@visa/cli 5.0.0-rc.407 → 5.0.0-rc.408

package/README.md

@@ -256,13 +256,18 @@ the held agent answers again. `--restart` never touches the
 installed `pair-visa-agent` skill; `--force-skill` replaces it, moving a locally
 edited copy to `.visa-cli-managed/backups/` first.
 
-`visa connect --setup <key>` picks up an agent the owner started on the Visa
-website. That page shows the exact line to run once the agent exists. The
-approval link this prints carries the key, and the owner's page binds this
-machine to that agent instead of making a new one. Running the same line again
-resumes the same approval. A setup can be picked up by one computer only; a
-second gets `web_start_already_adopted`. In a chat, pass `setup` to
-`agent_enroll` with the same key.
+`visa connect [client] --setup <key>` picks up an agent the owner started on
+the Visa website. Once the owner approves it there, that page shows one line to
+paste, `curl -fsSL https://app.visacli.sh/cli | bash && visa-cli connect <client> --setup <key>`,
+which installs the CLI, mounts it in that client and carries the key. This
+command tells the owner's open page which terminal it is (its challenge, code
+and device keys, under the key), and the page adopts this machine for that
+agent on its own: no link to open, no code to type, no second approval. It
+opens no browser; the link and code it prints are the way back if the page was
+closed. Running the same line again resumes the same approval. A setup can be
+picked up by one computer only; a second gets `web_start_already_adopted`, and a
+terminal signed in to another account is still refused. In a chat, pass `setup`
+to `agent_enroll` with the same key.
 
 The agent's keys (wallet, card and TAP) live in the operating system's
 store: the macOS Keychain, Windows data protection (DPAPI), or the Linux Secret
@@ -553,6 +558,7 @@ Deterministic preconditions always resolve to a specific code:
 | The Linux keyring is locked, missing, or did not answer in time | `secret_service_locked_or_unavailable`, `secret_service_unavailable`, `secret_service_timeout` | `platform` |
 | Windows DPAPI refused the device key (usually a different Windows user) | `dpapi_locked_or_unavailable` | `platform` |
 | `visa connect --restart` while this computer's setup still waits for the owner's device approval (run `visa connect` to reopen it) | `enrollment_device_approval_pending` | `platform` |
+| `visa connect --ceiling/--per-transaction` (`agent_enroll` `ceiling`/`per_transaction`) with limits different from the setup already waiting for approval; nothing changed. Run `visa connect` without them to reopen it, or `--restart` (`restart: true`) to ask for the new limits | `invalid_argument` | `caller` |
 | The owner's approval link expired before they approved it (`visa connect`, `agent_enroll`); run `visa connect --restart` (`restart: true`) for a new link | `enrollment_expired` | `caller` |
 | The signer refused: this key is bound to another purpose, or an identity key was asked for a financial proof (nothing was signed or sent; update the CLI) | `key_purpose_mismatch`, `legacy_custody_profile_required` | `platform` |
 | The signer refused: the request named another agent or runtime than the key is bound to | `identity_binding_mismatch` | `platform` |