@tryarcanist/cli 0.1.405 → 0.1.407

package/README.md

@@ -14,16 +14,18 @@ Requires Node.js 22 or newer.
 
 Give your agent this prompt from a repository checkout:
 
-> Install the latest @tryarcanist/cli and run `arcanist onboard --json`. Follow its next actions until this repository is ready and its first pull request review is verified. Show me approval links when needed; run the terminal commands yourself. Use `arcanist help onboard --json` for the full flow.
+> Install the latest @tryarcanist/cli and run `arcanist onboard --json`. Follow its next actions until this repository is ready and its first pull request review is verified. Open approval links for me when needed; run the terminal commands yourself. Keep me updated when something changes. Use `arcanist help onboard --json` for the full flow.
 
-No Arcanist account or manually copied token is needed beforehand. New users approve sign-in in the browser; repository owners approve GitHub App installation when it is missing. Existing write-scoped CLI logins are reused. A browser-approved replacement supersedes a rejected or read-only project token for the same API; the project file stays unchanged. Explicit token overrides remain authoritative and must be replaced or unset if invalid. The agent resumes the same command after approval. Approval links carry a challenge, never the CLI token; the verifier and approved token stay in private files under `~/.arcanist`.
+No Arcanist account or manually copied token is needed beforehand. New users approve sign-in in the browser; repository owners approve GitHub App installation when it is missing. Existing write-scoped CLI logins are reused. A browser-approved replacement supersedes a rejected or read-only project token for the same API; the project file stays unchanged. Explicit token overrides remain authoritative and must be replaced or unset if invalid. The agent checks the same command while approval is pending and continues automatically after approval. Approval links carry a challenge, never the CLI token; the verifier and approved token stay in private files under `~/.arcanist`.
 
 ```bash
 arcanist onboard --json
 arcanist onboard owner/repo --pr https://github.com/owner/repo/pull/123 --json
 ```
 
-Follow `command` to resume and `repository.nextAction` for setup interventions. `setup_pending` can be polled every five seconds. `repository_ready` means setup finished but the first review is still unverified: pass an existing PR with `--pr`. `review_pending` resumes the same review. The CLI saves a request key before starting it, so retrying after a lost response recovers that review even after it finishes. Concurrent commands use the same saved request; if another command still holds the lock, the CLI asks you to retry shortly. Cancelled, rejected, or missing saved requests are cleared so the next invocation can retry. After new commits or an incomplete result, use `--pr <url> --restart-review` once to request verification again; resume with the returned command, which omits that flag. Only `complete` with `reviewVerified: true` proves a conclusive review of the returned `headSha`; findings do not make onboarding fail. `review_needs_attention` requires inspecting the incomplete result. Do not create a PR or change its code merely to finish onboarding.
+Use `message` for plain-language progress. Share it when the state changes; keep polling and commands with the agent. Open approval links for the user when a browser is available, or show a clickable link. Approval stays with the user.
+
+Follow `command` to resume and `repository.nextAction` for setup interventions. Poll `approval_required` and `setup_pending` every five seconds. `repository_ready` means setup finished but the first review is still unverified: pass an existing PR with `--pr`. `review_pending` resumes the same review. The CLI saves a request key before starting it, so retrying after a lost response recovers that review even after it finishes. Concurrent commands use the same saved request; if another command still holds the lock, the CLI asks you to retry shortly. Cancelled, rejected, or missing saved requests are cleared so the next invocation can retry. After new commits or an incomplete result, use `--pr <url> --restart-review` once to request verification again; resume with the returned command, which omits that flag. Only `complete` with `reviewVerified: true` proves a conclusive review of the returned `headSha`; findings do not make onboarding fail. `review_needs_attention` requires inspecting the incomplete result. Do not create a PR or change its code merely to finish onboarding.
 
 If a connection drops during sign-in, rerun the command. The same approval recovers the same token until its ten-minute server expiry; revoked tokens cannot be recovered. Concurrent terminal processes share the approval, and saved credentials are replaced atomically with private permissions.