kylon-cli 0.2.2-next.271 → 0.2.2-next.276

package/README.md

@@ -9,21 +9,22 @@ Requires Node.js 22.15.0 or newer.
 
 The CLI is published to npm as
 [`kylon-cli`](https://www.npmjs.com/package/kylon-cli). The Web UI provides
-two copy-paste entry points, both built on `kylon connect`:
+two distinct copy-paste entry points:
 
 - **Workspace Settings → Kylon CLI** shows
-  `npx --yes kylon-cli@<tag> connect --workspace <id>` — registers this machine
-  as a computer for the workspace and runs the host daemon. Agents are then
-  assigned to the computer from the web.
+  `npx --yes kylon-cli@<tag> auth login --workspace <id>` — authorizes this
+  installation for human workspace commands. Its **Use with Your Agents**
+  prompt teaches Claude Code, Codex, Hermes, or OpenClaw to discover and use
+  `kylon workspace` commands without assuming a provider-specific interface.
 - **An external agent's Settings page** (and the create-agent flow) shows
-  `npx --yes kylon-cli@<tag> connect --url '<setup url>'` — same registration,
-  plus the named agent is assigned to this computer in the same run. The setup
-  URL carries intent only (workspace + agent), never a credential, and expires
-  after an hour.
-
-Both commands browser-authenticate the operator, enroll the computer (minting a
-machine-scoped credential stored locally with mode `0600`), and start the host
-daemon. In release builds on supported hosts a user-level
+  `npx --yes kylon-cli@<tag> connect --url '<setup url>'` — authorizes the
+  installation when needed, registers it as a computer, and assigns the named
+  agent in the same run. The setup URL carries intent only (workspace + agent),
+  never a credential, and expires after an hour.
+
+Both commands browser-authenticate the operator. Only `connect` enrolls the
+computer (minting a machine-scoped credential stored locally with mode `0600`)
+and starts the host daemon. In release builds on supported hosts a user-level
 `launchd` / `systemd --user` service is installed so the daemon survives
 terminal exit, reboot, and sleep/wake; otherwise the daemon runs in the
 foreground until `Ctrl+C`.
@@ -85,7 +86,7 @@ workspace's **Settings → Kylon CLI** section, expand it, and copy its setup
 command, or run:
 
 ```bash
-npm install -g kylon-cli@latest && kylon auth login --workspace <WORKSPACE_ID>
+npx --yes kylon-cli@latest auth login --workspace <WORKSPACE_ID>
 ```
 
 The CLI opens Kylon in your browser. After you sign in, confirm the installation
@@ -142,9 +143,17 @@ Logout revokes the selected installation credential remotely before removing
 that entry from the local collection. With no `--workspace`, it selects the most
 recently authorized entry. If Kylon cannot confirm revocation, it keeps the local
 credential so you can retry. `kylon auth logout --local-only` deliberately skips
-the remote revocation. You can also revoke any installation independently from
-**Settings → Kylon CLI**. Other installations, browser sessions, external-agent
-keys, and workspace service keys are unaffected.
+the remote revocation. This logout is deliberately credential-only: it does not
+disconnect a computer or unassign its agents. If that installation still hosts
+external agents, it remains listed as an **Authorized device** so its host
+authority can still be removed without signing the CLI in again.
+
+You can instead remove an **Authorized device** from **Settings → Kylon CLI**.
+After warning about the impact, that workspace-scoped action revokes any active
+installation credential, disconnects and revokes the computer host associated
+with the same installation, and unassigns every external agent hosted there.
+The device's authorizations and host registrations in other workspaces, browser
+sessions, and workspace service keys are unaffected.
 
 Credentials created by the earlier browser flow appear as **Legacy user API
 key** in Settings. They can be revoked there, but they are not bound to a single
@@ -155,7 +164,7 @@ workspace; sign in again to replace one with the per-installation flow.
 `kylon connect` is the single onboarding entrypoint.
 
 ```bash
-# From Workspace Settings — register this machine, assign agents from the web:
+# Register this machine directly, then assign agents from the web:
 npx --yes kylon-cli@latest connect --workspace <WORKSPACE_ID>
 
 # From an agent's page — register this machine AND assign that agent to it: