fix: report unauthenticated auth state honestly

src/cli.js

@@ -295,6 +295,8 @@ auth
         } else {
           console.log(`Skipping remote revocation (no password provided). Token ${config.tokenId} stays active on ${config.url}; revoke it from the web UI under Settings > Applications.`);
         }
+      } else if (!config.tokenId && !options.localOnly) {
+        console.log(`Removing local credentials. Stoke did not create this token and cannot revoke it. The token is still valid on ${config.url}; revoke it from the web UI under Settings > Applications.`);
       }
 
       clearConfig();
@@ -313,8 +315,12 @@ auth
     try {
       const config = loadConfig();
       if (!config || !config.token) {
-        console.log('Not authenticated.');
-        return;
+        if (options.json) {
+          console.log('{"authenticated": false}');
+        } else {
+          console.log('Not authenticated.');
+        }
+        process.exit(1);
       }
 
       const client = ForgejoClient.fromConfig(config);

test/cli.test.js

@@ -54,7 +54,7 @@ test('auth status reports an absent session in text and JSON with a failing stat
 
   const json = run(['auth', 'status', '--json'], { STOKE_CONFIG_FILE: missing });
   assert.equal(json.status, 1);
-  assert.equal(json.stdout, '{"authenticated":false}\n');
+  assert.equal(json.stdout, '{"authenticated": false}\n');
   assert.equal(json.stderr, '');
 });
 
@@ -78,6 +78,8 @@ test('auth logout identifies a supplied token that remains active without changi
     assert.match(logout.stdout, /cannot revoke it/i);
     assert.match(logout.stdout, /still valid on https:\/\/forge\.test/i);
     assert.match(logout.stdout, /Settings > Applications/);
+    assert.doesNotMatch(logout.stdout, /Revoked token/);
+    assert.doesNotMatch(logout.stdout, /Password for/);
     assert.doesNotMatch(logout.stdout, /token-that-must-not-be-printed/);
     assert.equal(fs.existsSync(cfg), false);