impel-cli 0.9.0 → 0.9.1

package/README.md

@@ -124,6 +124,7 @@ impel auth [--pat <pat>] [--gateway <url>] [--app <url>]
 impel pat create --label <label> [options]    Mint a personal PAT through the control plane
 impel pat create --agent <agent-id> [options]
                                              Mint a PAT associated with an org agent
+impel pat revoke <token-id> --yes             Irreversibly revoke one of your PATs
 impel token [--tenant <org>]                 Print a selected-tenant bearer
 impel mcp                                    Run the local MCP bridge used by Claude/Codex
 impel claude [claude args...]                Launch isolated Impel Claude Code
@@ -186,7 +187,7 @@ Stores your PAT, gateway base URL, and app/control-plane URL in `~/.config/impel
 impel auth --pat impel_pat_xxxxxxxxxxxx --gateway https://gateway.useimpel.com --app https://www.useimpel.com
 ```
 
-### `impel pat create ...`  (alias `impel pat mint ...`)
+### `impel pat create ...` / `impel pat revoke ...`
 
 Mints a new PAT through the app/control-plane API, authenticated by the PAT
 already stored by `impel auth`. Identity remains the minting authority: the
@@ -215,6 +216,20 @@ the config file. To rotate this CLI onto it, explicitly run
 `impel auth --pat <new-pat>` after copying it. `--json` includes the raw secret,
 so treat redirected output as a credential.
 
+Revoke a token by the token ID printed when it was created:
+
+```sh
+impel pat revoke personal1 --yes
+impel pat revoke personal1 --yes --json
+```
+
+Revocation is immediate and irreversible, so `--yes` is required. A full PAT is
+also accepted for recovery from older mint output, but using the token ID avoids
+putting a secret in shell history. The CLI extracts the ID without echoing the
+secret, authenticates with the currently stored PAT, and leaves the local config
+unchanged. If you revoke the stored PAT itself, authenticate again with a live PAT
+before running another protected command.
+
 ### `impel update`
 
 One command brings everything current, in dependency order: the CLI itself

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -37,6 +37,7 @@ Manage:
   impel auth [--pat <pat>]                    Store your PAT + URLs (--gateway/--app <url>)
   impel pat create --label <label>            Mint a personal PAT (--org/--scopes/--ttl-days)
   impel pat create --agent <agent-id>         Mint an org-scoped PAT associated with an agent
+  impel pat revoke <token-id> --yes           Irreversibly revoke one of your PATs
   impel tenant list|current|use <org>         List or select the active organization
   impel tasks list|get|create|update|delete   CRUD Impel tickets (aliases: task, ticket[s])
   impel token [--tenant <org>]                Print the selected-tenant bearer

package/src/commands/pat.js

@@ -16,8 +16,9 @@ import {
 const AGENT_PAT_LABEL_PREFIX = "Agent · ";
 const MAX_PAT_LABEL_LENGTH = 120;
 const MAX_PAT_TTL_DAYS = 365;
-const PAT_CREATE_PATH = "/api/cli/pats";
+const PAT_COLLECTION_PATH = "/api/cli/pats";
 const PAT_TOKEN_RE = /^impel_pat_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u;
+const PAT_TOKEN_INPUT_RE = /^impel_pat_([A-Za-z0-9_-]{8,128})\.[A-Za-z0-9_-]+$/u;
 const PAT_TOKEN_ID_RE = /^[A-Za-z0-9_-]{8,128}$/u;
 const AGENT_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,111}$/u;
 const CONTROL_CHARACTER_RE = /[\u0000-\u001F\u007F-\u009F]/u;
@@ -33,13 +34,28 @@ const FLAG_NAMES = new Set([
   "scopes",
   "tenant",
   "ttl-days",
+  "yes",
 ]);
 
-const HELP = `impel pat - mint a personal access token through Impel
+const CREATE_FLAG_NAMES = new Set([
+  "agent",
+  "app",
+  "help",
+  "json",
+  "label",
+  "org",
+  "scopes",
+  "tenant",
+  "ttl-days",
+]);
+const REVOKE_FLAG_NAMES = new Set(["app", "help", "json", "yes"]);
+
+const HELP = `impel pat - manage personal access tokens through Impel
 
 Usage:
   impel pat create --label <label> [options]
   impel pat create --agent <agent-id> [options]
+  impel pat revoke <token-id> --yes [options]
 
 Aliases:
   impel pats ...
@@ -52,11 +68,13 @@ Options:
                        Defaults are chosen by the control plane for your access tier.
   --ttl-days <days>    Expiry from 1 to ${MAX_PAT_TTL_DAYS} days. Default: 90.
   --app <url>          Override the app/control-plane URL for this command.
-  --json               Print the created PAT and metadata as JSON.
+  --json               Print the result as JSON.
+  --yes                Confirm irreversible PAT revocation.
 
 The stored PAT authenticates this request. The control plane verifies the owner,
 organization membership, requested scopes, and agent access before identity mints
-the new secret. The new PAT is shown once and is not stored automatically.
+the new secret or revokes the selected token. New PATs are shown once and are not
+stored automatically. Revoke accepts a token id or a full PAT and never echoes a secret.
 `;
 
 class PatCommandError extends Error {}
@@ -76,9 +94,17 @@ function flagSpec() {
     scopes: { type: "string" },
     tenant: { type: "string" },
     "ttl-days": { type: "string" },
+    yes: { type: "boolean" },
   };
 }
 
+function rejectUnsupportedFlags(flags, allowed, action) {
+  const unsupported = Object.keys(flags).find((name) => !allowed.has(name));
+  if (unsupported) {
+    fail(`impel pat ${action}: option --${redactSecretText(unsupported)} is not supported.`);
+  }
+}
+
 function requireConfig(flags) {
   const config = loadConfig();
   if (!config?.pat) {
@@ -135,6 +161,18 @@ function requestedTtlDays(value) {
   return days;
 }
 
+function requestedTokenId(value) {
+  if (value === undefined) {
+    fail("impel pat revoke: missing token id.");
+  }
+  const requested = String(value).trim();
+  const tokenId = PAT_TOKEN_INPUT_RE.exec(requested)?.[1] || requested;
+  if (!PAT_TOKEN_ID_RE.test(tokenId)) {
+    fail("impel pat revoke: expected a valid token id or full Impel PAT.");
+  }
+  return tokenId;
+}
+
 function requestedSubject(flags) {
   const agentId = flags.agent === undefined ? null : String(flags.agent).trim();
   const personalLabel = flags.label === undefined ? null : String(flags.label).trim();
@@ -215,19 +253,19 @@ function normalizeCreatedPat(payload, expected) {
   };
 }
 
-async function createPat({ appUrl, currentPat, body }) {
+async function requestControlPlane({ appUrl, currentPat, path, method, body, feature }) {
   const controller = new AbortController();
   const timeout = setTimeout(() => controller.abort(), 10_000);
   let response;
   try {
-    response = await fetch(new URL(PAT_CREATE_PATH, appUrl), {
-      method: "POST",
+    response = await fetch(new URL(path, appUrl), {
+      method,
       headers: {
         accept: "application/json",
         authorization: `Bearer ${currentPat}`,
-        "content-type": "application/json",
+        ...(body === undefined ? {} : { "content-type": "application/json" }),
       },
-      body: JSON.stringify(body),
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }),
       signal: controller.signal,
     });
   } catch (error) {
@@ -245,13 +283,24 @@ async function createPat({ appUrl, currentPat, body }) {
     payload = null;
   }
   if (!response.ok) {
-    if (response.status === 404) {
-      fail(`impel pat: PAT minting is not available on ${appUrl}; update the Impel control plane and try again.`);
+    if (response.status === 404 && !payload?.error) {
+      fail(`impel pat: PAT ${feature} is not available on ${appUrl}; update the Impel control plane and try again.`);
     }
     const message = redactSecretText(payload?.error || `${response.status} ${response.statusText}`.trim());
     fail(`impel pat: ${message}`);
   }
+  return payload;
+}
 
+async function createPat({ appUrl, currentPat, body }) {
+  const payload = await requestControlPlane({
+    appUrl,
+    currentPat,
+    path: PAT_COLLECTION_PATH,
+    method: "POST",
+    body,
+    feature: "minting",
+  });
   const created = normalizeCreatedPat(payload, body);
   if (!created) {
     fail("impel pat: the control plane returned an invalid PAT creation response; the secret was not displayed.");
@@ -259,6 +308,17 @@ async function createPat({ appUrl, currentPat, body }) {
   return created;
 }
 
+async function revokePat({ appUrl, currentPat, tokenId }) {
+  await requestControlPlane({
+    appUrl,
+    currentPat,
+    path: `${PAT_COLLECTION_PATH}/${encodeURIComponent(tokenId)}`,
+    method: "DELETE",
+    feature: "revocation",
+  });
+  return { revoked: true, tokenId };
+}
+
 function printCreatedPat(created, subject, json) {
   if (json) {
     console.log(JSON.stringify({
@@ -274,6 +334,7 @@ function printCreatedPat(created, subject, json) {
   } else {
     console.log(`Created personal PAT ${JSON.stringify(created.label)} in ${created.orgId}.`);
   }
+  console.log(`Token ID: ${created.tokenId}`);
   console.log(`Scopes:  ${created.scopes.join(", ") || "none"}`);
   console.log(`Expires: ${created.expiresAt === null ? "never" : new Date(created.expiresAt).toISOString()}`);
   console.log("");
@@ -281,15 +342,23 @@ function printCreatedPat(created, subject, json) {
   console.log(created.token);
 }
 
+function printRevokedPat(revoked, json) {
+  if (json) {
+    console.log(JSON.stringify(revoked, null, 2));
+    return;
+  }
+  console.log(`Revoked PAT ${revoked.tokenId}.`);
+}
+
 export async function cmdPat(argv) {
   const [action, ...rest] = argv;
   if (!action || action === "help" || action === "--help" || action === "-h") {
     console.log(HELP);
     return;
   }
-  if (action !== "create" && action !== "mint") {
+  if (action !== "create" && action !== "mint" && action !== "revoke") {
     console.error(`impel pat: unknown subcommand "${redactSecretText(action)}".`);
-    console.error("  Use `impel pat create --label <label>` or `impel pat create --agent <agent-id>`.");
+    console.error("  Use `impel pat create --label <label>`, `impel pat create --agent <agent-id>`, or `impel pat revoke <token-id> --yes`.");
     process.exitCode = 1;
     return;
   }
@@ -302,6 +371,23 @@ export async function cmdPat(argv) {
     }
     const unknownFlag = Object.keys(flags).find((name) => !FLAG_NAMES.has(name));
     if (unknownFlag) fail(`impel pat: unknown option --${redactSecretText(unknownFlag)}.`);
+
+    if (action === "revoke") {
+      rejectUnsupportedFlags(flags, REVOKE_FLAG_NAMES, "revoke");
+      const tokenId = requestedTokenId(positionals[0]);
+      if (positionals.length > 1) {
+        fail(`impel pat revoke: unexpected argument "${redactSecretText(positionals[1])}".`);
+      }
+      if (flags.yes !== true) {
+        fail("impel pat revoke: refusing to revoke without --yes.");
+      }
+      const { appUrl, config } = requireConfig(flags);
+      const revoked = await revokePat({ appUrl, currentPat: config.pat, tokenId });
+      printRevokedPat(revoked, flags.json === true);
+      return;
+    }
+
+    rejectUnsupportedFlags(flags, CREATE_FLAG_NAMES, "create");
     if (positionals.length > 0) {
       fail(`impel pat create: unexpected argument "${redactSecretText(positionals[0])}".`);
     }