pando-ai 0.2.3 → 0.2.4

package/README.md

@@ -117,6 +117,40 @@ context. Gateway mode is an additional full-wire layer for request/response
 inspection, memory, and provider-bound enforcement; hooks still run when the
 gateway is active.
 
+#### Enabling gateway mode
+
+Gateway mode starts only when Claude Code gateway credentials are present and
+`[proxy].claude = "enforce"`. Provide one of:
+
+```bash
+# Environment variable (highest precedence)
+export ANTHROPIC_API_KEY=sk-ant-...
+# …or an auth token
+export ANTHROPIC_AUTH_TOKEN=...
+```
+
+For local development you can keep the key in a git-ignored `.env` at the repo
+root and source it before launching:
+
+```bash
+# .env  (already git-ignored — never commit it)
+ANTHROPIC_API_KEY=sk-ant-...
+
+export $(grep -v '^#' .env | xargs)   # load it into the shell
+claude -p 'hello'                     # Pando supervises + routes via gateway
+```
+
+A `apiKeyHelper` configured in Claude Code settings works as well. With any of
+these present Pando logs `gateway listening on http://127.0.0.1:<port>
+(memory=off)` and sets `ANTHROPIC_BASE_URL` for the child `claude` process.
+Without them, Pando falls back to hooks-only enforcement over subscription OAuth.
+
+The gateway forwards the Anthropic Messages and OpenAI Responses APIs
+transparently, including compressed upstream responses: `fetch` decodes the
+`content-encoding` (gzip/brotli) before Pando inspects or rewrites the body, and
+the gateway emits the decoded, identity-encoded bytes — it never re-advertises a
+`content-encoding` it isn't sending.
+
 ### Provider proxy toggle
 
 Users can enable or disable the local provider proxy per supervised tool:
@@ -147,6 +181,7 @@ provider-bound gateway enforcement is disabled.
 ```bash
 pando-ai                 # firewall console (TTY): status + proactive install
 pando-ai install         # force a (re)install pass
+pando-ai uninstall       # remove Pando shims, managed PATH block, and install state
 pando-ai serve [path]    # stdio MCP server for MCP clients
 pando-ai serve-http      # HTTP MCP server
 pando-ai gateway         # run the firewall gateway in the foreground (debug)
@@ -158,6 +193,25 @@ pando-ai config set telemetry false
 `pando-ai launch codex|claude -- <args>` is the supervised launcher the shims
 call; you don't run it directly.
 
+## Uninstall
+
+To stop supervising `codex` and `claude`:
+
+```bash
+pando-ai uninstall
+```
+
+This removes Pando-owned `codex`/`claude` shims from `~/.pando/bin`, removes
+the managed PATH block from your shell startup file when present, and deletes
+`~/.pando/state.json` so declined/install state does not suppress future setup
+prompts. It does not delete policy files, logs, or other user data.
+
+If you installed the npm package globally, remove it separately:
+
+```bash
+npm uninstall -g pando-ai
+```
+
 ## MCP serve mode
 
 When invoked without a TTY (e.g. spawned by an MCP client) `pando-ai` starts the