@hyperscale0/cli 1.0.246 → 1.0.248

package/AGENTS.md

@@ -21,14 +21,23 @@ help       command tree
 Start with `hyperscale auth login --no-open --json`. The URL and code go to
 stderr. A person approves them in the browser. Rerun to resume a pending login.
 Verify with `hyperscale whoami --json`. Signup uses `auth signup --email <email>
---name <name> --company <company>`. Logout removes the local token; `--revoke`
-revokes it too. Do not print or persist credentials in project files.
+--name <name> --company <company>`. Do not print or persist credentials in
+project files.
+
+Browser login creates a named agent member with its own CLI grant. Access
+tokens last ten minutes; the CLI rotates the refresh token and keeps both in
+Keychain or a mode 0600 file. Logout removes them locally. Revoke the member or
+grant in the browser; `--revoke` only revokes a human PAT. Sandbox work within
+the grant runs directly. A live action exits 3 with `agent_approval_required`
+and a browser link; a human approves it with their password. The CLI cannot
+approve its own work.
 
 Every command accepts `--json`. Ordinary success is one JSON value on stdout;
 failure is an error object on stderr. Errors retain status, code, message,
 fix, details and available request, operation, receipt and trace IDs.
 JSON output has no ANSI codes, banners, spinners or prompts.
-Exit codes: 0 success, 1 failure, 2 HSX check or plan cannot proceed.
+Exit codes: 0 success, 1 failure, 2 HSX check or plan cannot proceed,
+3 live action waiting for human approval.
 
 `hsx watch --json` emits one JSON object per line with `type` set to `check`,
 `plan` or `error`. Check and plan events contain `data`; errors contain `error`.