[FEATURE] OAuth tokens should be revoked server-side on claude logout and on devcontainer shutdown to support secure workflows

Preflight Checklist

• [x] I have searched existing requests and this feature hasn't been requested yet
• [x] This is a single feature request (not multiple features)

Problem Statement

When using Claude Code in devcontainers for security reasons (no host mounts), a new OAuth token is issued on every container creation. Currently, neither claude logout nor closing a devcontainer in VS Code revokes the token server-side. Local credentials (~/.claude/.credentials.json or macOS Keychain via VS Code extension) are removed or abandoned, but the server-side token remains valid for up to 4 days.
Additionally, the VS Code extension and CLI store credentials in different locations (VS Code secret storage / macOS Keychain vs ~/.claude/.credentials.json), meaning a claude logout in the terminal does not necessarily affect the token held by the VS Code extension, and vice versa.
The only current workaround is to manually visit claude.ai/settings/claude-code and revoke tokens one by one — which is impractical for frequent devcontainer workflows.
As a result, orphaned valid tokens accumulate server-side with each container lifecycle, which is a security concern.

Proposed Solution

claude logout should call Anthropic's token revocation endpoint server-side, immediately invalidating the token

Closing a devcontainer in VS Code (or any container shutdown event) should also trigger server-side token revocation for any tokens associated with that session

The CLI and VS Code extension should share a unified logout mechanism so that logging out from either invalidates all associated tokens

A scriptable revocation mechanism should be provided so that devcontainer shutdown hooks can automate this process

Alternative Solutions

_No response_

Priority

High - Significant impact on productivity

Feature Category

CLI commands and flags

Use Case Example

_No response_

Additional Context

_No response_