feat(cli): Add /auth logout command to clear credentials and auth state (#13383)

packages/cli/src/ui/commands/authCommand.test.ts

@@ -4,19 +4,44 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { describe, it, expect, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { authCommand } from './authCommand.js';
 import { type CommandContext } from './types.js';
 import { createMockCommandContext } from '../../test-utils/mockCommandContext.js';
+import { SettingScope } from '../../config/settings.js';
+
+vi.mock('@google/gemini-cli-core', async () => {
+  const actual = await vi.importActual('@google/gemini-cli-core');
+  return {
+    ...actual,
+    clearCachedCredentialFile: vi.fn().mockResolvedValue(undefined),
+  };
+});
 
 describe('authCommand', () => {
   let mockContext: CommandContext;
 
   beforeEach(() => {
-    mockContext = createMockCommandContext();
+    mockContext = createMockCommandContext({
+      services: {
+        config: {
+          getGeminiClient: vi.fn(),
+        },
+      },
+    });
+    // Add setValue mock to settings
+    mockContext.services.settings.setValue = vi.fn();
+    vi.clearAllMocks();
   });
 
-  it('should return a dialog action to open the auth dialog', () => {
+  it('should have subcommands: login and logout', () => {
+    expect(authCommand.subCommands).toBeDefined();
+    expect(authCommand.subCommands).toHaveLength(2);
+    expect(authCommand.subCommands?.[0]?.name).toBe('login');
+    expect(authCommand.subCommands?.[1]?.name).toBe('logout');
+  });
+
+  it('should return a dialog action to open the auth dialog when called with no args', () => {
     if (!authCommand.action) {
       throw new Error('The auth command must have an action.');
     }
@@ -31,6 +56,76 @@ describe('authCommand', () => {
 
   it('should have the correct name and description', () => {
     expect(authCommand.name).toBe('auth');
-    expect(authCommand.description).toBe('Change the auth method');
+    expect(authCommand.description).toBe('Manage authentication');
+  });
+
+  describe('auth login subcommand', () => {
+    it('should return auth dialog action', () => {
+      const loginCommand = authCommand.subCommands?.[0];
+      expect(loginCommand?.name).toBe('login');
+      const result = loginCommand!.action!(mockContext, '');
+      expect(result).toEqual({ type: 'dialog', dialog: 'auth' });
+    });
+  });
+
+  describe('auth logout subcommand', () => {
+    it('should clear cached credentials', async () => {
+      const logoutCommand = authCommand.subCommands?.[1];
+      expect(logoutCommand?.name).toBe('logout');
+
+      const { clearCachedCredentialFile } = await import(
+        '@google/gemini-cli-core'
+      );
+
+      await logoutCommand!.action!(mockContext, '');
+
+      expect(clearCachedCredentialFile).toHaveBeenCalledOnce();
+    });
+
+    it('should clear selectedAuthType setting', async () => {
+      const logoutCommand = authCommand.subCommands?.[1];
+
+      await logoutCommand!.action!(mockContext, '');
+
+      expect(mockContext.services.settings.setValue).toHaveBeenCalledWith(
+        SettingScope.User,
+        'security.auth.selectedType',
+        undefined,
+      );
+    });
+
+    it('should strip thoughts from history', async () => {
+      const logoutCommand = authCommand.subCommands?.[1];
+      const mockStripThoughts = vi.fn();
+      const mockClient = {
+        stripThoughtsFromHistory: mockStripThoughts,
+      } as unknown as ReturnType<
+        NonNullable<typeof mockContext.services.config>['getGeminiClient']
+      >;
+
+      if (mockContext.services.config) {
+        mockContext.services.config.getGeminiClient = vi.fn(() => mockClient);
+      }
+
+      await logoutCommand!.action!(mockContext, '');
+
+      expect(mockStripThoughts).toHaveBeenCalled();
+    });
+
+    it('should return logout action to signal explicit state change', async () => {
+      const logoutCommand = authCommand.subCommands?.[1];
+      const result = await logoutCommand!.action!(mockContext, '');
+
+      expect(result).toEqual({ type: 'logout' });
+    });
+
+    it('should handle missing config gracefully', async () => {
+      const logoutCommand = authCommand.subCommands?.[1];
+      mockContext.services.config = null;
+
+      const result = await logoutCommand!.action!(mockContext, '');
+
+      expect(result).toEqual({ type: 'logout' });
+    });
   });
 });

packages/cli/src/ui/commands/authCommand.ts

@@ -4,12 +4,18 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import type { OpenDialogActionReturn, SlashCommand } from './types.js';
+import type {
+  OpenDialogActionReturn,
+  SlashCommand,
+  LogoutActionReturn,
+} from './types.js';
 import { CommandKind } from './types.js';
+import { clearCachedCredentialFile } from '@google/gemini-cli-core';
+import { SettingScope } from '../../config/settings.js';
 
-export const authCommand: SlashCommand = {
-  name: 'auth',
-  description: 'Change the auth method',
+const authLoginCommand: SlashCommand = {
+  name: 'login',
+  description: 'Login or change the auth method',
   kind: CommandKind.BUILT_IN,
   autoExecute: true,
   action: (_context, _args): OpenDialogActionReturn => ({
@@ -17,3 +23,34 @@ export const authCommand: SlashCommand = {
     dialog: 'auth',
   }),
 };
+
+const authLogoutCommand: SlashCommand = {
+  name: 'logout',
+  description: 'Log out and clear all cached credentials',
+  kind: CommandKind.BUILT_IN,
+  action: async (context, _args): Promise<LogoutActionReturn> => {
+    await clearCachedCredentialFile();
+    // Clear the selected auth type so user sees the auth selection menu
+    context.services.settings.setValue(
+      SettingScope.User,
+      'security.auth.selectedType',
+      undefined,
+    );
+    // Strip thoughts from history instead of clearing completely
+    context.services.config?.getGeminiClient()?.stripThoughtsFromHistory();
+    // Return logout action to signal explicit state change
+    return {
+      type: 'logout',
+    };
+  },
+};
+
+export const authCommand: SlashCommand = {
+  name: 'auth',
+  description: 'Manage authentication',
+  kind: CommandKind.BUILT_IN,
+  subCommands: [authLoginCommand, authLogoutCommand],
+  action: (context, args) =>
+    // Default to login if no subcommand is provided
+    authLoginCommand.action!(context, args),
+};

packages/cli/src/ui/commands/types.ts

@@ -142,13 +142,22 @@ export interface OpenCustomDialogActionReturn {
   component: ReactNode;
 }
 
+/**
+ * The return type for a command action that specifically handles logout logic,
+ * signaling the application to explicitly transition to an unauthenticated state.
+ */
+export interface LogoutActionReturn {
+  type: 'logout';
+}
+
 export type SlashCommandActionReturn =
   | CommandActionReturn<HistoryItemWithoutId[]>
   | QuitActionReturn
   | OpenDialogActionReturn
   | ConfirmShellCommandsActionReturn
   | ConfirmActionReturn
-  | OpenCustomDialogActionReturn;
+  | OpenCustomDialogActionReturn
+  | LogoutActionReturn;
 
 export enum CommandKind {
   BUILT_IN = 'built-in',