saphan seat
Acts on one seat — a vendor CLI login, with its own profile directory, on an admitted machine: checking and repairing its credential, configuring its vendor settings, and issuing or ending the tokens
Acts on one seat — a vendor CLI login, with its own profile directory, on an admitted machine: checking and repairing its credential, configuring its vendor settings, and issuing or ending the tokens and keys it signs with. Machines themselves are managed with saphan machine.
saphan seat auth
Reports what the record says about a seat's credential: credential-dead, reauth-recorded, lane-limited (a usage limit, which waiting fixes and re-login does not), credential-ok or never-measured, with the age of the evidence. Only for credential-dead does it print the exact command to run on the seat's own host to log in again; it never logs in itself. By default it only reads the record and costs nothing; an old credential-ok can be stale, so use --probe to check live.
| flag | type | default | what it does |
|---|---|---|---|
--identity | string | The seat to report on; omitted, every seat in the registry is reported. | |
--machine | string | Look the seat up on this one admitted machine only. Without it, the name is resolved across all machines and the last declaration wins. | |
--probe | bool | false | Run one non-interactive, billed model turn on each named seat under its own profile, record the result, and answer from it. ⚠ Without --identity this bills a turn on every seat in the registry. |
--requested-by | string | When a tool or screen requests the probe on someone's behalf, who asked; written into the probe's record note. The recorded actor remains the engine. |
saphan seat auth-performed
Records that a named person re-authenticated a seat whose credential the record reads as dead, so seat auth reports reauth-recorded until the next real run confirms it. This is a report, not a check: nothing contacts the vendor, yet it makes the seat dispatchable again. Refused on a seat whose credential is not recorded as dead.
| flag | type | default | what it does |
|---|---|---|---|
--by | string | The person who performed the login — a person, not a role; recorded as given and not verified. Required. | |
--identity | string | The seat that was re-authenticated. Required. |
saphan seat configure
Copies the workspace's declared settings into one seat's vendor configuration file (today codex only): the retry settings for server-side capacity refusals, written only for a ChatGPT login, and network access to the channel store, written only when the seat's permission class already allows it. It writes no credential and widens no permission. A key you set to a different value is refused and both values are shown, never overwritten; lines this command wrote earlier for a ChatGPT login are removed if the seat no longer reads as one. Re-run it after any re-login.
| flag | type | default | what it does |
|---|---|---|---|
--backend | string | Which vendor's configuration to write; today only codex. | |
--seat | string | The seat's own profile directory (for codex, its CODEX_HOME). Required. |
saphan seat grant-token
Issues a bearer token of one class for an actor already bound to the workspace, and writes it to a file in the server's state directory with mode 0600; the token is never printed. issuance is the token engines and agents use to obtain seat keys, placement is the engine's own token for requesting each run's issuance nonce when the run is placed, and operator is for saphan seat revoke. Nothing but file access to the server's state directory and its signing key decides who can issue a token: run it as the user that owns that directory. Without --yes it only shows what it would issue.
| flag | type | default | what it does |
|---|---|---|---|
--actor | string | The bound actor the token is issued for. Required. | |
--class | string | The token class: issuance, placement or operator. Required. | |
--register-client | string | Register the actor as a client in the server's registry under this client id, if it is not registered yet; a running server reads it at its next restart. | |
--replace | bool | false | Overwrite an existing token file, to refresh the token; without it an existing file is refused. |
--ttl | duration | 0s | The token's lifetime; defaults to 720 hours for issuance and placement tokens (at most 2160) and 24 hours for operator tokens (at most 168). |
--yes | bool | false | Issue and write the token; without it, the command only shows what it would do. |
saphan seat revoke
Ends a seat key using an operator token. --cause leak-report marks the key compromised from its creation, so everything it ever signed reads as compromised — ⚠ this is permanent and cannot later be turned into a plain retirement; --cause run-end retires the key of a run that has ended, and is refused while the run is still running. Anyone holding an operator token can send either cause for any seat key. Without --yes it only shows what it would send.
| flag | type | default | what it does |
|---|---|---|---|
--cause | string | Why the key is ended: leak-report or run-end. Required. | |
--key | string | The seat key id (sek-…), as shown in a signed document's author verdict. Required. | |
--token-file | string | The operator token file; defaults to seat-operator.token in the server's state directory. | |
--yes | bool | false | Send the request; without it, the command only shows what it would send. |
Global options apply to every command — see Every command.