@wave-ai-os/wave-cli 0.1.75 → 0.1.77

package/README.md

@@ -200,6 +200,13 @@ CLI version, registry digest, organization, and actor. Machine mode clears ambie
 Wave configuration and local credential storage before dispatch, so it cannot inherit
 a developer's local session.
 
+Hosted adapters pass the machine-auth envelope through private file descriptor `3`
+(`--machine-auth-fd 3`) and, for writes, the approval through descriptor `4`
+(`--machine-approval-fd 4`). The descriptor numbers are the only values present in
+argv; bearer credentials and approval payloads are never accepted from machine-mode
+environment variables. The CLI keeps trusted machine auth in request-local runtime
+state while dispatching the registered command.
+
 ## Commands
 
 Examples:
@@ -453,7 +460,6 @@ Commands:
 - `wave osmd ingest file <path> --slug <slug> --parent-ref <canonicalPath> --summary <summary> [--source-type <type>] [--title <title>] [--run-lint] [--dry-run] [--readable]`
 - `wave osmd ingest url <url> --slug <slug> --parent-ref <canonicalPath> --summary <summary> [--source-type <type>] [--title <title>] [--run-lint] [--dry-run] [--readable]`
 - `wave osmd ingest transcript [text] [--content <text> | --file <path> | stdin] --slug <slug> --parent-ref <canonicalPath> --summary <summary> [--source-type <type>] [--title <title>] [--run-lint] [--dry-run] [--readable]`
-- `wave osmd phantom run [--dry-run] [--readable]`
 - `wave osmd read <path> [--parent-ref <canonicalPath>]`
 - `wave osmd children [path] [--parent-ref <canonicalPath>] [--source canonical_osmd|agent_overlay|agent_wiki]`
 - `wave osmd status <path> [--parent-ref <canonicalPath>]`
@@ -510,8 +516,6 @@ GraphQL mapping:
 - `osmd memory-quality` -> `osMdMemoryQuality`
 - `osmd ingest text` / `osmd ingest file` / `osmd ingest url` / `osmd ingest transcript` -> `registerRawSource`, then `ingestRawSource`
 - `osmd ingest ... --dry-run` -> `rawSourceIngestionPlan`
-- `osmd phantom run --dry-run` -> `runPhantomOsmdMaintenance(dryRun: true)`
-- `osmd phantom run` -> `runPhantomOsmdMaintenance(dryRun: false)`
 - `phantom inventory --json` -> `phantomLedgerInventory`
 - `phantom observations --json` -> `phantomObservations`
 - `phantom observations --run-id <run-id> --json` -> `phantomObservations(phantomRunId: <run-id>)`
@@ -611,10 +615,6 @@ Path and permission rules:
 - `osmd ingest --dry-run` calls backend `rawSourceIngestionPlan` and returns the backend plan through the same output schema.
 - `osmd ingest --update-overlays` is rejected locally with `unsupported_contract`; CLI Phase 1 does not pass a blind overlay boolean.
 - `osmd ingest file` reads local file content and sends the filename as source metadata. The CLI does not mutate raw sources, upload raw-source storage objects, infer source storage paths, or implement summarization rules.
-- `osmd phantom run` is organization-scoped, manual-only, and fixed to the backend OSMD/agent semantic memory scope. The CLI does not schedule cron jobs.
-- `osmd phantom run --dry-run` calls backend `runPhantomOsmdMaintenance` with `dryRun: true` and does not write files directly.
-- `osmd phantom run` passes backend result fields through, including run id, run status, inventory count fields, optional `countSemantics`, lint summary, report path, updated files, skipped nodes, and notification metadata when provided.
-- Phantom runs use a 120 second default HTTP timeout because the backend maintenance pass can outlive the CLI's normal 10 second default. Operators can still override this with `--timeout-ms <milliseconds>` or `WAVE_TIMEOUT_MS`.
 - Top-level `phantom` commands are read-only operator/debug surfaces over the API-owned inert Phantom Evidence Ledger.
 - `phantom inventory --json` returns backend ledger counts in the standard JSON envelope.
 - `phantom observations --json` returns API-owned Phantom observations with ids, run ids, observation/source metadata, content hash, payload, schema version, test run id, idempotency key, and timestamps.