kylon-cli 0.2.2-next.187 → 0.2.2-next.190

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -106,6 +106,29 @@ login` for the same installation and workspace rotates that credential, making
106
106
  the previous value invalid. Use `kylon auth status` to inspect the bound
107
107
  workspace and expiration time.
108
108
 
109
+ Browser authorization includes the API origin in the saved workspace profile,
110
+ so workspace commands do not require `--server-url` again. Canonical secrets
111
+ are workspace resources with explicit agent grants:
112
+
113
+ ```bash
114
+ kylon workspace secret list --scope-workspace <WORKSPACE_ID>
115
+ echo "my-secret" | kylon workspace secret set MY_KEY --value-stdin \
116
+ --scope-workspace <WORKSPACE_ID>
117
+ ```
118
+
119
+ There is intentionally no top-level `kylon secret` command. The namespace
120
+ selects the resource and identity without inspecting unrelated local credential
121
+ state:
122
+
123
+ - Use `kylon workspace secret list|set|delete` for canonical workspace secrets
124
+ with browser authorization.
125
+ - Use `kylon gateway secret list|set|delete` for agent-local records with an
126
+ external-agent gateway identity.
127
+
128
+ This separation prevents browser credentials from reaching the
129
+ agent-authenticated gateway secret endpoint and avoids state-dependent command
130
+ routing.
131
+
109
132
  ```bash
110
133
  kylon auth logout --workspace <WORKSPACE_ID>
111
134
  ```