@spinalfluid/ultrac 0.1.0 → 0.1.6

package/README.md

@@ -35,7 +35,7 @@ For local testing before a registry release, build and install the verified tarb
 pnpm check
 pnpm verify:install
 npm pack
-npm install -g ./spinalfluid-ultrac-0.1.0.tgz
+npm install -g ./spinalfluid-ultrac-0.1.6.tgz
 ultrac login
 ```
 
@@ -53,7 +53,17 @@ ultrac logout    # drop local credentials and revoke the minted key
 
 For interactive use, `ultrac login` opens `https://ultrac.io/cli/login` (or the same path on a local
 site). Approve the CLI using your existing website account; the site mints a key and the CLI stores
-it in `~/.ultrac/auth.json` with `0600` permissions. You do not need to create or paste a key.
+it in `~/.ultrac/auth.json`. The browser return is bound to the initiating CLI with loopback,
+state, and PKCE checks. Confirm that the browser and terminal show the same reference code; you do
+not enter that code during the normal flow. If the browser cannot reach the loopback callback, the
+CLI accepts the short-lived, one-time completion code from the failed
+localhost callback URL and exchanges it with the same PKCE verifier. This recovery path never asks
+for a permanent API key. `--no-browser` prints the authorization URL instead of opening it.
+
+Credentials use an owner-only `0600` file because the package intentionally avoids native keychain
+dependencies. On filesystems that do not enforce Unix permission bits, protect the account and home
+directory with the operating system's access controls. You do not need to create or paste a key for
+normal browser sign-in.
 
 For scripts and CI, do not run the browser sign-in flow. Create a dedicated API key in the account's
 `/keys` page, store it in your CI secret manager, and expose it to the command as `ULTRAC_API_KEY`.
@@ -62,8 +72,10 @@ for an existing key, and `ultrac login --key <key>` verifies and stores one; use
 intentionally need a local saved credential, not as the default CI setup. Avoid putting secrets in
 shell history, command arguments, project config, or source control. An approved Ultrac account is required for model access.
 
-The minted key is checked with `GET <base>/models` before it is saved: a 401/403 is refused and
-nothing is written; if the API cannot be reached the key is saved anyway with a warning.
+Every key is checked with `GET <base>/models` before it is saved. A browser-issued key is stored only
+after the API accepts it; a 401/403 or unavailable verification writes nothing. For compatibility,
+an explicitly supplied `--key` or `--manual` key may still be saved with a warning when verification
+is unavailable, but a rejected key is never saved.
 
 ### Cosmic 1, in a repo
 
@@ -128,7 +140,11 @@ ultrac "Find the main entry points and summarize the architecture"
 
 Inside a session:
 
-- Type to talk to Ultrac; it gathers repository context first and can call tools.
+- Type to talk to Ultrac; it inspects the repository with tools as needed.
+- You can type another message while Ultrac is working. It is queued and inserted after the current
+  tool batch or completed model response, before the next model request. Slash commands wait for
+  the main prompt instead of entering model context.
+- Ctrl-C stops active work at a safe boundary. At an idle prompt, Ctrl-C exits and saves the session.
 - Gated tools (file writes, shell, network) prompt for approval: `once` / `always` / `no`.
 - Coding commands: `/plan [task]`, `/coding`, `/review [focus]`, `/diff [--staged]`,
   `/test [instructions]`, `/init`, `/max-steps [number]`.
@@ -158,6 +174,8 @@ Non-interactive, scriptable one-shot runs:
 ultrac run "Review this patch" --mode review
 ultrac run "Inspect this repo" --provider echo     # offline smoke provider, no key
 ultrac run --continue <session-id> "Follow up on the last result"
+ultrac run "Finish the remaining tests" --autonomous
+ultrac notify setup                                # Telegram or SMS for unattended questions
 ```
 
 One prompt, one reply, no tools or workspace context - the smallest end-to-end check of the wiring: