Ship trust-first CLI and runtime defaults

README.md

@@ -45,6 +45,8 @@ The package ships the embedded Firecracker runtime and a package-controlled envi
 Official environments are pulled as OCI artifacts from public Docker Hub repositories into a local
 cache on first use or through `pyro env pull`.
 End users do not need registry credentials to pull or run official environments.
+The default cache location is `~/.cache/pyro-mcp/environments`; override it with
+`PYRO_ENVIRONMENT_CACHE_DIR`.
 
 ## CLI
 
@@ -63,13 +65,13 @@ pyro env pull debian:12
 Run one command in an ephemeral VM:
 
 ```bash
-pyro run debian:12 --vcpu-count 1 --mem-mib 1024 -- git --version
+pyro run debian:12 -- git --version
 ```
 
 Run with outbound internet enabled:
 
 ```bash
-pyro run debian:12 --vcpu-count 1 --mem-mib 1024 --network -- \
+pyro run debian:12 --network -- \
   "git clone --depth 1 https://github.com/octocat/Hello-World.git hello-world && git -C hello-world rev-parse --is-inside-work-tree"
 ```
 
@@ -77,8 +79,13 @@ Show runtime and host diagnostics:
 
 ```bash
 pyro doctor
+pyro doctor --json
 ```
 
+`pyro run` defaults to `1 vCPU / 1024 MiB`.
+It fails closed when guest boot or guest exec is unavailable.
+Use `--allow-host-compat` only if you explicitly want host execution.
+
 Run the deterministic demo:
 
 ```bash
@@ -103,8 +110,6 @@ pyro = Pyro()
 result = pyro.run_in_vm(
     environment="debian:12",
     command="git --version",
-    vcpu_count=1,
-    mem_mib=1024,
     timeout_seconds=30,
     network=False,
 )
@@ -119,8 +124,6 @@ from pyro_mcp import Pyro
 pyro = Pyro()
 created = pyro.create_vm(
     environment="debian:12",
-    vcpu_count=1,
-    mem_mib=1024,
     ttl_seconds=600,
     network=True,
 )
@@ -144,12 +147,12 @@ print(pyro.inspect_environment("debian:12"))
 
 Primary agent-facing tool:
 
-- `vm_run(environment, command, vcpu_count, mem_mib, timeout_seconds=30, ttl_seconds=600, network=false)`
+- `vm_run(environment, command, vcpu_count=1, mem_mib=1024, timeout_seconds=30, ttl_seconds=600, network=false, allow_host_compat=false)`
 
 Advanced lifecycle tools:
 
 - `vm_list_environments()`
-- `vm_create(environment, vcpu_count, mem_mib, ttl_seconds=600, network=false)`
+- `vm_create(environment, vcpu_count=1, mem_mib=1024, ttl_seconds=600, network=false, allow_host_compat=false)`
 - `vm_start(vm_id)`
 - `vm_exec(vm_id, command, timeout_seconds=30)`
 - `vm_stop(vm_id)`
@@ -180,6 +183,7 @@ The package ships an embedded Linux x86_64 runtime payload with:
 
 No system Firecracker installation is required.
 `pyro` installs curated environments into a local cache and reports their status through `pyro env inspect` and `pyro doctor`.
+The public CLI is human-readable by default; add `--json` for structured output.
 
 ## Contributor Workflow