team revoke

Removes the grant or one external delegate from the current team file, or ends a standing grant. An absent target is a successful no-op. Removing the last delegate removes the delegates section.

Synopsis

team revoke grant [--dry-run] [--json]
team revoke delegate <session/pane> [--dry-run] [--json]
team revoke <name> [--dry-run] [--json]

The delegate target is exact. There is no wildcard or revoke-all form. The bare <name> form revokes a standing grant only when a record with that name exists; any other word is the invocation error.

Who may run it

Only the owner, from a terminal outside herdr, in every form. An agent, seat, delegate or caller without a terminal is refused before the team file is read. Existing grant or delegate authority cannot authorize this command, and no mode waives the gate; --dry-run has the same owner requirement.

What it changes

grant and delegate write only the selected top-level section, preserving other delegates and unrelated text. An invalid file, malformed target, linked file or concurrent file change is refused. --dry-run validates the removal without writing.

A bare <name> appends a signed revocation record naming that standing grant's file name and generation — the pair that identifies the record — into the grants folder in the owner's home; the grant file itself is never edited. The revocation takes effect at the next gate check, and never restores an older record: a later grant under the same name is a new record this revocation does not touch. Revoking a team grant that carries the dialogs.trust setting turns trust answering off at the next dialog. A record already revoked is an unchanged no-op. A revocation is always its own file: a record name that is the grant's own, or another grant's stem, is refused before anything is written, so a revocation never overwrites a grant.

Removal withdraws the named record only. Another independent grant, delegate or intrinsic lead capability can still authorize an operation. The next admission check reads the live file and the records that remain; an older record does not restore the removed one. Existing runtime requirements still apply. Running seats stay running.

Output and exit codes

--help and -h show usage and exit 0. See team grant and team delegate for creating records.