snipara-companion 3.4.0 → 3.5.0

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 Release notes for `snipara-companion`, newest first.
 
+## New In 3.5.0
+
+- Adds an explicit `workflow run --strong-repair` handoff contract for one
+  bounded strong-adapter repair after local proof or output failure.
+- Keeps Companion recommendation-only: it records final authority, proof,
+  scope, and `main_agent` fallback without silently launching workers.
+
+## New In 3.4.1
+
+- Declares provider API keys by environment-variable name and supports
+  `authorization` or `x-api-key` headers without persisting secret values.
+- Resolves declared Codex and Claude CLI workers to explicit native adapters;
+  unsupported generic CLI profiles fail closed.
+- Preserves opt-in local routing behavior while forwarding provider auth metadata
+  to the orchestrator catalog.
+
 ## New In 3.4.0
 
 - Adds repeatable `workers execute --output-fragment` contracts.

package/dist/index.d.ts

@@ -3238,6 +3238,14 @@ interface AdaptiveRoutingResolution {
     warnings?: string[];
     rejectedReasons?: Record<string, string[]>;
 }
+interface AdaptiveStrongRepairContract {
+    enabled: boolean;
+    maxAttempts: 1;
+    finalAuthority: "strong_adapter";
+    proofRequired: true;
+    scopePreserved: true;
+    fallback: "main_agent";
+}
 interface AdaptiveWorkRoutingRecommendation {
     workProfile: AdaptiveWorkProfile;
     requirements: AdaptiveModelRequirements;
@@ -3245,6 +3253,7 @@ interface AdaptiveWorkRoutingRecommendation {
     gateway?: AdaptiveRoutingGatewayStatus;
     runtimeCatalog?: AdaptiveRoutingRuntimeCatalog;
     resolution?: AdaptiveRoutingResolution;
+    strongRepair?: AdaptiveStrongRepairContract;
 }
 interface AdaptiveWorkRoutingOptions {
     query: string;
@@ -3259,6 +3268,7 @@ interface AdaptiveWorkRoutingOptions {
     catalogLimit?: number;
     dailyBudgetCents?: number;
     monthlyBudgetCents?: number;
+    strongRepair?: boolean;
 }
 interface OrchestratorHandoffArtifact {
     schemaVersion: "snipara.orchestrator.handoff.v1";
@@ -3289,6 +3299,7 @@ interface OrchestratorHandoffArtifact {
         gateway?: AdaptiveRoutingGatewayStatus;
         runtimeCatalog?: AdaptiveRoutingRuntimeCatalog;
         resolution?: AdaptiveRoutingResolution;
+        strongRepair?: AdaptiveStrongRepairContract;
     };
     task: {
         title: string;
@@ -4478,6 +4489,8 @@ interface LocalWorkerDeclaration {
     endpointType: "local";
     provider: string;
     baseUrl: string;
+    apiKeyEnv?: string;
+    apiKeyHeader?: "authorization" | "x-api-key";
     command?: string;
     model?: string;
     preferModel?: string;
@@ -4496,11 +4509,16 @@ interface LocalWorkersConfig {
 interface LocalWorkerRoutingDefaults {
     worker: LocalWorkerDeclaration;
     routeLocalWorkers: true;
+    routingLocalTransport: "openai_http" | "cli";
+    routingLocalAdapter?: "codex_app_server" | "claude_cli";
+    routingLocalCommand?: string;
     routingWorkerRole: string;
     routingLocalBaseUrl: string;
     routingLocalModel?: string;
     routingLocalPreferModel?: string;
     routingLocalProvider: string;
+    routingLocalApiKeyEnv?: string;
+    routingLocalApiKeyHeader?: "authorization" | "x-api-key";
     routingPreferredEndpoints: string[];
     routingAllowedEndpoints: string[];
     plannerRetainsReasoning: true;
@@ -4520,6 +4538,8 @@ interface LocalWorkerAddOptions {
     json?: boolean;
     transport?: "openai_http" | "cli";
     command?: string;
+    apiKeyEnv?: string;
+    apiKeyHeader?: "authorization" | "x-api-key";
 }
 interface LocalWorkerStatusOptions {
     json?: boolean;
@@ -4542,6 +4562,8 @@ interface LocalWorkerProbeOptions {
     writeScope?: string[];
     reasoning?: "low" | "medium" | "high";
     contextWindow?: number;
+    apiKeyEnv?: string;
+    apiKeyHeader?: "authorization" | "x-api-key";
     json?: boolean;
 }
 declare function workersLocalAddCommand(options: LocalWorkerAddOptions): void;

package/dist/index.js

@@ -9755,7 +9755,9 @@ function normalizeWorkerProfileTransport(value) {
       baseUrl,
       ...stringValue(value.model) ? { model: stringValue(value.model) } : {},
       ...stringValue(value.preferModel) ? { preferModel: stringValue(value.preferModel) } : {},
-      ...stringValue(value.provider) ? { provider: stringValue(value.provider) } : {}
+      ...stringValue(value.provider) ? { provider: stringValue(value.provider) } : {},
+      ...safeEnvironmentVariableName(value.apiKeyEnv) ? { apiKeyEnv: safeEnvironmentVariableName(value.apiKeyEnv) } : {},
+      ...value.apiKeyHeader === "authorization" || value.apiKeyHeader === "x-api-key" ? { apiKeyHeader: value.apiKeyHeader } : {}
     };
   }
   if (kind === "cli") {
@@ -9897,6 +9899,10 @@ function numberValue(value) {
 function booleanValue(value) {
   return value === true;
 }
+function safeEnvironmentVariableName(value) {
+  const normalized = stringValue(value);
+  return normalized && /^[A-Za-z_][A-Za-z0-9_]*$/.test(normalized) ? normalized : void 0;
+}
 function stringValue(value) {
   if (value === null || value === void 0) {
     return void 0;
@@ -14201,7 +14207,8 @@ function buildOrchestratorHandoff(options) {
         routingCard: options.adaptiveRouting.routingCard,
         ...options.adaptiveRouting.gateway ? { gateway: options.adaptiveRouting.gateway } : {},
         ...options.adaptiveRouting.runtimeCatalog ? { runtimeCatalog: options.adaptiveRouting.runtimeCatalog } : {},
-        ...options.adaptiveRouting.resolution ? { resolution: options.adaptiveRouting.resolution } : {}
+        ...options.adaptiveRouting.resolution ? { resolution: options.adaptiveRouting.resolution } : {},
+        ...options.adaptiveRouting.strongRepair ? { strongRepair: options.adaptiveRouting.strongRepair } : {}
       } : {}
     },
     task: {
@@ -14318,7 +14325,17 @@ function buildAdaptiveWorkRoutingRecommendation(options) {
   return {
     workProfile,
     requirements,
-    routingCard
+    routingCard,
+    ...options.strongRepair ? {
+      strongRepair: {
+        enabled: true,
+        maxAttempts: 1,
+        finalAuthority: "strong_adapter",
+        proofRequired: true,
+        scopePreserved: true,
+        fallback: "main_agent"
+      }
+    } : {}
   };
 }
 function inferAdaptiveTaskType(query, changedFiles) {
@@ -19627,6 +19644,9 @@ function workersLocalAddCommand(options) {
   printKeyValue("Role:", result.worker.workerRole);
   printKeyValue("Provider:", result.worker.provider);
   printKeyValue("Base URL:", result.worker.baseUrl);
+  if (result.worker.apiKeyEnv) {
+    printKeyValue("API key env:", result.worker.apiKeyEnv);
+  }
   if (result.worker.model) {
     printKeyValue("Model:", result.worker.model);
   } else if (result.worker.preferModel) {
@@ -19718,7 +19738,9 @@ function workersLocalProbeCommand(options) {
     capabilities: normalizeStringList3(options.capabilities),
     writeScope: normalizeStringList3(options.writeScope),
     model,
-    preferModel
+    preferModel,
+    apiKeyEnv: options.apiKeyEnv,
+    apiKeyHeader: options.apiKeyHeader
   });
   const catalogContextWindow = resolveContextWindowFromCatalog(catalog, model, preferModel);
   const contextWindow = normalizeContextWindow(
@@ -19737,7 +19759,9 @@ function workersLocalProbeCommand(options) {
         baseUrl,
         ...model ? { model } : {},
         ...preferModel ? { preferModel } : {},
-        provider
+        provider,
+        ...options.apiKeyEnv ? { apiKeyEnv: options.apiKeyEnv } : {},
+        ...options.apiKeyHeader ? { apiKeyHeader: options.apiKeyHeader } : {}
       },
       capabilities: {
         roles: [role],
@@ -19891,7 +19915,26 @@ function resolveLocalWorkerRoutingDefaults(options = {}) {
     throw new Error(`Local worker ${requestedId} is not declared.`);
   }
   if (!worker.baseUrl || worker.baseUrl === "cli://command") {
-    return null;
+    const command = worker.command?.toLowerCase() ?? "";
+    const adapter = command.includes("codex") ? "codex_app_server" : command.includes("claude") ? "claude_cli" : void 0;
+    if (!adapter) {
+      throw new Error(
+        `CLI worker ${worker.id} is not mapped to a supported native adapter; use a Codex or Claude command.`
+      );
+    }
+    return {
+      worker,
+      routeLocalWorkers: true,
+      routingLocalTransport: "cli",
+      routingLocalBaseUrl: "cli://command",
+      routingLocalAdapter: adapter,
+      routingLocalCommand: worker.command,
+      routingWorkerRole: worker.workerRole,
+      routingLocalProvider: worker.provider,
+      routingPreferredEndpoints: ["local"],
+      routingAllowedEndpoints: ["local"],
+      plannerRetainsReasoning: true
+    };
   }
   if (!worker.model && !worker.preferModel) {
     const hasCatalogHint = true;
@@ -19900,11 +19943,14 @@ function resolveLocalWorkerRoutingDefaults(options = {}) {
   return {
     worker,
     routeLocalWorkers: true,
+    routingLocalTransport: "openai_http",
     routingWorkerRole: worker.workerRole,
     routingLocalBaseUrl: worker.baseUrl,
     ...worker.model ? { routingLocalModel: worker.model } : {},
     ...worker.preferModel ? { routingLocalPreferModel: worker.preferModel } : {},
     routingLocalProvider: worker.provider,
+    ...worker.apiKeyEnv ? { routingLocalApiKeyEnv: worker.apiKeyEnv } : {},
+    ...worker.apiKeyHeader ? { routingLocalApiKeyHeader: worker.apiKeyHeader } : {},
     routingPreferredEndpoints: ["local"],
     routingAllowedEndpoints: ["local"],
     plannerRetainsReasoning: true
@@ -20012,7 +20058,9 @@ function normalizeWorkerProfileRecord(value) {
       transport: {
         ...transport,
         baseUrl,
-        provider: normalizeProvider(transport.provider ?? "lm-studio")
+        provider: normalizeProvider(transport.provider ?? "lm-studio"),
+        ...transport.apiKeyEnv ? { apiKeyEnv: transport.apiKeyEnv } : {},
+        ...transport.apiKeyHeader ? { apiKeyHeader: transport.apiKeyHeader } : {}
       }
     };
   }
@@ -20047,7 +20095,9 @@ function toProfileFromLegacyWorker(worker) {
       baseUrl: worker.baseUrl,
       ...worker.model ? { model: worker.model } : {},
       ...worker.preferModel ? { preferModel: worker.preferModel } : {},
-      provider: worker.provider
+      provider: worker.provider,
+      ...worker.apiKeyEnv ? { apiKeyEnv: worker.apiKeyEnv } : {},
+      ...worker.apiKeyHeader ? { apiKeyHeader: worker.apiKeyHeader } : {}
     },
     capabilities: {
       roles: [normalizeWorkerRole(worker.workerRole)],
@@ -20090,6 +20140,8 @@ function toLocalWorkerDeclaration(profile) {
     endpointType: "local",
     provider: normalizeProvider(profile.transport.provider ?? "lm-studio"),
     baseUrl: profile.transport.baseUrl,
+    ...profile.transport.apiKeyEnv ? { apiKeyEnv: profile.transport.apiKeyEnv } : {},
+    ...profile.transport.apiKeyHeader ? { apiKeyHeader: profile.transport.apiKeyHeader } : {},
     ...stringValue6(profile.transport.model) ? { model: stringValue6(profile.transport.model) } : {},
     ...stringValue6(profile.transport.preferModel) && !profile.transport.model ? { preferModel: stringValue6(profile.transport.preferModel) } : {},
     capabilities: normalizeWorkerCapabilities(profile.capabilities.roles),
@@ -20195,6 +20247,12 @@ function runOrchestratorLocalCatalog(options) {
   if (options.preferModel) {
     args.push("--prefer-model", options.preferModel);
   }
+  if (options.apiKeyEnv) {
+    args.push("--api-key-env", options.apiKeyEnv);
+  }
+  if (options.apiKeyHeader) {
+    args.push("--api-key-header", options.apiKeyHeader);
+  }
   try {
     const result = (0, import_node_child_process9.execFileSync)("snipara-orchestrator", args, {
       encoding: "utf8",
@@ -20330,12 +20388,15 @@ function normalizeWorkerTransport(options) {
   const baseUrl = normalizeBaseUrl(options.baseUrl ?? "http://127.0.0.1:1234");
   const model = stringValue6(options.model);
   const preferModel = stringValue6(options.preferModel);
+  const apiKeyEnv = normalizeApiKeyEnvironmentName(options.apiKeyEnv);
   return {
     kind: "openai_http",
     baseUrl,
     ...model ? { model } : {},
     ...preferModel ? { preferModel } : {},
-    provider: normalizeProvider(stringValue6(options.provider) ?? "lm-studio")
+    provider: normalizeProvider(stringValue6(options.provider) ?? "lm-studio"),
+    ...apiKeyEnv ? { apiKeyEnv } : {},
+    ...options.apiKeyHeader ? { apiKeyHeader: options.apiKeyHeader } : {}
   };
 }
 function normalizeProvider(value) {
@@ -20357,6 +20418,8 @@ function normalizeLegacyWorkerDeclaration(value) {
     endpointType: "local",
     provider: normalizeProvider(stringValue6(value.provider) ?? "lm-studio"),
     baseUrl,
+    ...stringValue6(value.apiKeyEnv) ? { apiKeyEnv: stringValue6(value.apiKeyEnv) } : {},
+    ...value.apiKeyHeader === "authorization" || value.apiKeyHeader === "x-api-key" ? { apiKeyHeader: value.apiKeyHeader } : {},
     ...stringValue6(value.model) ? { model: stringValue6(value.model) } : {},
     ...stringValue6(value.preferModel) ? { preferModel: stringValue6(value.preferModel) } : {},
     capabilities: normalizeStringList3(value.capabilities).length > 0 ? normalizeStringList3(value.capabilities) : defaultCapabilitiesForWorker(normalizeWorkerRole(value.workerRole)),
@@ -20434,6 +20497,16 @@ function stringValue6(value) {
   const stringified = String(value).trim();
   return stringified || void 0;
 }
+function normalizeApiKeyEnvironmentName(value) {
+  const normalized = stringValue6(value);
+  if (!normalized) {
+    return void 0;
+  }
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(normalized)) {
+    throw new Error("API key env must be a shell-safe environment variable name.");
+  }
+  return normalized;
+}
 function isRecord10(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -25105,6 +25178,10 @@ function printAdaptiveRoutingRecommendation(routing) {
   if (routing.requirements.plannerRetainsReasoning) {
     printKeyValue2("Planner retains reasoning:", "yes");
   }
+  if (routing.strongRepair?.enabled) {
+    printKeyValue2("Strong repair:", "one bounded attempt after proof/output failure");
+    printKeyValue2("Repair authority:", routing.strongRepair.finalAuthority);
+  }
   if (routing.gateway) {
     printKeyValue2(
       routing.gateway.source === "local_orchestrator" ? "Local route:" : "Hosted catalog:",
@@ -25425,7 +25502,7 @@ function shouldResolveAdaptiveRoutingLocally(options, routing) {
   return preferred.includes("local") || allowed.length === 0 || allowed.includes("local");
 }
 function hasLocalRoutingRequest(options) {
-  return options.routeLocalWorkers === true || Boolean(options.routingLocalWorker) || Boolean(options.routingLocalBaseUrl) || Boolean(options.routingLocalModel) || Boolean(options.routingLocalPreferModel) || Boolean(options.routingLocalProvider) || normalizeRoutingEndpointTypes(options.routingPreferredEndpoints).includes("local") || normalizeRoutingEndpointTypes(options.routingAllowedEndpoints).includes("local");
+  return options.routeLocalWorkers === true || Boolean(options.routingLocalWorker) || Boolean(options.routingLocalBaseUrl) || Boolean(options.routingLocalModel) || Boolean(options.routingLocalPreferModel) || Boolean(options.routingLocalProvider) || Boolean(options.routingLocalApiKeyEnv) || normalizeRoutingEndpointTypes(options.routingPreferredEndpoints).includes("local") || normalizeRoutingEndpointTypes(options.routingAllowedEndpoints).includes("local");
 }
 function applyLocalWorkerRoutingDefaults(options, defaults) {
   if (!defaults) {
@@ -25434,6 +25511,9 @@ function applyLocalWorkerRoutingDefaults(options, defaults) {
   return {
     ...options,
     routeLocalWorkers: options.routeLocalWorkers ?? defaults.routeLocalWorkers,
+    routingLocalTransport: options.routingLocalTransport ?? defaults.routingLocalTransport,
+    routingLocalAdapter: options.routingLocalAdapter ?? defaults.routingLocalAdapter,
+    routingLocalCommand: options.routingLocalCommand ?? defaults.routingLocalCommand,
     routingWorkerRole: options.routingWorkerRole ?? defaults.routingWorkerRole,
     routingPreferredEndpoints: options.routingPreferredEndpoints && options.routingPreferredEndpoints.length > 0 ? options.routingPreferredEndpoints : defaults.routingPreferredEndpoints,
     routingAllowedEndpoints: options.routingAllowedEndpoints && options.routingAllowedEndpoints.length > 0 ? options.routingAllowedEndpoints : defaults.routingAllowedEndpoints,
@@ -25441,6 +25521,8 @@ function applyLocalWorkerRoutingDefaults(options, defaults) {
     routingLocalModel: options.routingLocalModel ?? defaults.routingLocalModel,
     routingLocalPreferModel: options.routingLocalPreferModel ?? defaults.routingLocalPreferModel,
     routingLocalProvider: options.routingLocalProvider ?? defaults.routingLocalProvider,
+    routingLocalApiKeyEnv: options.routingLocalApiKeyEnv ?? defaults.routingLocalApiKeyEnv,
+    routingLocalApiKeyHeader: options.routingLocalApiKeyHeader ?? defaults.routingLocalApiKeyHeader,
     plannerRetainsReasoning: options.plannerRetainsReasoning ?? defaults.plannerRetainsReasoning
   };
 }
@@ -25455,6 +25537,67 @@ function runOrchestratorJsonCommand(args, cwd = process.cwd()) {
 }
 function enrichAdaptiveRoutingWithLocalOrchestrator(routing, options, cwd = process.cwd()) {
   try {
+    if (options.routingLocalTransport === "cli") {
+      const candidateId = options.routingLocalAdapter ?? options.routingLocalCommand ?? "declared-cli";
+      const candidate = {
+        candidateId,
+        workerClass: routing.requirements.workerRole,
+        catalogSource: "declared_cli_worker",
+        endpointType: "local",
+        workerRoles: [routing.requirements.workerRole],
+        capabilities: routing.requirements.capabilities ?? [],
+        writeScope: routing.requirements.writeScope ?? [],
+        reasoning: routing.requirements.reasoning,
+        speed: "normal",
+        cost: "balanced",
+        contextBudget: routing.requirements.contextBudget,
+        qualityScore: null,
+        isAvailable: true,
+        requiresApiKey: false,
+        metadata: {
+          adapter: options.routingLocalAdapter,
+          command: options.routingLocalCommand
+        }
+      };
+      const resolution2 = normalizeAdaptiveRoutingResolution(
+        runOrchestratorJsonCommand(
+          [
+            "route",
+            "--dry-run",
+            "--json",
+            "--work-profile-json",
+            JSON.stringify(routing.workProfile),
+            "--requirements-json",
+            JSON.stringify(routing.requirements),
+            "--candidate-json",
+            JSON.stringify(candidate)
+          ],
+          cwd
+        )
+      );
+      return {
+        ...routing,
+        gateway: {
+          source: "local_orchestrator",
+          success: true,
+          resolutionStatus: resolution2?.status ?? "resolved",
+          candidateCount: 1,
+          fallback: "main_agent",
+          warnings: []
+        },
+        runtimeCatalog: {
+          source: "declared_cli_worker",
+          candidates: [candidate],
+          workerEndpoints: {
+            [candidateId]: {
+              adapter: options.routingLocalAdapter,
+              command: options.routingLocalCommand
+            }
+          }
+        },
+        resolution: resolution2
+      };
+    }
     const catalogArgs = [
       "local-model-catalog",
       "--json",
@@ -25477,6 +25620,12 @@ function enrichAdaptiveRoutingWithLocalOrchestrator(routing, options, cwd = proc
     if (options.routingLocalProvider) {
       catalogArgs.push("--provider", options.routingLocalProvider);
     }
+    if (options.routingLocalApiKeyEnv) {
+      catalogArgs.push("--api-key-env", options.routingLocalApiKeyEnv);
+    }
+    if (options.routingLocalApiKeyHeader) {
+      catalogArgs.push("--api-key-header", options.routingLocalApiKeyHeader);
+    }
     const runtimeCatalog = normalizeAdaptiveRoutingCatalog(
       runOrchestratorJsonCommand(catalogArgs, cwd)
     );
@@ -27367,7 +27516,7 @@ async function workflowRunCommand(options) {
 }
 function shouldBuildAdaptiveRouting(options) {
   return Boolean(
-    options.adaptiveRoutingDryRun || options.routeLocalWorkers || options.routingLocalWorker || options.routingWorkerRole || options.routingPreferredEndpoints?.length || options.routingAllowedEndpoints?.length || options.routingLocalBaseUrl || options.routingLocalModel || options.routingLocalPreferModel || options.routingLocalProvider || options.plannerRetainsReasoning
+    options.adaptiveRoutingDryRun || options.routeLocalWorkers || options.routingLocalWorker || options.routingWorkerRole || options.routingPreferredEndpoints?.length || options.routingAllowedEndpoints?.length || options.routingLocalBaseUrl || options.routingLocalModel || options.routingLocalPreferModel || options.routingLocalProvider || options.routingLocalApiKeyEnv || options.plannerRetainsReasoning || options.strongRepair
   );
 }
 function buildWorkflowAdaptiveRouting(options, policy = null, intentWarnings = []) {
@@ -27411,6 +27560,7 @@ function buildWorkflowAdaptiveRouting(options, policy = null, intentWarnings = [
     allowedEndpointTypes,
     workerRole,
     plannerRetainsReasoning: options.plannerRetainsReasoning ?? policy?.plannerRetainsReasoning ?? (options.routeLocalWorkers ? true : void 0),
+    strongRepair: options.strongRepair,
     catalogLimit: policy?.catalogLimit ?? DEFAULT_ADAPTIVE_ROUTING_CATALOG_LIMIT,
     dailyBudgetCents: policy?.dailyBudgetCents,
     monthlyBudgetCents: policy?.monthlyBudgetCents
@@ -38817,8 +38967,17 @@ workflow.command("run").description("Run a LITE/STANDARD/FULL/orchestrate workfl
   "--routing-local-prefer-model <text>",
   "Prefer a local /v1/models entry containing this text during worker routing"
 ).option("--routing-local-provider <provider>", "Provider label for local worker routing").option(
+  "--routing-local-api-key-env <env>",
+  "Environment variable containing the local/remote provider API key"
+).option(
+  "--routing-local-api-key-header <header>",
+  "Provider API key header: authorization or x-api-key"
+).option(
   "--planner-retains-reasoning",
   "Mark the main planner as retaining deep reasoning while the worker executes scoped work"
+).option(
+  "--strong-repair",
+  "Allow one bounded strong-adapter repair after local proof or output validation fails"
 ).option("--write-plan-file <file>", "Write the generated FULL-mode plan as workflow JSON").option(
   "--start-workflow-from-plan",
   "Start a local managed workflow from the generated FULL-mode plan"
@@ -38844,7 +39003,10 @@ workflow.command("run").description("Run a LITE/STANDARD/FULL/orchestrate workfl
     routingLocalModel: options.routingLocalModel,
     routingLocalPreferModel: options.routingLocalPreferModel,
     routingLocalProvider: options.routingLocalProvider,
+    routingLocalApiKeyEnv: options.routingLocalApiKeyEnv,
+    routingLocalApiKeyHeader: options.routingLocalApiKeyHeader,
     plannerRetainsReasoning: options.plannerRetainsReasoning ? true : void 0,
+    strongRepair: Boolean(options.strongRepair),
     writePlanFile: options.writePlanFile,
     startWorkflowFromPlan: Boolean(options.startWorkflowFromPlan),
     workflowId: options.workflowId,
@@ -38944,7 +39106,11 @@ localWorkers.command("add").description("Declare a local worker and enable local
   "--role <role>",
   "Worker role, for example coding, documentation, tests, or review",
   "coding"
-).option("--provider <provider>", "Provider label", "lm-studio").option("--base-url <url>", "OpenAI-compatible local runtime base URL", "http://127.0.0.1:1234").option("--model <id>", "Exact model id exposed by the local runtime").option(
+).option("--provider <provider>", "Provider label", "lm-studio").option("--base-url <url>", "OpenAI-compatible local runtime base URL", "http://127.0.0.1:1234").option("--api-key-env <env>", "Environment variable containing the provider API key").option(
+  "--api-key-header <header>",
+  "Provider API key header: authorization or x-api-key",
+  "authorization"
+).option("--model <id>", "Exact model id exposed by the local runtime").option(
   "--prefer-model <text>",
   "Fallback model id substring to prefer when no exact model is set"
 ).option("--transport <openai_http|cli>", "Worker transport: openai_http (default) or cli").option("--command <command>", "CLI command to execute when transport is cli").option("--capability <capability>", "Worker capability; repeatable", collectOption, []).option(
@@ -38971,6 +39137,8 @@ localWorkers.command("add").description("Declare a local worker and enable local
     preferModel: options.preferModel,
     transport: options.transport,
     command: options.command,
+    apiKeyEnv: options.apiKeyEnv,
+    apiKeyHeader: options.apiKeyHeader,
     capabilities: options.capability,
     reasoning: options.reasoning ? options.reasoning.toLowerCase() : void 0,
     contextWindow: options.contextWindow,
@@ -38988,7 +39156,11 @@ localWorkers.command("list").description("List declared local workers").option("
 localWorkers.command("remove").description("Remove a declared local worker").argument("id", "Local worker id").option("--json", "Print raw JSON").action((id, options) => {
   workersLocalRemoveCommand({ id, json: options.json });
 });
-localWorkers.command("probe").description("Probe an OpenAI-compatible endpoint and draft a worker suggestion").option("--base-url <url>", "OpenAI-compatible local runtime base URL", "http://127.0.0.1:1234").option("--provider <provider>", "Provider label", "lm-studio").option("--model <id>", "Exact model id exposed by the local runtime").option("--prefer-model <text>", "Fallback local model substring when exact model is unset").option(
+localWorkers.command("probe").description("Probe an OpenAI-compatible endpoint and draft a worker suggestion").option("--base-url <url>", "OpenAI-compatible local runtime base URL", "http://127.0.0.1:1234").option("--api-key-env <env>", "Environment variable containing the provider API key").option(
+  "--api-key-header <header>",
+  "Provider API key header: authorization or x-api-key",
+  "authorization"
+).option("--provider <provider>", "Provider label", "lm-studio").option("--model <id>", "Exact model id exposed by the local runtime").option("--prefer-model <text>", "Fallback local model substring when exact model is unset").option(
   "--role <role>",
   "Worker role; for example coding, documentation, tests, or review",
   "coding"
@@ -39019,6 +39191,8 @@ localWorkers.command("probe").description("Probe an OpenAI-compatible endpoint a
     reasoning: options.reasoning ? options.reasoning.toLowerCase() : void 0,
     contextWindow: options.contextWindow,
     writeScope: options.writeScope,
+    apiKeyEnv: options.apiKeyEnv,
+    apiKeyHeader: options.apiKeyHeader,
     json: options.json
   });
 });

package/docs/FULL_REFERENCE.md

@@ -421,6 +421,7 @@ snipara-companion workflow run \
   --routing-allowed-endpoint local \
   --routing-allowed-endpoint cloud \
   --planner-retains-reasoning \
+  --strong-repair \
   "Update documentation for the new gateway"
 ```
 
@@ -464,7 +465,8 @@ snipara-companion workers local add \
   --role coding \
   --provider lm-studio \
   --base-url http://127.0.0.1:1234 \
-  --model openai/gpt-oss-20b
+  --model openai/gpt-oss-20b \
+  --api-key-env LM_STUDIO_API_KEY
 ```
 
 The declaration is written under `.snipara/workers/<worker-id>.json`; Companion
@@ -499,7 +501,11 @@ Do not store secrets in worker profiles. Local endpoints such as
 `http://127.0.0.1:1234` are safe to commit when they contain no credentials, but
 cloud CLI transports or authenticated endpoints must reference secrets through
 environment variables rather than embedding API keys, bearer tokens, passwords,
-or private URLs directly in `.snipara/workers/*.json`.
+or private URLs directly in `.snipara/workers/*.json`. `--api-key-env` stores
+only the variable name; pair it with `--api-key-header authorization` (default)
+or `--api-key-header x-api-key`. Native Codex and Claude profiles use their
+host-managed credentials. A generic `cli://command` profile fails closed unless
+the command maps to a supported Codex or Claude adapter.
 
 Use `workers local probe` to query a local endpoint and preview a declaration
 proposal before committing it:
@@ -518,6 +524,12 @@ routing/handoff contract: Companion resolves the local candidate through
 `snipara-orchestrator`, records metadata, and leaves execution plus proof review
 to the supervising agent workflow.
 
+Add `--strong-repair` when the supervising workflow should permit one strong
+adapter repair after a local proof or output failure. The handoff records the
+contract (`maxAttempts: 1`, same scope and proof, strong adapter as final
+authority, `main_agent` fallback); Companion remains recommendation-only and
+does not launch the worker.
+
 Use Qwen for reflection, architecture, and documentation:
 
 ```bash
@@ -559,6 +571,39 @@ snipara-orchestrator local-model-catalog \
   --json > .snipara/local-devstral-runtime-catalog.json
 ```
 
+For a remote OpenAI-compatible runtime, use an explicit allowlist and an
+environment-backed key when running the native host:
+
+```bash
+snipara-orchestrator host run \
+  --adapter openai_compatible \
+  --base-url https://provider.example.com --allow-remote \
+  --api-key-env PROVIDER_API_KEY --api-key-header authorization \
+  --model provider/coder --task "Bounded task" --workspace . \
+  --write-scope docs/** --proof "git diff --check" --execute
+```
+
+For a loopback local worker with one explicit strong repair attempt:
+
+```bash
+snipara-orchestrator host run \
+  --adapter openai_compatible --base-url http://127.0.0.1:1234 \
+  --model local/coder --task "Bounded task" --workspace . \
+  --write-scope docs/** --proof "git diff --check" \
+  --strong-repair --repair-adapter codex_app_server --execute
+```
+
+The repair reuses the approval envelope when approval is required, reruns the
+same proof, and records redacted repair metrics in the durable host receipt.
+Scope violations, unavailable repair hosts, skipped proof, or a failed repair
+escalate without a retry loop.
+
+Native host proof commands run automatically after dispatch. Use
+`--no-run-proof` only when a reviewer will validate the receipt; the state then
+remains `verification_required`. Use `--require-approval` with both an approval
+receipt id and `--approval-receipt-file <json>` for unattended execution; an id
+alone never bypasses the approval gate.
+
 The local catalog records the OpenAI-compatible routes exposed by LM Studio:
 `GET /v1/models`, `POST /v1/responses`, `POST /v1/chat/completions`,
 `POST /v1/completions`, and `POST /v1/embeddings`. `--prefer-model devstral`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "snipara-companion",
-  "version": "3.4.0",
+  "version": "3.5.0",
   "description": "Local-first CLI that asks your repo what breaks before an AI coding agent edits it.",
   "main": "dist/index.js",
   "bin": {