@runneth/cli 0.0.0-sha.38007d8a11bd.production → 0.0.0-sha.41910c2f7cce.production

package/README.md

@@ -40,7 +40,7 @@ runneth send [--name default] [--timeout-ms 600000] [--stdin] -- <command...>
 runneth status [--name default]
 runneth list
 runneth close [--name default]
-runneth oauth login [--resource <url>] [--client-name "Runneth MCP"] [--scope <scope>] [--no-open]
+runneth oauth login [--resource <url>] [--client-id|--clientid <id>] [--client-secret|--secret <value>] [--client-name "Runneth MCP"] [--scope <scope>] [--no-open]
 runneth oauth status [--resource <url>]
 runneth oauth logout [--resource <url>]
 runneth chat --workspace <workspace-id> [--api <builder-url>] [--resource <url>] [--auth mondrian|builder] [--conversation <id>]
@@ -52,8 +52,8 @@ runneth ssh target add <name> (--host <host> | --ssh-url <url>) [--resource <url
 runneth ssh target import <file>
 runneth ssh target list
 runneth ssh target use <name>
-runneth ssh [--target <name>] [--unique-key | --identity-file <path>] [-- remote-command]
-runneth ssh stdio [--target <name>] [--unique-key | --identity-file <path>]
+runneth ssh [--conversation <id> --workspace <workspace-id> | --target <name> | --host <host> | --ssh-url <url>] [--api <builder-url>] [--resource <url>] [--unique-key | --identity-file <path>] [-- remote-command]
+runneth ssh stdio [--conversation <id> --workspace <workspace-id> | --target <name> | --host <host> | --ssh-url <url>] [--api <builder-url>] [--resource <url>] [--unique-key | --identity-file <path>]
 runneth skills install [--agent claude|codex|all]
 runneth shutdown
 ```
@@ -72,12 +72,16 @@ use a different state directory.
 
 ## OAuth
 
-`runneth-cli oauth login` performs OAuth protected-resource discovery, dynamic
-client registration as a public MCP-style client, PKCE authorization, and token
-exchange through a local loopback callback.
+`runneth-cli oauth login` performs OAuth protected-resource discovery, PKCE
+authorization, and token exchange through a local loopback callback. By default
+it uses dynamic client registration as a public MCP-style client. Provide
+`--client-id`/`--clientid` and `--client-secret`/`--secret`, or set
+`RUNNETH_OAUTH_CLIENT_ID` and `RUNNETH_OAUTH_CLIENT_SECRET`, to use a
+pre-registered confidential client instead.
 
 ```bash
 runneth oauth login --resource http://localhost:4100/mcp
+RUNNETH_OAUTH_CLIENT_ID=client-id RUNNETH_OAUTH_CLIENT_SECRET=client-secret runneth oauth login --resource http://localhost:4100/mcp
 runneth oauth status --resource http://localhost:4100/mcp
 ```
 
@@ -118,7 +122,8 @@ runneth conversation state --workspace "$MONDRIAN_WORKSPACE_ID" --conversation "
 
 `send` waits for the assistant response by default. `send` and `state` require an
 explicit `--conversation`; the CLI does not track an implicit active
-conversation for machine commands.
+conversation for machine commands. State reads advertise Runneth stream V2, so
+the same command can inspect read-only task-origin transcripts.
 
 Long-lived agents can keep one authenticated process open with JSONL over
 stdin/stdout:
@@ -153,21 +158,28 @@ Typical responses:
 ## SSH
 
 `runneth-cli ssh` uses the stored OAuth credential for the resource. If no
-credential exists yet, it starts the OAuth login flow first. The first SSH
-connection for a resource/app pair generates an ed25519 keypair, sends the
-public key to the Runneth SSH app, writes an isolated OpenSSH config, and then
-starts `ssh` through the app tunnel.
+credential exists yet, it starts the OAuth login flow first. Pass a conversation
+and workspace to resolve its public SSH app target from Builder, or pass a
+named, host, or URL target directly. The first SSH connection for a resource/app
+pair generates an ed25519 keypair, sends the public key to the Runneth SSH app,
+writes an isolated OpenSSH config, and then starts `ssh` through the app tunnel.
 
 ```bash
 runneth ssh \
+  --conversation 11111111-1111-4111-8111-111111111111 \
+  --workspace 22222222-2222-4222-8222-222222222222 \
   --resource https://projects.motionapp.com/mcp \
-  --host 93c7ca56-debe-4b95-8be2-a873afe72234.app.runneth.com
+  --api https://projects.motionapp.com
 ```
 
 SSH keys, known hosts, and generated config files are stored under
 `~/.runneth-cli/ssh`. The generated OpenSSH config uses an internal
 `ProxyCommand` transport that attaches the OAuth bearer token to the SSH app
-HTTP tunnel.
+tunnel. The CLI reads the target VM's authenticated `/runneth/ssh/api` metadata
+before connecting, independently of app catalog health:
+VMs that advertise `runneth-ssh-v1` use one full-duplex WebSocket, while older
+VMs continue through the HTTPS tunnel. Transport selection is automatic. Capability
+discovery allows 70 seconds for authorization and response delivery.
 
 ### SSH stdio