@hydra-acp/cli 0.1.179 → 0.1.181

package/README.md

@@ -411,6 +411,15 @@ hydra-acp agent log <id> [-f] [-n N]       # tail or follow an agent's spawn/std
 hydra-acp registry pin | unpin             # freeze the daemon on its cached registry, or
                                            # resume normal TTL fetching
 
+hydra-acp remote add <name> <host[:port]> [--label <text>]
+                                           # federate with a peer daemon under a local name
+                                           # (prompts for its password; matches `git remote add`).
+                                           # TOFU-pins the peer's TLS cert on first trust; re-running
+                                           # this before the token expires refreshes it without
+                                           # re-prompting for the cert
+hydra-acp remote [list]                    # list federated peer daemons
+hydra-acp remote remove <name>             # un-federate a peer daemon and revoke its token
+
 hydra-acp config [list] [<dotted.key>]     # print effective config (or one subtree) as JSON
 hydra-acp config get <dotted.key>          # print one effective value (e.g. tui.mouse)
 hydra-acp config set <dotted.key> <value>  # persist a value, validated against the schema
@@ -939,6 +948,8 @@ The daemon exposes a process-management surface. Treat the service token like an
 
 The service token (stored at `~/.hydra-acp/auth-token`, mode 0600) is generated on `hydra-acp init` and required as `Authorization: Bearer <token>` for every REST call and as a WebSocket subprotocol or query parameter for `wss://.../acp`. The token never leaves `~/.hydra-acp/`.
 
+> **Windows:** mode 0600 is not enforcement there. Windows derives file access from ACLs, and Node's `chmod` only toggles the read-only bit, so `auth-token` (along with `config.json`, `peers.json`, `remotes.json`, and the session records) inherits whatever the parent directory grants. On a machine with more than one interactive user, restrict `%USERPROFILE%\.hydra-acp` yourself, e.g. `icacls "%USERPROFILE%\.hydra-acp" /inheritance:r /grant:r "%USERNAME%:(OI)(CI)F"`.
+
 For remote access (binding to a non-loopback address), enable TLS via:
 
 ```json