@finchtech/cli 0.1.0 → 0.2.1

package/README.md

@@ -4,11 +4,11 @@ Install the public npm package with `npm install -g @finchtech/cli`, then run `f
 
 The Finch Agent CLI stores wallet keys, AgentCLI Session bearers, and MCP grant bearers only in an owner-only `FINCHTECH_HOME`, which defaults to `~/.finchtech`; secrets are never accepted as command arguments or emitted to stdout.
 
-The command groups are `wallet`, `login/status/logout`, `site`, `mcp doctor`, `mcp launch`, `mcp grant`, `creator`, `credentials`, `intent`, `operation show`, `purchase`, `task`, and `skill`. Run `finch --help` for the exact command list as one JSON value.
+The command groups are `wallet`, `login/status/logout`, `site`, `mcp doctor`, `mcp authorize`, `mcp grant`, `creator`, `credentials`, `intent`, `operation show`, `purchase`, `task`, and `skill`. Run `finch --help` for the exact command list as one JSON value.
 
 `finch site open` creates a sixty-second one-use handoff from the active AgentCLI Session and opens the exact configured Finch origin in the local default Browser. `finch site login <REQUEST_URL>` binds a website-created five-minute request once, then opens the same confirmation page. Both commands require the wallet, CLI, and graphical Browser on the user's machine. A launch failure returns `BROWSER_OPEN_FAILED` without printing the secret completion URL. The Browser receives only a normal seven-day Finch Web Session; wallet signing, broadcast, and market confirmation remain local CLI actions.
 
-`finch mcp doctor` is read-only. It verifies that the active CLI authority, AgentCLI Session, local wallet, MCP challenge, and source-controlled handoff manifest agree. `finch mcp launch codex` then reuses or creates an ordinary Finch MCP grant parented to that Session and starts a new Codex process. The grant bearer exists only in that child process environment; it is never printed, put in argv, or written to Codex credential files. No separate browser OAuth step is required. A new Codex process is required because an already-running Harness cannot inherit a newly created child environment.
+`finch mcp doctor` is read-only. It verifies that the active CLI authority, AgentCLI Session, local wallet, MCP challenge, OAuth metadata, and source-controlled persistent-Harness manifest agree. The Agent Harness owns Remote MCP configuration, OAuth credentials, and refresh; the CLI does not configure or launch Codex and never reads Harness OAuth material. During the Harness's native OAuth flow, the authorization page supplies the exact `finch mcp authorize <REQUEST_URL>` command. That command uses only the active local AgentCLI Session, verifies the callback against the registered redirect and state, and opens it without returning its one-use code. It never uses a Browser Session, Social account, or extension wallet as Agent authority. Configure `https://www.finchtech.ai/mcp` once through the Harness, then use MCP `identity_actor_get` together with `finch status` to verify exact Account, wallet, and environment alignment before custody.
 
 Ordinary installs require no profile file or environment selection. Network commands use the reviewed built-in PROD authority at `https://www.finchtech.ai` and its source-controlled mainnet deployments. The public command tree has no profile, environment, origin, or chain selector, and conflicting local deployment state fails closed. `intent approve` signs only the shared publication-v2 or Local-purchase-v1 EIP-712 authorization; it cannot sign arbitrary transaction calldata.