@linzumi/cli 0.0.9-beta → 0.0.11-beta

package/README.md

@@ -1,64 +1,86 @@
 # Linzumi CLI
 
-Connect your computer to Kandan so you can run Codex locally from the browser.
+Run an AI coding session on the code that is already on your computer, then
+open the editor and app preview from a shared browser workspace.
 
-Linzumi gives Kandan a secure, authenticated bridge to your own machine. You
-keep the code, shells, editors, and preview servers local. Kandan gives you the
-web UI, sharing controls, HTTPS editor access, forwarded previews, and Codex
-session orchestration.
+Linzumi is for the common team workflow that is still too painful:
 
-## Copy And Paste
+- your branch is only on your laptop
+- your app only runs with your local setup, secrets, database, or devices
+- you want an AI agent to read, edit, run, and explain that code
+- you want a teammate to see the editor or preview without cloning the repo
+- you do not want to move the project into a cloud VM just to collaborate
 
-Use a Chromium-based browser such as Chrome, Edge, Arc, or Brave.
+The CLI connects your machine to Kandan, Linzumi's shared browser workspace.
+Your code, terminal commands, dev servers, and editor runtime stay local. Kandan
+handles sign-in, sharing, HTTPS browser access, and permission checks.
+
+## Try It
+
+Use Chrome, Edge, Arc, Brave, or another Chromium-based browser.
 
 ```bash
-npm install -g @linzumi/cli@beta && linzumi start ~/code
+npm install -g @linzumi/cli@beta
+linzumi start ~/code/my-app
 ```
 
-To pin this exact beta:
+Then in the browser:
+
+```text
+Explain this project, open the editor, and tell me how to run it.
+```
+
+If the project has a dev server, start it locally:
 
 ```bash
-npm install -g @linzumi/cli@0.0.9-beta && linzumi start ~/code
+npm run dev
 ```
 
-Use a different folder if your projects live somewhere else:
+Open the forwarded preview from Kandan. You should get a normal HTTPS URL that
+you can share with an approved teammate, without exposing a raw `localhost`
+address.
+
+To pin this exact beta:
 
 ```bash
-npm install -g @linzumi/cli@beta && linzumi start ~/work/my-app
+npm install -g @linzumi/cli@0.0.11-beta
+linzumi start ~/code/my-app
 ```
 
-That command opens Kandan, walks you through signup or sign-in, connects this
-computer, and lets Kandan start Codex against the folder you chose.
+## What You Get
 
-## What You Can Do
+Linzumi turns your local project into a shared coding workspace:
 
-After `linzumi start` is connected, try this from Kandan:
+1. Codex can inspect and edit the folder you allowed.
+2. You can open a browser editor for that local folder.
+3. Local app previews are reachable through Kandan HTTPS URLs.
+4. Approved teammates can join the editor or preview.
+5. Kandan enforces auth, sharing grants, and allowed-port policy.
 
-1. Start a Codex session.
-2. Ask Codex to inspect or edit a file in the folder you allowed.
-3. Open the local editor from Kandan.
-4. Start a dev server locally, then open its forwarded preview from Kandan.
-5. Share editor or preview access with another user.
+The important part: your project does not have to leave your computer for this
+to work.
 
-The editor and previews open on Kandan HTTPS URLs. They should not expose
-`localhost` URLs to the browser.
+## What Runs Where
 
-## What Linzumi Runs Locally
+On your computer, the CLI starts a runner. The runner can:
 
-The CLI starts a local runner process on your computer. That runner:
+- launch or connect to Codex
+- download the Kandan-approved editor runtime
+- start code-server for the folder you chose
+- connect to explicitly approved local ports
+- stream editor and preview traffic through Kandan
 
-- launches or connects to Codex locally
-- downloads the Kandan-approved editor runtime when needed
-- starts code-server for the allowed folder
-- exposes only explicitly approved local ports through Kandan
-- keeps Kandan auth cookies and bearer tokens away from local services
+In the browser, Kandan provides:
 
-Kandan remains the control plane. Browser traffic terminates at Kandan first,
-where auth, grants, and allowed-port policy are enforced before traffic is sent
-through the runner tunnel.
+- sign-in and workspace UI
+- local-runner status
+- editor and preview links
+- sharing controls
+- HTTPS termination
+- access checks before traffic reaches your machine
 
-In the local-service hop, `127.0.0.1` means your computer, not the Kandan
-server.
+When docs mention `127.0.0.1` or `localhost` on the local-service hop, that
+means your computer, not the Kandan server.
 
 ## Requirements
 
@@ -85,7 +107,7 @@ collaboration behavior.
 ## First Run
 
 ```bash
-linzumi start ~/code
+linzumi start ~/code/my-app
 ```
 
 What happens:
@@ -110,33 +132,35 @@ readiness after that runtime is verified locally.
 
 ## Good Things To Try
 
-Start from a real project:
+Ask Codex to map the project:
 
-```bash
-linzumi start ~/code/my-app
+```text
+What does this app do? Where should I start reading?
 ```
 
-Then in Kandan:
+Ask Codex to make a small change:
 
 ```text
-Summarize this repository and tell me how to run it locally.
+Find the main settings page and add a clear empty state.
 ```
 
-If your app starts a dev server:
+Open the editor from Kandan and inspect the changed files.
+
+Start a local dev server:
 
 ```bash
 npm run dev
 ```
 
-Open the detected forwarded port from Kandan. If a port is not auto-detected,
-restart with an explicit approved port:
+If a port is not auto-detected, restart with an explicit approved port:
 
 ```bash
 linzumi start ~/code/my-app --forward-port 3000
 ```
 
-For a shared editor test, invite another user, open the local editor, and edit
-the same file. Chromium should show remote cursor labels and selections.
+For a collaboration test, invite another user, open the same file in the local
+editor, and type in Chromium. Remote cursor labels and selections should be
+visible.
 
 ## Hosted Kandan
 
@@ -223,7 +247,7 @@ linzumi --version
 Expected:
 
 ```text
-linzumi 0.0.9-beta
+linzumi 0.0.11-beta
 ```
 
 If `linzumi` is not found, your global npm bin directory is not on `PATH`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@linzumi/cli",
-  "version": "0.0.9-beta",
+  "version": "0.0.11-beta",
   "description": "Connect your computer to Kandan for local Codex sessions, editors, and forwarded previews",
   "type": "module",
   "bin": {
@@ -29,5 +29,5 @@
     "node": ">=20",
     "bun": ">=1.2.0"
   },
-  "readme": "# Linzumi CLI\n\nConnect your computer to Kandan so you can run Codex locally from the browser.\n\nLinzumi gives Kandan a secure, authenticated bridge to your own machine. You\nkeep the code, shells, editors, and preview servers local. Kandan gives you the\nweb UI, sharing controls, HTTPS editor access, forwarded previews, and Codex\nsession orchestration.\n\n## Copy And Paste\n\nUse a Chromium-based browser such as Chrome, Edge, Arc, or Brave.\n\n```bash\nnpm install -g @linzumi/cli@beta && linzumi start ~/code\n```\n\nTo pin this exact beta:\n\n```bash\nnpm install -g @linzumi/cli@0.0.9-beta && linzumi start ~/code\n```\n\nUse a different folder if your projects live somewhere else:\n\n```bash\nnpm install -g @linzumi/cli@beta && linzumi start ~/work/my-app\n```\n\nThat command opens Kandan, walks you through signup or sign-in, connects this\ncomputer, and lets Kandan start Codex against the folder you chose.\n\n## What You Can Do\n\nAfter `linzumi start` is connected, try this from Kandan:\n\n1. Start a Codex session.\n2. Ask Codex to inspect or edit a file in the folder you allowed.\n3. Open the local editor from Kandan.\n4. Start a dev server locally, then open its forwarded preview from Kandan.\n5. Share editor or preview access with another user.\n\nThe editor and previews open on Kandan HTTPS URLs. They should not expose\n`localhost` URLs to the browser.\n\n## What Linzumi Runs Locally\n\nThe CLI starts a local runner process on your computer. That runner:\n\n- launches or connects to Codex locally\n- downloads the Kandan-approved editor runtime when needed\n- starts code-server for the allowed folder\n- exposes only explicitly approved local ports through Kandan\n- keeps Kandan auth cookies and bearer tokens away from local services\n\nKandan remains the control plane. Browser traffic terminates at Kandan first,\nwhere auth, grants, and allowed-port policy are enforced before traffic is sent\nthrough the runner tunnel.\n\nIn the local-service hop, `127.0.0.1` means your computer, not the Kandan\nserver.\n\n## Requirements\n\nInstall these before running the beta:\n\n```bash\nnode --version\nnpm --version\nbun --version\ncodex --version\n```\n\nExpected:\n\n- Node.js 20 or newer\n- npm\n- Bun 1.2 or newer\n- Codex CLI\n- Chrome, Edge, Arc, Brave, or another Chromium-based browser\n\nSafari is semi-supported for now. Use Chromium for the best editor and\ncollaboration behavior.\n\n## First Run\n\n```bash\nlinzumi start ~/code\n```\n\nWhat happens:\n\n1. The CLI opens Kandan.\n2. You sign up or sign in.\n3. Kandan asks permission to connect this computer.\n4. The CLI stores a scoped local-runner token.\n5. The CLI checks Bun, Codex, and the Kandan editor runtime.\n6. Kandan shows the computer as connected.\n\nThe first editor launch can download a Kandan-approved runtime archive. Later\nruns reuse the verified runtime from:\n\n```text\n~/.linzumi/editor-runtimes\n```\n\nThe production path does not use a random local `code-server` install. Kandan\npublishes a checksummed runtime manifest, and the CLI only advertises editor\nreadiness after that runtime is verified locally.\n\n## Good Things To Try\n\nStart from a real project:\n\n```bash\nlinzumi start ~/code/my-app\n```\n\nThen in Kandan:\n\n```text\nSummarize this repository and tell me how to run it locally.\n```\n\nIf your app starts a dev server:\n\n```bash\nnpm run dev\n```\n\nOpen the detected forwarded port from Kandan. If a port is not auto-detected,\nrestart with an explicit approved port:\n\n```bash\nlinzumi start ~/code/my-app --forward-port 3000\n```\n\nFor a shared editor test, invite another user, open the local editor, and edit\nthe same file. Chromium should show remote cursor labels and selections.\n\n## Hosted Kandan\n\nFor a hosted Kandan deployment, point the CLI at the hosted websocket URL:\n\n```bash\nlinzumi start ~/code/my-app --kandan-url wss://<your-kandan-host>\n```\n\nFor Render-hosted Kandan, public TLS should work without local certificate\nflags. The CLI derives the HTTPS API origin from the websocket URL for OAuth,\nruntime manifest download, and runtime archive download.\n\nFor local development with a private CA:\n\n```bash\nKANDAN_TLS_CA_FILE=/path/to/ca.crt linzumi start ~/code/my-app \\\n  --kandan-url wss://linzumi.io:4140\n```\n\n## Tailscale Development\n\nIf your browser needs to reach a local Kandan server through Tailscale:\n\n```bash\nlinzumi start ~/code/my-app \\\n  --kandan-url ws://100.71.192.98:4162 \\\n  --oauth-callback-host 100.71.192.98\n```\n\nUse your own Tailscale IP.\n\n## Commands\n\n```bash\nlinzumi\nlinzumi --help\nlinzumi --version\nlinzumi start <folder>\nlinzumi connect --help\nlinzumi connect [runner options]\nlinzumi auth [auth options]\n```\n\nMost people should use `linzumi start`.\n\n`linzumi connect` is the lower-level command for connecting to an explicit\nworkspace and channel:\n\n```bash\nlinzumi connect \\\n  --kandan-url wss://serve.kandanai.com \\\n  --workspace default \\\n  --channel general \\\n  --cwd ~/code/my-app\n```\n\n## Useful Options\n\n```bash\n--kandan-url <ws-url>       Kandan websocket URL\n--oauth-callback-host <ip>  Callback host reachable by your browser\n--runner-id <id>            Stable id for this computer\n--codex-bin <path>          Codex executable, default codex\n--model <name>              Codex model metadata shown in Kandan\n--reasoning-effort <value>  Codex reasoning metadata shown in Kandan\n--fast                      Mark this runner as low-latency\n--forward-port <ports>      Comma-separated local ports Kandan may expose\n--allowed-cwd <paths>       Comma-separated roots Kandan may use\n--log-file <path>           JSONL runner event log\n```\n\n`--code-server-bin` exists only as a development override. It is not the\nsupported production editor path.\n\n## Troubleshooting\n\nCheck the CLI version:\n\n```bash\nlinzumi --version\n```\n\nExpected:\n\n```text\nlinzumi 0.0.9-beta\n```\n\nIf `linzumi` is not found, your global npm bin directory is not on `PATH`.\n\nIf `bun` is not found, install Bun and rerun `linzumi start`.\n\nIf `codex` is not found, install or configure the Codex CLI, or pass\n`--codex-bin`.\n\nIf OAuth opens but does not return to the CLI, pass an\n`--oauth-callback-host` that your browser can reach.\n\nIf the editor does not become ready, do not install a local code-server package\nas a workaround. The server-managed runtime must download and verify cleanly.\nRerun the CLI and check the runner log.\n\nIf collaboration behaves oddly in Safari, retry in Chromium. Safari is currently\nsemi-supported.\n\n## For Kandan Release Engineers\n\nThe production contract is:\n\n1. Build the server-approved editor runtime archive.\n2. Publish the manifest and archive from Kandan.\n3. Publish the CLI beta.\n4. The CLI downloads only the approved runtime archive.\n5. The CLI verifies the archive SHA before advertising editor readiness.\n\nFor local package verification:\n\n```bash\nbun test\nnpm pack --dry-run\n```\n\nThe npm package must include this README, `bin/linzumi.js`, and the `src`\nruntime files."
+  "readmeFilename": "README.md"
 }

package/src/index.ts

@@ -101,7 +101,7 @@ async function main(args: readonly string[]): Promise<void> {
       process.stdout.write(connectGuideText());
       return;
     case "version":
-      process.stdout.write("linzumi 0.0.9-beta\n");
+      process.stdout.write("linzumi 0.0.11-beta\n");
       return;
     case "auth":
       await runAuthCommand(parsed.args);
@@ -347,7 +347,7 @@ export async function parseRunnerArgs(
   }
 
   if (values.get("version") === true) {
-    process.stdout.write("linzumi 0.0.9-beta\n");
+    process.stdout.write("linzumi 0.0.11-beta\n");
     process.exit(0);
   }