@superjackfruitlabs/salaam 0.0.1 → 0.0.3

package/dist/src/cli.js

@@ -1,23 +1,28 @@
 #!/usr/bin/env node
 import { acp } from './acp.js';
 import { homedir } from 'node:os';
-import { join, resolve } from 'node:path';
+import { join, resolve, dirname } from 'node:path';
 import { spawn } from 'node:child_process';
-import { randomUUID } from 'node:crypto';
+import { randomUUID, randomBytes } from 'node:crypto';
+import { digest, object } from './protocol.js';
 import { fileURLToPath } from 'node:url';
-import { mkdirSync, openSync, closeSync, readFileSync } from 'node:fs';
+import { mkdirSync, openSync, closeSync, readFileSync, realpathSync, writeFileSync, fsyncSync, } from 'node:fs';
 import { VERSION } from './config.js';
 import { cliHelp, hasHelpFlag } from './cli-help.js';
 import { SalaamService } from './service.js';
 import { call } from './transport.js';
 import { attach, acquireControl, Outbox } from './attach.js';
-import { providerRoute } from './provider-config.js';
-import { credentialPath, loadApiKey, readSecret, saveApiKey } from './credentials.js';
+import { providerRoute, PI_PROVIDERS, getProvider, providerHasOutputCap, } from './provider-config.js';
+import { readSecret, validateApiKey } from './credentials.js';
+import { authDirectory, ProviderCredentialStore, providerModels, loginProvider, resolveProviderAuth, } from './provider-auth.js';
+import { bindProviderConfiguration } from './provider-model.js';
+import { createInterface } from 'node:readline/promises';
 import { canonical } from './protocol.js';
 import { SocketEffectConnector } from './effect-connector.js';
 import { proveExecutionBoundary } from './execution-proof.js';
 import { BoundaryBroker, engineRequest } from './execution-boundary.js';
 import { workspaceDiff } from './workspace-diff.js';
+import { probeHarness, HARNESS_TARGETS, } from './harness-probe.js';
 async function main() {
     const args = process.argv.slice(2);
     if (args[0] === '--version' || args[0] === '-V' || args[0] === 'version') {
@@ -54,8 +59,353 @@ async function main() {
         args.splice(args.indexOf('--foreground'), 1);
     const socket = join(state, 'operator.sock');
     const [group, verb, id] = args;
+    if (group === 'a2a' && verb === 'credential') {
+        const file = option('--file');
+        if (!id || !file)
+            throw Error('Supply PEER_ID and --file NEW_OWNER_ONLY_FILE');
+        const { a2aIdentity } = await import('./a2a-peer.js');
+        a2aIdentity(id);
+        const path = resolve(file), value = { peer: id, token: randomBytes(32).toString('base64url') };
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        const fd = openSync(path, 'wx', 0o600);
+        try {
+            writeFileSync(fd, JSON.stringify(value) + '\n');
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        console.log(JSON.stringify({ peer: id, file: realpathSync(path), credential_digest: digest(value) }, null, 2));
+        return;
+    }
+    if (group === 'a2a' && verb === 'discover') {
+        const peer = option('--peer'), endpoint = option('--endpoint'), card_url = option('--card-url'), credential = option('--credential-file'), addresses = option('--addresses');
+        if (!peer || !endpoint || !card_url || !credential || !addresses)
+            throw Error('Supply --peer, --endpoint, --card-url, --credential-file and --addresses');
+        const { privateJSON, validatePeer, A2AHttp } = await import('./a2a-peer.js');
+        const credential_file = realpathSync(resolve(credential)), value = privateJSON(credential_file);
+        const pin = validatePeer({
+            id: peer,
+            endpoint,
+            card_url,
+            card_digest: digest(null),
+            tenant: option('--tenant') ?? '',
+            skill: 'pending-review',
+            addresses: addresses.split(','),
+            local: args.includes('--local'),
+            credential_file,
+            credential_digest: digest(value),
+            files: [],
+            retention: 'unknown',
+            cancel: false,
+            streaming: false,
+        });
+        console.log(JSON.stringify(await new A2AHttp(pin).request(card_url), null, 2));
+        return;
+    }
+    if (group === 'a2a' && verb === 'pin') {
+        const peer = option('--peer'), endpoint = option('--endpoint'), cardFile = option('--card-file'), credential = option('--credential-file'), addresses = option('--addresses'), skill = option('--skill');
+        if (!peer || !endpoint || !cardFile || !credential || !addresses || !skill)
+            throw Error('Supply --peer, --endpoint, --card-file, --credential-file, --addresses and --skill');
+        const { privateJSON, validatePeer, A2AHttp } = await import('./a2a-peer.js');
+        const card = JSON.parse(readFileSync(resolve(cardFile), 'utf8')), credential_file = realpathSync(resolve(credential)), value = privateJSON(credential_file), card_url = option('--card-url');
+        if (!card_url)
+            throw Error('Supply the exact --card-url that was reviewed');
+        const pin = validatePeer({
+            id: peer,
+            endpoint,
+            card_url,
+            card_digest: digest(card),
+            tenant: option('--tenant') ?? '',
+            skill,
+            addresses: addresses.split(','),
+            local: args.includes('--local'),
+            credential_file,
+            credential_digest: digest(value),
+            files: option('--files')?.split(',').filter(Boolean) ?? [],
+            retention: option('--retention') ?? 'unknown',
+            cancel: args.includes('--supports-cancel'),
+            streaming: args.includes('--supports-streaming'),
+        });
+        new A2AHttp(pin).assertCard(card);
+        console.log(JSON.stringify(pin, null, 2));
+        return;
+    }
+    if (group === 'a2a' && verb === 'grant') {
+        const assignment = option('--assignment'), peer = option('--peer'), credential = option('--credential-file');
+        if (!assignment || !peer || !credential)
+            throw Error('Supply --assignment, --peer and --credential-file');
+        const { privateJSON } = await import('./a2a-peer.js');
+        const credential_file = realpathSync(resolve(credential)), value = object(privateJSON(credential_file));
+        if (value.peer !== peer ||
+            Object.keys(value).sort().join(',') !== 'peer,token' ||
+            typeof value.token !== 'string' ||
+            !/^[A-Za-z0-9._~-]{32,512}$/.test(value.token))
+            throw Error('Use a dedicated peer credential JSON {peer,token}');
+        const peerClient = option('--peer-client');
+        if (peerClient && peerClient !== 'openclaw-2026.10.5')
+            throw Error('Only the explicitly pinned OpenClaw client adapter is available');
+        const binding = await call(socket, `/v1/a2a/grants/${encodeURIComponent(assignment)}`);
+        console.log(JSON.stringify({
+            peer,
+            tenant: option('--tenant') ?? '',
+            skill: option('--skill') ?? 'review',
+            assignment_id: assignment,
+            binding_digest: digest(binding),
+            credential_file,
+            credential_digest: digest(value),
+            ...(peerClient ? { client: peerClient } : {}),
+        }, null, 2));
+        return;
+    }
+    if (group === 'a2a' && verb === 'peers') {
+        console.log(JSON.stringify((await call(socket, '/v1/harnesses')).filter((r) => r.kind === 'a2a'), null, 2));
+        return;
+    }
+    if (group === 'harness' && verb === 'probe') {
+        const path = option('--pin');
+        if (!path)
+            throw new Error('Supply an operator-reviewed --pin FILE');
+        const pin = JSON.parse(readFileSync(resolve(path), 'utf8'));
+        console.log(JSON.stringify(await probeHarness(pin), null, 2));
+        return;
+    }
+    if (group === 'harness' && verb === 'prepare') {
+        const path = option('--runtime-root'), arch = option('--arch');
+        if (!path || !arch)
+            throw Error('Supply a new --runtime-root and execution-host --arch');
+        const { prepareHarnessRuntime } = await import('./harness-prepare.js');
+        console.log(JSON.stringify(await prepareHarnessRuntime(path, arch), null, 2));
+        return;
+    }
+    if (group === 'harness' && verb === 'config') {
+        const target = option('--target'), path = option('--runtime-root');
+        if (!target || !Object.hasOwn(HARNESS_TARGETS, target) || !path)
+            throw Error('Supply a named --target and dedicated --runtime-root');
+        const runtime_root = realpathSync(resolve(path));
+        const { assertHarnessArtifactRoot, harnessRuntimeDigest } = await import('./harness-backend.js');
+        assertHarnessArtifactRoot(runtime_root);
+        console.log(JSON.stringify({
+            schema: 1,
+            runtimes: [
+                {
+                    id: option('--id') ?? target,
+                    target,
+                    version: HARNESS_TARGETS[target].version,
+                    runtime_root,
+                    runtime_digest: await harnessRuntimeDigest(runtime_root),
+                    model: 'claude-sonnet-4-6',
+                    output: 4096,
+                    requests: 12,
+                },
+            ],
+        }, null, 2));
+        return;
+    }
+    if (['harness', 'a2a'].includes(group ?? '') &&
+        ['list', 'inspect', 'reconcile'].includes(verb ?? '')) {
+        if (verb === 'list') {
+            console.log(JSON.stringify(await call(socket, '/v1/harnesses'), null, 2));
+            return;
+        }
+        if (!id)
+            throw Error('Supply an external CHILD_ID');
+        const current = await call(socket, `/v1/harnesses/${id}`);
+        if (verb === 'inspect') {
+            console.log(JSON.stringify(current, null, 2));
+            return;
+        }
+        const run_id = option('--run-id');
+        if (!run_id)
+            throw Error('Supply the exact --run-id from harness inspect');
+        const client_id = randomUUID(), owner = current.child.parent_session, lease = await acquireControl(socket, owner, client_id, args.includes('--takeover'));
+        try {
+            console.log(JSON.stringify(await call(socket, `/v1/harnesses/${id}/reconcile`, {
+                client_id,
+                token: lease.token,
+                run_id,
+                request_id: option('--request-id') ?? randomUUID(),
+            }), null, 2));
+        }
+        finally {
+            await call(socket, `/v1/sessions/${owner}/control`, {
+                request_id: randomUUID(),
+                client_id,
+                token: lease.token,
+                action: 'release',
+                expected_epoch: lease.epoch,
+            }).catch(() => { });
+        }
+        return;
+    }
+    if (group === 'workers') {
+        if (!id)
+            throw new Error('Supply a child or integration receipt ID');
+        if (verb === 'proposal' || verb === 'integration') {
+            const result = await call(socket, verb === 'proposal'
+                ? `/v1/workers/${id}/proposal?offset=${Number(option('--offset') ?? 0)}`
+                : `/v1/integrations/${id}`);
+            if (verb === 'proposal' && !args.includes('--json')) {
+                const { changes, diff, ...metadata } = result;
+                console.log(JSON.stringify({
+                    ...metadata,
+                    files: changes.map((c) => ({
+                        path: c.path,
+                        before_hash: digest(c.before),
+                        after_hash: digest(c.after),
+                    })),
+                }, null, 2));
+                for (const patch of diff)
+                    console.log(patch);
+            }
+            else
+                console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        if (!['integrate', 'resolve'].includes(verb ?? ''))
+            throw new Error('Use workers proposal, integrate, integration or resolve');
+        const owner = verb === 'integrate'
+            ? (await call(socket, `/v1/children/${id}`)).parent_session
+            : (await call(socket, `/v1/integrations/${id}`)).parent_session;
+        const revision = option('--revision'), workspace_digest = option('--root-digest'), patch_digest = option('--patch-digest');
+        if (revision === undefined || !workspace_digest || (verb === 'integrate' && !patch_digest))
+            throw new Error('Supply reviewed --revision N, --root-digest SHA256 and --patch-digest SHA256 for integration');
+        const client_id = randomUUID(), lease = await acquireControl(socket, owner, client_id, args.includes('--takeover'));
+        try {
+            const result = await call(socket, verb === 'integrate' ? `/v1/workers/${id}/integrate` : `/v1/integrations/${id}/resolve`, {
+                client_id,
+                token: lease.token,
+                request_id: option('--request-id') ?? randomUUID(),
+                workspace_revision: Number(revision),
+                workspace_digest,
+                patch_digest,
+            });
+            console.log(JSON.stringify(result, null, 2));
+        }
+        finally {
+            await call(socket, `/v1/sessions/${owner}/control`, {
+                request_id: randomUUID(),
+                client_id,
+                token: lease.token,
+                action: 'release',
+                expected_epoch: lease.epoch,
+            }).catch(() => { });
+        }
+        return;
+    }
+    if (group === 'team') {
+        if (!id)
+            throw new Error('Supply TASK_ID');
+        if (verb === 'show') {
+            console.log(JSON.stringify(await call(socket, `/v1/tasks/${id}/team`), null, 2));
+            return;
+        }
+        if (!['assign', 'run', 'reject', 'send', 'receive', 'ack'].includes(verb ?? ''))
+            throw new Error('Use team show, assign, run, send, receive or ack');
+        const task = await call(socket, `/v1/tasks/${id}`);
+        const client_id = randomUUID(), lease = await acquireControl(socket, task.session_id, client_id, args.includes('--takeover'));
+        try {
+            const assignment = option('--assignment');
+            if (['run', 'reject', 'receive', 'ack'].includes(verb) && !assignment)
+                throw new Error('Supply --assignment ID');
+            const revision = option('--revision'), generation = option('--generation');
+            if (['assign', 'run', 'reject'].includes(verb) && revision === undefined)
+                throw new Error('Supply the reviewed --revision N');
+            if (['run', 'reject'].includes(verb) && generation === undefined)
+                throw new Error('Supply the reviewed --generation N');
+            const path = assignment ? `${assignment}/${verb}` : verb;
+            const result = await call(socket, `/v1/tasks/${id}/team/${path}`, {
+                client_id,
+                token: lease.token,
+                request_id: option('--request-id') ?? randomUUID(),
+                expected_revision: revision === undefined ? undefined : Number(revision),
+                generation: generation === undefined ? undefined : Number(generation),
+                ...(verb === 'assign'
+                    ? {
+                        step_id: option('--step'),
+                        profile_id: option('--profile'),
+                        ...(() => {
+                            const runtime = option('--runtime');
+                            return runtime
+                                ? { runtime, invocations: Number(option('--invocations')) }
+                                : { requests: Number(option('--requests')) };
+                        })(),
+                    }
+                    : {}),
+                ...(verb === 'run'
+                    ? { instruction: option('--instruction'), continues_attempt_id: option('--continues') }
+                    : {}),
+                ...(verb === 'send' ? { recipient: option('--to'), text: option('--text') } : {}),
+                ...(verb === 'ack' ? { message_id: option('--message') } : {}),
+                ...(verb === 'reject' ? { reason: option('--reason') } : {}),
+            });
+            console.log(JSON.stringify(result, null, 2));
+        }
+        finally {
+            await call(socket, `/v1/sessions/${task.session_id}/control`, {
+                request_id: randomUUID(),
+                client_id,
+                token: lease.token,
+                action: 'release',
+                expected_epoch: lease.epoch,
+            }).catch(() => { });
+        }
+        return;
+    }
+    if (group === 'agents') {
+        const session = option('--session');
+        if (!session)
+            throw new Error('Supply --session SESSION_ID');
+        if (verb === 'list' || verb === 'inspect') {
+            console.log(JSON.stringify(await call(socket, `/v1/sessions/${session}/agents${verb === 'inspect' ? '?profile=' + encodeURIComponent(id ?? '') : ''}`), null, 2));
+            return;
+        }
+        if (!id || !['admit', 'revoke'].includes(verb ?? ''))
+            throw new Error('Use agents list, inspect, admit or revoke');
+        const client_id = randomUUID(), lease = await acquireControl(socket, session, client_id, args.includes('--takeover'));
+        try {
+            const expected_digest = option('--digest');
+            if (verb === 'admit' && !expected_digest)
+                throw new Error('Review agents inspect and supply --digest SHA256');
+            const fact_ids = option('--facts')?.split(',').filter(Boolean) ?? [];
+            const result = await call(socket, `/v1/sessions/${session}/agents/${verb}`, {
+                request_id: option('--request-id') ?? randomUUID(),
+                client_id,
+                token: lease.token,
+                ...(verb === 'admit' ? { profile_id: id, expected_digest, fact_ids } : { grant_id: id }),
+            });
+            console.log(JSON.stringify(result, null, 2));
+        }
+        finally {
+            await call(socket, `/v1/sessions/${session}/control`, {
+                request_id: randomUUID(),
+                client_id,
+                token: lease.token,
+                action: 'release',
+                expected_epoch: lease.epoch,
+            }).catch(() => { });
+        }
+        return;
+    }
     if (group === 'host') {
         const { planHost, readHost, hostUnit, runHost } = await import('./host.js');
+        if (verb?.startsWith('config-')) {
+            const file = option('--manifest');
+            if (!file)
+                throw Error('Supply --manifest FILE');
+            const { hostConfiguration } = await import('./host-configuration.js');
+            const chunks = [];
+            let size = 0;
+            for await (const chunk of process.stdin) {
+                const data = Buffer.from(chunk);
+                size += data.length;
+                if (size > 65536)
+                    throw Error('Configuration request exceeds limit');
+                chunks.push(data);
+            }
+            console.log(JSON.stringify(await hostConfiguration(resolve(file), verb.slice(7), JSON.parse(Buffer.concat(chunks).toString('utf8')))));
+            return;
+        }
         if (verb === 'plan') {
             const file = option('--config');
             if (!file)
@@ -91,13 +441,30 @@ async function main() {
             await runHost(file);
             return;
         }
+        if (verb === 'start') {
+            const { startHost } = await import('./host-start.js');
+            console.log(JSON.stringify(await startHost(file)));
+            return;
+        }
         if (verb === 'serve') {
             const m = readHost(file), service = await SalaamService.open({
                 stateDir: m.state,
-                codingRoot: m.coding_root,
-                codingSocket: m.coding_socket,
+                ...(m.schema === 1
+                    ? { codingRoot: m.coding_root, codingSocket: m.coding_socket, expectedExecution: m }
+                    : {
+                        agentpodConfig: m.agentpod_config,
+                        ...((m.schema === 3 || m.schema === 4 || m.schema === 5 || m.schema === 6) &&
+                            m.managed_mcp
+                            ? { managedMcp: m.managed_mcp }
+                            : {}),
+                        ...((m.schema === 4 || m.schema === 5 || m.schema === 6) && m.managed_toolkit
+                            ? { managedToolkitConfig: m.managed_toolkit }
+                            : {}),
+                        ...(m.schema === 5 || m.schema === 6 ? { stationConfig: m.station_execution } : {}),
+                        ...(m.schema === 6 ? { agentpodWorkProgression: true } : {}),
+                    }),
+                hostManifestDigest: digest(m),
                 providerRoute: m.provider,
-                expectedExecution: m,
             });
             if (process.connected)
                 process.once('disconnect', () => void service.close());
@@ -108,7 +475,7 @@ async function main() {
                 process.disconnect?.();
             return;
         }
-        throw new Error('Use host plan, unit, run or inspect');
+        throw new Error('Use host plan, start, unit, run or inspect');
     }
     if (group === 'remote' && verb) {
         const { remote } = await import('./remote.js');
@@ -262,11 +629,127 @@ async function main() {
         await acp(state, { coding: args.includes('--coding') });
         return;
     }
-    if (group === 'auth' && verb === 'set' && id === 'anthropic') {
-        saveApiKey(await readSecret());
-        console.log('Claude API key saved to ' + credentialPath() + ' (mode 600).');
+    if (group === 'providers' && verb === 'list') {
+        console.log(JSON.stringify(PI_PROVIDERS.map((p) => ({
+            id: p.id,
+            name: p.name,
+            chat_models: p.getModels().length,
+            apis: [...new Set(p.getModels().map((m) => m.api))],
+            auth: [p.auth.apiKey ? 'api_key' : null, p.auth.oauth ? 'oauth' : null].filter(Boolean),
+            limitation: !p.getModels().length
+                ? 'Classifier only; no chat route'
+                : p.id === 'openai-codex'
+                    ? 'No provider-enforced output cap; tasks must explicitly disable token budgeting'
+                    : null,
+        })), null, 2));
+        return;
+    }
+    if (group === 'models' && verb === 'list') {
+        const providers = id ? [getProvider(id)] : PI_PROVIDERS;
+        if (providers.some((p) => !p))
+            throw new Error('Unknown Pi provider');
+        console.log(JSON.stringify(providers.flatMap((p) => p.getModels().map((m) => ({
+            provider: p.id,
+            id: m.id,
+            name: m.name,
+            api: m.api,
+            context_window: m.contextWindow,
+            max_output_tokens: m.maxTokens,
+        }))), null, 2));
         return;
     }
+    if (group === 'auth') {
+        const store = new ProviderCredentialStore();
+        if (verb === 'status') {
+            const models = providerModels(store), entries = id ? [getProvider(id)] : PI_PROVIDERS;
+            if (entries.some((p) => !p))
+                throw new Error('Unknown Pi provider');
+            const statuses = [];
+            for (const p of entries) {
+                try {
+                    const auth = await models.checkAuth(p.id);
+                    statuses.push({
+                        provider: p.id,
+                        configured: !!auth,
+                        type: auth?.type ?? null,
+                        source: auth?.source ?? null,
+                    });
+                }
+                catch {
+                    statuses.push({ provider: p.id, configured: false, error: 'Credential check failed' });
+                }
+            }
+            console.log(JSON.stringify(statuses, null, 2));
+            return;
+        }
+        if (!id || !getProvider(id))
+            throw new Error('Choose a provider from salaam providers list');
+        if (verb === 'logout') {
+            await store.delete(id);
+            console.log('Stored credential removed for ' + id + '. Environment credentials remain external.');
+            return;
+        }
+        if (verb === 'set') {
+            if (!getProvider(id).auth.apiKey)
+                throw new Error('This provider needs salaam auth login ' + id + ' --oauth');
+            const key = (await readSecret(id + ' API key (hidden): ')).trim();
+            if (!key ||
+                key.length > 4096 ||
+                /[^\x21-\x7e]/.test(key) ||
+                (id === 'anthropic' && key.includes('sk-ant-oat')))
+                throw new Error('Supply a provider API key, not an OAuth token');
+            if (id === 'anthropic')
+                validateApiKey(key);
+            await store.modify(id, async () => ({ type: 'api_key', key }));
+            console.log('API key saved privately for ' + id + ' under ' + authDirectory() + ' (mode 600).');
+            return;
+        }
+        if (verb === 'login') {
+            if (!process.stdin.isTTY)
+                throw new Error('Interactive login needs a terminal; use auth set PROVIDER for a piped API key');
+            const provider = getProvider(id);
+            const type = args.includes('--oauth') || !provider.auth.apiKey ? 'oauth' : 'api_key';
+            const interaction = {
+                async prompt(prompt) {
+                    if (prompt.type === 'secret')
+                        return readSecret(prompt.message + ' (hidden): ', prompt.signal);
+                    const rl = createInterface({ input: process.stdin, output: process.stderr });
+                    try {
+                        const choices = prompt.type === 'select'
+                            ? '\n' + prompt.options.map((v, i) => `${i + 1}. ${v.label} (${v.id})`).join('\n')
+                            : '';
+                        const answer = await rl.question(prompt.message + choices + '\n> ', {
+                            signal: prompt.signal,
+                        });
+                        return prompt.type === 'select' && /^\d+$/.test(answer)
+                            ? (prompt.options[Number(answer) - 1]?.id ?? answer)
+                            : answer;
+                    }
+                    finally {
+                        rl.close();
+                    }
+                },
+                notify(event) {
+                    if (event.type === 'auth_url')
+                        console.error('Open in your browser: ' +
+                            event.url +
+                            (event.instructions ? '\n' + event.instructions : ''));
+                    else if (event.type === 'device_code')
+                        console.error('Open ' + event.verificationUri + ' and enter ' + event.userCode);
+                    else
+                        console.error(event.message);
+                },
+            };
+            await loginProvider(id, type, interaction);
+            console.log('Signed in to ' +
+                id +
+                ' with ' +
+                type +
+                '. Restart the service to use a different provider route.');
+            return;
+        }
+        throw new Error('Run salaam auth --help');
+    }
     if (group === 'schedules' && verb) {
         if (verb === 'list' || (id && ['inspect', 'occurrences'].includes(verb))) {
             console.log(JSON.stringify(await call(socket, verb === 'list'
@@ -629,6 +1112,54 @@ async function main() {
         }), null, 2));
         return;
     }
+    if (group === 'session' && verb === 'revocation' && id) {
+        console.log(JSON.stringify(await call(socket, `/v1/sessions/${id}/revocation`), null, 2));
+        return;
+    }
+    if (group === 'session' && verb === 'revoke' && id) {
+        const reason = option('--reason');
+        if (!reason)
+            throw new Error('Supply --reason');
+        const request_id = option('--request-id') ?? randomUUID();
+        const saved = await call(socket, `/v1/sessions/${id}/revocation`);
+        if (saved?.request_id === request_id && saved.session_id === id) {
+            if (saved.reason !== reason)
+                throw new Error('Request ID already binds a different reason');
+            console.log(JSON.stringify(saved, null, 2));
+            return;
+        }
+        const client = randomUUID();
+        const lease = await acquireControl(socket, id, client, args.includes('--takeover'));
+        const controller = { client_id: client, token: lease.token };
+        try {
+            console.log(JSON.stringify({ request_id }));
+            for (let retry = 0;; retry++) {
+                const snapshot = await call(socket, `/v1/sessions/${id}/snapshot`);
+                try {
+                    console.log(JSON.stringify(await call(socket, `/v1/sessions/${id}/revoke`, {
+                        ...controller,
+                        request_id,
+                        expected_revision: snapshot.revision,
+                        reason,
+                    }), null, 2));
+                    break;
+                }
+                catch (error) {
+                    if (error.code !== 'revision_conflict' || retry >= 7)
+                        throw error;
+                }
+            }
+        }
+        finally {
+            await call(socket, `/v1/sessions/${id}/control`, {
+                ...controller,
+                request_id: randomUUID(),
+                action: 'release',
+                expected_epoch: lease.epoch,
+            }).catch(() => { });
+        }
+        return;
+    }
     if (group === 'session' && verb === 'cancel' && id) {
         const attempt = option('--attempt');
         if (!attempt)
@@ -705,20 +1236,33 @@ async function main() {
         const model = option('--model');
         const cap = option('--max-output-tokens');
         const workspace = option('--workspace-id');
-        const route = providerRoute(provider, model, cap === undefined ? undefined : Number(cap), workspace);
+        let route = providerRoute(provider, model, cap === undefined ? undefined : Number(cap), workspace);
+        if (route.provider !== 'salaam-proof') {
+            const auth = await resolveProviderAuth(route);
+            if (cap !== undefined && !providerHasOutputCap(route, auth))
+                throw new Error('This authentication cannot enforce --max-output-tokens; omit it and explicitly disable token budgeting in task plans');
+            route = bindProviderConfiguration(route, auth);
+        }
         const effectSocket = option('--effect-socket');
         const opaque = args.includes('--effect-opaque');
-        const codingRoot = option('--coding-root'), codingSocket = option('--coding-socket');
+        const codingRoot = option('--coding-root'), codingSocket = option('--coding-socket'), harnessConfig = option('--harness-config'), a2aConfig = option('--a2a-config'), agentpodConfig = option('--agentpod-config'), a2aListenConfig = option('--a2a-listen-config');
         if (foreground) {
             const service = await SalaamService.open({
                 stateDir: state,
                 providerRoute: route,
+                agentpodConfig: agentpodConfig ? resolve(agentpodConfig) : undefined,
                 codingRoot: codingRoot ? resolve(codingRoot) : undefined,
                 codingSocket: codingSocket ? resolve(codingSocket) : undefined,
+                harnessConfig: harnessConfig ? resolve(harnessConfig) : undefined,
+                a2aConfig: a2aConfig ? resolve(a2aConfig) : undefined,
+                a2aListenConfig: a2aListenConfig ? resolve(a2aListenConfig) : undefined,
                 effectConnector: effectSocket
                     ? new SocketEffectConnector(resolve(effectSocket), { opaque })
                     : undefined,
             });
+            const warning = service.supervisor.providerCapabilities().warning;
+            if (warning)
+                console.error(warning);
             process.stdout.write(JSON.stringify({ socket, service: 'started' }) + '\n');
             for (const signal of ['SIGINT', 'SIGTERM'])
                 process.once(signal, () => {
@@ -736,6 +1280,11 @@ async function main() {
         }
         catch { }
         if (health) {
+            if ((health.agentpod_config ?? null) !== (agentpodConfig ? resolve(agentpodConfig) : null) ||
+                (agentpodConfig &&
+                    health.agentpod_pins_digest !==
+                        digest(JSON.parse(readFileSync(resolve(agentpodConfig), 'utf8')))))
+                throw new Error('Service is already running with different AgentPod authority pins; stop it first');
             if (canonical(health.provider_route ?? providerRoute()) !== canonical(route))
                 throw new Error('Service is already running with another provider route; stop it first');
             if ((health.coding_root ?? null) !== (codingRoot ? resolve(codingRoot) : null) ||
@@ -744,8 +1293,6 @@ async function main() {
             console.log('Salaam service already running');
             return;
         }
-        if (route.provider === 'anthropic')
-            loadApiKey();
         mkdirSync(state, { recursive: true, mode: 0o700 });
         const fd = openSync(join(state, 'service.log'), 'a', 0o600);
         const child = spawn(process.execPath, [
@@ -764,12 +1311,18 @@ async function main() {
             ...(opaque ? ['--effect-opaque'] : []),
             ...(codingRoot ? ['--coding-root', resolve(codingRoot)] : []),
             ...(codingSocket ? ['--coding-socket', resolve(codingSocket)] : []),
+            ...(harnessConfig ? ['--harness-config', resolve(harnessConfig)] : []),
+            ...(a2aConfig ? ['--a2a-config', resolve(a2aConfig)] : []),
+            ...(agentpodConfig ? ['--agentpod-config', resolve(agentpodConfig)] : []),
+            ...(a2aListenConfig ? ['--a2a-listen-config', resolve(a2aListenConfig)] : []),
         ], { detached: true, stdio: ['ignore', fd, fd] });
         closeSync(fd);
         child.unref();
         for (let i = 0; i < 150; i++) {
             try {
-                await call(socket, '/v1/health');
+                const health = await call(socket, '/v1/health');
+                if (health.provider_capabilities?.warning)
+                    console.error(health.provider_capabilities.warning);
                 console.log(JSON.stringify({ socket, service: 'started' }));
                 return;
             }
@@ -799,6 +1352,23 @@ async function main() {
             cwd,
             request_id: requestId,
             ...(args.includes('--coding') ? { coding: true } : {}),
+            ...(args.includes('--local') || args.includes('--local-coding')
+                ? {
+                    local_workspace: true,
+                    ...(args.includes('--local-coding') ? { local_coding: true } : {}),
+                    ...(option('--provider')
+                        ? {
+                            route: {
+                                provider: option('--provider'),
+                                model: option('--model'),
+                                max_tokens: option('--max-output-tokens')
+                                    ? Number(option('--max-output-tokens'))
+                                    : undefined,
+                            },
+                        }
+                        : {}),
+                }
+                : {}),
         }), null, 2));
         return;
     }