1 files changed, 23 insertions, 3 deletions
diff --git a/docs/USERGUIDE.md b/docs/USERGUIDE.md
index 09d264e..d66e757 100644
--- a/docs/USERGUIDE.md
+++ b/docs/USERGUIDE.md
@@ -230,8 +230,8 @@ twice. That window belongs to the application, so nothing displayed in the page
 
 ### The command-line client
 
-`meshbay-cli` reaches your groups' files from a terminal — a server, a script, a
-machine with no desktop. It is a package of its own on Linux (`meshbay-cli`,
+`meshbay-cli` reaches your groups and their files from a terminal — a server,
+a script, a machine with no desktop. It is a package of its own on Linux (`meshbay-cli`,
 with a manual page: `man meshbay-cli`), and comes with the desktop
 application's full installer on Windows (not with the light one).
 
@@ -261,7 +261,27 @@ can read, which `login` tells you.
 The first time it opens a group, the client may print a linking code instead
 of the files: the node holds no copy of your keys (Browser access is off), so
 this computer asks to be added as one of your devices. Enter the code in the
-application under *Your devices on this node*; the client goes on by itself.
+application under *Your devices on this node*, or run
+`meshbay-cli devices approve GROUP CODE` on a computer already linked; the
+client goes on by itself.
+
+Joining and leaving work as in the application (§4):
+
+```bash
+meshbay-cli invitations                       # what you were invited to
+meshbay-cli join Family@bob --code K7P2-9WQX  # accept, then give the node its code
+meshbay-cli join 'https://meshbay.org/#/invite?v=1&...'   # a link, pasted as sent
+meshbay-cli decline Club@carol
+meshbay-cli leave Club@carol                  # asks first; --yes in a script
+```
+
+`meshbay-cli devices list GROUP` shows your devices on the node serving a group;
+`devices approve` admits a new one by its code, `devices revoke` retires one.
+
+Like the application, the client keeps your keys to itself: a browser cannot
+open, with your passphrase alone, a group you joined from it. To allow that, as
+*Browser access* does in the application, run `meshbay-cli browser-access on`
+on that computer; `off` takes the copy back. It is that computer's setting.
 
 Managing a node is not the client's job: that is `meshbay-node` (§6).