Script to renew every host's gateway session over SSH

README.md

@@ -46,8 +46,9 @@ docker exec -it wristcode-gateway wristcode device revoke <id or name>
 
 The gateway exchanges the credential for a 30 day T3 session limited to reading and driving
 threads, so the long-lived token never leaves the gateway. T3 sessions cannot be refreshed. A week
-before one expires, the watch gets a notification, and running `host add` again with a fresh
-credential renews it.
+before one expires, the watch gets a notification. [`scripts/renew-hosts.sh`](scripts/renew-hosts.sh)
+renews every host in one go over SSH, passing each one-time credential straight to the gateway
+without printing it. Edit its host list to match your machines.
 
 For local development, run `bun --watch src/main.ts` in `gateway/` with `WRISTCODE_DB` pointing at
 a scratch file. Without APNs settings, pushes are logged instead of sent.