@tryarcanist/cli 0.1.406 → 0.1.408

package/README.md

@@ -14,16 +14,18 @@ Requires Node.js 22 or newer.
 
 Give your agent this prompt from a repository checkout:
 
-> Install the latest @tryarcanist/cli and run `arcanist onboard --json`. Follow its next actions until this repository is ready and its first pull request review is verified. Show me approval links when needed; run the terminal commands yourself. Use `arcanist help onboard --json` for the full flow.
+> Install the latest @tryarcanist/cli and run `arcanist onboard --json`. Follow its next actions until this repository is ready and its first pull request review is verified. Open approval links for me when needed; run the terminal commands yourself. Keep me updated when something changes. Use `arcanist help onboard --json` for the full flow.
 
-No Arcanist account or manually copied token is needed beforehand. New users approve sign-in in the browser; repository owners approve GitHub App installation when it is missing. Existing write-scoped CLI logins are reused. A browser-approved replacement supersedes a rejected or read-only project token for the same API; the project file stays unchanged. Explicit token overrides remain authoritative and must be replaced or unset if invalid. The agent resumes the same command after approval. Approval links carry a challenge, never the CLI token; the verifier and approved token stay in private files under `~/.arcanist`.
+No Arcanist account or manually copied token is needed beforehand. New users approve sign-in in the browser; repository owners approve GitHub App installation when it is missing. Existing write-scoped CLI logins are reused. A browser-approved replacement supersedes a rejected or read-only project token for the same API; the project file stays unchanged. Explicit token overrides remain authoritative and must be replaced or unset if invalid. The agent checks the same command while approval is pending and continues automatically after approval. Approval links carry a challenge, never the CLI token; the verifier and approved token stay in private files under `~/.arcanist`.
 
 ```bash
 arcanist onboard --json
 arcanist onboard owner/repo --pr https://github.com/owner/repo/pull/123 --json
 ```
 
-Follow `command` to resume and `repository.nextAction` for setup interventions. `setup_pending` can be polled every five seconds. `repository_ready` means setup finished but the first review is still unverified: pass an existing PR with `--pr`. `review_pending` resumes the same review. The CLI saves a request key before starting it, so retrying after a lost response recovers that review even after it finishes. Concurrent commands use the same saved request; if another command still holds the lock, the CLI asks you to retry shortly. Cancelled, rejected, or missing saved requests are cleared so the next invocation can retry. After new commits or an incomplete result, use `--pr <url> --restart-review` once to request verification again; resume with the returned command, which omits that flag. Only `complete` with `reviewVerified: true` proves a conclusive review of the returned `headSha`; findings do not make onboarding fail. `review_needs_attention` requires inspecting the incomplete result. Do not create a PR or change its code merely to finish onboarding.
+Use `message` for plain-language progress. Share it when the state changes; keep polling and commands with the agent. Open approval links for the user when a browser is available, or show a clickable link. Approval stays with the user.
+
+Follow `command` to resume and `repository.nextAction` for setup interventions. Poll `approval_required` and `setup_pending` every five seconds. `repository_ready` means setup finished but the first review is still unverified: pass an existing PR with `--pr`. `review_pending` resumes the same review. The CLI saves a request key before starting it, so retrying after a lost response recovers that review even after it finishes. Concurrent commands use the same saved request; if another command still holds the lock, the CLI asks you to retry shortly. Cancelled, rejected, or missing saved requests are cleared so the next invocation can retry. After new commits or an incomplete result, use `--pr <url> --restart-review` once to request verification again; resume with the returned command, which omits that flag. Only `complete` with `reviewVerified: true` proves a conclusive review of the returned `headSha`; findings do not make onboarding fail. `review_needs_attention` requires inspecting the incomplete result. Do not create a PR or change its code merely to finish onboarding.
 
 If a connection drops during sign-in, rerun the command. The same approval recovers the same token until its ten-minute server expiry; revoked tokens cannot be recovered. Concurrent terminal processes share the approval, and saved credentials are replaced atomically with private permissions.
 
@@ -243,52 +245,6 @@ ARCANIST_TOKEN=arc_... arcanist auth whoami --json
 
 JSON mode prints the raw `/api/auth/whoami` API response. Fields currently include `userId`, `email`, `tokenId`, `tokenScope`, and `authMode`.
 
-### `arcanist auth browser-session`
-
-QA only. Trades a write-scope CLI token for a 24-hour browser session for the same user and prints it as a Playwright storage state (`{"cookies":[...],"origins":[]}`) on stdout. Only GitHub logins listed in the QA worker's `QA_BROWSER_SESSION_LOGINS` may do this; production returns 404. The output holds a live session token, so write it to a private file.
-
-```bash
-ARCANIST_API_URL=https://qa.tryarcanist.com arcanist auth browser-session > storage-state.json
-```
-
-### `arcanist codex login`
-
-Local development only; deployed workspaces return 403.
-
-Authenticates a Codex/ChatGPT subscription and stores it for your Codex sessions, then activates it (turns on "use subscription auth for OpenAI sessions"). Runs the Codex CLI device-authorization login locally under a temporary `CODEX_HOME`, then uploads the resulting `auth.json` to Arcanist (encrypted, per user). The credential is never written to your default `~/.codex`. Requires a write-scoped token. If activation fails the credential is still saved; run `arcanist codex use on`.
-
-```bash
-arcanist codex login
-arcanist codex login --codex-path /usr/local/bin/codex
-```
-
-`--codex-path <path>` overrides the `codex` executable used (default: `codex` on `PATH`, or `ARCANIST_CODEX_BIN`).
-
-### `arcanist codex use <on|off>`
-
-`on` works in local development only; deployed workspaces return 403. `off` works everywhere.
-
-Turns using your saved Codex subscription auth for OpenAI sessions on or off, without changing the stored credential. `arcanist codex login` turns it on automatically; use this to toggle it later.
-
-```bash
-arcanist codex use on
-arcanist codex use off
-```
-
-### `arcanist codex status`
-
-Deployed workspaces report subscription auth as unavailable; it works in local development only.
-
-Shows that Codex subscription auth is available and whether an `auth.json` is currently saved.
-
-```bash
-arcanist codex status
-arcanist codex status --json
-```
-
-JSON mode returns `{eligible, credential: {isSet, lastValidationStatus?, lastValidationReasonCode?}}`; `eligible` is always
-`true` and remains for compatibility with older clients.
-
 ### `arcanist sessions get <session-id>`
 
 ```bash
@@ -372,17 +328,6 @@ arcanist sessions artifacts get abc123 art-1 -o ./run-evidence
 
 `-o, --output <dir>` picks the destination directory (default: the current directory). An artifact ID that is not in the session exits non-zero. JSON mode returns `{artifactId, path}`.
 
-### `arcanist review-models show|set|clear`
-
-Arcanist members only. Stage models for your own `tryarcanist/arcanist` reviews; customer reviews never read them.
-A per-PR eval row still wins. `--user <id>` targets another member.
-
-```bash
-arcanist review-models set --scouts deepseek-ai/DeepSeek-V4.1-Flash --verifier deepseek-ai/DeepSeek-V4.1-Flash
-arcanist review-models show
-arcanist review-models clear
-```
-
 ### `arcanist repos list`
 
 ```bash
@@ -450,8 +395,6 @@ For cron, prefer `ARCANIST_TOKEN` or a logged-in `~/.arcanist/config.json` over
 
 ```bash
 arcanist reviews get <pr-request-id> --json
-arcanist reviews stages <session-id> --json
-arcanist reviews stages <session-id> judge --json
 arcanist sessions view <session-id> --json
 ```
 
@@ -463,19 +406,6 @@ API errors retain the normal exit codes. Quiet text mode suppresses output. JSON
 The lifecycle snapshot preserves `unavailableRequestIds` and retry/recovery state.
 For a **local request ID**, use `arcanist review --request <id> --no-wait --json` with its existing review exit codes.
 
-Stage reads require Arcanist membership. The index lists stage names, byte sizes, and upload timestamps.
-A selected record includes full structured `input`, `output`, and `threads`. The CLI fetches no other records.
-
 `sessions view` returns the enriched session envelope for the token workspace.
 Its prompts contain the first page only (`promptLimit=1`). Use `sessions transcript` for full activity and `sessions artifacts` for files.
 `sessions get` keeps its raw session response.
-
-## Operator workspace admission
-
-Arcanist operators can set a workspace’s review allowance through the CLI with an admin token in `ARCANIST_TOKEN`:
-
-```sh
-arcanist workspaces review-limit <business-id> default --json
-```
-
-Modes are `default`, `pilot`, `unlimited`, and `off`. `off` pauses setup and new reviews while retaining the stored cap; the other modes enable admission and set the selected cap. Set `ARCANIST_API_URL` to the intended deployment. Customer CLI tokens cannot change operator admission.