PR #403's AuthStore already implements the mechanism — revoke_token (single token) and family-wide revocation (used by refresh reuse detection and authorization-code replay). What is missing is the operator UX: there is no way to see which clients hold live tokens, or to revoke one, without editing ~/.onebrain/gateway/tokens.json by hand.
Proposed:
onebrain gateway tokens list — client_id, kind, issued/expires, family, revoked status. Never print the token value itself (only a short prefix or a stable id).onebrain gateway tokens revoke <id> and --client <client_id> / --family <family> for bulk.onebrain gateway clients list|remove is the natural sibling.
🤖 Generated with Claude Code
PR #403's
AuthStorealready implements the mechanism —revoke_token(single token) and family-wide revocation (used by refresh reuse detection and authorization-code replay). What is missing is the operator UX: there is no way to see which clients hold live tokens, or to revoke one, without editing~/.onebrain/gateway/tokens.jsonby hand.Proposed:
onebrain gateway tokens list— client_id, kind, issued/expires, family, revoked status. Never print the token value itself (only a short prefix or a stable id).onebrain gateway tokens revoke <id>and--client <client_id>/--family <family>for bulk.onebrain gateway clients list|removeis the natural sibling.🤖 Generated with Claude Code