@backifydev/cli 0.3.7 → 0.3.9

package/README.md

@@ -257,7 +257,9 @@ npx @backifydev/cli pull
 npx @backifydev/cli ship
 ```
 
-`login` opens the Backify portal in your browser. Sign in and select an organization; the portal returns the organization and access token to the CLI through a random, short-lived callback bound to `127.0.0.1`. The CLI stores them in `~/.backify.json`. Set `portalUrl` in that file to use another portal, or `BACKIFY_PORTAL_URL` in the environment. `login <token> [organizationId]` remains available for scripted development.
+`login` in an application folder, or `connect --reauth`, opens `https://auth.backify.dev` for sign-in and explicit CLI approval. Choose 7, 14, 30, or 90 days; after approval the CLI saves an application-scoped credential in `~/.backify.json` and continues automatically. The browser can then be closed. No copied setup prompt or pasted credential is required. `login` outside an application retains general sign-in for later connection. Set `BACKIFY_AUTH_URL` for a different authorization host (HTTPS, or loopback HTTP for local development); legacy `BACKIFY_PORTAL_URL` and `portalUrl` configuration remain supported. `login <token> [organizationId]` remains available for scripted development.
+
+Authenticated application commands recover automatically from a known expired credential or an API 401: they open browser approval, replace the saved application credential, and retry the rejected request once. Permission errors (403), network failures, and service errors do not trigger sign-in or write retries. Use `--no-browser` for unattended work. With `--json`, authentication failures include `code: "authentication_required"` and `reauthenticationCommand: "backify connect --reauth"`. A coding agent should ask its user to sign in before starting explicit recovery. The callback accepts only the selected authorization origin and matching random state/application/organization, is bound to `127.0.0.1`, and closes after approval or a five-minute timeout. Browser local-network access may need approval. A remotely hosted or headless coding tool needs a browser on the CLI host that can reach this loopback listener; this flow does not add remote device-code authentication.
 
 `init` installs `@backifydev/sdk`, writes `backify.json` and `BACKIFY.md`, and maintains only the selected coding tool's Backify block. Use `--agent codex` (`AGENTS.md`), `--agent claude` (`CLAUDE.md`), `--agent copilot` (`.github/copilot-instructions.md`), or `--agent gemini` (`GEMINI.md`). The CLI remembers the selection for `init`, `sync`, and `doctor`; new projects default to Codex. For any other tool, pass `--instruction-file <relative-path>` to use its native instruction or rule file, including nested paths; this is remembered too. It preserves other instructions and does not create or modify other tools' files.
 
@@ -276,3 +278,5 @@ Copy the application AI prompt in Backify to receive the application ID, organiz
 `ship` runs configured checks, verifies the repository/branch, and pushes already-committed source using a short-lived repository-scoped GitHub App credential. It never stages, commits, force-pushes, or fabricates preview testing. It waits for the exact healthy preview, then publishes when policy and permissions allow. Required testing/approval returns a pending state and preview URL, not a false successful production deployment. Use `--preview-only` to stop at preview, or `--timeout <seconds>` to change the default 1200-second wait. Applications must currently be at the repository root; Backify Cloud needs static index.html output, and customer Azure needs a Dockerfile serving port 8080.
 
 `disconnect` revokes that user's application CLI sessions. `logout` removes local credentials only. Prompt histories and local reports remain subject to application permissions. Deploy the matching API and publish CLI 0.3.0 before enabling this flow in production.
+
+Connections now report the device hostname, operating system, architecture, and installed CLI version. Browser-based `connect` exchanges a general sign-in token for an application-scoped device session. Application **People & access → CLI access** shows these sessions and lets access managers revoke individual devices; source managers can revoke their own. Existing connections may need reconnecting to record device details. See [CLI access and country lookup configuration](../../docs/cli-access.md) for privacy, permissions and deployment requirements.