@oddington/cli 0.1.23 → 0.1.25

package/README.md

@@ -108,10 +108,21 @@ authority, and opening the interface does not require local routine code.
 The command prints the clean assigned IPv4 loopback URL and owns the host until
 Ctrl-C or termination. No root, workspace, command or port override is accepted;
 `os app run` is unsupported. Browser authority is separate, origin-scoped and
-bounded to ten minutes or the retained access session’s earlier expiry window.
+bounded to ten minutes per issued credential or the checked access session's
+earlier expiry window. Before expiry the SDK proactively asks only that exact
+Host to renew. The Host silently refreshes the securely stored CLI login and
+confirms the same member, app, workspace and complete repository scope before
+atomically rotating the browser credential and bounded deadline. CLI credentials
+never enter browser state, and renewal never opens a login flow.
 Local sign-out leaves CLI sign-in intact. Removing CLI storage alone leaves an
-established app session intact; every protected request still checks upstream
-identity and workspace access. Host shutdown ends it immediately. An opener
+established unexpired app session intact but prevents renewal. Protected requests
+check retained local authority; hosted identity and repository bindings are
+observed together in the background without extending expiry. Confirmed scope
+or target changes end the session; a same-target published-version advance
+atomically replaces the affected index reader. Temporary background or renewal
+failures preserve only current bounded access and never extend its deadline.
+The SDK retries renewal independently of Data reads. Confirmed renewal denial and Host
+shutdown end it immediately. An opener
 failure stops the host without printing a bootstrap secret.
 
 Launch supplies authenticated context and unchanged interface assets. The SDK's
@@ -134,11 +145,16 @@ fixed Node child. Its private `appRun.current()` input is immutable; declared
 steps and finish await host acceptance. Success requires accepted finish and
 zero exit. Shared effects publish immediately, without a preparation selector.
 Supplied File inputs reject execution unavailable before capability issuance;
-File-use transfer and local Data/Files adapters remain unsupported.
+File-use transfer and a local browser Files adapter remain unsupported. Local
+Data uses the exact published index; warm reads make no synchronous hosted or
+CLI-store calls and neither initiate nor await browser-session renewal.
 
 The host owns children across refresh and tab closure. Exact-origin browser
 state permits `recover()` without a run selector while the host/session remains
-authorized. `events()` reconnects in order; `cancel()` resolves after child
+authorized. Successful credential rotation preserves admitted Data and routine
+work and the same bounded run ownership. Other tabs confirm and adopt the stored
+winner silently; an old credential cannot start new requests or erase that
+winner. `events()` reconnects in order; `cancel()` resolves after child
 termination and capability revocation. Host stop, local sign-out, expiry or
 authority loss ends active execution. At most four runs occupy authorization,
 execution or cleanup slots; event retention is bounded to 256 events / 1 MiB