claweed — CLI reference
Generated by claweed docs from the binary's own help renderer and published
here verbatim. Synced 2026-10-14 at claweed v0.3.25. Run claweed docs
locally for the same reference as markdown, or fetch
cli-help.md.
See also the clawee CLI reference and the main docs.
There is no help verb — help spellings are flags only: -h / --h / -help / --help.
Every verb rejects stray arguments; a usage refusal exits 2 on clawee, 64 on claweed.
Run claweed <command> --help for that command's own page (claweed docs prints the full reference as markdown) — or browse the full generated reference:
clawee CLI reference · claweed CLI reference.
claweed
claweed — Clawee PTY service daemon
Usage:
claweed <command> [flags]
Commands:
serve run the daemon on a unix socket
[--data-dir <dir>] data dir (required unless running as the root
parent)
[--instance-id <id>] instance id override (default: read from the
config root; never generated)
[--no-local] do not serve the local link
[--register-socket <path>] gateway register socket path (production;
auto-resolved when unset)
[--socket <path>] local-link unix socket path (default: the
resolved system or per-user path)
tenant manage YOUR OWN tenant enrollment
add enroll a trust key for YOURSELF
<pubkey> the public key line itself
@<file> read the public key from the named file
[--data-dir <dir>] claweed data dir (required; `claweed auth`
resolves a default)
auth pair a device key (sugar over tenant add)
<pubkey|@file>
[--data-dir <dir>] claweed data dir (default: installed boot unit,
then the tree of the user this run is for —
under sudo the human who elevated, otherwise
this account (root's own included))
devices manage device keys host-locally (invoking user
only)
list enrolled keys + the numbered pending queue
(numbers are approve indices)
[--data-dir <dir>] claweed data dir (default: installed boot unit,
then the tree of the user this run is for —
under sudo the human who elevated, otherwise
this account (root's own included))
approve approve a pending knock (bare = the first
asking key)
<#> the pending knock at that number in the queue
<fp> the pending knock with that exact SHA256:
fingerprint
[--data-dir <dir>] claweed data dir (default: installed boot unit,
then the tree of the user this run is for —
under sudo the human who elevated, otherwise
this account (root's own included))
[--label <label>] label for the enrolled key
([A-Za-z0-9._-]{0,32})
[--role <role>] device role: owner (default) may take a
session's writer role; viewer may only watch,
follow, snapshot and chat
revoke drop an enrolled key or a pending knock
<fp>
[--data-dir <dir>] claweed data dir (default: installed boot unit,
then the tree of the user this run is for —
under sudo the human who elevated, otherwise
this account (root's own included))
role set an enrolled key's device role (viewer =
watch only, never write)
<fp> <owner|viewer>
[--data-dir <dir>] claweed data dir (default: installed boot unit,
then the tree of the user this run is for —
under sudo the human who elevated, otherwise
this account (root's own included))
service the claweed system service (boot unit)
print render the boot unit — a launchd .plist /
systemd .service — to stdout
[--claweed <path>] path of the binary the unit execs:
claweed-guard, or claweed for a kit without one
(required)
[--group <group>] run-as group (optional)
[--home <dir>] service user's home dir — the unit's HOME
(always required)
[--kind <kind>] unit kind: launchd | systemd (required)
[--log <path>] launchd stderr/stdout log path (optional)
[--no-local] render serve --no-local: bind no local link
(claweed local off is the persisted setting)
[--register-socket <path>] claweed --register-socket path (production)
[--root-scheme] root daemon, no run-as user (excludes
--user/--group; --home still required)
[--socket <path>] claweed --socket path (dev)
[--user <user>] run-as user (required unless --root-scheme)
print-aqua render the aqua session host's LaunchAgent
.plist (macOS) to stdout
[--host <path>] aqua host binary path — the installed host
beside claweed (required)
policy host spawn policy (root-owned)
allow-uid permit one uid to spawn sessions on this host
<uid>
[--allowlist <path>] spawn-allow uid list path
local serve the local link on this host, or not
(persisted; root to change)
on serve the local link (removes the config root's
no-local marker)
off do not serve the local link (creates the
marker; survives updates)
status report which — readable without root
socket print the local-link socket path (readable
without root)
shared-uploads share every tenant's uploads under one
root-owned tree (persisted; root to change)
on create the shared root and write the config
root's marker naming it
off remove the marker; files under the shared root
stay where they are
status report which, the root and its owner/mode —
readable without root
[--root <dir>] the shared root dir (with on)
doctor diagnose the deployment; --fix repairs
service-user-owned bits
[--allowlist <path>] spawn-allow uid list path
[--data-dir <dir>] data dir (default: installed boot unit)
[--fix] repair failed checks (asks consent)
[--register-socket <path>] gateway register socket path (default:
installed boot unit)
[--service-home <dir>] service home dir (see --service-uid)
[--service-uid <uid>] service uid (default: the --data-dir owner; set
by a root re-read)
[--service-user <user>] service user (see --service-uid)
[--sessions-verdict <verdict>] relayed sessions verdict (root re-read; display
only)
[--socket <path>] local-link unix socket path (default: installed
boot unit)
[--system-uid-allowlist <path>] system-uid opt-in path
[--yes] skip consent prompts (unattended --fix)
status alias of doctor (read-only) — same report, no
--fix
[--data-dir <dir>] service data dir (default: installed boot unit,
then the tree of the user this run is for —
under sudo the human who elevated, otherwise
this account (root's own included))
[--register-socket <path>] gateway register socket path (default:
installed boot unit)
[--socket <path>] local-link unix socket path (default: installed
boot unit)
setup first-time setup for the invoking user — doctor
--fix, then tenant status + knock/approve
guidance
restart restart the managed claweed service
osmetrics print this host's thermal/cpu/memory/disk
reading
[--json] print the sample as JSON
update update claweed from release.clawee.org
[--auto] apply unattended; restart only if changed
[--dry] print the update plan only, then exit
[--force] reinstall everything (binary + spawn policy +
boot-unit) + restart
docs print the full CLI reference as markdown (docs
sites, AI agents)
version print the claweed version (also --version)
Run 'claweed <command> --help' for that command's help; auth, devices and tenant
act on the INVOKING user only. There is no cross-user enrolment verb:
each user enrols their own key.
claweed serve
run the daemon on a unix socket
claweed serve — run the daemon on a unix socket
Usage:
claweed serve [flags]
serve
[--data-dir <dir>] data dir (required unless running as the root parent)
[--instance-id <id>] instance id override (default: read from the config root;
never generated)
[--no-local] do not serve the local link
[--register-socket <path>] gateway register socket path (production; auto-resolved when
unset)
[--socket <path>] local-link unix socket path (default: the resolved system or
per-user path)
claweed tenant
manage YOUR OWN tenant enrollment
claweed tenant — manage YOUR OWN tenant enrollment
Usage:
claweed tenant <command>
Commands:
add enroll a trust key for YOURSELF
<pubkey> the public key line itself
@<file> read the public key from the named file
[--data-dir <dir>] claweed data dir (required; `claweed auth` resolves a default)
claweed tenant add
enroll a trust key for YOURSELF
claweed tenant add — enroll a trust key for YOURSELF
Usage:
claweed tenant add <pubkey|@file> [flags]
add
<pubkey> the public key line itself
@<file> read the public key from the named file
[--data-dir <dir>] claweed data dir (required; `claweed auth` resolves a default)
claweed auth
pair a device key (sugar over tenant add)
claweed auth — pair a device key (sugar over tenant add)
Usage:
claweed auth <pubkey|@file> [flags]
auth
<pubkey|@file>
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the tree of the
user this run is for — under sudo the human who elevated, otherwise
this account (root's own included))
claweed devices
manage device keys host-locally (invoking user only)
claweed devices — manage device keys host-locally (invoking user only)
Usage:
claweed devices <command>
Commands:
list enrolled keys + the numbered pending queue (numbers are approve
indices)
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the tree of
the user this run is for — under sudo the human who elevated,
otherwise this account (root's own included))
approve approve a pending knock (bare = the first asking key)
<#> the pending knock at that number in the queue
<fp> the pending knock with that exact SHA256: fingerprint
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the tree of
the user this run is for — under sudo the human who elevated,
otherwise this account (root's own included))
[--label <label>] label for the enrolled key ([A-Za-z0-9._-]{0,32})
[--role <role>] device role: owner (default) may take a session's writer role;
viewer may only watch, follow, snapshot and chat
revoke drop an enrolled key or a pending knock
<fp>
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the tree of
the user this run is for — under sudo the human who elevated,
otherwise this account (root's own included))
role set an enrolled key's device role (viewer = watch only, never
write)
<fp> <owner|viewer>
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the tree of
the user this run is for — under sudo the human who elevated,
otherwise this account (root's own included))
claweed devices list
enrolled keys + the numbered pending queue (numbers are approve indices)
claweed devices list — enrolled keys + the numbered pending queue (numbers are approve indices)
Usage:
claweed devices list [flags]
list
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the tree of the
user this run is for — under sudo the human who elevated, otherwise
this account (root's own included))
claweed devices approve
approve a pending knock (bare = the first asking key)
claweed devices approve — approve a pending knock (bare = the first asking key)
Usage:
claweed devices approve [<#>|<fp>] [flags]
approve
<#> the pending knock at that number in the queue
<fp> the pending knock with that exact SHA256: fingerprint
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the tree of
the user this run is for — under sudo the human who elevated,
otherwise this account (root's own included))
[--label <label>] label for the enrolled key ([A-Za-z0-9._-]{0,32})
[--role <role>] device role: owner (default) may take a session's writer role;
viewer may only watch, follow, snapshot and chat
claweed devices revoke
drop an enrolled key or a pending knock
claweed devices revoke — drop an enrolled key or a pending knock
Usage:
claweed devices revoke <fp> [flags]
revoke
<fp>
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the tree of the
user this run is for — under sudo the human who elevated, otherwise
this account (root's own included))
claweed devices role
set an enrolled key's device role (viewer = watch only, never write)
claweed devices role — set an enrolled key's device role (viewer = watch only, never write)
Usage:
claweed devices role <fp> <owner|viewer> [flags]
role
<fp> <owner|viewer>
[--data-dir <dir>] claweed data dir (default: installed boot unit, then the tree of the
user this run is for — under sudo the human who elevated, otherwise
this account (root's own included))
claweed service
the claweed system service (boot unit)
claweed service — the claweed system service (boot unit)
Usage:
claweed service <command>
Commands:
print render the boot unit — a launchd .plist / systemd
.service — to stdout
[--claweed <path>] path of the binary the unit execs: claweed-guard, or
claweed for a kit without one (required)
[--group <group>] run-as group (optional)
[--home <dir>] service user's home dir — the unit's HOME (always
required)
[--kind <kind>] unit kind: launchd | systemd (required)
[--log <path>] launchd stderr/stdout log path (optional)
[--no-local] render serve --no-local: bind no local link (claweed
local off is the persisted setting)
[--register-socket <path>] claweed --register-socket path (production)
[--root-scheme] root daemon, no run-as user (excludes --user/--group;
--home still required)
[--socket <path>] claweed --socket path (dev)
[--user <user>] run-as user (required unless --root-scheme)
print-aqua render the aqua session host's LaunchAgent .plist
(macOS) to stdout
[--host <path>] aqua host binary path — the installed host beside
claweed (required)
claweed service print
render the boot unit — a launchd .plist / systemd .service — to stdout
claweed service print — render the boot unit — a launchd .plist / systemd .service — to stdout
Usage:
claweed service print [flags]
print
[--claweed <path>] path of the binary the unit execs: claweed-guard, or claweed
for a kit without one (required)
[--group <group>] run-as group (optional)
[--home <dir>] service user's home dir — the unit's HOME (always required)
[--kind <kind>] unit kind: launchd | systemd (required)
[--log <path>] launchd stderr/stdout log path (optional)
[--no-local] render serve --no-local: bind no local link (claweed local
off is the persisted setting)
[--register-socket <path>] claweed --register-socket path (production)
[--root-scheme] root daemon, no run-as user (excludes --user/--group; --home
still required)
[--socket <path>] claweed --socket path (dev)
[--user <user>] run-as user (required unless --root-scheme)
claweed service print-aqua
render the aqua session host's LaunchAgent .plist (macOS) to stdout
claweed service print-aqua — render the aqua session host's LaunchAgent .plist (macOS) to stdout
Usage:
claweed service print-aqua [flags]
print-aqua
[--host <path>] aqua host binary path — the installed host beside claweed
(required)
claweed policy
host spawn policy (root-owned)
claweed policy — host spawn policy (root-owned)
Usage:
claweed policy <command>
Commands:
allow-uid permit one uid to spawn sessions on this host
<uid>
[--allowlist <path>] spawn-allow uid list path
claweed policy allow-uid
permit one uid to spawn sessions on this host
claweed policy allow-uid — permit one uid to spawn sessions on this host
Usage:
claweed policy allow-uid <uid> [flags]
allow-uid
<uid>
[--allowlist <path>] spawn-allow uid list path
claweed local
serve the local link on this host, or not (persisted; root to change)
claweed local — serve the local link on this host, or not (persisted; root to change)
Usage:
claweed local <on|off|status>
local
on serve the local link (removes the config root's no-local marker)
off do not serve the local link (creates the marker; survives updates)
status report which — readable without root
claweed socket
print the local-link socket path (readable without root)
claweed socket — print the local-link socket path (readable without root) Usage: claweed socket
claweed doctor
diagnose the deployment; --fix repairs service-user-owned bits
claweed doctor — diagnose the deployment; --fix repairs service-user-owned bits
Usage:
claweed doctor [flags]
doctor
[--allowlist <path>] spawn-allow uid list path
[--data-dir <dir>] data dir (default: installed boot unit)
[--fix] repair failed checks (asks consent)
[--register-socket <path>] gateway register socket path (default: installed boot
unit)
[--service-home <dir>] service home dir (see --service-uid)
[--service-uid <uid>] service uid (default: the --data-dir owner; set by a
root re-read)
[--service-user <user>] service user (see --service-uid)
[--sessions-verdict <verdict>] relayed sessions verdict (root re-read; display only)
[--socket <path>] local-link unix socket path (default: installed boot
unit)
[--system-uid-allowlist <path>] system-uid opt-in path
[--yes] skip consent prompts (unattended --fix)
claweed status
alias of doctor (read-only) — same report, no --fix
claweed status — alias of doctor (read-only) — same report, no --fix
Usage:
claweed status [flags]
status
[--data-dir <dir>] service data dir (default: installed boot unit, then the
tree of the user this run is for — under sudo the human who
elevated, otherwise this account (root's own included))
[--register-socket <path>] gateway register socket path (default: installed boot unit)
[--socket <path>] local-link unix socket path (default: installed boot unit)
claweed setup
first-time setup for the invoking user — doctor --fix, then tenant status + knock/approve guidance
claweed setup — first-time setup for the invoking user — doctor --fix, then tenant status + knock/approve guidance Usage: claweed setup
claweed restart
restart the managed claweed service
claweed restart — restart the managed claweed service Usage: claweed restart
claweed osmetrics
print this host's thermal/cpu/memory/disk reading
claweed osmetrics — print this host's thermal/cpu/memory/disk reading
Usage:
claweed osmetrics [flags]
osmetrics
[--json] print the sample as JSON
claweed update
update claweed from release.clawee.org
claweed update — update claweed from release.clawee.org
Usage:
claweed update [flags]
update
[--auto] apply unattended; restart only if changed
[--dry] print the update plan only, then exit
[--force] reinstall everything (binary + spawn policy + boot-unit) + restart
claweed docs
print the full CLI reference as markdown (docs sites, AI agents)
claweed docs — print the full CLI reference as markdown (docs sites, AI agents) Usage: claweed docs
claweed version
print the claweed version (also --version)
claweed version — print the claweed version (also --version) Usage: claweed version