neuvikon 0.2.1 → 0.2.3

package/README.md

@@ -38,7 +38,7 @@ as being worked on, by whom, with which tool.
 | `neuvikon start --ticket EWWQ-1` | Begin tracking. `--tool claude-code\|codex\|cursor\|other` |
 | `neuvikon stop` | Stop tracking |
 | `neuvikon status` | Login, project setup, current ticket |
-| `neuvikon logout` | Forget the stored token |
+| `neuvikon logout` | Revoke this machine's token and forget it |
 
 `start` also accepts the ticket on stdin, and pulls the reference out of it:
 

package/dist/index.mjs

@@ -149,7 +149,7 @@ function isInstalled(root) {
 * installed copy of this CLI hardcodes whatever ships here, and a dev
 * deployment can be reset out from under them.
 */
-const DEFAULT_SITE_URL = process.env.NEUVIKON_URL ?? "https://flexible-bird-801.eu-west-1.convex.site";
+const DEFAULT_SITE_URL = process.env.NEUVIKON_URL ?? "https://flexible-bird-801.eu-west-1.convex.sites";
 const CONFIG_DIR = join(homedir(), ".neuvikon");
 const CONFIG_PATH = join(CONFIG_DIR, "config.json");
 /**
@@ -366,15 +366,6 @@ async function login(flags) {
 	}
 }
 //#endregion
-//#region src/commands/logout.ts
-function logout() {
-	if (clearCredentials()) {
-		success("Logged out.");
-		return;
-	}
-	info("You were not logged in.");
-}
-//#endregion
 //#region src/session.ts
 /**
 * Scoped to the working directory rather than the machine: two checkouts driven
@@ -409,6 +400,42 @@ function clearSession() {
 	} catch {}
 }
 //#endregion
+//#region src/commands/logout.ts
+/**
+* Deleting the local file is not enough: the token stays valid until the server
+* is told otherwise, so a copy of it lifted from a backup or a shared machine
+* would still be able to report. Revoking is the part that actually ends the
+* session; forgetting it locally is bookkeeping.
+*/
+async function logout() {
+	const credentials = readCredentials();
+	if (!credentials) {
+		info("You were not logged in.");
+		return;
+	}
+	const session = readSession();
+	if (session) {
+		await post(credentials.url, "/api/agent/events", {
+			token: credentials.token,
+			event: "stop",
+			sessionKey: session.sessionKey
+		}).catch(() => void 0);
+		clearSession();
+	}
+	let revoked = false;
+	try {
+		revoked = (await post(credentials.url, "/api/cli/auth/revoke", { token: credentials.token })).revoked;
+	} catch {}
+	if (process.env.NEUVIKON_TOKEN) warn("NEUVIKON_TOKEN is set in your environment — unset it to finish logging out.");
+	clearCredentials();
+	if (revoked) {
+		success("Logged out. That token has been revoked.");
+		return;
+	}
+	success("Logged out on this machine.");
+	info(dim("  Could not reach Neuvikon to revoke the token — revoke it in settings if it leaked."));
+}
+//#endregion
 //#region src/ticket.ts
 /**
 * Ticket refs look like `AWKN-14`. This pattern is deliberately looser than the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "neuvikon",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Tell Neuvikon which ticket your coding agent is working on.",
   "keywords": [
     "neuvikon",