saphan console
Manages who may sign in to the web console and which passkeys may approve actions in it.
Manages who may sign in to the web console and which passkeys may approve actions in it. The console has one administrator, who signs in with a password; approving a gate or other recorded act in the browser takes a registered passkey, never the password.
saphan console admin
Sets and inspects the console administrator's sign-in credential.
saphan console admin set
Sets or rotates the console administrator's password. It asks for the password twice with echo off, like passwd, and stores only an argon2id digest in a file in the workspace's state directory that only its owner can read; the password is never stored, printed or logged. When standard input is not a terminal the password is read from it, which is how to script it. ⚠ It asks for no owner code: anyone who can write the workspace's state directory can set or replace the password. A rotation takes effect only when the server is restarted; until then the old password still signs in and open sessions stay valid, and the command prints the restart.
| flag | type | default | what it does |
|---|---|---|---|
--user | string | The administrator's username (required). There is deliberately no password option, because command lines are visible to other users and saved in shell history. |
saphan console admin status
Reports whether the console has a usable administrator credential: its username, its digest parameters and the file it lives in, never the digest or the password. Run it first when the console refuses to sign you in; it tells "never set up" apart from "present but unreadable".
saphan console device
Manages the passkeys that may sign acts in the browser as the console administrator.
saphan console device enrol
Prints a one-use code, valid for 15 minutes and signed with this workspace's key, that lets one browser register one passkey; it also prints a link with the code filled in when the configuration names the passkey origin. A second device needs a second code, and only a digest of the code is stored. It is an owner act: it prints a one-time six-character code on the terminal and waits for it to be typed back, and is refused with no terminal (scripts, CI), inside the console's browser terminal and after five wrong codes. Run it on the machine where saphan-server runs, or through the gateway when connected to one.
| flag | type | default | what it does |
|---|---|---|---|
--label | string | Your own name for the device, shown by saphan console device list. | |
--setup-window | bool | false | Authorise this one enrolment through the first-run setup window instead of the owner code. Refused once the record shows a console administrator has existed, when the administrator already holds a passkey, and when connected to a gateway; the setup wizard uses it, and a person at a terminal never needs it. |
--web | bool | false | Enrol a browser passkey (required; browsers are currently the only supported platform). |
saphan console device list
Lists the passkeys enrolled for the console administrator, each with its state (active or retired), when and from which origin it was enrolled, and for a retired one, when and by which key it was retired.
saphan console device revoke
Retires one passkey and signs a record of the retirement. The passkey's next use is refused with webauthn-credential-retired; the entry is kept rather than deleted, so the refusal tells the person to use another passkey instead of enrolling one they already hold. It is an owner act and asks for the six-character terminal code, like enrol. Use this for a lost passkey, then enrol a replacement.
| flag | type | default | what it does |
|---|---|---|---|
--device | string | The credential id of the passkey to retire (required); saphan console device list prints them. |
Global options apply to every command — see Every command.
saphan confine-exec
Applies this machine's own filesystem confinement and then runs a command inside it; Saphan Studio invokes it on a remote machine to start an agent within the boundary a run was given.
saphan cost
Shows what a stream has cost, from the run record: the number of runs, each run with its model, its cost in US dollars, its status and its token counts (input, cached, output and reasoning), and the s