fix(auth): give steps that actually untrack a committed token file

[theCodeDrift]

The tracked-token warning fires only when git ls-files already reports .taskless/.env.local.json, so the advice to "gitignore" it changed nothing: git keeps tracking a file that is already in the index.

The warning now lists the steps that help:

1. git rm --cached .taskless/.env.local.json to untrack it and keep the local copy
2. make sure .taskless/.gitignore lists .env.local.json (saveToken and the init migration usually add it already), then commit
3. if the commit was pushed, treat the token as exposed and replace it with auth logout then auth login

Step 3 also says that logout only deletes the local copy and does not revoke the old token (auth logout is local-only), so the CLI doesn't suggest the leak is fixed when it isn't. If the service has a revocation path, the warning should link to it in a follow-up.

Testing

• Two new tests in test/token.test.ts: one tracks the file in a real git repo and checks the warning, the other checks nothing is printed when the file is untracked
• pnpm typecheck and pnpm lint pass
• Checked by hand against the built CLI (info -d <repo with the file tracked>)

Fixes #453

[theCodeDrift]

@claude /review

[claude]

Claude finished @theCodeDrift's task in 1m 14s —— View job

---

Review mode: incremental — read 0 prior review thread(s) before reviewing.

.prior-review.json contains no review threads, reviews, or top-level comments beyond the @claude /review trigger itself — this is the first review of this PR.

• Read .prior-review.json (empty — first review)
• Fetch PR diff and metadata via gh pr diff / gh pr view
• Read full packages/cli/src/auth/token.ts for context around the change
• Verify the auth logout claim (local-only, no revocation) against packages/cli/src/commands/auth.ts
• Review test coverage in packages/cli/test/token.test.ts
• Review changeset wording/bump

Assessment

This is a solid, well-scoped fix. Highlights:

• Correctness verified: logoutCommand (packages/cli/src/commands/auth.ts:123-133) does call just removeToken(cwd), which only deletes the local file — no server-side revoke call exists in this codebase. The warning's claim that auth logout "does not revoke the old token" is accurate.
• Message content matches the PR description's 3-step plan and is consistent with the actual PER_REPO_AUTH_FILE/.gitignore wiring in saveToken (addToGitignore(cwd, [".env.local.json"])).
• execFile("git", ["ls-files", relativePath], ...) continues to use an args array (no shell), so there's no command-injection concern introduced here.
• Tests are good: one spins up a real git repo, tracks the file, and asserts the new warning text (git rm --cached, auth logout, auth login, does not revoke); the other confirms silence when untracked. Adding vi.restoreAllMocks() to afterEach is the right call since these are the first tests in this file to spy on console.error — without it the spy would leak into later tests.
• The WHY-comment added above the new code (// Already in the index, so a .gitignore entry alone changes nothing…) is exactly the kind of non-obvious rationale the style guide asks for, not a restatement of what the code does.
• Changeset is a patch, correctly — this is a bug fix (and the package is pre-1.0 regardless).

Minor (non-blocking) nit

• [New] packages/cli/src/auth/token.ts:150: step 2 of the message hardcodes the literal .env.local.json instead of reusing the PER_REPO_AUTH_FILE constant already imported/defined in this file. Not a bug — just a small duplication that could drift if the filename ever changes in one place and not the other.

No correctness, security, or test-adequacy issues found. Nothing else to flag.
(branch)

[theCodeDrift]

Re: @claude[bot] — "Minor (non-blocking) nit: step 2 of the message hardcodes the literal .env.local.json instead of reusing the PER_REPO_AUTH_FILE constant…"
#460 (comment)

Fixed in aaed9c8. The constant now builds the warning text and also two spots with the same drift risk: the relativePath the tracked-file check passes to git ls-files, and the .gitignore entry saveToken writes.

— AI Coding Agent