saphan policy
Validates, inspects and merges drafts of the two policy document types: egress rule-sets (policy egress) and permission classes (policy grant).
Validates, inspects and merges drafts of the two policy document types: egress rule-sets (policy egress) and permission classes (policy grant). Documents are judged by the same loader the product uses when it enforces them; a draft that declares "template": true is an unfilled form and is refused by name. These commands read files and print verdicts; admitting a draft into the record is a separate owner act.
saphan policy egress
Works on egress rule-set drafts: named, tagged documents wrapping an egress policy.
saphan policy egress list
Lists the egress rule-set documents in a directory.
saphan policy egress merge
Composes two or more egress rule-sets into a new draft: lists and rules are combined, and every value that cannot be combined unambiguously is refused, naming the two documents, the key and both values. The sources are validated first and never modified. Exit codes: 0 composed, 1 bad invocation, 2 refused.
| flag | type | default | what it does |
|---|---|---|---|
--id | string | The new draft's identifier. Required. | |
--out, -o | string | Write the composed draft to this file instead of standard output; an existing file there is overwritten, and a path that resolves to any of the sources is refused. | |
--scope | string | user | The new draft's scope: user (the default) or team; builtin is refused. |
--title | string | The new draft's title; defaults to its identifier. |
saphan policy egress show
Prints one egress rule-set's envelope, its validation verdict and its digests.
saphan policy egress validate
Validates egress rule-set drafts given as files or as directories, which are read one level deep. In a directory every entry is accounted for: documents of the other type, the library's INDEX.json and files that are not documents are skipped with a named reason, and an entry that is not a regular file (policy-entry-not-a-regular-file) or cannot be read (policy-entry-unreadable) is refused while the rest are still judged. Exit codes: 0 all valid, 1 bad invocation, 2 at least one document refused.
saphan policy grant
Works on permission class drafts, in either supported shape: a Claude Code settings file or a commands_allow class.
saphan policy grant list
Lists the permission class documents in a directory.
saphan policy grant merge
Composes two or more permission classes into a new draft: allow and deny lists and environment keys are combined, and every value that cannot be combined unambiguously is refused, naming the two documents, the key and both values. The sources are validated first and never modified. Exit codes: 0 composed, 1 bad invocation, 2 refused.
| flag | type | default | what it does |
|---|---|---|---|
--id | string | The new draft's identifier. Required. | |
--out, -o | string | Write the composed draft to this file instead of standard output; an existing file there is overwritten, and a path that resolves to any of the sources is refused. | |
--scope | string | user | The new draft's scope: user (the default) or team; builtin is refused. |
--title | string | The new draft's title; defaults to its identifier. |
saphan policy grant show
Prints one permission class's envelope, its validation verdict and its digests.
saphan policy grant validate
Validates permission class drafts given as files or as directories, which are read one level deep. In a directory every entry is accounted for: documents of the other type, the library's INDEX.json and files that are not documents are skipped with a named reason, and an entry that is not a regular file (policy-entry-not-a-regular-file) or cannot be read (policy-entry-unreadable) is refused while the rest are still judged. Exit codes: 0 all valid, 1 bad invocation, 2 at least one document refused.
saphan policy project
Copies the policy documents shipped in the Saphan Studio engine's source tree into the bridge's permission-classes directory, overwriting any bridge copy of the same name, and commits every changed file in one commit as the person running it; it never deletes a copy the engine no longer ships (it reports it and exits non-zero), and saphan dry-run policy project writes nothing. Used when developing Saphan Studio; not needed to operate an installation.
| flag | type | default | what it does |
|---|---|---|---|
--actor | string | The person the commit is made as; defaults to SAPHAN_ACTOR, then your configuration. | |
--branch | string | The branch the bridge working tree must already be on; it is checked, never switched to. Defaults to main. | |
--bridge | string | The absolute path of the bridge working tree; defaults to bridge under the workspace. | |
--engine-ref | string | The engine ref whose policies are copied; defaults to develop. | |
--engine-repo | string | The absolute path of the engine source checkout; defaults to sources/saphan-studio-engine (or saphan-studio-engine) under the workspace. | |
--git | string | The git executable to run; defaults to git found on your PATH. |
Global options apply to every command — see Every command.
saphan person
Performs a person's own act from the command line with a FIDO2 security key: checking what the host offers, enrolling a key, and signing orders.
saphan pr-preflight
Runs seven checks on the current branch before you open a pull request (branch name, working-tree status, commit subjects, how far it is behind the base, submodules, a clean build and a passing scoped