@sailorbridge/client 0.2.4 → 0.2.5

package/README.md

@@ -89,10 +89,13 @@ sailorbridge --help
 sailorbridge login
 sailorbridge upgrade
 sailorbridge workflow
-sailorbridge mailbox peek "$SAILORBRIDGE_AGENT_NAME"
+sailorbridge mailbox peek
+sailorbridge mailbox claim
+sailorbridge reply --in-reply-to MESSAGE_ID REPLY --body-file ./reply.txt
 sailorbridge mailbox ack MESSAGE_ID --lease-token LEASE_TOKEN
 printf '%s\n' 'hello $USER `date` $(pwd)' | sailorbridge mailbox send --to-agents ab_hand --tag BTW
-sailorbridge mailbox send --to-roles reviewer --session ab --tag PLAN-REVIEW --body-file ./plan.txt
+sailorbridge mailbox send --to-roles reviewer --tag PLAN-REVIEW --body-file ./plan.txt
+sailorbridge mailbox send --to-agents captain --tag REPORT --body-file ./report.txt
 sailorbridge enrollment --session ab --agent ab_hand --roles operator
 sailorbridge host register
 sailorbridge host consume --once --dry-run-start
@@ -101,8 +104,8 @@ sailorbridge host service status
 sailorbridge worker list
 sailorbridge worker run --worker dev-1 -- uname -s
 sailorbridge worker job JOB_ID
-sailorbridge worker serve --worker dev-1 --workdir "$PWD"
-sailorbridge supervise --agent ab_hand --cli codex --cwd "$PWD" --i-own-this-agent
+sailorbridge worker serve
+sailorbridge supervise --cli codex --cwd "$PWD" --i-own-this-agent
 ```
 
 `worker list`, `worker run`, and `worker job` are member-runtime commands;
@@ -132,7 +135,7 @@ The package installs a `sailorbridge` bin after build:
 ```bash
 bun run build
 node dist/src/cli.js workflow
-node dist/src/cli.js mailbox peek "$SAILORBRIDGE_AGENT_NAME"
+node dist/src/cli.js mailbox peek
 ```
 
 Build a native standalone binary for the current host:
@@ -298,11 +301,11 @@ non-destructive command. Add `--lease` to a claim only to include rows already
 leased by this client. A supervisor peek leaves workflow-obligation messages
 queued and claimable after it surfaces the body-free doorbell. The bound agent's
 first `mailbox claim` leases them, then the agent completes the required action.
-Direct workflow messages are acknowledged with the lease token returned by the
-claim. Durable task sources are acknowledged by their successful task
-transition, while task terminal replies and `UNPARKED` are auto-acked after
-delivery. Ordinary and control messages keep their existing acknowledgement
-behavior.
+Plain claims expose every lease token. `HUMAN` and `MAIL` stay leased so
+`reply --in-reply-to` can infer the sender and atomically record the reply plus
+source ACK; untagged peer mail is shown and handled as `MAIL`.
+`--no-ack` leaves the source leased. Other direct workflow messages
+retain their manual ACK or durable-transition settlement.
 
 Mailbox send is footgun-free by construction: message bodies are read only from
 piped stdin or `--body-file`, never from positional argv. Every `--body-file` and
@@ -312,8 +315,9 @@ that another selected source would discard is rejected instead of silently
 ignored; commands without a stdin contract reject it before any relay request.
 This prevents the local
 shell from expanding `$VARS`, backticks, or `$()` before the client starts. A
-single `--to-agents A` sends directly to that agent even when `--session` is also
-present. Multiple explicit agents use the session mailbox endpoint. `--to-agents`
+single `--to-agents A` sends directly to that agent, except reserved `captain`,
+which uses the session transcript endpoint. Multiple explicit agents use the
+session mailbox endpoint. `--to-agents`
 is mutually exclusive with `--to-roles` and `--to-host`; combine roles and host
 when filtering registered agents. An empty pipe sends an empty string body; an
 interactive TTY with no pipe fails fast instead of waiting for typed input.
@@ -341,10 +345,10 @@ interactive pane. Host-started agents use readable session names such as
 `sb-<team>-<role>` and append the captain number only when that default already
 exists on the host.
 
-Tmux launch environment is passed through tmux process mechanisms (`-e` and the
-child process environment), never as `KEY=value command` text typed into the
-pane. That still has the normal short-lived process-list exposure of command
-arguments; cleaner secret delivery belongs to a later transport release.
+Tmux launch environment is handed directly to the new pane through a private,
+one-shot FIFO. The pane imports it immediately before `exec`; bearer values
+never enter tmux argv, the tmux environment store, pane input, or a regular
+credential file.
 
 SDK drivers are optional implementation code and are release-gated from the
 public Phase 1 CLI. A base install or tmux-only caller does not need to
@@ -391,6 +395,16 @@ channel must have one owner, otherwise mailbox leases can be stolen. Use
 `sailorbridge supervise` only for agents not already driven by another
 listener/supervisor.
 
+Context auto-checkpoint (tmux transport, claude/codex): the supervisor reads
+the context percentage from the pane every ~20s and, at or above the agent's
+configured `context_checkpoint_percent` (console setting; `0` disables,
+default 75), posts one self-addressed `SAVE-CONTEXT`. The mailbox loop then
+cues the `save_ctx` skill, waits for `SAVE-CONTEXT-DONE`, and replays
+`/clear` plus the `resume_ctx` cue. Threshold changes made in the console
+take effect live through the `reload_context_autopilot` resolve command.
+Semantics match the engine listener's autopilot (same thresholds, same
+armed-below/fire-once water-mark).
+
 Default transport selection:
 
 | CLI | Default transport | Default command |
@@ -448,7 +462,7 @@ message. Persistent relay errors back off instead of spinning.
 The CLI entrypoint is explicit about ownership:
 
 ```bash
-sailorbridge supervise --agent A --cli codex --cwd /repo --i-own-this-agent
+sailorbridge supervise --cli codex --cwd /repo --i-own-this-agent
 ```
 
 `--i-own-this-agent` is required as a runtime collision guard. For tmux launches,