@ariobarin/glossa 0.1.0-beta.8 → 0.1.0

package/README.md

@@ -1,21 +1,42 @@
 # @ariobarin/glossa
 
-This package contains the `glossa` executable. Node 24 is required. Install the open beta from npm:
+The `glossa` CLI connects one project on your computer to the Glossa MCP relay through an authenticated outbound worker. The npm package supports Windows, macOS, and Linux and requires Node.js 22.9 or newer.
 
-```powershell
-npm install --global @ariobarin/glossa@beta
-Set-Location C:\path\to\a\repository
+```shell
+npm install --global @ariobarin/glossa
+```
+
+Start it in the project you want ChatGPT to use:
+
+```shell
 glossa
 ```
 
-Glossa opens Google sign-in automatically when needed using OAuth Device Authorization Flow. Public client and resource identifiers are built in, so testers do not configure OAuth values. Use the same Google account when authorizing Glossa in ChatGPT.
+## Access profiles
+
+| Profile | Read files | Edit files inside the project | Run commands |
+| --- | --- | --- | --- |
+| `read-only` | Yes | No | No |
+| `workspace` (default) | Yes | Yes | No |
+| `system` | Yes | Yes | Yes |
 
-OAuth and device credentials use the operating-system credential store. If it is unavailable, Glossa warns before using a restricted credential file.
+Use `glossa --access read-only` for inspection. Use `glossa --access system` only when the task needs local tests, builds, Git, or another project command.
 
-The first managed session enrolls the computer under its hostname. Running `glossa` inside a Git worktree exposes only that worktree root. `glossa start .` is the explicit form. Each process registers an independent workspace, so the same computer may expose several workspaces at once. The process prints the canonical root, connection state, shell authority warning, and write or command activity. Press Ctrl+C to disconnect.
+> **`system` is not sandboxed.** Commands inherit the full environment, credentials, filesystem permissions, and network access of the operating-system account that started Glossa. They are not confined to the selected root.
 
-Glossa signs in automatically whenever an authenticated command needs an account. `glossa login` is an optional preflight. `glossa status` validates the session and relay, then reports enrolled devices and active workers. Use `glossa devices list`, `glossa devices rename <id> <name>`, and `glossa devices revoke <id>` to manage enrolled computers.
+Expose only a narrow project you trust. Keep credentials and regulated or sensitive data out of the workspace. Review the [security overview](https://glossa.sh/security) before enabling commands.
 
-The managed endpoint defaults to `https://mcp.glossa.sh`. Development deployments may override `GLOSSA_RELAY_ORIGIN` and `GLOSSA_WORKER_ORIGIN`. Plain HTTP is accepted only for loopback relay origins and loopback or private IPv4 worker origins.
+Pass a directory to expose another project, and add `--label <name>` when several online workspaces need a non-sensitive identifier. The terminal shows the selected project, access profile, connection state, and recent activity. Press `q` or Ctrl+C to disconnect.
+
+Glossa opens sign-in when needed. Use the same Glossa account in ChatGPT and the CLI.
+
+Useful controls:
+
+```shell
+glossa status
+glossa devices revoke <id>
+glossa logout
+glossa update --check
+```
 
-Run `glossa logout` to remove the CLI's local OAuth credentials. Running workers remain connected until stopped or revoked. Run `glossa logout --browser` before switching Google accounts so the next Glossa authorization does not silently reuse the previous browser session.
+See the [quickstart](https://glossa.sh/docs/quickstart), [operations guide](https://github.com/ariobarin/glossa/blob/main/docs/operations.md), and [security overview](https://glossa.sh/security).