Point logout and revoke at this connection, not the whole agent

Basecamp is about to let a personal agent hold several connections, one
per computer or profile, each with its own secret. Then "disconnect the
agent" is My > Agent's Disconnect all, which ends every computer, and
rotating the client secret rewrites only the first connection's.

auth logout and auth revoke now say to disconnect this connection in
Basecamp. That is right today as well: an agent has one connection, and
disconnecting it is what My > Agent's Disconnect does. The README says
where to find it for a personal agent and a shared one, and that
Disconnect all, once My > Agent lists several, ends every one.

Author: jeremy

README.md

@@ -239,9 +239,11 @@ op read "op://Vault/Item/credential" | basecamp auth login --with-client-credent
 The login mints once, which is what proves the client id and secret: a refused
 mint stores nothing. `--account` is required when the profile does not exist
 yet. `basecamp auth logout` forgets the credential; there is no useful
-revocation, since the same client would mint another — disconnect the agent in
-Basecamp to end its access, which kills its client secret and every token
-minted from it.
+revocation, since the same client would mint another. To end its access,
+disconnect its connection in Basecamp (on My > Agent for your own agent, in
+Adminland for a shared one), which kills that connection's secret and every
+token minted from it. Where My > Agent lists several connections, disconnect
+the one this profile used: Disconnect all ends every one of them.
 
 ### Connecting an agent to this computer
 

internal/auth/agent_test.go

@@ -392,9 +392,9 @@ func TestAgentMintRefusesARedirect(t *testing.T) {
 	assert.Zero(t, *sinkCalls, "the client secret followed a redirect")
 }
 
-// TestAgentLogoutSaysRotatingTheSecretIsTheRemedy: revoking one self-token
+// TestAgentLogoutForgetsWithoutRevoking: revoking one self-token
 // accomplishes nothing while the client that minted it can mint another.
-func TestAgentLogoutSaysRotatingTheSecretIsTheRemedy(t *testing.T) {
+func TestAgentLogoutForgetsWithoutRevoking(t *testing.T) {
 	as := startDeviceAS(t)
 	m := newDeviceTestManager(t, as.srv.URL)
 	key := storeAgent(t, m, agentCredential(as.srv.URL+"/oauth/token", time.Now().Add(time.Hour)))
@@ -421,7 +421,7 @@ func TestAgentRevokeIsRefusedAndKeepsTheCredential(t *testing.T) {
 	err := m.RevokeStored(context.Background())
 	require.Error(t, err)
 	assert.Equal(t, output.CodeUsage, output.AsError(err).Code)
-	assert.Contains(t, err.Error(), "disconnect the agent in Basecamp")
+	assert.Contains(t, output.AsError(err).Hint, "disconnect this connection in Basecamp")
 	assert.Empty(t, as.revokeCalls(), "a revocation was sent for an agent self-token")
 
 	creds, loadErr := m.store.Load(key)

internal/auth/revoke.go

@@ -44,10 +44,13 @@ const (
 	RevokeSkippedImported = "imported_token"
 	// RevokeSkippedAgent: an agent self-token is minted on demand from a
 	// client id and secret, so revoking one accomplishes nothing — the
-	// same client mints another on the next command. Ending an agent's
-	// access means disconnecting it in Basecamp, which kills the client
-	// secret and every token minted from it. (Basecamp has no separate
-	// "rotate secret": reconnecting is the rotation.)
+	// same client mints another on the next command. What ends this
+	// credential's access is disconnecting its connection in Basecamp,
+	// which kills that connection's secret and every token minted from it.
+	// Once an agent can hold several connections, neither older remedy is
+	// right: rotating the client secret (Basecamp has no control for it)
+	// rewrites only the first connection's, and disconnecting the whole
+	// agent ends every other computer's connection too.
 	RevokeSkippedAgent = "agent"
 )
 
@@ -196,7 +199,7 @@ func (m *Manager) RevokeStored(ctx context.Context) error {
 				"Forget the credential locally instead: basecamp auth logout")
 		case RevokeSkippedAgent:
 			return output.ErrUsageHint("An agent self-token is not worth revoking: the client that minted it can mint another",
-				"Forget the credential locally instead (basecamp auth logout), and disconnect the agent in Basecamp to end its access")
+				"Forget the credential locally instead (basecamp auth logout), and disconnect this connection in Basecamp to end its access")
 		}
 		if err := m.Revoke(ctx, creds); err != nil {
 			// Keep the failure's taxonomy — a transport failure or a 5xx

internal/commands/auth.go

@@ -1607,7 +1607,7 @@ func describeLogout(done string, result *auth.LogoutResult) (summary string, fie
 		summary = done + " (forgot the imported token; it stays valid until revoked in Basecamp)"
 	case result.Skipped == auth.RevokeSkippedAgent:
 		fields["reason"] = result.Skipped
-		summary = done + " (forgot the agent credential; it stays connected until you disconnect the agent in Basecamp)"
+		summary = done + " (forgot the agent credential; this connection stays live until you disconnect it in Basecamp)"
 	case result.Err != nil:
 		fields["reason"] = result.Err.Error()
 		fields["remaining"] = result.Remaining

internal/commands/auth_logout_test.go

@@ -198,7 +198,7 @@ func TestAuthLogoutHumanCopy(t *testing.T) {
 		s := startRevocationServer(t)
 		app, buf := newLogoutTestApp(t, s, output.FormatStyled, agentLogoutCredentials(s))
 		require.NoError(t, runLogout(t, app))
-		assert.Contains(t, buf.String(), "Logged out (forgot the agent credential; it stays connected until you disconnect the agent in Basecamp)")
+		assert.Contains(t, buf.String(), "Logged out (forgot the agent credential; this connection stays live until you disconnect it in Basecamp)")
 		assert.NotContains(t, buf.String(), "rotate", "Basecamp has no rotate-secret control to send anyone to")
 		assert.Empty(t, s.revoked(), "an agent self-token is minted on demand; revoking one ends nothing")
 		assert.False(t, app.Auth.IsAuthenticated())