Token cache not invalidated after `gws auth login` to a different account

Start in the auth login command path and trace where ~/.config/gws/credentials.enc and ~/.config/gws/token_cache.json are written or read. Reproduce by logging in as two accounts and running gws auth status plus a Gmail or Drive request; done means switching accounts no longer uses the first account's token without manually deleting the cache.

Bug

After running gws auth login to authenticate with a different Google account than the previously logged-in one, ~/.config/gws/credentials.enc is correctly overwritten with the new account's credentials, but ~/.config/gws/token_cache.json retains the old account's access token.

This causes all subsequent API calls to use the old account's token (until it expires ~1h later), even though gws auth status reports the new account as active.

Repro

# Account 1
gws auth login   # browser → select account-A@example.com
gws auth status  # user: account-A@example.com  ✓
gws gmail users getProfile --params '{"userId":"me"}'  # emailAddress: account-A@example.com  ✓

# Account 2 (re-login)
gws auth login   # browser → select account-B@example.com
gws auth status  # user: account-B@example.com  ✓ (correct)
gws gmail users getProfile --params '{"userId":"me"}'  # emailAddress: account-A@example.com  ✗ (still old account!)
gws drive files list --params '{"pageSize":3}'  # owners: account-A@example.com  ✗

# Workaround: manually clear the token cache
rm ~/.config/gws/token_cache.json
gws gmail users getProfile --params '{"userId":"me"}'  # emailAddress: account-B@example.com  ✓

Expected

gws auth login should invalidate (or remove) ~/.config/gws/token_cache.json whenever the encrypted credentials in credentials.enc change to a different account. Otherwise the cached access token from the previous account masks the new credentials until it expires.

Environment

• gws version: 0.22.5
• macOS 26.4.1 (arm64, Apple Silicon)
• Install: Homebrew (brew install googleworkspace-cli)
• Keyring backend: keyring (default macOS Keychain)

Suggested fix

In the auth login command path, after writing credentials.enc, either:

1. Remove token_cache.json if it exists, OR
2. Compare the new account email against the cached token's identity and invalidate the cache on mismatch.

Side note (related but separate)

While we're here — multi-account workflow appears unsupported in 0.22.5:

• gws auth login has no --account flag
• gws auth list does not exist
• gws --account <email> flag mentioned in some docs/runbooks isn't recognized

The current model is single-credential (one account at a time, with re-login required to switch). If multi-account is on the roadmap, this token-cache bug should be fixed regardless, since the single-credential workflow itself stumbles on it.

Contact

Filed by gabor.kosa@tewelon.at — happy to provide further repro details or test patches.