feat(sessions): sessions list and revoke command#55
Merged
Conversation
Add seamless sessions to view and revoke the logged-in user's active sessions. sessions (or sessions list) calls GET /sessions and renders each session's id, device or user agent, IP, and last-used time, marking the current session. sessions revoke <id> calls DELETE /sessions/:id and sessions revoke --all calls DELETE /sessions. Revoking the current session, or all sessions, confirms first and then clears the local keychain tokens, since that request signs the CLI out. The network logic lives in core/sessions.ts (listSessions, revokeSessionById, revokeAllSessions) and is unit tested against an injected client; the command is a thin front end. Accepts --profile and honors SEAMLESS_PROFILE. Closes #44
9 tasks
Bccorb
added a commit
that referenced
this pull request
Jul 17, 2026
feat(sessions): sessions list and revoke command
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sixth issue in the CLI auth epic (#38). Adds
seamless sessionsto list and revoke the logged-in user's active sessions from the terminal, built on the authenticated client (#41).Commands
seamless sessions(orsessions list):GET /sessions, renders each session's id, device or user agent, IP, and last-used time, with the current session marked (*).seamless sessions revoke <id>:DELETE /sessions/:id. A 404 is reported as "may already be revoked" rather than an error.seamless sessions revoke --all:DELETE /sessions.Revoking the current session (detected via the
currentflag on the list) or--allprompts for confirmation first, and on success clears the local keychain tokens, since that request signs the CLI out.--profile/SEAMLESS_PROFILEare honored. Not-logged-in fails cleanly with the "run seamless login" message.Contract note
The serialized session (from the auth-api
serializeSession) exposesid,deviceName,ipAddress,userAgent,lastUsedAt,expiresAt, andcurrent. There is nocreatedAtin the payload, so the list showslastUsedAt(the issue mentioned created and last-used; only last-used is available from the API).Structure
src/core/sessions.ts:listSessions,revokeSessionById,revokeAllSessions, unit tested against an injectedAuthClient.src/commands/sessions.ts: the@clack/promptsfront end (rendering + confirmation).Tests / verification
npm run build(tsc strict): passing.npm test(vitest): 58 passing (5 new): list mapping with the current marker, malformed-entry filtering, non-ok list error, revoke-by-id with URL encoding, 404 surfaced, and revoke-all routing.sessionsandsessions revoke(clean message, exit 1).Live end-to-end remains blocked by #50 (conformance stack cannot start the auth-api on Node 20 vs the
>=24engine); the logic is covered by injected-client unit tests, and a real drive-through fits under #47 once #50 lands.Acceptance criteria
Closes #44