@hyperscale0/cli 1.0.385 → 1.0.386

package/AGENTS.md

@@ -47,21 +47,26 @@ The login creates a named agent member with its own CLI grant. In sandbox
 it acts as the founder, `--on-behalf-of` included; `whoami` shows the
 founder's team role. The grant ends after 30 days, or 7 days unused, and so do
 sandbox keys `key create --name <name>` makes from it. `doctor` names where the
-token is stored. Access
-tokens last ten minutes; the CLI rotates the refresh token and keeps both in
+token is stored. The
+login's access token lasts an hour and ends with `device_login_expired`; the
+CLI rotates the refresh token and keeps both in
 Keychain or a mode 0600 file. Logout removes them locally. Revoke the member or
 grant in the browser; `--revoke` only revokes a human PAT. Sandbox work within
 the grant runs directly. A live action exits 3 with `agent_approval_required`
 and a browser link; a human approves it with their password. A grant with
 money caps runs live calls inside them; a call over a cap exits 3 with
-`agent_cap_exceeded` and the same link. The CLI cannot approve its own work.
+`agent_cap_exceeded`, the same link and a `cliCommand`. The founder decides
+either from the browser or with `agent approvals approve|decline <id>`, whose
+approve asks for the password; an agent token cannot call either.
 
 `agent setup [claude-code|codex|cursor]` uses the founder's CLI login to mint
 a named, sandbox-only agent credential (`agent_grant.create`). It keeps the
 token in the login's store, writes the host's MCP entry with
 `HYPERSCALE_TOKEN` as the bearer variable, and installs the skill into the
 host's skills folder. `--name` names the agent member, so two projects can
-each keep their own. `agent token [host] [--name <name>] [--dir <path>]`
+each keep their own. A rerun keeps a working stored token and changes the
+grant in place; `--rotate` mints a new one. `agent caps` changes the money
+caps through `agent_grant.caps.set` and keeps the token. `agent token [host] [--name <name>] [--dir <path>]`
 prints the stored token so the shell can export it as `HYPERSCALE_TOKEN`; MCP
 and the CLI then use the same door. With no `--name`, it reads the agent set
 up for the directory, then the host's default name.