claweed — CLI reference
Generated by claweed docs from the binary's own help renderer and published
here verbatim. Synced 2026-08-21 at claweed v0.2.4. Run claweed docs
locally for the same reference as markdown, or fetch
cli-help.md.
See also the clawee CLI reference and the main docs.
There is no help verb — help spellings are flags only: -h / --h / -help / --help.
Every verb rejects stray arguments; a usage refusal exits 2 on clawee, 64 on claweed.
Run claweed <command> --help for that command's own page (claweed docs prints the full reference as markdown) — or browse the full generated reference:
clawee CLI reference · claweed CLI reference.
claweed
claweed — Clawee PTY service daemon
Usage:
claweed <command> [flags]
Commands:
serve run the daemon on a unix socket
[--data-dir <dir>] data dir (required unless running as the root
parent)
[--instance-id <id>] instance id override (default: read from the config
root; never generated)
[--register-socket <path>] gateway register socket path (production; excludes
--socket; auto-resolved when unset)
[--socket <path>] dev unix socket path to listen on (excludes
--register-socket)
tenant manage YOUR OWN tenant enrollment
add enroll a trust key for YOURSELF
<pubkey> the public key line itself
@<file> read the public key from the named file
[--data-dir <dir>] claweed data dir (required; `claweed auth` resolves
a default)
auth pair a device key (sugar over tenant add)
<pubkey|@file>
[--data-dir <dir>] claweed data dir (default: installed boot unit, then
the euid default (system root as root,
~/.clawee/data otherwise))
devices manage device keys host-locally (invoking user only)
list enrolled keys + the numbered pending queue (numbers
are approve indices)
[--data-dir <dir>] claweed data dir (default: installed boot unit, then
the euid default (system root as root,
~/.clawee/data otherwise))
approve approve a pending knock (bare = the first asking
key)
<#> the pending knock at that number in the queue
<fp> the pending knock with that exact SHA256:
fingerprint
[--data-dir <dir>] claweed data dir (default: installed boot unit, then
the euid default (system root as root,
~/.clawee/data otherwise))
[--label <label>] label for the enrolled key ([A-Za-z0-9._-]{0,32})
revoke drop an enrolled key or a pending knock
<fp>
[--data-dir <dir>] claweed data dir (default: installed boot unit, then
the euid default (system root as root,
~/.clawee/data otherwise))
service the claweed system service (boot unit)
print render the boot unit — a launchd .plist / systemd
.service — to stdout
[--claweed <path>] claweed binary path (required)
[--group <group>] run-as group (optional)
[--home <dir>] service user's home dir — the unit's HOME (always
required)
[--kind <kind>] unit kind: launchd | systemd (required)
[--log <path>] launchd stderr/stdout log path (optional)
[--register-socket <path>] claweed --register-socket path (production)
[--root-scheme] root daemon, no run-as user (excludes
--user/--group; --home still required)
[--socket <path>] claweed --socket path (dev)
[--user <user>] run-as user (required unless --root-scheme)
doctor diagnose the deployment; --fix repairs
service-user-owned bits
[--allowlist <path>] spawn-allow uid list path
[--data-dir <dir>] data dir (default: installed boot unit)
[--fix] repair failed checks (asks consent)
[--register-socket <path>] gateway register socket path (default: installed
boot unit)
[--service-home <dir>] service home dir (see --service-uid)
[--service-uid <uid>] service uid (default: the --data-dir owner; set by a
root re-read)
[--service-user <user>] service user (see --service-uid)
[--sessions-verdict <verdict>] relayed sessions verdict (root re-read; display
only)
[--socket <path>] dev unix socket path (default: installed boot unit)
[--system-uid-allowlist <path>] system-uid opt-in path
[--yes] skip consent prompts (unattended --fix)
status alias of doctor (read-only) — same report, no --fix
[--data-dir <dir>] service data dir (default: installed boot unit, then
the euid default (system root as root,
~/.clawee/data otherwise))
[--register-socket <path>] gateway register socket path (default: installed
boot unit)
[--socket <path>] dev unix socket path (default: installed boot unit)
setup first-time setup for the invoking user — doctor
--fix, then bootstrap YOUR tenant keys
restart restart the managed claweed service
osmetrics print this host's thermal/cpu/memory reading
[--json] print the sample as JSON
update update claweed from release.clawee.org
[--auto] apply unattended; restart only if changed
[--dry] print the update plan only, then exit
[--force] reinstall everything (binary + spawn policy +
boot-unit) + restart
docs print the full CLI reference as markdown (docs
sites, AI agents)
version print the claweed version (also --version)
Run 'claweed <command> --help' for that command's help; auth, devices and tenant
act on the INVOKING user (cross-user is 'manage', root-only).
claweed serve
run the daemon on a unix socket
claweed serve — run the daemon on a unix socket
Usage:
claweed serve [flags]
serve
[--data-dir <dir>] data dir (required unless running as the root parent)
[--instance-id <id>] instance id override (default: read from the config root;
never generated)
[--register-socket <path>] gateway register socket path (production; excludes --socket;
auto-resolved when unset)
[--socket <path>] dev unix socket path to listen on (excludes
--register-socket)
claweed tenant
manage YOUR OWN tenant enrollment
claweed tenant — manage YOUR OWN tenant enrollment
Usage:
claweed tenant <command>
Commands:
add enroll a trust key for YOURSELF
<pubkey> the public key line itself
@<file> read the public key from the named file
[--data-dir <dir>] claweed data dir (required; `claweed auth` resolves a default)
claweed tenant add
enroll a trust key for YOURSELF
claweed tenant add — enroll a trust key for YOURSELF
Usage:
claweed tenant add <pubkey|@file> [flags]
add
<pubkey> the public key line itself
@<file> read the public key from the named file
[--data-dir <dir>] claweed data dir (required; `claweed auth` resolves a default)
claweed auth
pair a device key (sugar over tenant add)
claweed auth — pair a device key (sugar over tenant add)
Usage:
claweed auth <pubkey|@file> [flags]
auth
<pubkey|@file>
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the euid default
(system root as root, ~/.clawee/data otherwise))
claweed devices
manage device keys host-locally (invoking user only)
claweed devices — manage device keys host-locally (invoking user only)
Usage:
claweed devices <command>
Commands:
list enrolled keys + the numbered pending queue (numbers are approve
indices)
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the euid
default (system root as root, ~/.clawee/data otherwise))
approve approve a pending knock (bare = the first asking key)
<#> the pending knock at that number in the queue
<fp> the pending knock with that exact SHA256: fingerprint
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the euid
default (system root as root, ~/.clawee/data otherwise))
[--label <label>] label for the enrolled key ([A-Za-z0-9._-]{0,32})
revoke drop an enrolled key or a pending knock
<fp>
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the euid
default (system root as root, ~/.clawee/data otherwise))
claweed devices list
enrolled keys + the numbered pending queue (numbers are approve indices)
claweed devices list — enrolled keys + the numbered pending queue (numbers are approve indices)
Usage:
claweed devices list [flags]
list
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the euid default
(system root as root, ~/.clawee/data otherwise))
claweed devices approve
approve a pending knock (bare = the first asking key)
claweed devices approve — approve a pending knock (bare = the first asking key)
Usage:
claweed devices approve [<#>|<fp>] [flags]
approve
<#> the pending knock at that number in the queue
<fp> the pending knock with that exact SHA256: fingerprint
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the euid
default (system root as root, ~/.clawee/data otherwise))
[--label <label>] label for the enrolled key ([A-Za-z0-9._-]{0,32})
claweed devices revoke
drop an enrolled key or a pending knock
claweed devices revoke — drop an enrolled key or a pending knock
Usage:
claweed devices revoke <fp> [flags]
revoke
<fp>
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the euid
default (system root as root, ~/.clawee/data otherwise))
claweed service
the claweed system service (boot unit)
claweed service — the claweed system service (boot unit)
Usage:
claweed service <command>
Commands:
print render the boot unit — a launchd .plist / systemd .service —
to stdout
[--claweed <path>] claweed binary path (required)
[--group <group>] run-as group (optional)
[--home <dir>] service user's home dir — the unit's HOME (always required)
[--kind <kind>] unit kind: launchd | systemd (required)
[--log <path>] launchd stderr/stdout log path (optional)
[--register-socket <path>] claweed --register-socket path (production)
[--root-scheme] root daemon, no run-as user (excludes --user/--group; --home
still required)
[--socket <path>] claweed --socket path (dev)
[--user <user>] run-as user (required unless --root-scheme)
claweed service print
render the boot unit — a launchd .plist / systemd .service — to stdout
claweed service print — render the boot unit — a launchd .plist / systemd .service — to stdout
Usage:
claweed service print [flags]
print
[--claweed <path>] claweed binary path (required)
[--group <group>] run-as group (optional)
[--home <dir>] service user's home dir — the unit's HOME (always required)
[--kind <kind>] unit kind: launchd | systemd (required)
[--log <path>] launchd stderr/stdout log path (optional)
[--register-socket <path>] claweed --register-socket path (production)
[--root-scheme] root daemon, no run-as user (excludes --user/--group; --home
still required)
[--socket <path>] claweed --socket path (dev)
[--user <user>] run-as user (required unless --root-scheme)
claweed doctor
diagnose the deployment; --fix repairs service-user-owned bits
claweed doctor — diagnose the deployment; --fix repairs service-user-owned bits
Usage:
claweed doctor [flags]
doctor
[--allowlist <path>] spawn-allow uid list path
[--data-dir <dir>] data dir (default: installed boot unit)
[--fix] repair failed checks (asks consent)
[--register-socket <path>] gateway register socket path (default: installed boot
unit)
[--service-home <dir>] service home dir (see --service-uid)
[--service-uid <uid>] service uid (default: the --data-dir owner; set by a
root re-read)
[--service-user <user>] service user (see --service-uid)
[--sessions-verdict <verdict>] relayed sessions verdict (root re-read; display only)
[--socket <path>] dev unix socket path (default: installed boot unit)
[--system-uid-allowlist <path>] system-uid opt-in path
[--yes] skip consent prompts (unattended --fix)
claweed status
alias of doctor (read-only) — same report, no --fix
claweed status — alias of doctor (read-only) — same report, no --fix
Usage:
claweed status [flags]
status
[--data-dir <dir>] service data dir (default: installed boot unit, then the
euid default (system root as root, ~/.clawee/data
otherwise))
[--register-socket <path>] gateway register socket path (default: installed boot unit)
[--socket <path>] dev unix socket path (default: installed boot unit)
claweed setup
first-time setup for the invoking user — doctor --fix, then bootstrap YOUR tenant keys
claweed setup — first-time setup for the invoking user — doctor --fix, then bootstrap YOUR tenant keys Usage: claweed setup
claweed restart
restart the managed claweed service
claweed restart — restart the managed claweed service Usage: claweed restart
claweed osmetrics
print this host's thermal/cpu/memory reading
claweed osmetrics — print this host's thermal/cpu/memory reading
Usage:
claweed osmetrics [flags]
osmetrics
[--json] print the sample as JSON
claweed update
update claweed from release.clawee.org
claweed update — update claweed from release.clawee.org
Usage:
claweed update [flags]
update
[--auto] apply unattended; restart only if changed
[--dry] print the update plan only, then exit
[--force] reinstall everything (binary + spawn policy + boot-unit) + restart
claweed docs
print the full CLI reference as markdown (docs sites, AI agents)
claweed docs — print the full CLI reference as markdown (docs sites, AI agents) Usage: claweed docs
claweed version
print the claweed version (also --version)
claweed version — print the claweed version (also --version) Usage: claweed version