@learnaltitude/cli 0.1.0 → 0.2.0

package/README.md

@@ -11,3 +11,42 @@ npm install -g @learnaltitude/cli
 
 Pair the CLI with your account at [app.learnaltitude.com](https://app.learnaltitude.com).
 Supported agents are Claude Code and Codex.
+
+## Copied skills installs and updates
+
+Claude Code marketplace installs remain the recommended Claude path and update through that
+marketplace. For Codex or a manual Claude Code copy, install the public skills through the target
+declaration shipped by the relevant adapter:
+
+```sh
+altitude skills install --adapter-config /path/to/adapter/skills-install.json
+```
+
+The first install remembers the resolved target in the CLI data directory (by default,
+`~/.altitude/skills-manifest.json`), including the exact `jasonku09/altitude-skills` commit and a
+SHA-256 content hash for every managed file. Later updates need no adapter flag:
+
+```sh
+altitude update
+```
+
+Use `--ref <commit-sha>` with either command to pin or roll back to a particular public-repository
+commit. Updates change only manifest-managed files plus new upstream paths; unrelated skills in a
+shared target are left alone, while managed files removed upstream are removed locally. An edited
+managed file or colliding pre-CLI copy is backed up in the CLI data directory (by default,
+`~/.altitude/skills-backups/`) before the upstream version replaces or removes it. Backups never
+live in an agent skills directory. If no copied install is configured, the skills step is an
+informative no-op because marketplace or plugin-managed skills update through the agent.
+After the skills step completes or is skipped, `altitude update` asks the detected global package
+manager to update `@learnaltitude/cli`; if detection or execution fails, it prints the exact manual
+command instead. A genuine copied-skills sync failure stops before the CLI self-update.
+
+## Network disclosure
+
+The distributed client uses the user's own agent subscription and no Altitude-held API key.
+Interactive `connect`, `diagnostics`, and `update` commands make anonymous, direct version checks
+to GitHub (the public skills repository's `main` commit) and the npm registry (the CLI's latest
+version). Results are cached in the CLI data directory for about 24 hours. Skills downloads also
+come directly from GitHub. These requests do not pass through the Altitude service and carry no
+Altitude credentials. Hooks, gates, queue flushers, and other non-interactive paths never perform
+the version check; all check failures are silent and cannot change a command's exit code.