feat: auth logout

[alukach]

Stacked on #24 (feat/product-commands). Retarget to main once #24 merges.

Rebuilt on #24, under auth (#24 moved login to auth login). Replaces this PR's earlier top-level source-coop logout.

What

source-coop auth logout removes an environment's login session and one role's cached credentials, from the keyring and the file fallback.

• --proxy-url / SOURCE_PROXY_URL and --role-arn / SOURCE_ROLE_ARN pick the environment and role, as for creds.
• Order: the session first, then the role's credentials, each under its slot's lock. A creds that's minting finishes before its result is removed.
• Old-format entries: for a non-production environment, an old-format entry of that environment left in production's slot is removed too. Otherwise read_credentials would copy it straight back.
• Other roles: the keyring can't list its entries, so other roles' credentials stay until they expire. Without the session they can't be renewed. The README says so.
• Revocation: tokens aren't revoked at the identity provider. That could be a follow-up.
• Prints "Logged out of …" or "Not logged in to …" on stderr.

This and #40 (auth status) are independent, so either can land first. The other then has a one-line conflict in the auth command's description and in the README.

Testing

• remove_file_reports_whether_it_existed.
• cargo fmt, cargo clippy --all-targets -- -D warnings, cargo test and cargo test --features staging: 89 passed.
• Ran it for a made-up environment with HOME in a scratch folder holding fake session and credential files. It removed both and said "Logged out", and a second run said "Not logged in". No real keychain entry or login was touched.

🤖 Generated with Claude Code

[claude]

Claude finished @alukach's task in 18s —— View job

---

✅ No blocking issues — safe to merge.

I read the diff and the surrounding read_credentials and read_session code. I did not build the branch or run the tests or clippy.

Notes (non-blocking)

• PR description is stale. It says source-coop logout, but the code and README use auth logout. This matches AGENTS.md ("signing in lives under auth"). Update the description so it doesn't confuse the squash title or release notes.
• Legacy-slot race. In src/cache.rs:244-250, read_slot(&legacy) runs without the legacy slot's lock, and delete_slot then takes the lock. If another environment's creds rewrites that slot between the check and the delete, you could delete a still-valid entry. The cost is one extra re-mint, so this is harmless.
• Message prints the proxy URL as given. run_logout (src/main.rs) prints args.proxy_url exactly as passed, so a trailing slash shows up as typed. This is cosmetic.

Simplify (ponytail)

• src/cache.rs remove_file: fs::remove_file plus a NotFound match is already minimal. It is only used by delete_slot, so it could be inlined. The unit test for it is the only reason to keep it separate, so keep it.
• src/main.rs LogoutArgs: duplicates the proxy_url and role_arn args from creds. If creds has a shared args struct, flatten it with #[command(flatten)] instead of redeclaring the arguments.
  · branch feat/logout-command

---

💰 Estimated review cost: $0.12 · 0m18s · 7 turns

[alukach]

Superseded by #46 (auth commands: login, status, logout, token), built on #45 instead of #24. The branch is kept.