# auth: drop `auth list`, show active sessions in `auth status`

Remove the `entire auth list` command. The rows it listed are server-side login sessions (OAuth refresh-token families), not personal access tokens — nothing functional depends on listing them (see COR-389 notes). Fold that view into `entire auth status` as a clearly-labelled "Active sessions" table, reusing the table renderer.

`auth revoke <id>` still works; the session IDs now come from `auth status`.

## Sessions

## Changes

- cmd/entire/cli
  - Mauth.go+48/-84
  - Mauth_test.go+26/-58

```go
import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"github.com/spf13/cobra"
)

// authTokenLister lists API tokens for the authenticated user. The
// implementation resolves its own data-API bearer via
// auth.TokenForResource (RFC 8693 exchange in split-host setups, same-
// host shortcut otherwise); callers don't pass a bearer through, which
// removes the temptation to forward the wrong-audience keyring token.
// authTokenLister lists the authenticated user's active login sessions —
// the server-side refresh-token families (one per `entire login`, across
// all devices), surfaced by `entire auth status` and used by revoke as a
// liveness probe. Despite the api.Token name, these are sessions, not
// personal access tokens; the CLI never mints them. The implementation
// resolves its own data-API bearer via auth.TokenForResource (RFC 8693
// exchange in split-host setups, same-host shortcut otherwise); callers
// don't pass a bearer through, which removes the temptation to forward the
// wrong-audience keyring token.
type authTokenLister func(ctx context.Context) ([]api.Token, error)

// authTokenRevoker revokes a single API token by id. Same bearer-...
```