@backifydev/cli 0.3.8 → 0.3.9

package/README.md

@@ -257,7 +257,9 @@ npx @backifydev/cli pull
 npx @backifydev/cli ship
 ```
 
-`login` opens the Backify portal in your browser. Sign in and select an organization; the portal returns the organization and access token to the CLI through a random, short-lived callback bound to `127.0.0.1`. The CLI stores them in `~/.backify.json`. Set `portalUrl` in that file to use another portal, or `BACKIFY_PORTAL_URL` in the environment. `login <token> [organizationId]` remains available for scripted development.
+`login` in an application folder, or `connect --reauth`, opens `https://auth.backify.dev` for sign-in and explicit CLI approval. Choose 7, 14, 30, or 90 days; after approval the CLI saves an application-scoped credential in `~/.backify.json` and continues automatically. The browser can then be closed. No copied setup prompt or pasted credential is required. `login` outside an application retains general sign-in for later connection. Set `BACKIFY_AUTH_URL` for a different authorization host (HTTPS, or loopback HTTP for local development); legacy `BACKIFY_PORTAL_URL` and `portalUrl` configuration remain supported. `login <token> [organizationId]` remains available for scripted development.
+
+Authenticated application commands recover automatically from a known expired credential or an API 401: they open browser approval, replace the saved application credential, and retry the rejected request once. Permission errors (403), network failures, and service errors do not trigger sign-in or write retries. Use `--no-browser` for unattended work. With `--json`, authentication failures include `code: "authentication_required"` and `reauthenticationCommand: "backify connect --reauth"`. A coding agent should ask its user to sign in before starting explicit recovery. The callback accepts only the selected authorization origin and matching random state/application/organization, is bound to `127.0.0.1`, and closes after approval or a five-minute timeout. Browser local-network access may need approval. A remotely hosted or headless coding tool needs a browser on the CLI host that can reach this loopback listener; this flow does not add remote device-code authentication.
 
 `init` installs `@backifydev/sdk`, writes `backify.json` and `BACKIFY.md`, and maintains only the selected coding tool's Backify block. Use `--agent codex` (`AGENTS.md`), `--agent claude` (`CLAUDE.md`), `--agent copilot` (`.github/copilot-instructions.md`), or `--agent gemini` (`GEMINI.md`). The CLI remembers the selection for `init`, `sync`, and `doctor`; new projects default to Codex. For any other tool, pass `--instruction-file <relative-path>` to use its native instruction or rule file, including nested paths; this is remembered too. It preserves other instructions and does not create or modify other tools' files.