@ariobarin/glossa 0.1.0-beta.9 → 0.1.0

package/README.md

@@ -1,40 +1,42 @@
 # @ariobarin/glossa
 
-This package contains the `glossa` executable. Node.js 22.9 or newer is required.
-Install the open beta with either the hosted installer:
+The `glossa` CLI connects one project on your computer to the Glossa MCP relay through an authenticated outbound worker. The npm package supports Windows, macOS, and Linux and requires Node.js 22.9 or newer.
 
-```powershell
-irm https://glossa.sh/install | iex
+```shell
+npm install --global @ariobarin/glossa
 ```
 
-Or install directly from npm:
+Start it in the project you want ChatGPT to use:
 
-```powershell
-npm install --global @ariobarin/glossa@beta
+```shell
+glossa
 ```
 
-Then choose a recognizable name during this computer's first enrollment:
+## Access profiles
 
-```powershell
-Set-Location C:\path\to\a\repository
-glossa --device-name "my-workstation" .
-```
-
-The hosted command runs the tracked installer at `site/install.ps1`. Use
-`glossa update` or its `glossa upgrade` alias to update the global beta later.
+| Profile | Read files | Edit files inside the project | Run commands |
+| --- | --- | --- | --- |
+| `read-only` | Yes | No | No |
+| `workspace` (default) | Yes | Yes | No |
+| `system` | Yes | Yes | Yes |
 
-Glossa opens Google sign-in automatically when needed using OAuth Device Authorization Flow. Public client and resource identifiers are built in, so testers do not configure OAuth values. Use the same Google account when authorizing Glossa in ChatGPT.
+Use `glossa --access read-only` for inspection. Use `glossa --access system` only when the task needs local tests, builds, Git, or another project command.
 
-OAuth and device credentials use the operating-system credential store. If it is unavailable, Glossa warns before using a restricted credential file.
+> **`system` is not sandboxed.** Commands inherit the full environment, credentials, filesystem permissions, and network access of the operating-system account that started Glossa. They are not confined to the selected root.
 
-`--device-name` is used only during initial enrollment. Later starts reuse the enrolled name; use `glossa devices rename <id> <name>` to change it. Without the option, the first managed session enrolls the computer under its hostname. Running `glossa` inside a Git worktree exposes only that worktree root. `glossa start .` is the explicit form. Each process registers an independent workspace, so the same computer may expose several workspaces at once. The process prints the canonical root, connection state, shell authority warning, and write or command activity. Press Ctrl+C to disconnect.
+Expose only a narrow project you trust. Keep credentials and regulated or sensitive data out of the workspace. Review the [security overview](https://glossa.sh/security) before enabling commands.
 
-The experimental `glossa ui .` command opens a compact live session HUD and immediately exposes the selected workspace. Press `d` for recent activity, `?` for help, and `q` to disconnect. The screen keeps the worker-account authority warning visible.
+Pass a directory to expose another project, and add `--label <name>` when several online workspaces need a non-sensitive identifier. The terminal shows the selected project, access profile, connection state, and recent activity. Press `q` or Ctrl+C to disconnect.
 
-Glossa signs in automatically whenever an authenticated command needs an account. `glossa login` is an optional preflight. `glossa status` validates the session and relay, then reports enrolled devices and active workers. `glossa doctor` performs a read-only readiness check, including the local device credential, and supports `--json`. Use `glossa devices list`, `glossa devices rename <id> <name>`, and `glossa devices revoke <id>` to manage enrolled computers.
+Glossa opens sign-in when needed. Use the same Glossa account in ChatGPT and the CLI.
 
-Generate shell completion with `glossa completions <powershell|bash|zsh|fish>` and source the output from your shell profile. For example, use `glossa completions powershell | Out-String | Invoke-Expression` in PowerShell, `source <(glossa completions bash)` in Bash, `source <(glossa completions zsh)` after `compinit` in Zsh, or `glossa completions fish | source` in Fish.
+Useful controls:
 
-The managed endpoint defaults to `https://mcp.glossa.sh`. Development deployments may override `GLOSSA_RELAY_ORIGIN` and `GLOSSA_WORKER_ORIGIN`. Plain HTTP is accepted only for loopback relay origins and loopback or private IPv4 worker origins.
+```shell
+glossa status
+glossa devices revoke <id>
+glossa logout
+glossa update --check
+```
 
-Run `glossa logout` to remove the CLI's local OAuth credentials. Running workers remain connected until stopped or revoked. Run `glossa logout --browser` before switching Google accounts so the next Glossa authorization does not silently reuse the previous browser session.
+See the [quickstart](https://glossa.sh/docs/quickstart), [operations guide](https://github.com/ariobarin/glossa/blob/main/docs/operations.md), and [security overview](https://glossa.sh/security).