auth: review follow-ups + keyring-safe cli TestMain

[Soph]

https://entire.io/gh/entireio/cli/trails/511

Follow-ups from review of the (now-merged) auth-context-consolidation work, plus a test-isolation fix.

Changes

auth: review follow-ups (3eeb08c)

• CLAUDE.md: correct the auth command surface — login/logout/status/contexts/use (drop the removed list/revoke) and document logout's --everywhere / --all-contexts flags.
• logout: runLogout now takes a single caller-selected revoke func instead of both revokeCurrent+revokeAll plus an all bool — the command already knows --everywhere. Dropped the now-obsolete TestRunLogout_AllRevokesAllSessions (selection is covered end-to-end by TestLogoutCommand_FlagMatrix) and updated the simple callers.
• Fixed stale method names in //nolint:wrapcheck comments left over from the Session → AuthSession rename.

test: mock the OS keyring in the cli package TestMain (1ea54e2)

• The cli package's TestMain never routed go-keyring to its in-memory mock (unlike the auth subpackage). The default tokenstore backend is the real OS keychain, so a cli test reaching a credential path without UseFileBackendForTesting — or running in the window after such a test restores the global backend — could read the developer's real keychain and trigger a macOS unlock prompt during mise run test:ci.
• Calls keyring.MockInit() once in TestMain, mirroring cmd/entire/cli/auth's TestMain, so no cli test can touch the real keychain. This closes a latent, pre-existing gap (not introduced by the auth branch).

Testing

• go build ./..., targeted cli tests pass
• mise run fmt + mise run lint — 0 issues

🤖 Generated with Claude Code

---

Note

Low Risk
Local CLI auth/logout and test isolation only; behavior for --everywhere is unchanged and still covered by the flag-matrix e2e test.

Overview
Docs: CLAUDE.md now documents the consolidated auth surface (contexts, use; no list/revoke) and logout’s --everywhere / --all-contexts flags.

Logout refactor: runLogout takes one caller-chosen revoke func instead of revokeCurrent + revokeAll and an all bool—the Cobra handler already selects current vs all sessions via --everywhere. Unit tests were updated; TestRunLogout_AllRevokesAllSessions was removed in favor of TestLogoutCommand_FlagMatrix.

Tests: cli package TestMain calls keyring.MockInit() so tests never touch the real OS keychain (avoids macOS unlock prompts). Stale //nolint:wrapcheck comments were aligned with AuthSession naming.

^{Reviewed by Cursor Bugbot for commit 1ea54e2. Configure here.}

[Copilot]

Pull request overview

This pull request applies follow-up refinements to the auth/logout surface and hardens test isolation by ensuring the CLI package never hits the real OS keychain during unit tests.

Changes:

• Refactors logout internals so runLogout takes a single caller-selected revoke function (current-session vs all-sessions selection remains in the Cobra command).
• Updates //nolint:wrapcheck comments to match AuthSession-renamed method names and removes an obsolete unit test now covered by the command flag-matrix test.
• Adds keyring.MockInit() to the cli package TestMain to prevent any tests from accessing the developer’s real keychain.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
cmd/entire/cli/logout.go	Simplifies logout’s revocation injection and refreshes wrapcheck annotations.
cmd/entire/cli/logout_test.go	Updates unit tests for the new runLogout signature and removes a redundant test.
cmd/entire/cli/global_test.go	Mocks go-keyring globally for the cli package test suite to avoid OS keychain access.
cmd/entire/cli/auth.go	Fixes stale wrapcheck comment text after method renames.
CLAUDE.md	Updates documented auth command surface and logout flags to match current behavior.

[toothbrush]

Ah, thanks for the cleanup 🫡