CLI reference

usage: sleeptalk [-h] [--version] [--web | --terminal | --discord]
                 {settings,trust,link,dev-call,run,doctor,connect,init,service,adapter,eval,host}
                 ...

Run sleeptalk to open the settings page in your browser: set up, pick a profile, and start a call.
Without a browser here (over SSH, or no display) it runs the setup in the terminal instead.

positional arguments:
  {settings,trust,link,dev-call,run,doctor,connect,init,service,adapter,eval,host}
    settings            Change this workspace's agent, voice, keys, or call
                        destination.
    trust               Use the Sleeptalk config in this repo (config/profiles/). Its
                        profiles choose the agent, endpoints, and .env.
    link                Mint a single-use live-call link for an already configured
                        profile (agents: use `host ensure` and `host start-voice`).
    dev-call            M0 WebRTC walking skeleton: browser microphone to host echo.
    run                 Run a voice session from sleeptalk.toml.
    doctor              Re-run the full validation ladder against a config.
    connect             Attach a running agent dashboard to an existing profile.
    init                Set up a new profile; use settings to edit the current
                        workspace.
    service             Opt-in OS persistence: install/uninstall/status.
    adapter             Scaffold and test your own agent adapter.
    eval                Run eval tiers: contract (pytest) or health (trace
                        invariants).
    host                Context-aware setup and voice start for agents and local
                        terminals.

options:
  -h, --help            show this help message and exit
  --version             show program's version number and exit
  --web                 Use web for this call without changing your default.
  --terminal            Use terminal for this call without changing your default.
  --discord             Use discord for this call without changing your default.

Agents: use `sleeptalk host` (ensure, input link, start-voice). Never ask the user
for provider keys in chat or write them to a file; `sleeptalk host input link`
sends the user a private setup page instead. Never read or copy files under the
state directory's credentials/ folder; the JSON receipts carry everything you
need. See `sleeptalk host --help`.

usage: sleeptalk settings [-h] [--open] [--terminal] [--phone] [--json]
                          [--profile SETTINGS_PROFILE]

options:
  -h, --help            show this help message and exit
  --open                Open the settings page in this machine's browser (the default
                        when there is one).
  --terminal            Use the terminal setup instead of the settings page.
  --phone               Print a single-use link that opens the settings page on your
                        phone (or any device), through an encrypted channel the call
                        service can't read. Keep this command running, or add --json
                        to return a link from a detached server and exit.
  --json                With --phone, return a JSON link receipt and exit while a
                        detached server handles settings.
  --profile SETTINGS_PROFILE
                        Profile slug to edit (default: the workspace's default).

usage: sleeptalk trust [-h] [--remove] [path]

positional arguments:
  path        Repo to trust (default: the one containing the current directory).

options:
  -h, --help  show this help message and exit
  --remove    Stop trusting it.

usage: sleeptalk link [-h] [--rendezvous RENDEZVOUS] [--agent-instance AGENT_INSTANCE]
                      [--conversation-id CONVERSATION_ID]
                      [--platform-user-id PLATFORM_USER_ID] [--config CONFIG]
                      [--tailnet] [--echo] [--foreground] [--ttl-seconds TTL_SECONDS]

options:
  -h, --help            show this help message and exit
  --rendezvous RENDEZVOUS
                        Custom rendezvous origin (default: a package-owned localhost
                        service).
  --agent-instance AGENT_INSTANCE
                        Agent instance identifier stored with the ticket.
  --conversation-id CONVERSATION_ID
                        Originating agent session/conversation identifier.
  --platform-user-id PLATFORM_USER_ID
                        Originating platform user identifier stored with the ticket.
  --config CONFIG       Runtime profile whose agent/STT/TTS host the call.
  --tailnet             Publish the call on this host's tailnet with `tailscale
                        serve`; no hosted relay or TURN.
  --echo                Use the M1 echo fixture instead of an agent runtime.
  --foreground          Stay attached to the call host (development only).
  --ttl-seconds TTL_SECONDS
                        Unused-link lifetime from 1 to 300 seconds (default: 300).

usage: sleeptalk dev-call [-h] [--rendezvous RENDEZVOUS] [--room ROOM]

options:
  -h, --help            show this help message and exit
  --rendezvous RENDEZVOUS
                        Public staging origin (default: SLEEPTALK_RENDEZVOUS_URL or
                        localhost:8788 for the M0 echo).
  --room ROOM           Fixed development room ID for debugging; random by default.

usage: sleeptalk run [-h] [--config CONFIG] [--skip-checks]

options:
  -h, --help       show this help message and exit
  --config CONFIG  Explicit config path (tier 1; orthogonal to SLEEPTALK_HOME).
                   Default: resolved via SLEEPTALK_HOME -> repo context ->
                   ~/.sleeptalk.
  --skip-checks    Skip provider connectivity checks at startup.

usage: sleeptalk doctor [-h] [--config CONFIG] [--offline] [--json]

options:
  -h, --help       show this help message and exit
  --config CONFIG  Explicit config path (tier 1; orthogonal to SLEEPTALK_HOME).
                   Default: resolved via SLEEPTALK_HOME -> repo context ->
                   ~/.sleeptalk.
  --offline        Skip live network rungs (connectivity, Discord, STT round-trip).
                   Live rungs send each key only to its own provider; some (an
                   ElevenLabs transcription and one spoken word) use a little credit.
  --json           Print one machine-readable JSON line with stable rung ids.

usage: sleeptalk connect [-h] {hermes} ...

positional arguments:
  {hermes}
    hermes    Find a Hermes dashboard and write type=hermes_gateway.

options:
  -h, --help  show this help message and exit

usage: sleeptalk connect hermes [-h] [--url URL] [--token TOKEN] [--slug SLUG]
                                [--config CONFIG] [--offline]

options:
  -h, --help       show this help message and exit
  --url URL        Dashboard URL (default: http://127.0.0.1:9119).
  --token TOKEN    Dashboard session token. Use - to type it at a hidden prompt (or
                   pipe it on stdin).
  --slug SLUG      Existing profile slug.
  --config CONFIG  Existing profile path.
  --offline        Write the profile without handshaking the dashboard.

usage: sleeptalk init [-h] [--answers ANSWERS] [--non-interactive] [--offline]
                      [--surface SURFACE] [--route-type ROUTE_TYPE]
                      [--realtime-key REALTIME_KEY] [--realtime-model REALTIME_MODEL]
                      [--realtime-voice REALTIME_VOICE] [--speech-model SPEECH_MODEL]
                      [--transcription-model TRANSCRIPTION_MODEL]
                      [--agent-type AGENT_TYPE] [--workspace-dir WORKSPACE_DIR]
                      [--gateway-url GATEWAY_URL] [--gateway-api-key GATEWAY_API_KEY]
                      [--gateway-session-token GATEWAY_SESSION_TOKEN]
                      [--agent-permission-mode AGENT_PERMISSION_MODE]
                      [--agent-token AGENT_TOKEN]
                      [--gateway-session-id GATEWAY_SESSION_ID]
                      [--openclaw-token OPENCLAW_TOKEN] [--name NAME] [--slug SLUG]
                      [--guild-id GUILD_ID] [--client-id CLIENT_ID]
                      [--token-env TOKEN_ENV] [--token TOKEN] [--language LANGUAGE]
                      [--speech-provider SPEECH_PROVIDER] [--speech-key SPEECH_KEY]
                      [--stt-provider STT_PROVIDER] [--stt-model STT_MODEL]
                      [--stt-key STT_KEY] [--tts-provider TTS_PROVIDER]
                      [--tts-model TTS_MODEL] [--tts-voice-id TTS_VOICE_ID]
                      [--tts-key TTS_KEY] [--tts-user-id TTS_USER_ID]
                      [--tts-mode TTS_MODE]

options:
  -h, --help            show this help message and exit
  --answers ANSWERS     TOML answers file (headless setup).
  --non-interactive     Never prompt; answers come from --answers and/or flags.
  --offline             Skip live credential validation.
  --surface SURFACE
  --route-type ROUTE_TYPE
  --realtime-key REALTIME_KEY
                        Use - to type it at a hidden prompt (or pipe it on stdin); a
                        key written here shows in ps and shell history.
  --realtime-model REALTIME_MODEL
  --realtime-voice REALTIME_VOICE
  --speech-model SPEECH_MODEL
  --transcription-model TRANSCRIPTION_MODEL
  --agent-type AGENT_TYPE
  --workspace-dir WORKSPACE_DIR
  --gateway-url GATEWAY_URL
  --gateway-api-key GATEWAY_API_KEY
                        Use - to type it at a hidden prompt (or pipe it on stdin); a
                        key written here shows in ps and shell history.
  --gateway-session-token GATEWAY_SESSION_TOKEN
                        Use - to type it at a hidden prompt (or pipe it on stdin); a
                        key written here shows in ps and shell history.
  --agent-permission-mode AGENT_PERMISSION_MODE
  --agent-token AGENT_TOKEN
                        Use - to type it at a hidden prompt (or pipe it on stdin); a
                        key written here shows in ps and shell history.
  --gateway-session-id GATEWAY_SESSION_ID
  --openclaw-token OPENCLAW_TOKEN
                        Use - to type it at a hidden prompt (or pipe it on stdin); a
                        key written here shows in ps and shell history.
  --name NAME
  --slug SLUG
  --guild-id GUILD_ID
  --client-id CLIENT_ID
  --token-env TOKEN_ENV
  --token TOKEN         Use - to type it at a hidden prompt (or pipe it on stdin); a
                        key written here shows in ps and shell history.
  --language LANGUAGE
  --speech-provider SPEECH_PROVIDER
  --speech-key SPEECH_KEY
                        Use - to type it at a hidden prompt (or pipe it on stdin); a
                        key written here shows in ps and shell history.
  --stt-provider STT_PROVIDER
  --stt-model STT_MODEL
  --stt-key STT_KEY     Use - to type it at a hidden prompt (or pipe it on stdin); a
                        key written here shows in ps and shell history.
  --tts-provider TTS_PROVIDER
  --tts-model TTS_MODEL
  --tts-voice-id TTS_VOICE_ID
  --tts-key TTS_KEY     Use - to type it at a hidden prompt (or pipe it on stdin); a
                        key written here shows in ps and shell history.
  --tts-user-id TTS_USER_ID
  --tts-mode TTS_MODE

usage: sleeptalk service [-h] [--config CONFIG] [--yes]
                         {install,uninstall,status,preflight} slug

positional arguments:
  {install,uninstall,status,preflight}
  slug                  Profile slug.

options:
  -h, --help            show this help message and exit
  --config CONFIG       Config path for install (default: resolved layout's profile).
  --yes                 Skip the confirmation prompt.

usage: sleeptalk adapter [-h] {versions,new,test} ...

positional arguments:
  {versions,new,test}
    versions           Inspect harness compatibility and upstream releases without
                       upgrading.
    new                Create a working agent you can edit.
    test               Check an agent against the Sleeptalk contract.

options:
  -h, --help           show this help message and exit

usage: sleeptalk adapter versions [-h] [--upstream] [--pi-bin PI_BIN]
                                  [--omp-bin OMP_BIN] [--cursor-bin CURSOR_BIN]
                                  [--json] [--fail-on-change]

options:
  -h, --help            show this help message and exit
  --upstream            Check public release metadata; never install or upgrade.
  --pi-bin PI_BIN       Inspect this existing Pi executable with --version (no
                        prompt).
  --omp-bin OMP_BIN     Inspect this existing OMP executable and its protected SDK
                        eligibility (no prompt).
  --cursor-bin CURSOR_BIN
                        Inspect an existing Cursor CLI executable (no prompt or
                        upgrade).
  --json                Print the complete inventory as JSON.
  --fail-on-change      With --upstream, exit 1 when a release differs from the last
                        review.

usage: sleeptalk adapter new [-h] [--kind {command,http,acp,bridge,python}]
                             [--language {python,node}] [--dir DIR]
                             name

positional arguments:
  name                  Adapter name: lowercase letters, digits, - or _.

options:
  -h, --help            show this help message and exit
  --kind {command,http,acp,bridge,python}
                        command: a program over stdio (default). http: a web endpoint.
                        acp: an ACP agent. bridge: a remote Agent Bridge server.
                        python: an installable plugin.
  --language {python,node}
  --dir DIR             Target directory (default: ./<name>).

usage: sleeptalk adapter test [-h] [--config CONFIG] [--live | --fixture] [--json]

options:
  -h, --help       show this help message and exit
  --config CONFIG  Profile whose [agent] section to test.
  --live           Send a few short real prompts. Proves speech and abort; may spend
                   tokens.
  --fixture        Send the scaffold's test prompts (hello, slow, hang, tool,
                   permission, clarify).
  --json           Print one machine-readable JSON report.

usage: sleeptalk eval [-h] {contract,health} ...

positional arguments:
  {contract,health}
    contract         Run public contract pytest tier.
    health           Check session health invariants on JSONL traces.

options:
  -h, --help         show this help message and exit

usage: sleeptalk eval contract [-h]

options:
  -h, --help  show this help message and exit

usage: sleeptalk eval health [-h] --log LOG [--events EVENTS]
                             [--minimum-turns MINIMUM_TURNS]

options:
  -h, --help            show this help message and exit
  --log LOG             Path to voice_latency.jsonl (or compatible trace log).
  --events EVENTS       Optional session_events.jsonl for tool/interruption events.
  --minimum-turns MINIMUM_TURNS
                        Minimum completed turns required (default: 1).

usage: sleeptalk host [-h]
                      {remote,auth,inventory,bootstrap,probe-runtime,discover,ensure,input,settings-link,credentials,start-voice,list,status,stop,reset-access}
                      ...

Setup and voice start for an agent acting on the user's behalf.

  1. sleeptalk host ensure --profile default --agent <yours> --surface web --json
     Reports needs_input with the missing pieces; never starts a call. If its
     `tailnet.available` is true, ask the user whether the device they will call
     from is on the same Tailscale network; if yes, rerun with --tailnet once and
     every later call uses the tailnet (private, no relay) without a flag.
     It also checks for a key already on this host that can listen and speak
     (OpenRouter, Groq, Together, Venice: from Sleeptalk's store, the environment,
     or your own config and .env). If it finds one, it only offers it: the receipt
     carries `reusable_keys` and an `ask` line. Put that question to the user and
     wait. On yes, rerun ensure with --reuse-key <provider>; it comes back ready with
     a `say` line to relay, then go to step 3. Never reuse a key without that yes.
     On no, or when nothing was found, send a link:
  2. sleeptalk host input link --request-id <id> --profile default --workspace <dir>
       --agent <yours>
     Returns a single-use setup link. Send it to the user: the page offers every
     speech provider with its free usage and whether a card is needed, and the user
     picks one and enters its key there (one key listens and speaks). Don't ask them
     to choose in chat; --speech-provider only puts one first. Never ask for keys
     in chat, never write them to a file, never open the link yourself.
     Poll with `host input wait --request-id <id>`; its receipt names the provider.
  3. sleeptalk host start-voice --profile default --json
     Starts one call and prints the join link for the user. Add --tailnet when the
     host and the user's device share a Tailscale network: no relay is used. The
     receipt's `delivery` says which way the call travels (a tailnet link contains
     .ts.net); tell the user that, and never call a relay link a tailnet call.
     A profile that stored --tailnet uses it for every call. When the user asks
     for a normal web link instead, add --no-tailnet to this one start-voice; to
     stop using the tailnet for good, run `host ensure --no-tailnet`.
  Settings, any time: `sleeptalk host settings-link --json` returns a single-use
     link to the full settings page for the user's phone (speech service, keys,
     voice, agent, Discord). Send it privately; never open it yourself.
  4. Discord, optional. Once the first browser call has worked, mention once that
     the user can also talk to you in a Discord voice channel and offer to set it
     up; they can ask for it at any time. Then:
       python -m pip install 'sleeptalk[discord]'   (the python that runs sleeptalk)
       sleeptalk host input link --request-id <id> --profile discord --surface discord
         --speech-from-profile default --workspace <dir> --agent <yours>
     Always pass --speech-from-profile <the working profile> and no provider flag:
     it reuses the speech key already saved, so the page asks only for the bot token.
     The page walks them through creating the bot, adding it to their server,
     picking the voice channel, and locking the bot to their own account. It also
     shows them the invite link and how to find their user ID. When `host input
     wait` reports
     profile_ready, run `sleeptalk service install discord --yes` and start the
     service with the command it prints. In Discord they join that voice channel
     and type /discord join in any chat in that server; the bot joins and greets them.

Never read or copy files under the state directory's credentials/ folder (provider
keys and the hosted-service grant live there). The receipts from these commands
carry every value an agent needs. Manage calls with `sleeptalk host list` (live
calls and their callId) and `sleeptalk host stop <callId>`.

positional arguments:
  {remote,auth,inventory,bootstrap,probe-runtime,discover,ensure,input,settings-link,credentials,start-voice,list,status,stop,reset-access}
    remote              Pair a private device and operate the remote setup relay.
    auth                Privately validate and save a model-provider credential.
    inventory           Report non-secret bootstrap inventory as JSON.
    bootstrap           Install a verified wheel into a separate per-user runtime.
    probe-runtime       Verify an adapter without starting user work.
    discover            Read-only capability discovery; does not start setup or audio.
    ensure              Convergent readiness check; never mints a call.
    input               Bounded private credential entry in the user's local browser.
    settings-link       A single-use link to the full settings page for the user's
                        phone: speech service, keys, voice, agent, Discord, and the
                        rest. Send it privately; never open it yourself.
    credentials         List, inspect, prune, move, or remove stored credentials;
                        never print a value.
    start-voice         Run Terminal, start a localhost Web call, or return a hosted
                        agent call. Use --request-id to recover an existing attempt.
    list                List live detached calls as one JSON receipt.
    status              Read a start attempt as JSON without returning its join link.
    stop                Stop a detached call by callId and print one JSON receipt.
    reset-access        Replace this machine's anonymous hosted-service credential.

options:
  -h, --help            show this help message and exit

usage: sleeptalk host remote [-h]
                             {identity,serve,relay,pair,setup,status,cancel,revoke}
                             ...

positional arguments:
  {identity,serve,relay,pair,setup,status,cancel,revoke}
    identity            Print this host's public remote setup identity.
    serve               Run the host's outbound relay connection in the foreground.
    relay               Run the separate volatile setup relay service.
    pair                Open a trusted loopback page for passkey pairing confirmation.
    setup               Create a private remote credential-entry invitation.
    status              Read value-free durable remote progress.
    cancel              Cancel a setup request from this trusted host.
    revoke              Revoke a paired operator on this host.

options:
  -h, --help            show this help message and exit

usage: sleeptalk host remote identity [-h]

options:
  -h, --help  show this help message and exit

usage: sleeptalk host remote serve [-h] --origin ORIGIN

options:
  -h, --help       show this help message and exit
  --origin ORIGIN  Exact HTTPS setup service origin.

usage: sleeptalk host remote relay [-h] {serve} ...

positional arguments:
  {serve}

options:
  -h, --help  show this help message and exit

usage: sleeptalk host remote relay serve [-h] --origin ORIGIN --host-map HOST_MAP
                                         [--bind BIND] [--port PORT] [--assets ASSETS]

options:
  -h, --help           show this help message and exit
  --origin ORIGIN      Exact public HTTPS origin served by the TLS frontend.
  --host-map HOST_MAP  Private JSON map of host IDs to public keys.
  --bind BIND
  --port PORT
  --assets ASSETS

usage: sleeptalk host remote pair [-h] --origin ORIGIN [--display-host DISPLAY_HOST]
                                  [--user-browser-local] [--agent-auth-mode {api_key}]
                                  [--agent-auth-protocol {openai-completions,openai-responses,openai-codex-responses,anthropic-messages,cursor}]
                                  [--agent-auth-url AGENT_AUTH_URL]
                                  [--agent-credential-ref AGENT_CREDENTIAL_REF]
                                  [--agent-option NAME=VALUE] [--collect-agent-auth]
                                  --request-id REQUEST_ID --profile PROFILE
                                  --workspace WORKSPACE --agent AGENT --surface
                                  {web,terminal,discord}
                                  [--runtime {native,gateway,acp}]
                                  [--permission-mode PERMISSION_MODE]
                                  [--gateway-url GATEWAY_URL] [--model MODEL]
                                  [--provider PROVIDER] [--pi-bin PI_BIN]
                                  [--capture-mode {headphones,speakers}]
                                  [--user-terminal-local]
                                  [--tts-voice-id TTS_VOICE_ID]
                                  [--speech-from-profile SLUG]
                                  [--speech-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}]
                                  [--stt-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}]
                                  [--tts-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}]
                                  [--language LANGUAGE] [--guild-id GUILD_ID]
                                  [--channel-id CHANNEL_ID]
                                  [--discord-operator-id DISCORD_OPERATOR_ID]
                                  [--replace-reference REPLACE_REFERENCE]
                                  [--affected-profile AFFECTED_PROFILE]

options:
  -h, --help            show this help message and exit
  --origin ORIGIN
  --display-host DISPLAY_HOST
  --user-browser-local
  --agent-auth-mode {api_key}
  --agent-auth-protocol {openai-completions,openai-responses,openai-codex-responses,anthropic-messages,cursor}
  --agent-auth-url AGENT_AUTH_URL
                        Exact HTTPS model-provider endpoint; no embedded credentials.
  --agent-credential-ref AGENT_CREDENTIAL_REF
                        Private credential reference, never a key or token.
  --agent-option NAME=VALUE
                        Non-secret adapter option, such as hermes_root. Validated by
                        the selected adapter.
  --collect-agent-auth  Collect the Hermes model credential in the paired browser;
                        omit --agent-credential-ref.
  --request-id REQUEST_ID
  --profile PROFILE
  --workspace WORKSPACE
  --agent AGENT
  --surface {web,terminal,discord}
  --runtime {native,gateway,acp}
  --permission-mode PERMISSION_MODE
  --gateway-url GATEWAY_URL
  --model MODEL
  --provider PROVIDER
  --pi-bin PI_BIN
  --capture-mode {headphones,speakers}
  --user-terminal-local
  --tts-voice-id TTS_VOICE_ID
                        A voice the user asked for; the setup page then validates
                        exactly this voice.
  --speech-from-profile SLUG
                        Reuse the speech provider, voice, and stored key of an
                        existing profile (for example `default`), so the page only
                        asks for what the new surface needs, such as a Discord bot
                        token.
  --speech-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}
                        Optional. The key page always offers every provider, with its
                        free usage and whether a card is needed, and the user picks
                        one there (one key listens and speaks). Pass this only to put
                        a provider the user already named first; the others stay a tap
                        away.
  --stt-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}
                        Mixed setups only: the listening (speech-to-text) provider.
  --tts-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}
                        Mixed setups only: the speaking (text-to-speech) provider.
  --language LANGUAGE
  --guild-id GUILD_ID
  --channel-id CHANNEL_ID
  --discord-operator-id DISCORD_OPERATOR_ID
  --replace-reference REPLACE_REFERENCE
  --affected-profile AFFECTED_PROFILE

usage: sleeptalk host remote setup [-h] --origin ORIGIN [--display-host DISPLAY_HOST]
                                   --operator-id OPERATOR_ID --workspace-id
                                   WORKSPACE_ID [--agent-auth-mode {api_key}]
                                   [--agent-auth-protocol {openai-completions,openai-responses,openai-codex-responses,anthropic-messages,cursor}]
                                   [--agent-auth-url AGENT_AUTH_URL]
                                   [--agent-credential-ref AGENT_CREDENTIAL_REF]
                                   [--agent-option NAME=VALUE] [--collect-agent-auth]
                                   --request-id REQUEST_ID --profile PROFILE
                                   --workspace WORKSPACE --agent AGENT --surface
                                   {web,terminal,discord}
                                   [--runtime {native,gateway,acp}]
                                   [--permission-mode PERMISSION_MODE]
                                   [--gateway-url GATEWAY_URL] [--model MODEL]
                                   [--provider PROVIDER] [--pi-bin PI_BIN]
                                   [--capture-mode {headphones,speakers}]
                                   [--user-terminal-local]
                                   [--tts-voice-id TTS_VOICE_ID]
                                   [--speech-from-profile SLUG]
                                   [--speech-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}]
                                   [--stt-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}]
                                   [--tts-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}]
                                   [--language LANGUAGE] [--guild-id GUILD_ID]
                                   [--channel-id CHANNEL_ID]
                                   [--discord-operator-id DISCORD_OPERATOR_ID]
                                   [--replace-reference REPLACE_REFERENCE]
                                   [--affected-profile AFFECTED_PROFILE]

options:
  -h, --help            show this help message and exit
  --origin ORIGIN
  --display-host DISPLAY_HOST
  --operator-id OPERATOR_ID
                        Paired remote operator ID.
  --workspace-id WORKSPACE_ID
                        Workspace ID returned by pairing.
  --agent-auth-mode {api_key}
  --agent-auth-protocol {openai-completions,openai-responses,openai-codex-responses,anthropic-messages,cursor}
  --agent-auth-url AGENT_AUTH_URL
                        Exact HTTPS model-provider endpoint; no embedded credentials.
  --agent-credential-ref AGENT_CREDENTIAL_REF
                        Private credential reference, never a key or token.
  --agent-option NAME=VALUE
                        Non-secret adapter option, such as hermes_root. Validated by
                        the selected adapter.
  --collect-agent-auth  Collect the Hermes model credential in the paired browser;
                        omit --agent-credential-ref.
  --request-id REQUEST_ID
  --profile PROFILE
  --workspace WORKSPACE
  --agent AGENT
  --surface {web,terminal,discord}
  --runtime {native,gateway,acp}
  --permission-mode PERMISSION_MODE
  --gateway-url GATEWAY_URL
  --model MODEL
  --provider PROVIDER
  --pi-bin PI_BIN
  --capture-mode {headphones,speakers}
  --user-terminal-local
  --tts-voice-id TTS_VOICE_ID
                        A voice the user asked for; the setup page then validates
                        exactly this voice.
  --speech-from-profile SLUG
                        Reuse the speech provider, voice, and stored key of an
                        existing profile (for example `default`), so the page only
                        asks for what the new surface needs, such as a Discord bot
                        token.
  --speech-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}
                        Optional. The key page always offers every provider, with its
                        free usage and whether a card is needed, and the user picks
                        one there (one key listens and speaks). Pass this only to put
                        a provider the user already named first; the others stay a tap
                        away.
  --stt-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}
                        Mixed setups only: the listening (speech-to-text) provider.
  --tts-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}
                        Mixed setups only: the speaking (text-to-speech) provider.
  --language LANGUAGE
  --guild-id GUILD_ID
  --channel-id CHANNEL_ID
  --discord-operator-id DISCORD_OPERATOR_ID
  --replace-reference REPLACE_REFERENCE
  --affected-profile AFFECTED_PROFILE

usage: sleeptalk host remote status [-h] --request-id REQUEST_ID
                                    [--kind {setup,pairing}]

options:
  -h, --help            show this help message and exit
  --request-id REQUEST_ID
  --kind {setup,pairing}

usage: sleeptalk host remote cancel [-h] --request-id REQUEST_ID

options:
  -h, --help            show this help message and exit
  --request-id REQUEST_ID

usage: sleeptalk host remote revoke [-h] --operator-id OPERATOR_ID

options:
  -h, --help            show this help message and exit
  --operator-id OPERATOR_ID

usage: sleeptalk host auth [-h] {start,status,cancel} ...

positional arguments:
  {start,status,cancel}
    start               Run a private entry page for the user on this host.

options:
  -h, --help            show this help message and exit

usage: sleeptalk host auth start [-h] --request-id REQUEST_ID --mode {api_key}
                                 --protocol
                                 {openai-completions,openai-responses,openai-codex-responses,anthropic-messages,cursor}
                                 --base-url BASE_URL --model MODEL
                                 [--user-browser-local]

options:
  -h, --help            show this help message and exit
  --request-id REQUEST_ID
  --mode {api_key}
  --protocol {openai-completions,openai-responses,openai-codex-responses,anthropic-messages,cursor}
  --base-url BASE_URL
  --model MODEL
  --user-browser-local

usage: sleeptalk host auth status [-h] --request-id REQUEST_ID

options:
  -h, --help            show this help message and exit
  --request-id REQUEST_ID

usage: sleeptalk host auth cancel [-h] --request-id REQUEST_ID

options:
  -h, --help            show this help message and exit
  --request-id REQUEST_ID

usage: sleeptalk host inventory [-h]

options:
  -h, --help  show this help message and exit

usage: sleeptalk host bootstrap [-h] --artifact ARTIFACT --sha256 SHA256 --surface
                                {web,terminal,discord} --agent AGENT

options:
  -h, --help            show this help message and exit
  --artifact ARTIFACT
  --sha256 SHA256
  --surface {web,terminal,discord}
  --agent AGENT

usage: sleeptalk host probe-runtime [-h] --workspace WORKSPACE --agent AGENT
                                    [--runtime {native,gateway,acp}]
                                    [--agent-auth-mode {api_key}]
                                    [--agent-auth-protocol {openai-completions,openai-responses,openai-codex-responses,anthropic-messages,cursor}]
                                    [--agent-auth-url AGENT_AUTH_URL]
                                    [--agent-credential-ref AGENT_CREDENTIAL_REF]
                                    [--agent-option NAME=VALUE]
                                    [--permission-mode PERMISSION_MODE]
                                    [--model MODEL] [--provider PROVIDER]
                                    [--pi-bin PI_BIN] [--gateway-url GATEWAY_URL]

options:
  -h, --help            show this help message and exit
  --workspace WORKSPACE
  --agent AGENT
  --runtime {native,gateway,acp}
  --agent-auth-mode {api_key}
  --agent-auth-protocol {openai-completions,openai-responses,openai-codex-responses,anthropic-messages,cursor}
  --agent-auth-url AGENT_AUTH_URL
                        Exact HTTPS model-provider endpoint; no embedded credentials.
  --agent-credential-ref AGENT_CREDENTIAL_REF
                        Private credential reference, never a key or token.
  --agent-option NAME=VALUE
                        Non-secret adapter option, such as hermes_root. Validated by
                        the selected adapter.
  --permission-mode PERMISSION_MODE
  --model MODEL
  --provider PROVIDER
  --pi-bin PI_BIN
  --gateway-url GATEWAY_URL
                        Non-secret gateway address; configure authentication privately
                        on the runtime host.

usage: sleeptalk host discover [-h] [--workspace WORKSPACE] [--agent AGENT]
                               [--surface {web,terminal,discord}]
                               [--preferred-surface {web,terminal,discord}]
                               [--session {new,resume}] [--persist]
                               [--context CONTEXT] [--schema] [--json]

options:
  -h, --help            show this help message and exit
  --workspace WORKSPACE
                        Intended directory on this execution host.
  --agent AGENT         Explicit voice adapter choice; no automatic selection.
  --surface {web,terminal,discord}
  --preferred-surface {web,terminal,discord}
  --session {new,resume}
  --persist             Request a persistence feasibility check.
  --context CONTEXT     Non-secret integration claims in JSON, at most 32 KiB.
  --schema              Print the installed discovery JSON schemas without probing.
  --json

usage: sleeptalk host ensure [-h] [--profile PROFILE] [--workspace WORKSPACE]
                             [--tailnet] [--no-tailnet] [--config CONFIG]
                             [--reuse-key {openrouter,groq,together,venice}]
                             [--no-key-reuse] [--answers ANSWERS]
                             [--surface {auto,web,terminal,discord}]
                             [--caller-context CONTEXT] [--route {cascade,hybrid}]
                             [--agent AGENT] [--json] [--live]

options:
  -h, --help            show this help message and exit
  --profile PROFILE     Profile slug under SLEEPTALK_HOME/profiles (default: default).
  --workspace WORKSPACE
                        Bind new profiles to this explicit workspace; verify existing
                        bindings.
  --tailnet             Store delivery = "tailnet" in the profile: browser calls
                        publish on this host's tailnet, no hosted relay. Ask the user
                        first whether the device they call from is on it.
  --no-tailnet          Remove a stored delivery = "tailnet": later browser calls go
                        through the hosted relay again.
  --config CONFIG       Explicit profile path (overrides --profile).
  --reuse-key {openrouter,groq,together,venice}
                        Set voice up from this key already on this host, after the
                        user said yes to the receipt's `ask`. Without it, ensure only
                        offers the keys it finds. The key is validated with its
                        provider (a small paid request), copied into the private
                        store, and never shown.
  --no-key-reuse        Do not look for keys already on this host; report what is
                        missing instead.
  --answers ANSWERS     Local TOML answers file used to create or repair the profile.
  --surface {auto,web,terminal,discord}
                        Interface override (default: infer from caller context).
  --caller-context CONTEXT
                        Integration-supplied context; local/terminal/desktop run
                        locally, any chat integration name returns a hosted link
                        (default: SLEEPTALK_CALLER_CONTEXT or Web).
  --route {cascade,hybrid}
                        Requested route for the receipt (default: cascade; hybrid is
                        an unsupported research preview).
  --agent AGENT         Requested agent type, or auto from the profile (default:
                        auto).
  --json                Print a versioned JSON receipt on stdout (default).
  --live                Include live doctor rungs (default: offline static checks
                        only).

usage: sleeptalk host input [-h] {start,link,status,cancel,wait} ...

positional arguments:
  {start,link,status,cancel,wait}
    link                Web setup for a host without the user's browser: returns a
                        single-use phone link through the hosted call service. Send it
                        to the user; never open it yourself.
    wait                Block until the setup request completes, ends, or the timeout
                        passes.

options:
  -h, --help            show this help message and exit

usage: sleeptalk host input start [-h] --request-id REQUEST_ID --profile PROFILE
                                  --workspace WORKSPACE --agent AGENT
                                  [--runtime {native,gateway,acp}]
                                  [--agent-auth-mode {api_key}]
                                  [--agent-auth-protocol {openai-completions,openai-responses,openai-codex-responses,anthropic-messages,cursor}]
                                  [--agent-auth-url AGENT_AUTH_URL]
                                  [--agent-credential-ref AGENT_CREDENTIAL_REF]
                                  [--agent-option NAME=VALUE]
                                  [--permission-mode PERMISSION_MODE] [--model MODEL]
                                  [--provider PROVIDER] [--pi-bin PI_BIN]
                                  [--gateway-url GATEWAY_URL]
                                  [--tts-voice-id TTS_VOICE_ID]
                                  [--speech-from-profile SLUG]
                                  [--speech-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}]
                                  [--stt-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}]
                                  [--tts-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}]
                                  [--language LANGUAGE]
                                  [--replace-reference REPLACE_REFERENCE]
                                  [--affected-profile AFFECTED_PROFILE] --surface
                                  {web,terminal,discord}
                                  [--capture-mode {headphones,speakers}]
                                  [--user-terminal-local] [--user-browser-local]

options:
  -h, --help            show this help message and exit
  --request-id REQUEST_ID
  --profile PROFILE
  --workspace WORKSPACE
  --agent AGENT
  --runtime {native,gateway,acp}
  --agent-auth-mode {api_key}
  --agent-auth-protocol {openai-completions,openai-responses,openai-codex-responses,anthropic-messages,cursor}
  --agent-auth-url AGENT_AUTH_URL
                        Exact HTTPS model-provider endpoint; no embedded credentials.
  --agent-credential-ref AGENT_CREDENTIAL_REF
                        Private credential reference, never a key or token.
  --agent-option NAME=VALUE
                        Non-secret adapter option, such as hermes_root. Validated by
                        the selected adapter.
  --permission-mode PERMISSION_MODE
  --model MODEL
  --provider PROVIDER
  --pi-bin PI_BIN
  --gateway-url GATEWAY_URL
                        Gateway address without embedded credentials or query
                        parameters.
  --tts-voice-id TTS_VOICE_ID
                        A voice the user asked for; the setup page then validates
                        exactly this voice.
  --speech-from-profile SLUG
                        Reuse the speech provider, voice, and stored key of an
                        existing profile (for example `default`), so the page only
                        asks for what the new surface needs, such as a Discord bot
                        token.
  --speech-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}
                        Optional. The key page always offers every provider, with its
                        free usage and whether a card is needed, and the user picks
                        one there (one key listens and speaks). Pass this only to put
                        a provider the user already named first; the others stay a tap
                        away.
  --stt-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}
                        Mixed setups only: the listening (speech-to-text) provider.
  --tts-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}
                        Mixed setups only: the speaking (text-to-speech) provider.
  --language LANGUAGE
  --replace-reference REPLACE_REFERENCE
                        Replace this stored credential through the private page.
  --affected-profile AFFECTED_PROFILE
  --surface {web,terminal,discord}
  --capture-mode {headphones,speakers}
  --user-terminal-local
                        The user controls a terminal on the audio host and will start
                        audio there.
  --user-browser-local  The user controls a browser on the runtime host; never set for
                        an agent browser or remote phone.

usage: sleeptalk host input link [-h] --request-id REQUEST_ID --profile PROFILE
                                 --workspace WORKSPACE --agent AGENT
                                 [--runtime {native,gateway,acp}]
                                 [--agent-auth-mode {api_key}]
                                 [--agent-auth-protocol {openai-completions,openai-responses,openai-codex-responses,anthropic-messages,cursor}]
                                 [--agent-auth-url AGENT_AUTH_URL]
                                 [--agent-credential-ref AGENT_CREDENTIAL_REF]
                                 [--agent-option NAME=VALUE]
                                 [--permission-mode PERMISSION_MODE] [--model MODEL]
                                 [--provider PROVIDER] [--pi-bin PI_BIN]
                                 [--gateway-url GATEWAY_URL]
                                 [--tts-voice-id TTS_VOICE_ID]
                                 [--speech-from-profile SLUG]
                                 [--speech-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}]
                                 [--stt-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}]
                                 [--tts-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}]
                                 [--language LANGUAGE]
                                 [--replace-reference REPLACE_REFERENCE]
                                 [--affected-profile AFFECTED_PROFILE]
                                 [--surface {web,discord}]

options:
  -h, --help            show this help message and exit
  --request-id REQUEST_ID
  --profile PROFILE
  --workspace WORKSPACE
  --agent AGENT
  --runtime {native,gateway,acp}
  --agent-auth-mode {api_key}
  --agent-auth-protocol {openai-completions,openai-responses,openai-codex-responses,anthropic-messages,cursor}
  --agent-auth-url AGENT_AUTH_URL
                        Exact HTTPS model-provider endpoint; no embedded credentials.
  --agent-credential-ref AGENT_CREDENTIAL_REF
                        Private credential reference, never a key or token.
  --agent-option NAME=VALUE
                        Non-secret adapter option, such as hermes_root. Validated by
                        the selected adapter.
  --permission-mode PERMISSION_MODE
  --model MODEL
  --provider PROVIDER
  --pi-bin PI_BIN
  --gateway-url GATEWAY_URL
                        Gateway address without embedded credentials or query
                        parameters.
  --tts-voice-id TTS_VOICE_ID
                        A voice the user asked for; the setup page then validates
                        exactly this voice.
  --speech-from-profile SLUG
                        Reuse the speech provider, voice, and stored key of an
                        existing profile (for example `default`), so the page only
                        asks for what the new surface needs, such as a Discord bot
                        token.
  --speech-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}
                        Optional. The key page always offers every provider, with its
                        free usage and whether a card is needed, and the user picks
                        one there (one key listens and speaks). Pass this only to put
                        a provider the user already named first; the others stay a tap
                        away.
  --stt-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}
                        Mixed setups only: the listening (speech-to-text) provider.
  --tts-provider {deepgram,cartesia,elevenlabs,openrouter,groq,together,venice,local}
                        Mixed setups only: the speaking (text-to-speech) provider.
  --language LANGUAGE
  --replace-reference REPLACE_REFERENCE
                        Replace this stored credential through the private page.
  --affected-profile AFFECTED_PROFILE
  --surface {web,discord}
                        What the profile talks through: a browser call (default) or a
                        Discord bot, which the page also sets up.

usage: sleeptalk host input status [-h] --request-id REQUEST_ID

options:
  -h, --help            show this help message and exit
  --request-id REQUEST_ID

usage: sleeptalk host input cancel [-h] --request-id REQUEST_ID

options:
  -h, --help            show this help message and exit
  --request-id REQUEST_ID

usage: sleeptalk host input wait [-h] --request-id REQUEST_ID [--timeout TIMEOUT]

options:
  -h, --help            show this help message and exit
  --request-id REQUEST_ID
  --timeout TIMEOUT     Seconds to wait (default: 900).

usage: sleeptalk host settings-link [-h] [--profile PROFILE] [--json]

options:
  -h, --help         show this help message and exit
  --profile PROFILE  Profile slug to open (default: the workspace's default).
  --json             Accepted for symmetry; the receipt is always JSON.

usage: sleeptalk host credentials [-h] {status,list,prune,move-to-keychain,remove} ...

positional arguments:
  {status,list,prune,move-to-keychain,remove}
    list                Every stored key: reference, provider, and the profiles using
                        it. Never a value.
    prune               Remove stored keys no known profile uses (left over from
                        replaced keys or deleted profiles). Never revokes them at the
                        provider.
    move-to-keychain    Move every stored key from the private file into the macOS
                        Keychain or Linux Secret Service (needs sleeptalk[credentials]
                        and a desktop session). Calls then need that session unlocked.

options:
  -h, --help            show this help message and exit

usage: sleeptalk host credentials status [-h] reference

positional arguments:
  reference

options:
  -h, --help  show this help message and exit

usage: sleeptalk host credentials list [-h]

options:
  -h, --help  show this help message and exit

usage: sleeptalk host credentials prune [-h] --confirm-local-deletion

options:
  -h, --help            show this help message and exit
  --confirm-local-deletion

usage: sleeptalk host credentials move-to-keychain [-h]

options:
  -h, --help  show this help message and exit

usage: sleeptalk host credentials remove [-h] [--affected-profile AFFECTED_PROFILE]
                                         --confirm-local-deletion
                                         reference

positional arguments:
  reference

options:
  -h, --help            show this help message and exit
  --affected-profile AFFECTED_PROFILE
  --confirm-local-deletion

usage: sleeptalk host start-voice [-h] [--profile PROFILE] [--request-id REQUEST_ID]
                                  [--workspace WORKSPACE] [--caller-context CONTEXT]
                                  [--config CONFIG] [--rendezvous RENDEZVOUS]
                                  [--agent-instance AGENT_INSTANCE]
                                  [--conversation-id CONVERSATION_ID]
                                  [--platform-user-id PLATFORM_USER_ID]
                                  [--ttl-seconds TTL_SECONDS] [--echo] [--tailnet]
                                  [--no-tailnet] [--json]
                                  [{web,terminal}]

positional arguments:
  {web,terminal}        Interface override (default: infer from caller context).

options:
  -h, --help            show this help message and exit
  --profile PROFILE     Profile slug or .toml filename under SLEEPTALK_HOME/profiles
                        (default: default).
  --request-id REQUEST_ID
                        Stable browser start ID, scoped to this profile; prints JSON
                        and replays the same attempt.
  --workspace WORKSPACE
                        Verify the profile's intended workspace before starting.
  --caller-context CONTEXT
                        Integration-supplied context; local/terminal/desktop run
                        locally, any chat integration name returns a hosted link
                        (default: SLEEPTALK_CALLER_CONTEXT or Web).
  --config CONFIG       Explicit profile path (overrides --profile).
  --rendezvous RENDEZVOUS
                        Custom rendezvous origin. Explicit Web otherwise uses
                        localhost; agent/chat starts use the hosted service.
  --agent-instance AGENT_INSTANCE
                        Agent instance identifier stored with the ticket.
  --conversation-id CONVERSATION_ID
                        Originating agent session/conversation identifier.
  --platform-user-id PLATFORM_USER_ID
                        Originating platform user identifier stored with the ticket.
  --ttl-seconds TTL_SECONDS
                        Unused-link lifetime from 1 to 300 seconds (default: 300).
  --echo                Use the M1 echo fixture instead of an agent runtime.
  --tailnet             Publish the call on this host's tailnet with `tailscale serve`
                        (https://<name>:8443); no hosted relay or TURN. Only tailnet
                        members can open the link.
  --no-tailnet          This call only: skip the profile's stored tailnet delivery and
                        use the usual link (the hosted relay for an agent). `host
                        ensure --no-tailnet` removes the stored choice.
  --json                Print a versioned JSON receipt instead of a plain local URL.

usage: sleeptalk host list [-h] [--json]

options:
  -h, --help  show this help message and exit
  --json      Accepted for symmetry; the receipt is always JSON.

usage: sleeptalk host status [-h] --request-id REQUEST_ID [--profile PROFILE]
                             [--config CONFIG] [--echo]
                             [--agent-instance AGENT_INSTANCE]

options:
  -h, --help            show this help message and exit
  --request-id REQUEST_ID
  --profile PROFILE
  --config CONFIG
  --echo
  --agent-instance AGENT_INSTANCE

usage: sleeptalk host stop [-h] [--call-id CALL_ID] [callId]

positional arguments:
  callId                Opaque call id, from `host list`.

options:
  -h, --help            show this help message and exit
  --call-id CALL_ID, --callId CALL_ID
                        The same call id, as a flag.

usage: sleeptalk host reset-access [-h] [--rendezvous RENDEZVOUS]

options:
  -h, --help            show this help message and exit
  --rendezvous RENDEZVOUS
                        Hosted rendezvous origin (default: the Sleeptalk production
                        service).