kylon-cli 0.2.2-next.183 → 0.2.2-next.185

package/README.md

@@ -181,9 +181,10 @@ Decision table:
 | yes | none | start the daemon from the saved session |
 | yes | any | reconnect with the overrides (falls back to saved values for fields you didn't pass), persist the refreshed session, start the daemon |
 
-Only CLI flags count as overrides. Setting `KYLON_API_KEY` in the
-environment does **not** trigger a reconnect on a saved session —
-it still feeds the normal API-key resolution inside `gateway start`.
+Only CLI flags count as overrides. On first connect, `KYLON_API_KEY` is
+persisted and the process is immediately replaced with a credential-free
+daemon image. With a saved session, the saved key remains authoritative and
+any inherited `KYLON_API_KEY` is removed before the daemon starts.
 
 ### Connect
 
@@ -237,14 +238,14 @@ arrives on — see
 | `kylon gateway run` | **Recommended.** Connect + start in one step; idempotent when a session already exists. |
 | `kylon gateway connect` | Register this machine as the gateway client for an agent (API key identifies which), without starting the daemon. |
 | `kylon gateway bind` | Create or update a logical session binding. |
-| `kylon gateway start` | Start the gateway daemon from a saved session — opens the SSE stream and executes assignments. Reads the API key from the saved session. |
+| `kylon gateway start` | Start the gateway daemon from a saved session — opens the SSE stream and executes assignments. Credential/server overrides are rejected on this long-running entrypoint. |
 
 ### Run Options
 
 | Flag | Description |
 |---|---|
 | `--server-url <url>` | P2 server URL (required for the first run; override otherwise) |
-| `--api-key <key>` | Agent API key, e.g. `pak_xxx` (required for first run; override otherwise. `KYLON_API_KEY` env var satisfies the first-run requirement but does not count as an override on subsequent runs) |
+| `--api-key <key>` | Agent API key, e.g. `pak_xxx` (required for first run; override otherwise. `KYLON_API_KEY` satisfies first-run setup and is removed from the daemon environment after the key is persisted) |
 | `--provider <name>` | Provider CLI: `codex`, `claude-code`, `hermes`, `openclaw`, `generic` (required for first run; override otherwise) |
 | `--session-dir <path>` | Isolated state directory for this agent (normally `~/.kylon/agents/<agent-id>`) |
 
@@ -270,10 +271,13 @@ arrives on — see
 
 | Flag | Description |
 |---|---|
-| `--server-url <url>` | Override the server URL from the saved session |
-| `--api-key <key>` | Override the API key from the saved session |
 | `--session-dir <path>` | Isolated state directory containing this agent's saved session, bindings, and provider runtime cache |
 
+`gateway start` accepts credentials and the server origin only from the saved
+session. Use `gateway run` when a credential or origin must be supplied or
+changed; it persists the session and replaces the process with a credential-free
+daemon image before opening SSE.
+
 ### Supported Providers
 
 - `codex` — OpenAI Codex CLI