@rayul/kordis 0.12.0 → 0.12.1

package/dist/index.js

@@ -2208,7 +2208,7 @@ function assertSafeVerificationUrl(raw) {
 function loginCommand() {
   return new Command("login").description("authenticate with the Kordis registry").option("--provider <name>", "OAuth provider", "google").option("--no-browser", "don't auto-open the browser; print the URL instead").option(
     "--emit-only",
-    "start device flow, open browser, save pending state, exit immediately \u2014 for non-interactive (agent) contexts where the 10-min poll would exceed the bash timeout"
+    "start device flow, open the user's browser, save pending state, and exit immediately (no blocking poll) \u2014 THE login path an agent should drive on a user's behalf; the next CLI call auto-claims the token. Prefer this over plain `login`, whose 10-min poll exceeds an agent's bash timeout"
   ).action(async (opts) => {
     const bundle = await useClient();
     const started = spinner("Requesting device code");
@@ -2318,7 +2318,7 @@ function requireAuth(bundle) {
     error: {
       code: "not_authenticated",
       message: "authentication required",
-      hint: "Run `kordis login --emit-only` to start browser sign-in (exits immediately, no blocking poll), then re-run this command \u2014 the next CLI call auto-claims the token. For interactive shells, plain `kordis login` (10-min poll) also works. If you DID login but auth keeps failing, run with `KORDIS_DEBUG=1` to surface auto-finalize stages (Round 12 F1 \u2014 diagnostic moment-of-need)."
+      hint: "Authenticate first \u2014 and if you are an AGENT acting for a user, lead the login yourself: YOU run `kordis login --emit-only`. It opens the user's browser (they just click Authorize) and returns immediately with no blocking poll; then re-run this command and the token is auto-claimed. Do NOT tell the user to run a login command themselves, and do NOT run plain `kordis login` \u2014 its ~10-min poll will exceed your bash timeout. Plain `kordis login` is ONLY for a human typing at their own terminal. If the user already clicked Authorize but auth still fails, re-run with `KORDIS_DEBUG=1` to surface auto-finalize stages."
     }
   });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rayul/kordis",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "private": false,
   "description": "Command-line client for the Kordis registry — discover, install, and publish agentic-coding packages.",
   "license": "MIT",