to end this machine's own sign-in, DELETE /access-tokens/current Bearer <PAT>.
 import { authFailureMessage } from "../shared/authError.js";
 import { clientHeaders } from "../shared/clientHeader.js";
-import { apiFetch } from "../shared/http.js";
+import { apiFetch, withDeadline } from "../shared/http.js";
+/** DELETE /access-tokens/current gives up after this long: sign-out never hangs on the api. */
+export const REVOKE_CURRENT_TIMEOUT_MS = 5_000;
 class AuthError extends Error {
     status;
     constructor(message, status) {
@@ -25,23 +29,64 @@ async function safeText(res) {
         return "";
     }
 }
+/** The error code a JSON error body carries, if any. */
+function errorCode(text) {
+    try {
+        const body = JSON.parse(text);
+        return typeof body.code === "string" ? body.code : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function readEvicted(raw) {
+    if (!Array.isArray(raw) || raw.length === 0)
+        return undefined;
+    return raw.map((e) => {
+        const r = (e ?? {});
+        return {
+            label: typeof r.label === "string" ? r.label : "",
+            lastUsedAt: typeof r.lastUsedAt === "string" ? r.lastUsedAt : null,
+        };
+    });
+}
 /** The real HTTP-backed AuthBackend, pointed at a Vincentt API base URL. */
 export function httpAuthBackend(apiBase) {
     const base = apiBase.replace(/\/$/, "");
+    const post = (body) => apiFetch(`${base}/access-tokens/exchange`, {
+        method: "POST",
+        headers: { ...clientHeaders(), "content-type": "application/json" },
+        body: JSON.stringify(body),
+    });
     return {
-        async exchange(code, codeVerifier) {
-            const res = await apiFetch(`${base}/access-tokens/exchange`, {
-                method: "POST",
-                headers: { ...clientHeaders(), "content-type": "application/json" },
-                body: JSON.stringify({ code, code_verifier: codeVerifier }),
-            });
+        async exchange(code, codeVerifier, label) {
+            const body = { code, code_verifier: codeVerifier };
+            if (label !== undefined)
+                body.label = label;
+            let res = await post(body);
+            if (!res.ok && res.status === 400 && label !== undefined) {
+                const text = await safeText(res);
+                // An api older than machine sign-ins decodes strictly and refuses the
+                // unknown `label` field with bad_request BEFORE it consumes the code, so
+                // the same code and verifier are still good: retry once without it. Any
+                // other refusal (label_invalid included) is final.
+                if (errorCode(text) !== "bad_request") {
+                    throw new AuthError(`Token exchange failed (${res.status}): ${text}`, res.status);
+                }
+                res = await post({ code, code_verifier: codeVerifier });
+            }
             if (!res.ok) {
                 throw new AuthError(`Token exchange failed (${res.status}): ${await safeText(res)}`, res.status);
             }
-            const body = (await res.json());
-            if (!body.token)
+            const out = (await res.json());
+            if (typeof out.token !== "string" || !out.token) {
                 throw new AuthError("Token exchange returned no token.");
-            return body.token;
+            }
+            return {
+                token: out.token,
+                label: typeof out.label === "string" ? out.label : undefined,
+                evicted: readEvicted(out.evicted),
+            };
         },
         async me(pat) {
             const res = await apiFetch(`${base}/me`, {
@@ -54,6 +99,27 @@ export function httpAuthBackend(apiBase) {
         },
     };
 }
+/**
+ * End THIS machine's sign-in on the platform (DELETE /access-tokens/current),
+ * best-effort. 204 is done; 400, 401, 403, 404 and 405 count as done too: an
+ * older api has no such route, or the sign-in had already ended. A network
+ * failure, a timeout or a 5xx is "unreachable".
+ */
+export async function revokeCurrent(apiBase, pat, fetchImpl = (input, init) => globalThis.fetch(input, init), timeoutMs = REVOKE_CURRENT_TIMEOUT_MS) {
+    const base = apiBase.replace(/\/$/, "");
+    try {
+        const res = await withDeadline(fetchImpl, timeoutMs)(`${base}/access-tokens/current`, {
+            method: "DELETE",
+            headers: { ...clientHeaders(), authorization: `Bearer ${pat}` },
+        });
+        if (res.ok || [400, 401, 403, 404, 405].includes(res.status))
+            return "done";
+        return "unreachable";
+    }
+    catch {
+        return "unreachable";
+    }
+}
 /**
  * Map the /me response shape onto our Identity. The backend returns memberships with an org
  * name + kind; we keep the projection resilient to the exact field names the Go handler emits

package/dist/login/loginCommand.d.ts

@@ -1,4 +1,4 @@
-import type { Identity, Membership } from "./authBackend.js";
+import type { EvictedMachine, Identity, Membership, RevokeOutcome } from "./authBackend.js";
 /** Collapse the home dir to `~` for display. `~/.vincentt/config.json` in every transcript. */
 export declare function displayConfigPath(absPath: string, home: string): string;
 /** The active org is the personal one (login lands on personal; the CLI never prompts). */
@@ -9,6 +9,12 @@ export declare function activeOrg(memberships: Membership[]): Membership | undef
  * org gets just the active-org line (no trailing clause).
  */
 export declare function orgSummaryLine(identity: Identity): string;
+/**
+ * The line naming a machine the 10-machine cap signed out (Flow L5). No glyph:
+ * it is not an advisory about this machine; no command: the other machine signs
+ * in again if someone wants it.
+ */
+export declare function evictionLine(e: EvictedMachine): string;
 export interface LoginCommandDeps {
     /** Print a line to the user (stdout for the transcript). */
     print: (line: string) => void;
@@ -16,13 +22,22 @@ export interface LoginCommandDeps {
     currentToken: () => Promise<string | undefined>;
     /** Confirm who the present token belongs to (GET /me). Throws the client's error unchanged. */
     whoAmI: () => Promise<Identity>;
-    /** Run the loopback + PKCE flow; resolves identity + the saved config path. */
+    /** Run the loopback + PKCE flow; resolves identity, the saved config path and what the api reported. */
     runLogin: () => Promise<{
         identity: Identity;
         configPath: string;
+        label?: string;
+        evicted?: EvictedMachine[];
     }>;
-    /** Forget the existing token before a --force re-login. */
+    /** Forget a stored token the api no longer accepts. */
     clearToken: () => Promise<void>;
+    /** The token saved in this machine's config (never the env override), read before a --force login. */
+    storedToken?: () => Promise<string | undefined>;
+    /**
+     * End a replaced token's sign-in on the platform, best-effort and silent. Called with
+     * the OLD token only after the new one is saved.
+     */
+    revokeToken?: (pat: string) => Promise<unknown>;
     /** For displaying the config path as ~/…. */
     home: string;
     /** Absolute config path (for the L2 already-signed-in line). */
@@ -37,3 +52,20 @@ export interface LoginCommandOptions {
  * exact retry command and return 1. No stack trace, no token printed.
  */
 export declare function loginCommand(deps: LoginCommandDeps, opts?: LoginCommandOptions): Promise<number>;
+export interface LogoutDeps {
+    /** Delete the local token; reports whether there was one. */
+    clear: () => Promise<{
+        path: string;
+        hadToken: boolean;
+    }>;
+    /** How the platform sign-out (DELETE /access-tokens/current) ended, asked BEFORE clearing. */
+    outcome: RevokeOutcome;
+    /** For displaying the config path as ~/…. */
+    home?: string;
+}
+/**
+ * `vincentt logout` (Flow L7): the platform sign-out was already attempted; the
+ * local token is ALWAYS deleted, and only an api that could not be reached adds
+ * a fact line, because that machine then stays listed in the console.
+ */
+export declare function logoutLines(deps: LogoutDeps): Promise<string[]>;

package/dist/login/loginCommand.js

@@ -5,8 +5,10 @@
 //
 // The IO boundary (print, current identity, run the PKCE flow, clock) is injected so every
 // L1–L4 branch is unit-testable with no real browser, socket, or config file.
+import os from "node:os";
 import { isAuthRefused } from "../shared/authError.js";
 import { EXIT } from "../lib/exitCodes.js";
+import { dayMonth, sanitizeServerLabel } from "./machineLabel.js";
 /** Collapse the home dir to `~` for display. `~/.vincentt/config.json` in every transcript. */
 export function displayConfigPath(absPath, home) {
     if (home && absPath.startsWith(home))
@@ -32,6 +34,18 @@ export function orgSummaryLine(identity) {
     const base = `  Active workspace: ${activeName}`;
     return others.length ? `${base}   ·   also a member of: ${others.join(", ")}` : base;
 }
+/**
+ * The line naming a machine the 10-machine cap signed out (Flow L5). No glyph:
+ * it is not an advisory about this machine; no command: the other machine signs
+ * in again if someone wants it.
+ */
+export function evictionLine(e) {
+    const label = sanitizeServerLabel(e.label);
+    const when = e.lastUsedAt
+        ? `last used ${dayMonth(new Date(e.lastUsedAt))}`
+        : "never used";
+    return `  Signed out "${label}", the least recently used of your 10 signed-in machines (${when}).`;
+}
 /**
  * Drive `vincentt login`. Returns an exit code (0 ok, 1 failed). Never throws for expected
  * failure states (timeout, cancel, state-mismatch) — they print a ✗ line ending with the
@@ -41,7 +55,19 @@ export async function loginCommand(deps, opts = {}) {
     const displayPath = displayConfigPath(deps.configPath, deps.home);
     if (opts.force) {
         deps.print("→ Replacing the existing token on this machine…");
-        await deps.clearToken();
+        // The old token stays on disk until the new one is saved: a failed login must
+        // never leave the machine with neither.
+        const old = deps.storedToken ? await deps.storedToken() : undefined;
+        const code = await runLoginFlow(deps);
+        if (code === EXIT.OK && old && deps.revokeToken) {
+            try {
+                await deps.revokeToken(old);
+            }
+            catch {
+                /* best-effort: the old sign-in ages out or is signed out in the console */
+            }
+        }
+        return code;
     }
     else {
         // L2: already signed in, but only once the api confirms the token.
@@ -78,9 +104,15 @@ function isTokenRejected(err) {
 async function runLoginFlow(deps) {
     // L1 / L4 — run the loopback + PKCE flow.
     try {
-        const { identity, configPath } = await deps.runLogin();
-        deps.print(`✓ Signed in as ${identity.email}`);
+        const { identity, configPath, label, evicted } = await deps.runLogin();
+        // The label is the api's ECHO, never what was sent: an older api never saw it.
+        const named = label ? sanitizeServerLabel(label) : "";
+        deps.print(named
+            ? `✓ Signed in as ${identity.email} on this machine (${named})`
+            : `✓ Signed in as ${identity.email}`);
         deps.print(orgSummaryLine(identity));
+        for (const e of evicted ?? [])
+            deps.print(evictionLine(e));
         deps.print(`  Token saved to ${displayConfigPath(configPath, deps.home)}`);
         deps.print("");
         deps.print("Run `vincentt --help` to see what you can do.");
@@ -94,3 +126,20 @@ async function runLoginFlow(deps) {
         return 1;
     }
 }
+/**
+ * `vincentt logout` (Flow L7): the platform sign-out was already attempted; the
+ * local token is ALWAYS deleted, and only an api that could not be reached adds
+ * a fact line, because that machine then stays listed in the console.
+ */
+export async function logoutLines(deps) {
+    const { path: p, hadToken } = await deps.clear();
+    if (!hadToken)
+        return ["Already signed out."];
+    const lines = [
+        `✓ Signed out. Token removed from ${displayConfigPath(p, deps.home ?? os.homedir())}`,
+    ];
+    if (deps.outcome === "unreachable") {
+        lines.push("  The api could not be reached. This machine stays listed under Signed-in machines until it is", "  signed out there or goes 90 days unused.");
+    }
+    return lines;
+}

package/dist/login/machineLabel.d.ts

@@ -0,0 +1,46 @@
+export declare const MACHINE_LABEL_MAX_CODE_POINTS = 64;
+export declare const MACHINE_LABEL_MAX_MARK_RUN = 4;
+export declare const LEGACY_MACHINE_LABEL = "Signed in before machine names";
+export declare const DEFAULT_MACHINE_LABEL_PREFIX = "Unnamed machine,";
+export declare const MACHINE_LABEL_REFUSED_LINES: readonly string[];
+/** "d Mon" in the given date's own calendar fields (local time unless the caller says otherwise). */
+export declare function dayMonth(d: Date, utc?: boolean): string;
+/** The default label, "<OS> <arch>, <d Mon>", from injected platform, arch and clock. */
+export declare function defaultMachineLabel(platform?: string, arch?: string, now?: Date): string;
+export type LabelCheck = {
+    ok: true;
+    label: string;
+} | {
+    ok: false;
+};
+/**
+ * The api's label rules, for a label the person typed: NFC, trim U+0020 only,
+ * then 1 to 64 code points, each a letter, mark, number, punctuation, symbol or
+ * plain space, no run of more than 4 marks, and not a platform-only string. An
+ * empty label is refused here (the api would store its default, but `--label ""`
+ * is a mistake, not a request for the default).
+ */
+export declare function validateMachineLabel(raw: string): LabelCheck;
+/**
+ * Drop every code point outside the label allowlist before a server-sent label
+ * is printed. The api already refuses such labels; this keeps a later
+ * validation bug from writing escape sequences or bidi controls to a terminal.
+ */
+export declare function sanitizeServerLabel(label: unknown): string;
+export type LoginLabel = {
+    ok: true;
+    label: string;
+} | {
+    ok: false;
+    lines: readonly string[];
+};
+/**
+ * The label a `vincentt login` sends. Without --label it is the default; with it,
+ * the typed value must pass the api's rules, or the refusal lines are returned
+ * and the login must stop before any browser or network.
+ */
+export declare function resolveLoginLabel(given: boolean, raw: string | undefined, defaults?: {
+    platform?: string;
+    arch?: string;
+    now?: Date;
+}): LoginLabel;