kylon-cli 0.7.4 → 0.7.5-next.1055

package/README.md

@@ -616,6 +616,20 @@ subsequent commands are plain `kylon workspace ...` with no npx.
 The collection keeps credentials separately by server and workspace, and
 `--scope-workspace` selects the matching entry.
 
+App source checkouts configure a Git credential helper automatically. After
+`kylon workspace app checkout`, ordinary `git push origin draft/<slug>` uses
+the current credential without a manual token export. Environment credentials
+(including `KYLON_GIT_TOKEN`) take precedence; human CLI checkouts can fall back
+to the saved credential matching the checkout's API server and workspace.
+The helper reads the current file on every request, so login rotation takes
+effect without re-exporting a key. The default file is
+`~/.kylon/workspace-auth.json`; with `XDG_CONFIG_HOME` set it is
+`$XDG_CONFIG_HOME/kylon/workspace-auth.json`. Kylon Agent runtimes and
+Agent-created checkouts never fall back to the operator's saved identity.
+Credentials are returned only for the exact checkout remote, never written
+into Git configuration. Re-run checkout from its non-Git parent directory to
+upgrade an existing checkout's helper.
+
 Each installation credential expires after 90 days. Re-running `kylon auth
 login` for the same installation and workspace rotates that credential, making
 the previous value invalid. Use `kylon status` to inspect the active user,
@@ -640,25 +654,18 @@ kylon workspace connection list --toolkit custom-api-key --scope-workspace <WORK
 kylon workspace connection run --connection <CONNECTION_ID> -- curl https://api.example.com/resource
 ```
 
-The `kylon workspace secret` noun is retired: every verb only prints its
-Connection replacement, accepts no secret value, and changes nothing.
-
-There is intentionally no top-level `kylon secret` command. The namespace
-selects the resource and identity without inspecting unrelated local credential
-state:
-
-- Use `kylon workspace connection list|create|credential set|access request|run`
-  for API-key Connections with browser authorization; the retired
-  `kylon workspace secret` verbs only print those replacements.
-- Use `kylon gateway secret list|delete --agent <agent-id>` for agent-local
-  records, authenticated by this installation's saved runtime credential
-  through agent-scoped runtime routes. There is no `set`: a credential is
-  stored as a Custom API Service from the agent's setup card or from
-  Connections in Kylon, and the agent reads it from its environment.
+Use `kylon workspace connection list|create|credential set|access request|run`
+for API-key Connections. There is no secret command any more:
 
-This separation prevents browser credentials from reaching the
-daemon-authenticated secret endpoints and avoids state-dependent command
-routing.
+- There is intentionally no top-level `kylon secret` command.
+- The `kylon workspace secret` noun is retired: every verb only prints its
+  Connection replacement, accepts no secret value, and changes nothing.
+- `kylon gateway secret` is retired too: an agent keeps no secrets of its
+  own, so `list`, `set` and `delete` make no request and only print the
+  Connection command that replaced them. A credential is stored as a Custom
+  API Service from the agent's setup card or from Connections in Kylon, the
+  agent reads it from its environment, and the person who manages the
+  service removes it.
 
 ```bash
 kylon auth logout --workspace <WORKSPACE_ID>
@@ -799,7 +806,10 @@ back to another saved identity.
   `onboard`) report anonymously only when they fail, with the setup session id
   from the link inspection and the stage they reached, and switch to the
   credential they obtain. Other commands never fall back to anonymous
-  submission when authentication fails.
+  submission when authentication fails. An anonymous report goes to
+  `--server-url` when given; without it, `agent link` reports to the server its
+  link names, and the other anonymous commands to the default server (the
+  server env vars, then the URL the install script recorded, then production).
 
 Telemetry initialization calls the installation store's `ensure()`:
 `install.json` in the CLI configuration directory holds the random `installId`,
@@ -807,7 +817,13 @@ sent as `install_id` on every record. It is created before login and reused
 across runs; deleting the file resets it, copying the configuration can
 duplicate it. It identifies an installation, not a device or a person, so these
 are pseudonymous diagnostics. If the installation cannot be read or created,
-telemetry stays off.
+records go out without `install_id`; anonymous ones require it and stay local.
+An entry that cannot be read, is not a regular file, or does not hold a valid
+`cli_…` id counts as damaged and is never replaced, because a saved computer
+connection records the id. Commands that need it (`agent link`, `connect`,
+`onboard`, `login`) stop, name the file, and print commands that first rename
+the entry aside (which never follows a link), then restore the recorded id or
+start over. A link to a valid file is read through, never written.
 
 Set `KYLON_TELEMETRY_DISABLED=1` in the CLI/daemon process environment to turn
 the whole channel off; local diagnostic logs are unchanged. Restart a running

package/dist/kylon-bundle.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.7.4",
-  "fingerprint": "6ec1a3a1fb80b0bd5013a9f91fe0e8f6c2decf1fd35e978e354e4fa7858ea743",
-  "source_commit": "6d43cb57011dd3a168a04a1c631acfc018c9a5c3"
+  "version": "0.7.5-next.1055",
+  "fingerprint": "e86142fe5ecf522a341ac9f57899e62f47e2792e9cf51d6e4b1e946e43ff1f5f",
+  "source_commit": "44ff32fc976468563b5e923680f37ce8f888d775"
 }