# claweed — CLI reference

Generated by `claweed docs` from the binary's own help renderer. Do not edit —
regenerate with `go run ./cmd/claweed docs > docs/cli-help.md`.

## claweed

```
claweed — Clawee PTY service daemon

Usage:
  claweed <command> [flags]

Commands:
  serve                                         run the daemon on a unix socket
              [--data-dir <dir>]                data dir (required unless running as the root
                                                parent)
              [--instance-id <id>]              instance id override (default: read from the config
                                                root; never generated)
              [--register-socket <path>]        gateway register socket path (production; excludes
                                                --socket; auto-resolved when unset)
              [--socket <path>]                 dev unix socket path to listen on (excludes
                                                --register-socket)
  tenant                                        manage YOUR OWN tenant enrollment
    add                                         enroll a trust key for YOURSELF
              <pubkey>                          the public key line itself
              @<file>                           read the public key from the named file
              [--data-dir <dir>]                claweed data dir (required; `claweed auth` resolves
                                                a default)
  auth                                          pair a device key (sugar over tenant add)
              <pubkey|@file>
              [--data-dir <dir>]                claweed data dir (default: installed boot unit, then
                                                the euid default (system root as root,
                                                ~/.clawee/data otherwise))
  devices                                       manage device keys host-locally (invoking user only)
    list                                        enrolled keys + the numbered pending queue (numbers
                                                are approve indices)
              [--data-dir <dir>]                claweed data dir (default: installed boot unit, then
                                                the euid default (system root as root,
                                                ~/.clawee/data otherwise))
    approve                                     approve a pending knock (bare = the first asking
                                                key)
              <#>                               the pending knock at that number in the queue
              <fp>                              the pending knock with that exact SHA256:
                                                fingerprint
              [--data-dir <dir>]                claweed data dir (default: installed boot unit, then
                                                the euid default (system root as root,
                                                ~/.clawee/data otherwise))
              [--label <label>]                 label for the enrolled key ([A-Za-z0-9._-]{0,32})
    revoke                                      drop an enrolled key or a pending knock
              <fp>
              [--data-dir <dir>]                claweed data dir (default: installed boot unit, then
                                                the euid default (system root as root,
                                                ~/.clawee/data otherwise))
  service                                       the claweed system service (boot unit)
    print                                       render the boot unit — a launchd .plist / systemd
                                                .service — to stdout
              [--claweed <path>]                claweed binary path (required)
              [--group <group>]                 run-as group (optional)
              [--home <dir>]                    service user's home dir — the unit's HOME (always
                                                required)
              [--kind <kind>]                   unit kind: launchd | systemd (required)
              [--log <path>]                    launchd stderr/stdout log path (optional)
              [--register-socket <path>]        claweed --register-socket path (production)
              [--root-scheme]                   root daemon, no run-as user (excludes
                                                --user/--group; --home still required)
              [--socket <path>]                 claweed --socket path (dev)
              [--user <user>]                   run-as user (required unless --root-scheme)
  doctor                                        diagnose the deployment; --fix repairs
                                                service-user-owned bits
              [--allowlist <path>]              spawn-allow uid list path
              [--data-dir <dir>]                data dir (default: installed boot unit)
              [--fix]                           repair failed checks (asks consent)
              [--register-socket <path>]        gateway register socket path (default: installed
                                                boot unit)
              [--service-home <dir>]            service home dir (see --service-uid)
              [--service-uid <uid>]             service uid (default: the --data-dir owner; set by a
                                                root re-read)
              [--service-user <user>]           service user (see --service-uid)
              [--sessions-verdict <verdict>]    relayed sessions verdict (root re-read; display
                                                only)
              [--socket <path>]                 dev unix socket path (default: installed boot unit)
              [--system-uid-allowlist <path>]   system-uid opt-in path
              [--yes]                           skip consent prompts (unattended --fix)
  status                                        alias of doctor (read-only) — same report, no --fix
              [--data-dir <dir>]                service data dir (default: installed boot unit, then
                                                the euid default (system root as root,
                                                ~/.clawee/data otherwise))
              [--register-socket <path>]        gateway register socket path (default: installed
                                                boot unit)
              [--socket <path>]                 dev unix socket path (default: installed boot unit)
  setup                                         first-time setup for the invoking user — doctor
                                                --fix, then bootstrap YOUR tenant keys
  restart                                       restart the managed claweed service
  osmetrics                                     print this host's thermal/cpu/memory reading
              [--json]                          print the sample as JSON
  update                                        update claweed from release.clawee.org
              [--auto]                          apply unattended; restart only if changed
              [--dry]                           print the update plan only, then exit
              [--force]                         reinstall everything (binary + spawn policy +
                                                boot-unit) + restart
  docs                                          print the full CLI reference as markdown (docs
                                                sites, AI agents)
  version                                       print the claweed version (also --version)

Run 'claweed <command> --help' for that command's help; auth, devices and tenant
act on the INVOKING user (cross-user is 'manage', root-only).
```

## claweed serve

run the daemon on a unix socket

```
claweed serve — run the daemon on a unix socket

Usage:
  claweed serve [flags]

  serve
          [--data-dir <dir>]           data dir (required unless running as the root parent)
          [--instance-id <id>]         instance id override (default: read from the config root;
                                       never generated)
          [--register-socket <path>]   gateway register socket path (production; excludes --socket;
                                       auto-resolved when unset)
          [--socket <path>]            dev unix socket path to listen on (excludes
                                       --register-socket)
```

## claweed tenant

manage YOUR OWN tenant enrollment

```
claweed tenant — manage YOUR OWN tenant enrollment

Usage:
  claweed tenant <command>

Commands:
  add                        enroll a trust key for YOURSELF
        <pubkey>             the public key line itself
        @<file>              read the public key from the named file
        [--data-dir <dir>]   claweed data dir (required; `claweed auth` resolves a default)
```

## claweed tenant add

enroll a trust key for YOURSELF

```
claweed tenant add — enroll a trust key for YOURSELF

Usage:
  claweed tenant add <pubkey|@file> [flags]

  add
        <pubkey>             the public key line itself
        @<file>              read the public key from the named file
        [--data-dir <dir>]   claweed data dir (required; `claweed auth` resolves a default)
```

## claweed auth

pair a device key (sugar over tenant add)

```
claweed auth — pair a device key (sugar over tenant add)

Usage:
  claweed auth <pubkey|@file> [flags]

  auth
         <pubkey|@file>
         [--data-dir <dir>]   claweed data dir (default: installed boot unit, then the euid default
                              (system root as root, ~/.clawee/data otherwise))
```

## claweed devices

manage device keys host-locally (invoking user only)

```
claweed devices — manage device keys host-locally (invoking user only)

Usage:
  claweed devices <command>

Commands:
  list                           enrolled keys + the numbered pending queue (numbers are approve
                                 indices)
            [--data-dir <dir>]   claweed data dir (default: installed boot unit, then the euid
                                 default (system root as root, ~/.clawee/data otherwise))
  approve                        approve a pending knock (bare = the first asking key)
            <#>                  the pending knock at that number in the queue
            <fp>                 the pending knock with that exact SHA256: fingerprint
            [--data-dir <dir>]   claweed data dir (default: installed boot unit, then the euid
                                 default (system root as root, ~/.clawee/data otherwise))
            [--label <label>]    label for the enrolled key ([A-Za-z0-9._-]{0,32})
  revoke                         drop an enrolled key or a pending knock
            <fp>
            [--data-dir <dir>]   claweed data dir (default: installed boot unit, then the euid
                                 default (system root as root, ~/.clawee/data otherwise))
```

## claweed devices list

enrolled keys + the numbered pending queue (numbers are approve indices)

```
claweed devices list — enrolled keys + the numbered pending queue (numbers are approve indices)

Usage:
  claweed devices list [flags]

  list
         [--data-dir <dir>]   claweed data dir (default: installed boot unit, then the euid default
                              (system root as root, ~/.clawee/data otherwise))
```

## claweed devices approve

approve a pending knock (bare = the first asking key)

```
claweed devices approve — approve a pending knock (bare = the first asking key)

Usage:
  claweed devices approve [<#>|<fp>] [flags]

  approve
            <#>                  the pending knock at that number in the queue
            <fp>                 the pending knock with that exact SHA256: fingerprint
            [--data-dir <dir>]   claweed data dir (default: installed boot unit, then the euid
                                 default (system root as root, ~/.clawee/data otherwise))
            [--label <label>]    label for the enrolled key ([A-Za-z0-9._-]{0,32})
```

## claweed devices revoke

drop an enrolled key or a pending knock

```
claweed devices revoke — drop an enrolled key or a pending knock

Usage:
  claweed devices revoke <fp> [flags]

  revoke
           <fp>
           [--data-dir <dir>]   claweed data dir (default: installed boot unit, then the euid
                                default (system root as root, ~/.clawee/data otherwise))
```

## claweed service

the claweed system service (boot unit)

```
claweed service — the claweed system service (boot unit)

Usage:
  claweed service <command>

Commands:
  print                                render the boot unit — a launchd .plist / systemd .service —
                                       to stdout
          [--claweed <path>]           claweed binary path (required)
          [--group <group>]            run-as group (optional)
          [--home <dir>]               service user's home dir — the unit's HOME (always required)
          [--kind <kind>]              unit kind: launchd | systemd (required)
          [--log <path>]               launchd stderr/stdout log path (optional)
          [--register-socket <path>]   claweed --register-socket path (production)
          [--root-scheme]              root daemon, no run-as user (excludes --user/--group; --home
                                       still required)
          [--socket <path>]            claweed --socket path (dev)
          [--user <user>]              run-as user (required unless --root-scheme)
```

## claweed service print

render the boot unit — a launchd .plist / systemd .service — to stdout

```
claweed service print — render the boot unit — a launchd .plist / systemd .service — to stdout

Usage:
  claweed service print [flags]

  print
          [--claweed <path>]           claweed binary path (required)
          [--group <group>]            run-as group (optional)
          [--home <dir>]               service user's home dir — the unit's HOME (always required)
          [--kind <kind>]              unit kind: launchd | systemd (required)
          [--log <path>]               launchd stderr/stdout log path (optional)
          [--register-socket <path>]   claweed --register-socket path (production)
          [--root-scheme]              root daemon, no run-as user (excludes --user/--group; --home
                                       still required)
          [--socket <path>]            claweed --socket path (dev)
          [--user <user>]              run-as user (required unless --root-scheme)
```

## claweed doctor

diagnose the deployment; --fix repairs service-user-owned bits

```
claweed doctor — diagnose the deployment; --fix repairs service-user-owned bits

Usage:
  claweed doctor [flags]

  doctor
           [--allowlist <path>]              spawn-allow uid list path
           [--data-dir <dir>]                data dir (default: installed boot unit)
           [--fix]                           repair failed checks (asks consent)
           [--register-socket <path>]        gateway register socket path (default: installed boot
                                             unit)
           [--service-home <dir>]            service home dir (see --service-uid)
           [--service-uid <uid>]             service uid (default: the --data-dir owner; set by a
                                             root re-read)
           [--service-user <user>]           service user (see --service-uid)
           [--sessions-verdict <verdict>]    relayed sessions verdict (root re-read; display only)
           [--socket <path>]                 dev unix socket path (default: installed boot unit)
           [--system-uid-allowlist <path>]   system-uid opt-in path
           [--yes]                           skip consent prompts (unattended --fix)
```

## claweed status

alias of doctor (read-only) — same report, no --fix

```
claweed status — alias of doctor (read-only) — same report, no --fix

Usage:
  claweed status [flags]

  status
           [--data-dir <dir>]           service data dir (default: installed boot unit, then the
                                        euid default (system root as root, ~/.clawee/data
                                        otherwise))
           [--register-socket <path>]   gateway register socket path (default: installed boot unit)
           [--socket <path>]            dev unix socket path (default: installed boot unit)
```

## claweed setup

first-time setup for the invoking user — doctor --fix, then bootstrap YOUR tenant keys

```
claweed setup — first-time setup for the invoking user — doctor --fix, then bootstrap YOUR tenant keys

Usage:
  claweed setup
```

## claweed restart

restart the managed claweed service

```
claweed restart — restart the managed claweed service

Usage:
  claweed restart
```

## claweed osmetrics

print this host's thermal/cpu/memory reading

```
claweed osmetrics — print this host's thermal/cpu/memory reading

Usage:
  claweed osmetrics [flags]

  osmetrics
              [--json]   print the sample as JSON
```

## claweed update

update claweed from release.clawee.org

```
claweed update — update claweed from release.clawee.org

Usage:
  claweed update [flags]

  update
           [--auto]    apply unattended; restart only if changed
           [--dry]     print the update plan only, then exit
           [--force]   reinstall everything (binary + spawn policy + boot-unit) + restart
```

## claweed docs

print the full CLI reference as markdown (docs sites, AI agents)

```
claweed docs — print the full CLI reference as markdown (docs sites, AI agents)

Usage:
  claweed docs
```

## claweed version

print the claweed version (also --version)

```
claweed version — print the claweed version (also --version)

Usage:
  claweed version
```