@visa/cli 5.0.0-rc.406 → 5.0.0-rc.408

package/README.md

@@ -227,6 +227,10 @@ known). A revoked agent is also `revoked` in `pairing.agents[].state`. Reopening
 the approval link, in the same tab or a new one, lands on the same approval;
 it never asks again for a code the terminal has already used.
 
+If the owner's approval window closes before they approve, `visa connect` and
+`agent_enroll` say the link expired (`enrollment_expired`) instead of offering
+it again; `visa connect --restart` (`restart: true`) makes a new link.
+
 On a machine that already holds its agent, `visa connect` (and `agent_enroll`)
 also looks after the agent's card key. That key's certificate runs to the end
 of the card approval it was issued under, and renewing the limits in the
@@ -252,13 +256,18 @@ the held agent answers again. `--restart` never touches the
 installed `pair-visa-agent` skill; `--force-skill` replaces it, moving a locally
 edited copy to `.visa-cli-managed/backups/` first.
 
-`visa connect --setup <key>` picks up an agent the owner started on the Visa
-website. That page shows the exact line to run once the agent exists. The
-approval link this prints carries the key, and the owner's page binds this
-machine to that agent instead of making a new one. Running the same line again
-resumes the same approval. A setup can be picked up by one computer only; a
-second gets `web_start_already_adopted`. In a chat, pass `setup` to
-`agent_enroll` with the same key.
+`visa connect [client] --setup <key>` picks up an agent the owner started on
+the Visa website. Once the owner approves it there, that page shows one line to
+paste, `curl -fsSL https://app.visacli.sh/cli | bash && visa-cli connect <client> --setup <key>`,
+which installs the CLI, mounts it in that client and carries the key. This
+command tells the owner's open page which terminal it is (its challenge, code
+and device keys, under the key), and the page adopts this machine for that
+agent on its own: no link to open, no code to type, no second approval. It
+opens no browser; the link and code it prints are the way back if the page was
+closed. Running the same line again resumes the same approval. A setup can be
+picked up by one computer only; a second gets `web_start_already_adopted`, and a
+terminal signed in to another account is still refused. In a chat, pass `setup`
+to `agent_enroll` with the same key.
 
 The agent's keys (wallet, card and TAP) live in the operating system's
 store: the macOS Keychain, Windows data protection (DPAPI), or the Linux Secret
@@ -545,15 +554,12 @@ Deterministic preconditions always resolve to a specific code:
 | Listing is not x402 (`pay`) | `invalid_argument` | `caller` |
 | Activity id not found or not attributable (`visa://receipt/{id}`) | `activity_entry_not_found` | `caller` |
 | A retired parameter was sent (`history` with `id` or `merchants`) | `invalid_argument` | `caller` |
-| The bundled signer is missing from this install (`agent_enroll`, `pay`) | `native_runtime_signer_not_installed` | `platform` |
-| The bundled signer is present but cannot be made executable | `native_runtime_signer_not_executable` | `platform` |
-| No signer is built for this OS/CPU | `native_runtime_platform_unsupported` | `platform` |
-| The signer could not be started (the `error` text carries the spawn errno) | `native_runtime_unavailable` | `platform` |
-| The signer exited (the `error` text carries its exit code and last stderr) | `native_runtime_closed` | `platform` |
-| The login keychain is locked or unavailable to the signer | `keychain_locked_or_unavailable` | `platform` |
+| The login keychain is locked or unavailable to the agent-key store | `keychain_locked_or_unavailable` | `platform` |
 | The Linux keyring is locked, missing, or did not answer in time | `secret_service_locked_or_unavailable`, `secret_service_unavailable`, `secret_service_timeout` | `platform` |
 | Windows DPAPI refused the device key (usually a different Windows user) | `dpapi_locked_or_unavailable` | `platform` |
 | `visa connect --restart` while this computer's setup still waits for the owner's device approval (run `visa connect` to reopen it) | `enrollment_device_approval_pending` | `platform` |
+| `visa connect --ceiling/--per-transaction` (`agent_enroll` `ceiling`/`per_transaction`) with limits different from the setup already waiting for approval; nothing changed. Run `visa connect` without them to reopen it, or `--restart` (`restart: true`) to ask for the new limits | `invalid_argument` | `caller` |
+| The owner's approval link expired before they approved it (`visa connect`, `agent_enroll`); run `visa connect --restart` (`restart: true`) for a new link | `enrollment_expired` | `caller` |
 | The signer refused: this key is bound to another purpose, or an identity key was asked for a financial proof (nothing was signed or sent; update the CLI) | `key_purpose_mismatch`, `legacy_custody_profile_required` | `platform` |
 | The signer refused: the request named another agent or runtime than the key is bound to | `identity_binding_mismatch` | `platform` |
 | The signer refused a proof timestamp outside its window (the machine clock is wrong) | `proof_time_invalid` | `platform` |