@superjackfruitlabs/salaam 0.0.1 → 0.0.2

package/dist/src/cli.js

@@ -1,23 +1,28 @@
 #!/usr/bin/env node
 import { acp } from './acp.js';
 import { homedir } from 'node:os';
-import { join, resolve } from 'node:path';
+import { join, resolve, dirname } from 'node:path';
 import { spawn } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
+import { randomUUID, randomBytes } from 'node:crypto';
+import { digest, object } from './protocol.js';
 import { fileURLToPath } from 'node:url';
-import { mkdirSync, openSync, closeSync, readFileSync } from 'node:fs';
+import { mkdirSync, openSync, closeSync, readFileSync, realpathSync, writeFileSync, fsyncSync, } from 'node:fs';
 import { VERSION } from './config.js';
 import { cliHelp, hasHelpFlag } from './cli-help.js';
 import { SalaamService } from './service.js';
 import { call } from './transport.js';
 import { attach, acquireControl, Outbox } from './attach.js';
-import { providerRoute } from './provider-config.js';
-import { credentialPath, loadApiKey, readSecret, saveApiKey } from './credentials.js';
+import { providerRoute, PI_PROVIDERS, getProvider, providerHasOutputCap, } from './provider-config.js';
+import { readSecret, validateApiKey } from './credentials.js';
+import { authDirectory, ProviderCredentialStore, providerModels, loginProvider, resolveProviderAuth, } from './provider-auth.js';
+import { bindProviderConfiguration } from './provider-model.js';
+import { createInterface } from 'node:readline/promises';
 import { canonical } from './protocol.js';
 import { SocketEffectConnector } from './effect-connector.js';
 import { proveExecutionBoundary } from './execution-proof.js';
 import { BoundaryBroker, engineRequest } from './execution-boundary.js';
 import { workspaceDiff } from './workspace-diff.js';
+import { probeHarness, HARNESS_TARGETS, } from './harness-probe.js';
 async function main() {
     const args = process.argv.slice(2);
     if (args[0] === '--version' || args[0] === '-V' || args[0] === 'version') {
@@ -54,6 +59,334 @@ async function main() {
         args.splice(args.indexOf('--foreground'), 1);
     const socket = join(state, 'operator.sock');
     const [group, verb, id] = args;
+    if (group === 'a2a' && verb === 'credential') {
+        const file = option('--file');
+        if (!id || !file)
+            throw Error('Supply PEER_ID and --file NEW_OWNER_ONLY_FILE');
+        const { a2aIdentity } = await import('./a2a-peer.js');
+        a2aIdentity(id);
+        const path = resolve(file), value = { peer: id, token: randomBytes(32).toString('base64url') };
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        const fd = openSync(path, 'wx', 0o600);
+        try {
+            writeFileSync(fd, JSON.stringify(value) + '\n');
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        console.log(JSON.stringify({ peer: id, file: realpathSync(path), credential_digest: digest(value) }, null, 2));
+        return;
+    }
+    if (group === 'a2a' && verb === 'discover') {
+        const peer = option('--peer'), endpoint = option('--endpoint'), card_url = option('--card-url'), credential = option('--credential-file'), addresses = option('--addresses');
+        if (!peer || !endpoint || !card_url || !credential || !addresses)
+            throw Error('Supply --peer, --endpoint, --card-url, --credential-file and --addresses');
+        const { privateJSON, validatePeer, A2AHttp } = await import('./a2a-peer.js');
+        const credential_file = realpathSync(resolve(credential)), value = privateJSON(credential_file);
+        const pin = validatePeer({
+            id: peer,
+            endpoint,
+            card_url,
+            card_digest: digest(null),
+            tenant: option('--tenant') ?? '',
+            skill: 'pending-review',
+            addresses: addresses.split(','),
+            local: args.includes('--local'),
+            credential_file,
+            credential_digest: digest(value),
+            files: [],
+            retention: 'unknown',
+            cancel: false,
+            streaming: false,
+        });
+        console.log(JSON.stringify(await new A2AHttp(pin).request(card_url), null, 2));
+        return;
+    }
+    if (group === 'a2a' && verb === 'pin') {
+        const peer = option('--peer'), endpoint = option('--endpoint'), cardFile = option('--card-file'), credential = option('--credential-file'), addresses = option('--addresses'), skill = option('--skill');
+        if (!peer || !endpoint || !cardFile || !credential || !addresses || !skill)
+            throw Error('Supply --peer, --endpoint, --card-file, --credential-file, --addresses and --skill');
+        const { privateJSON, validatePeer, A2AHttp } = await import('./a2a-peer.js');
+        const card = JSON.parse(readFileSync(resolve(cardFile), 'utf8')), credential_file = realpathSync(resolve(credential)), value = privateJSON(credential_file), card_url = option('--card-url');
+        if (!card_url)
+            throw Error('Supply the exact --card-url that was reviewed');
+        const pin = validatePeer({
+            id: peer,
+            endpoint,
+            card_url,
+            card_digest: digest(card),
+            tenant: option('--tenant') ?? '',
+            skill,
+            addresses: addresses.split(','),
+            local: args.includes('--local'),
+            credential_file,
+            credential_digest: digest(value),
+            files: option('--files')?.split(',').filter(Boolean) ?? [],
+            retention: option('--retention') ?? 'unknown',
+            cancel: args.includes('--supports-cancel'),
+            streaming: args.includes('--supports-streaming'),
+        });
+        new A2AHttp(pin).assertCard(card);
+        console.log(JSON.stringify(pin, null, 2));
+        return;
+    }
+    if (group === 'a2a' && verb === 'grant') {
+        const assignment = option('--assignment'), peer = option('--peer'), credential = option('--credential-file');
+        if (!assignment || !peer || !credential)
+            throw Error('Supply --assignment, --peer and --credential-file');
+        const { privateJSON } = await import('./a2a-peer.js');
+        const credential_file = realpathSync(resolve(credential)), value = object(privateJSON(credential_file));
+        if (value.peer !== peer ||
+            Object.keys(value).sort().join(',') !== 'peer,token' ||
+            typeof value.token !== 'string' ||
+            !/^[A-Za-z0-9._~-]{32,512}$/.test(value.token))
+            throw Error('Use a dedicated peer credential JSON {peer,token}');
+        const peerClient = option('--peer-client');
+        if (peerClient && peerClient !== 'openclaw-2026.10.5')
+            throw Error('Only the explicitly pinned OpenClaw client adapter is available');
+        const binding = await call(socket, `/v1/a2a/grants/${encodeURIComponent(assignment)}`);
+        console.log(JSON.stringify({
+            peer,
+            tenant: option('--tenant') ?? '',
+            skill: option('--skill') ?? 'review',
+            assignment_id: assignment,
+            binding_digest: digest(binding),
+            credential_file,
+            credential_digest: digest(value),
+            ...(peerClient ? { client: peerClient } : {}),
+        }, null, 2));
+        return;
+    }
+    if (group === 'a2a' && verb === 'peers') {
+        console.log(JSON.stringify((await call(socket, '/v1/harnesses')).filter((r) => r.kind === 'a2a'), null, 2));
+        return;
+    }
+    if (group === 'harness' && verb === 'probe') {
+        const path = option('--pin');
+        if (!path)
+            throw new Error('Supply an operator-reviewed --pin FILE');
+        const pin = JSON.parse(readFileSync(resolve(path), 'utf8'));
+        console.log(JSON.stringify(await probeHarness(pin), null, 2));
+        return;
+    }
+    if (group === 'harness' && verb === 'prepare') {
+        const path = option('--runtime-root'), arch = option('--arch');
+        if (!path || !arch)
+            throw Error('Supply a new --runtime-root and execution-host --arch');
+        const { prepareHarnessRuntime } = await import('./harness-prepare.js');
+        console.log(JSON.stringify(await prepareHarnessRuntime(path, arch), null, 2));
+        return;
+    }
+    if (group === 'harness' && verb === 'config') {
+        const target = option('--target'), path = option('--runtime-root');
+        if (!target || !Object.hasOwn(HARNESS_TARGETS, target) || !path)
+            throw Error('Supply a named --target and dedicated --runtime-root');
+        const runtime_root = realpathSync(resolve(path));
+        const { assertHarnessArtifactRoot, harnessRuntimeDigest } = await import('./harness-backend.js');
+        assertHarnessArtifactRoot(runtime_root);
+        console.log(JSON.stringify({
+            schema: 1,
+            runtimes: [
+                {
+                    id: option('--id') ?? target,
+                    target,
+                    version: HARNESS_TARGETS[target].version,
+                    runtime_root,
+                    runtime_digest: await harnessRuntimeDigest(runtime_root),
+                    model: 'claude-sonnet-4-6',
+                    output: 4096,
+                    requests: 12,
+                },
+            ],
+        }, null, 2));
+        return;
+    }
+    if (['harness', 'a2a'].includes(group ?? '') &&
+        ['list', 'inspect', 'reconcile'].includes(verb ?? '')) {
+        if (verb === 'list') {
+            console.log(JSON.stringify(await call(socket, '/v1/harnesses'), null, 2));
+            return;
+        }
+        if (!id)
+            throw Error('Supply an external CHILD_ID');
+        const current = await call(socket, `/v1/harnesses/${id}`);
+        if (verb === 'inspect') {
+            console.log(JSON.stringify(current, null, 2));
+            return;
+        }
+        const run_id = option('--run-id');
+        if (!run_id)
+            throw Error('Supply the exact --run-id from harness inspect');
+        const client_id = randomUUID(), owner = current.child.parent_session, lease = await acquireControl(socket, owner, client_id, args.includes('--takeover'));
+        try {
+            console.log(JSON.stringify(await call(socket, `/v1/harnesses/${id}/reconcile`, {
+                client_id,
+                token: lease.token,
+                run_id,
+                request_id: option('--request-id') ?? randomUUID(),
+            }), null, 2));
+        }
+        finally {
+            await call(socket, `/v1/sessions/${owner}/control`, {
+                request_id: randomUUID(),
+                client_id,
+                token: lease.token,
+                action: 'release',
+                expected_epoch: lease.epoch,
+            }).catch(() => { });
+        }
+        return;
+    }
+    if (group === 'workers') {
+        if (!id)
+            throw new Error('Supply a child or integration receipt ID');
+        if (verb === 'proposal' || verb === 'integration') {
+            const result = await call(socket, verb === 'proposal'
+                ? `/v1/workers/${id}/proposal?offset=${Number(option('--offset') ?? 0)}`
+                : `/v1/integrations/${id}`);
+            if (verb === 'proposal' && !args.includes('--json')) {
+                const { changes, diff, ...metadata } = result;
+                console.log(JSON.stringify({
+                    ...metadata,
+                    files: changes.map((c) => ({
+                        path: c.path,
+                        before_hash: digest(c.before),
+                        after_hash: digest(c.after),
+                    })),
+                }, null, 2));
+                for (const patch of diff)
+                    console.log(patch);
+            }
+            else
+                console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        if (!['integrate', 'resolve'].includes(verb ?? ''))
+            throw new Error('Use workers proposal, integrate, integration or resolve');
+        const owner = verb === 'integrate'
+            ? (await call(socket, `/v1/children/${id}`)).parent_session
+            : (await call(socket, `/v1/integrations/${id}`)).parent_session;
+        const revision = option('--revision'), workspace_digest = option('--root-digest'), patch_digest = option('--patch-digest');
+        if (revision === undefined || !workspace_digest || (verb === 'integrate' && !patch_digest))
+            throw new Error('Supply reviewed --revision N, --root-digest SHA256 and --patch-digest SHA256 for integration');
+        const client_id = randomUUID(), lease = await acquireControl(socket, owner, client_id, args.includes('--takeover'));
+        try {
+            const result = await call(socket, verb === 'integrate' ? `/v1/workers/${id}/integrate` : `/v1/integrations/${id}/resolve`, {
+                client_id,
+                token: lease.token,
+                request_id: option('--request-id') ?? randomUUID(),
+                workspace_revision: Number(revision),
+                workspace_digest,
+                patch_digest,
+            });
+            console.log(JSON.stringify(result, null, 2));
+        }
+        finally {
+            await call(socket, `/v1/sessions/${owner}/control`, {
+                request_id: randomUUID(),
+                client_id,
+                token: lease.token,
+                action: 'release',
+                expected_epoch: lease.epoch,
+            }).catch(() => { });
+        }
+        return;
+    }
+    if (group === 'team') {
+        if (!id)
+            throw new Error('Supply TASK_ID');
+        if (verb === 'show') {
+            console.log(JSON.stringify(await call(socket, `/v1/tasks/${id}/team`), null, 2));
+            return;
+        }
+        if (!['assign', 'run', 'reject', 'send', 'receive', 'ack'].includes(verb ?? ''))
+            throw new Error('Use team show, assign, run, send, receive or ack');
+        const task = await call(socket, `/v1/tasks/${id}`);
+        const client_id = randomUUID(), lease = await acquireControl(socket, task.session_id, client_id, args.includes('--takeover'));
+        try {
+            const assignment = option('--assignment');
+            if (['run', 'reject', 'receive', 'ack'].includes(verb) && !assignment)
+                throw new Error('Supply --assignment ID');
+            const revision = option('--revision'), generation = option('--generation');
+            if (['assign', 'run', 'reject'].includes(verb) && revision === undefined)
+                throw new Error('Supply the reviewed --revision N');
+            if (['run', 'reject'].includes(verb) && generation === undefined)
+                throw new Error('Supply the reviewed --generation N');
+            const path = assignment ? `${assignment}/${verb}` : verb;
+            const result = await call(socket, `/v1/tasks/${id}/team/${path}`, {
+                client_id,
+                token: lease.token,
+                request_id: option('--request-id') ?? randomUUID(),
+                expected_revision: revision === undefined ? undefined : Number(revision),
+                generation: generation === undefined ? undefined : Number(generation),
+                ...(verb === 'assign'
+                    ? {
+                        step_id: option('--step'),
+                        profile_id: option('--profile'),
+                        ...(() => {
+                            const runtime = option('--runtime');
+                            return runtime
+                                ? { runtime, invocations: Number(option('--invocations')) }
+                                : { requests: Number(option('--requests')) };
+                        })(),
+                    }
+                    : {}),
+                ...(verb === 'run'
+                    ? { instruction: option('--instruction'), continues_attempt_id: option('--continues') }
+                    : {}),
+                ...(verb === 'send' ? { recipient: option('--to'), text: option('--text') } : {}),
+                ...(verb === 'ack' ? { message_id: option('--message') } : {}),
+                ...(verb === 'reject' ? { reason: option('--reason') } : {}),
+            });
+            console.log(JSON.stringify(result, null, 2));
+        }
+        finally {
+            await call(socket, `/v1/sessions/${task.session_id}/control`, {
+                request_id: randomUUID(),
+                client_id,
+                token: lease.token,
+                action: 'release',
+                expected_epoch: lease.epoch,
+            }).catch(() => { });
+        }
+        return;
+    }
+    if (group === 'agents') {
+        const session = option('--session');
+        if (!session)
+            throw new Error('Supply --session SESSION_ID');
+        if (verb === 'list' || verb === 'inspect') {
+            console.log(JSON.stringify(await call(socket, `/v1/sessions/${session}/agents${verb === 'inspect' ? '?profile=' + encodeURIComponent(id ?? '') : ''}`), null, 2));
+            return;
+        }
+        if (!id || !['admit', 'revoke'].includes(verb ?? ''))
+            throw new Error('Use agents list, inspect, admit or revoke');
+        const client_id = randomUUID(), lease = await acquireControl(socket, session, client_id, args.includes('--takeover'));
+        try {
+            const expected_digest = option('--digest');
+            if (verb === 'admit' && !expected_digest)
+                throw new Error('Review agents inspect and supply --digest SHA256');
+            const fact_ids = option('--facts')?.split(',').filter(Boolean) ?? [];
+            const result = await call(socket, `/v1/sessions/${session}/agents/${verb}`, {
+                request_id: option('--request-id') ?? randomUUID(),
+                client_id,
+                token: lease.token,
+                ...(verb === 'admit' ? { profile_id: id, expected_digest, fact_ids } : { grant_id: id }),
+            });
+            console.log(JSON.stringify(result, null, 2));
+        }
+        finally {
+            await call(socket, `/v1/sessions/${session}/control`, {
+                request_id: randomUUID(),
+                client_id,
+                token: lease.token,
+                action: 'release',
+                expected_epoch: lease.epoch,
+            }).catch(() => { });
+        }
+        return;
+    }
     if (group === 'host') {
         const { planHost, readHost, hostUnit, runHost } = await import('./host.js');
         if (verb === 'plan') {
@@ -262,11 +595,127 @@ async function main() {
         await acp(state, { coding: args.includes('--coding') });
         return;
     }
-    if (group === 'auth' && verb === 'set' && id === 'anthropic') {
-        saveApiKey(await readSecret());
-        console.log('Claude API key saved to ' + credentialPath() + ' (mode 600).');
+    if (group === 'providers' && verb === 'list') {
+        console.log(JSON.stringify(PI_PROVIDERS.map((p) => ({
+            id: p.id,
+            name: p.name,
+            chat_models: p.getModels().length,
+            apis: [...new Set(p.getModels().map((m) => m.api))],
+            auth: [p.auth.apiKey ? 'api_key' : null, p.auth.oauth ? 'oauth' : null].filter(Boolean),
+            limitation: !p.getModels().length
+                ? 'Classifier only; no chat route'
+                : p.id === 'openai-codex'
+                    ? 'No provider-enforced output cap; tasks must explicitly disable token budgeting'
+                    : null,
+        })), null, 2));
         return;
     }
+    if (group === 'models' && verb === 'list') {
+        const providers = id ? [getProvider(id)] : PI_PROVIDERS;
+        if (providers.some((p) => !p))
+            throw new Error('Unknown Pi provider');
+        console.log(JSON.stringify(providers.flatMap((p) => p.getModels().map((m) => ({
+            provider: p.id,
+            id: m.id,
+            name: m.name,
+            api: m.api,
+            context_window: m.contextWindow,
+            max_output_tokens: m.maxTokens,
+        }))), null, 2));
+        return;
+    }
+    if (group === 'auth') {
+        const store = new ProviderCredentialStore();
+        if (verb === 'status') {
+            const models = providerModels(store), entries = id ? [getProvider(id)] : PI_PROVIDERS;
+            if (entries.some((p) => !p))
+                throw new Error('Unknown Pi provider');
+            const statuses = [];
+            for (const p of entries) {
+                try {
+                    const auth = await models.checkAuth(p.id);
+                    statuses.push({
+                        provider: p.id,
+                        configured: !!auth,
+                        type: auth?.type ?? null,
+                        source: auth?.source ?? null,
+                    });
+                }
+                catch {
+                    statuses.push({ provider: p.id, configured: false, error: 'Credential check failed' });
+                }
+            }
+            console.log(JSON.stringify(statuses, null, 2));
+            return;
+        }
+        if (!id || !getProvider(id))
+            throw new Error('Choose a provider from salaam providers list');
+        if (verb === 'logout') {
+            await store.delete(id);
+            console.log('Stored credential removed for ' + id + '. Environment credentials remain external.');
+            return;
+        }
+        if (verb === 'set') {
+            if (!getProvider(id).auth.apiKey)
+                throw new Error('This provider needs salaam auth login ' + id + ' --oauth');
+            const key = (await readSecret(id + ' API key (hidden): ')).trim();
+            if (!key ||
+                key.length > 4096 ||
+                /[^\x21-\x7e]/.test(key) ||
+                (id === 'anthropic' && key.includes('sk-ant-oat')))
+                throw new Error('Supply a provider API key, not an OAuth token');
+            if (id === 'anthropic')
+                validateApiKey(key);
+            await store.modify(id, async () => ({ type: 'api_key', key }));
+            console.log('API key saved privately for ' + id + ' under ' + authDirectory() + ' (mode 600).');
+            return;
+        }
+        if (verb === 'login') {
+            if (!process.stdin.isTTY)
+                throw new Error('Interactive login needs a terminal; use auth set PROVIDER for a piped API key');
+            const provider = getProvider(id);
+            const type = args.includes('--oauth') || !provider.auth.apiKey ? 'oauth' : 'api_key';
+            const interaction = {
+                async prompt(prompt) {
+                    if (prompt.type === 'secret')
+                        return readSecret(prompt.message + ' (hidden): ', prompt.signal);
+                    const rl = createInterface({ input: process.stdin, output: process.stderr });
+                    try {
+                        const choices = prompt.type === 'select'
+                            ? '\n' + prompt.options.map((v, i) => `${i + 1}. ${v.label} (${v.id})`).join('\n')
+                            : '';
+                        const answer = await rl.question(prompt.message + choices + '\n> ', {
+                            signal: prompt.signal,
+                        });
+                        return prompt.type === 'select' && /^\d+$/.test(answer)
+                            ? (prompt.options[Number(answer) - 1]?.id ?? answer)
+                            : answer;
+                    }
+                    finally {
+                        rl.close();
+                    }
+                },
+                notify(event) {
+                    if (event.type === 'auth_url')
+                        console.error('Open in your browser: ' +
+                            event.url +
+                            (event.instructions ? '\n' + event.instructions : ''));
+                    else if (event.type === 'device_code')
+                        console.error('Open ' + event.verificationUri + ' and enter ' + event.userCode);
+                    else
+                        console.error(event.message);
+                },
+            };
+            await loginProvider(id, type, interaction);
+            console.log('Signed in to ' +
+                id +
+                ' with ' +
+                type +
+                '. Restart the service to use a different provider route.');
+            return;
+        }
+        throw new Error('Run salaam auth --help');
+    }
     if (group === 'schedules' && verb) {
         if (verb === 'list' || (id && ['inspect', 'occurrences'].includes(verb))) {
             console.log(JSON.stringify(await call(socket, verb === 'list'
@@ -705,20 +1154,32 @@ async function main() {
         const model = option('--model');
         const cap = option('--max-output-tokens');
         const workspace = option('--workspace-id');
-        const route = providerRoute(provider, model, cap === undefined ? undefined : Number(cap), workspace);
+        let route = providerRoute(provider, model, cap === undefined ? undefined : Number(cap), workspace);
+        if (route.provider !== 'salaam-proof') {
+            const auth = await resolveProviderAuth(route);
+            if (cap !== undefined && !providerHasOutputCap(route, auth))
+                throw new Error('This authentication cannot enforce --max-output-tokens; omit it and explicitly disable token budgeting in task plans');
+            route = bindProviderConfiguration(route, auth);
+        }
         const effectSocket = option('--effect-socket');
         const opaque = args.includes('--effect-opaque');
-        const codingRoot = option('--coding-root'), codingSocket = option('--coding-socket');
+        const codingRoot = option('--coding-root'), codingSocket = option('--coding-socket'), harnessConfig = option('--harness-config'), a2aConfig = option('--a2a-config'), a2aListenConfig = option('--a2a-listen-config');
         if (foreground) {
             const service = await SalaamService.open({
                 stateDir: state,
                 providerRoute: route,
                 codingRoot: codingRoot ? resolve(codingRoot) : undefined,
                 codingSocket: codingSocket ? resolve(codingSocket) : undefined,
+                harnessConfig: harnessConfig ? resolve(harnessConfig) : undefined,
+                a2aConfig: a2aConfig ? resolve(a2aConfig) : undefined,
+                a2aListenConfig: a2aListenConfig ? resolve(a2aListenConfig) : undefined,
                 effectConnector: effectSocket
                     ? new SocketEffectConnector(resolve(effectSocket), { opaque })
                     : undefined,
             });
+            const warning = service.supervisor.providerCapabilities().warning;
+            if (warning)
+                console.error(warning);
             process.stdout.write(JSON.stringify({ socket, service: 'started' }) + '\n');
             for (const signal of ['SIGINT', 'SIGTERM'])
                 process.once(signal, () => {
@@ -744,8 +1205,6 @@ async function main() {
             console.log('Salaam service already running');
             return;
         }
-        if (route.provider === 'anthropic')
-            loadApiKey();
         mkdirSync(state, { recursive: true, mode: 0o700 });
         const fd = openSync(join(state, 'service.log'), 'a', 0o600);
         const child = spawn(process.execPath, [
@@ -764,12 +1223,17 @@ async function main() {
             ...(opaque ? ['--effect-opaque'] : []),
             ...(codingRoot ? ['--coding-root', resolve(codingRoot)] : []),
             ...(codingSocket ? ['--coding-socket', resolve(codingSocket)] : []),
+            ...(harnessConfig ? ['--harness-config', resolve(harnessConfig)] : []),
+            ...(a2aConfig ? ['--a2a-config', resolve(a2aConfig)] : []),
+            ...(a2aListenConfig ? ['--a2a-listen-config', resolve(a2aListenConfig)] : []),
         ], { detached: true, stdio: ['ignore', fd, fd] });
         closeSync(fd);
         child.unref();
         for (let i = 0; i < 150; i++) {
             try {
-                await call(socket, '/v1/health');
+                const health = await call(socket, '/v1/health');
+                if (health.provider_capabilities?.warning)
+                    console.error(health.provider_capabilities.warning);
                 console.log(JSON.stringify({ socket, service: 'started' }));
                 return;
             }

package/dist/src/config.js

@@ -2,6 +2,7 @@ import { readFileSync, existsSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { digest, textDigest } from './protocol.js';
+import { PI_PROVIDERS } from './provider-config.js';
 import { packageDigest } from './package-digest.js';
 let root = dirname(fileURLToPath(import.meta.url));
 while (!existsSync(join(root, 'pi-pin.json'))) {
@@ -16,7 +17,7 @@ export const PI_ROOT = resolve(dirname(fileURLToPath(import.meta.resolve('@earen
 export const PI_CLI = join(PI_ROOT, 'dist/bundle/cli.js');
 export const HOUSE_EXTENSION = join(ROOT, 'dist/src/house-extension.js');
 export const POLICY = {
-    version: 6,
+    version: 14,
     tools: [
         'salaam_probe',
         'salaam_review',
@@ -27,6 +28,9 @@ export const POLICY = {
         'salaam_history',
         'salaam_files',
         'salaam_command',
+        'salaam_repository',
+        'salaam_findings',
+        'salaam_team',
     ],
     children: {
         maxDepth: 1,
@@ -34,13 +38,21 @@ export const POLICY = {
         parentRequestBudget: 16,
         maxChildRequestBudget: 8,
         authority: ['salaam_probe'],
+        worker_boundary: 'frozen-native-model-request-v1',
+        specialist_profiles: 'operator-admitted-snapshot-v1',
+        team_claims: 'task-step-generation-v1',
+        daemon_workers: 8,
+        messages: 'passive-durable-explicit-ack-v1',
+        writing: 'owned-draft-explicit-hash-bound-integration-v1',
+        external: 'operator-pinned-whole-runtime-explicit-invocation-v1',
+        a2a: 'pinned-peer-one-turn-analysis-explicit-invocation-v1',
     },
     providers: [
         'salaam-proof/scripted',
-        'anthropic/claude-sonnet-5-5',
-        'anthropic/claude-sonnet-4-6',
+        ...PI_PROVIDERS.flatMap((provider) => provider.getModels().map((model) => provider.id + '/' + model.id)).sort(),
     ],
     provider_retries: 0,
+    task_token_budget: 'capped-default-explicit-null-opt-out-v1',
     compaction: { strategy: 'explicit-task-checkpoint-v1', automatic: false, keepRecentTokens: 512 },
     external_effects: 'explicit-connector-and-operation-approval',
     coding: {
@@ -72,9 +84,20 @@ export function bundleDigest() {
         policy: POLICY_DIGEST,
         lock: textDigest(readFileSync(lockPath, 'utf8')),
         house: textDigest(readFileSync(HOUSE_EXTENSION, 'utf8')),
+        provider_usage: textDigest(readFileSync(join(ROOT, 'dist/src/provider-usage.js'), 'utf8')),
+        provider_model: textDigest(readFileSync(join(ROOT, 'dist/src/provider-model.js'), 'utf8')),
+        live_provider: textDigest(readFileSync(join(ROOT, 'dist/src/live-provider.js'), 'utf8')),
+        provider_payload: textDigest(readFileSync(join(ROOT, 'dist/src/provider-payload.js'), 'utf8')),
+        provider_transport: textDigest(readFileSync(join(ROOT, 'dist/src/provider-transport.js'), 'utf8')),
+        provider_auth: textDigest(readFileSync(join(ROOT, 'dist/src/provider-auth.js'), 'utf8')),
         claude: textDigest(readFileSync(join(ROOT, 'dist/src/claude-provider.js'), 'utf8')),
         provider_config: textDigest(readFileSync(join(ROOT, 'dist/src/provider-config.js'), 'utf8')),
         protocol: textDigest(readFileSync(join(ROOT, 'dist/src/protocol.js'), 'utf8')),
+        worker_boundary: textDigest(readFileSync(join(ROOT, 'dist/src/worker-boundary.js'), 'utf8')),
+        agent_profiles: textDigest(readFileSync(join(ROOT, 'dist/src/agent-profiles.js'), 'utf8')),
+        team_work: textDigest(readFileSync(join(ROOT, 'dist/src/team-work.js'), 'utf8')),
+        worker_workspaces: textDigest(readFileSync(join(ROOT, 'dist/src/worker-workspaces.js'), 'utf8')),
+        repository_snapshots: textDigest(readFileSync(join(ROOT, 'dist/src/repository-snapshots.js'), 'utf8')),
         transport: textDigest(readFileSync(join(ROOT, 'dist/src/transport.js'), 'utf8')),
     });
 }

package/dist/src/credentials.js

@@ -58,7 +58,7 @@ export function saveApiKey(value, path = credentialPath()) {
         closeSync(directory);
     }
 }
-export async function readSecret() {
+export async function readSecret(label = 'Claude API key (hidden): ', signal) {
     if (!process.stdin.isTTY) {
         let input = '';
         for await (const chunk of process.stdin) {
@@ -68,13 +68,14 @@ export async function readSecret() {
         }
         return input;
     }
-    process.stderr.write('Claude API key (hidden): ');
+    process.stderr.write(label);
     const stdin = process.stdin, wasRaw = stdin.isRaw;
     stdin.setRawMode(true);
     stdin.resume();
     return new Promise((resolve, reject) => {
         let key = '';
         const done = (error) => {
+            signal?.removeEventListener('abort', aborted);
             stdin.off('data', data);
             stdin.setRawMode(wasRaw);
             stdin.pause();
@@ -103,6 +104,10 @@ export async function readSecret() {
                 }
             }
         };
+        const aborted = () => done(new Error('Credential entry cancelled'));
+        signal?.addEventListener('abort', aborted, { once: true });
         stdin.on('data', data);
+        if (signal?.aborted)
+            aborted();
     });
 }

package/dist/src/external-runtime.js

@@ -0,0 +1 @@
+export {};