Add a colab logout command to sign out and switch accounts

[pengqianhan]

Problem

colab has no command to sign out or switch Google accounts. Neither colab --help, the README, nor the docs describe how to do it. The account in use is also hard to discover, because colab whoami is hidden from --help.

Today, the only way to sign out is to know where the token is stored and remove it by hand. That location depends on the version:

• 0.7.4: ~/.config/colab-cli/token.json
• Current main: the OS keyring (service google-colab-cli, username oauth_token), with token.json migrated and then deleted

Removing the token locally also doesn't revoke it. The refresh token stays valid until the user finds the right entry on their Google Account permissions page. Logs written by versions affected by #177 can also still contain tokens, so deleting the token alone may leave credentials on disk.

Proposal

Add a colab logout command for the oauth2 provider that:

1. Revokes the stored token through Google's OAuth revocation endpoint (or offers this via a flag such as --revoke, see the question below).
2. Deletes the keyring entry and any leftover token.json, so the legacy migration path can't restore the old login.
3. Reports what it did, and succeeds without error if nobody is signed in.
4. Warns if the session state lists active sessions, since they may keep running and using the old account's compute units, and may not be manageable from a different account.

The next command would then start the normal sign-in flow, so switching accounts becomes:

colab logout
colab sessions   # prompts for sign-in
colab whoami     # confirms the new account

With --auth=adc, the CLI doesn't own the credentials, so colab logout should leave them alone and point to gcloud auth application-default revoke.

Also worth considering

• Unhide colab whoami, or add a similar supported command, so users can check which account is active before and after switching.
• Clear or scrub colab.log during logout, for logs left over from versions affected by [Bug]: Tokens written to colab.log in plain text; token.json/colab.log created with default (umask) permissions #177.

Open question

The bundled OAuth client is the cloud SDK client (764086051850-...). Could revoking the token also affect the user's gcloud login for that account? If so, a local-only logout by default with an explicit --revoke flag may be the safer design.

Environment

Observed on google-colab-cli 0.7.4 on macOS. Keyring details are from the docs and source on main.