saphan egress-door
Runs one agent's egress door on a remote machine: it opens a SOCKS5 proxy on a unix socket that judges every outbound connection against the run's egress policy, runs the given command as its child, a
Runs one agent's egress door on a remote machine: it opens a SOCKS5 proxy on a unix socket that judges every outbound connection against the run's egress policy, runs the given command as its child, and closes the door when that command ends. The engine starts it itself when it dispatches a run over ssh; you do not normally type it.
On Linux the door serves only the process it started and that process's children; any other connection is closed unread. ⚠ On macOS the door does not identify who connects: the run's sandbox profile is what limits which of the run's processes can reach it. The policy arrives as the document itself; when its digest is given with --policy-source or --policy-digest, the door refuses to start if the bytes do not match, and without them nothing is compared. There is no background mode, except the time-limited --standing door below. If the door is killed outright, nothing serves the socket and the agent's network fails closed. The command's exit status is the door's exit status.
| flag | type | default | what it does |
|---|---|---|---|
--address-file | string | Where the door writes the 127.0.0.1:<port> its HTTP CONNECT listener is bound to; an absolute path in the same directory as --socket, removed with the door. | |
--connect-loopback | bool | false | Also accept HTTP CONNECT on a loopback port, for clients that do not use SOCKS; requires --address-file. macOS only: refused on Linux, because a loopback port cannot be limited to the run's own processes. ⚠ On macOS any process of the same user that can reach the port is served under this run's policy. |
--guardrail-address-file | string | With --standing (refused without it), where the door writes the loopback port it reserved for the model-text guardrail proxy on this machine; an absolute path in the same directory as --socket. | |
--max-lifetime | duration | 0s | With --standing, the longest the door may stay open before it closes itself; required, so a standing door can never become a permanent proxy. |
--model-dial-socket | string | The unix socket through which the agent reaches the model endpoint; only the one registered peer is admitted. Used together with the other --model-* flags. | |
--model-only | bool | false | Serve only the model endpoint and no general egress door, for a sealed run whose agent needs nothing but its model; requires the four --model-* flags. |
--model-policy-document | string | The policy document for the model endpoint, as JSON: the model hosts and nothing wider. | |
--model-policy-source | string | The sha256 of the exact --model-policy-document bytes; the door refuses to start on a mismatch. | |
--model-register-socket | string | The unix socket on which the guardrail proxy registers itself, once, with the model endpoint. | |
--policy-digest | string | The sha256 of the compiled policy as the dispatcher recorded it; the door refuses to start on a mismatch. | |
--policy-document | string | The egress policy document itself, as one JSON value carried to this machine. | |
--policy-file | string | Where the door writes the policy it is enforcing, so a network wall inside the child can read its scope; an absolute path in the same directory as --socket, removed when the child ends. | |
--policy-source | string | The sha256 of the exact --policy-document bytes; the door refuses to start on a mismatch. | |
--socket | string | The absolute path of the unix socket to serve on, chosen by the dispatcher for this run. | |
--standing | bool | false | Open the door without a command, for a remote macOS machine whose sandbox profile must name the door's port in advance; it closes on a signal or when --max-lifetime passes. Requires --max-lifetime, --connect-loopback and --address-file, and takes no command. |
Global options apply to every command — see Every command.
saphan dry-run
Rehearses a command that would change the record, without making the change: saphan dry-run <command> [args...] runs the same checks the real command runs and shows what it would do, or the refusal it
saphan evidence
Parks a stream's evidence outside its worktree, places archives in the evidence store, and reads them back.