CLI commands - Meerkat

rkat is designed for three main workflows:

interactive terminal use
scripts and CI
Unix pipes and chained command composition

The default path is prompt-first:

rkat "summarize this repository"

You can also use subcommands explicitly:

rkat run "summarize this repository"
rkat run --resume last "keep going"
rkat mob pack ./mobs/release-triage -o dist/release-triage.mobpack

Global flags

All commands accept the same realm and convention-root flags:

rkat [--realm <id>] [--isolated] [--instance <id>] \
  [--realm-backend <sqlite|jsonl|memory>] \
  [--state-root <path>] \
  [--context-root <path>] \
  [--user-config-root <path>] \
  [--default-model <model>] \
  <command>

--default-model <model> persists the default agent model into the scope-resolved config (project/user/realm resolution included) and exits when given without a command — rkat --default-model claude-fable-5 is the one-liner for switching what every future run talks to. The model is validated against the catalog and configured custom models. By default, CLI commands use the current directory as the context root, derive a stable workspace realm id from that path, and store realm state under <context-root>/.rkat/realms/<realm>/. --context-root changes both the derived workspace identity and the default project-local state root. --state-root changes only where realm directories are stored. Fresh prompt-first runs and rkat help are fail-soft only at the default workspace storage boundary. If the workspace-derived realm cannot be opened, no historical session from that realm is loaded into the fresh run, and the explicit compatibility bridge is never invoked automatically. The ordinary strict open may already have completed supported manifest initialization or an earlier domain migration before a later store refuses. The CLI warns and creates a new generated realm using durable SQLite under the same resolved state root. The workspace’s configuration, auth policy, provider selection, and tool policy remain in force; only persistence-owned state is isolated in the generated realm. The warning names both realms and prints the explicit recovery command:

rkat --state-root <ROOT> --realm <ORIGINAL_REALM> storage migrate --apply --bridge-pre-0-8-10

An explicit --realm, --isolated, every resume form, and all session commands remain fail-closed. Historical session access therefore stays an explicit maintenance operation. The fresh-run fallback is never an in-memory session and never makes a historical session from the failed workspace realm part of the new run.

Common commands

Command	Purpose
`rkat <PROMPT>`	Run a task directly from the terminal
`rkat run <PROMPT>`	Explicit form of the default prompt command
`rkat run --resume[=<SESSION>] <PROMPT>`	Continue a saved session
`rkat help <QUESTION>`	Ask how to use Meerkat (embedded platform skill)
`rkat session ...`	Inspect, delete, or interrupt sessions
`rkat realm ...`	Inspect or manage realms
`rkat config ...`	Read or update CLI/runtime config
`rkat auth ...`	Log in, inspect auth profiles, test bindings, and refresh/logout credentials
`rkat blob ...`	Inspect and retrieve stored blob content
`rkat mcp ...`	Manage local/project MCP server config
`rkat mob ...`	Pack, inspect, validate, deploy, and build mob artifacts
`rkat workgraph ...`	Inspect WorkGraph items, ready work, snapshots, and events
`rkat skill ...`	Manage configured skill sources and inspect available skills
`rkat models`	List built-in models plus configured self-hosted aliases
`rkat capabilities`	Show runtime capabilities
`rkat doctor`	Check local setup, provider keys, and self-hosted server reachability
`rkat storage doctor`	Read-only storage diagnosis (realm inventory, schema ledgers, split-brain twins, structural integrity)
`rkat storage migrate`	Offline, fenced storage migration (dry-run by default)
`rkat storage prune`	Lifecycle for registered storage backup artifacts
`rkat init`	Create project config from the global template

Prompt-first usage

rkat [OPTIONS] <PROMPT>
rkat run [OPTIONS] <PROMPT>

Examples:

rkat "summarize this repository"
cat story.txt | rkat "summarize the story"
git diff | rkat run --json "review these changes"
tail -f app.log | rkat run --stdin lines "watch for incidents"
rkat run -t workspace "fix the failing test"
rkat run --yolo --param temperature=0.2 "take the gloves off"

Common run flags

-m, --model <MODEL>
-o, --output <text|json|html>
--json
-s, --stream
--no-stream
--no-web-search
--resume[=<SESSION>]
--skill <PATH_OR_ID> repeatable
-d, --max-duration <DURATION>
-t, --tools <safe|workspace|full|none>
--stdin <auto|blob|lines|off>
--keep-alive
--wait-for-mcp
--mcp-auth <stored|interactive>
-v, --verbose

For the full advanced set, use:

rkat run --help

Tool presets

rkat uses presets instead of many enable/disable booleans.

Preset	Meaning
`safe`	Builtins, skills, configured MCP, delegated-work-safe tools; no shell
`workspace`	`safe` plus shell access
`full`	All CLI-side capabilities, including memory and mob tools
`none`	No tools

--yolo is an alias for --tools full.

Provider and structured output controls

Use --param for common tuning and --params-json as the escape hatch:

rkat -m claude-sonnet-4-6 \
  --param temperature=0.2 \
  --param max_output_tokens=4000 \
  "triage this incident"

Structured output is file-friendly:

rkat --schema ./triage.schema.json "extract issues from this diff"

--json is a convenience alias for --output json. HTML output asks the agent to make the final answer a standalone local HTML artifact:

rkat run --html "explain how prompt caching works in this repo"
rkat run --browser "create a visual implementation plan for this change"

--html is a convenience alias for --output html. --browser is a compact shortcut for HTML output plus --open-in-browser. HTML output writes the file under the active realm’s presentation/html directory and prints the path. Template defaults live under [presentation.html]:

[presentation.html]
default_template = "polished"

[presentation.html.templates.review]
path = "html/review.md"

[presentation.html.templates.dense]
body = "Render this as a dense technical artifact with annotated snippets."

Per run, use --html-template <NAME> or --html-template-file <PATH>. Config template paths are resolved relative to the active config base directory.

Streaming defaults

In a TTY, text output streams by default.
In pipes and scripts, streaming is off by default.
JSON and HTML output stay non-streaming by default so stdout remains machine-friendly unless --stream is explicitly requested.

Stdin modes and Unix pipes

rkat treats piped stdin as a first-class interface:

auto default: if stdin is piped, read it as one blob of context
blob: always read full stdin to EOF before running
lines: keep stdin open and process one line at a time
off: ignore stdin even if something is piped in

Batch blob mode:

cat story.txt | rkat "summarize the story"
git diff | rkat "review these changes"
cat notes.txt | rkat "extract action items" | rkat "group these by owner"

Live line mode:

tail -f app.log | rkat run --stdin lines "watch for incidents and call them out"

--line-format json treats each incoming line as JSON instead of plain text.

run —resume

rkat run --resume[=<SESSION_ID>] [OPTIONS] <PROMPT>

Examples:

rkat run --resume last "keep going"
rkat run --resume ~2 "pick this thread back up"
cat notes.txt | rkat run --resume "merge these notes into the plan"
tail -f app.log | rkat run --resume --stdin lines "watch for new incidents"

SESSION_ID accepts:

a full UUID
a short prefix
last
~N

Omitting the value means last, so rkat run --resume "keep going" and rkat run --resume last "keep going" are equivalent. Resume supports the same stdin model as run, plus per-turn tool overlays and provider params. Self-hosted aliases work the same way:

rkat run --resume -m gemma-4-31b "Continue with the local model"

session

rkat session list [--limit <N>] [--offset <N>] [--label <KEY=VALUE>]
rkat session show <SESSION_ID>
rkat session delete <SESSION_ID>
rkat session interrupt <SESSION_ID>

This is the human/operator session surface. CLI-internal control-plane session APIs are not exposed here. Meerkat supports ordinary durable-state opens from 0.8.10 onward. For an older SQLite realm, stop every process that can access it and run the explicit current maintenance bridge:

rkat --state-root <ROOT> --realm <REALM> storage migrate --apply --bridge-pre-0-8-10

The frozen importer fails closed on unsupported pre-floor shapes. Normal realm opens remain strict. JSONL and memory realms are rejected before any database is mutated. The maintenance transaction preserves queued and nonterminal input rows without scheduling or replaying them. A later session activation follows normal recovery.

config

rkat config get [--format toml|json] [--with-generation]
rkat config set [<FILE>] [--json <JSON> | --toml <TOML>] [--expected-generation <N>]
rkat config patch [<FILE>] [--json <JSON>] [--expected-generation <N>]

The positional argument is always a file path; inline payloads use --json (or --toml for set). Examples:

rkat config get --format toml
rkat config set ./.rkat/config.toml
rkat config patch --json '{"agent":{"model":"gpt-5.5"}}'
rkat config patch --json '{"self_hosted":{"servers":{"ollama":{"transport":"openai_compatible","base_url":"http://127.0.0.1:11434","api_style":"chat_completions"}}}}'

auth

rkat auth realms                       # list realms defined in config
rkat auth profiles                     # list profiles/backends/bindings
rkat auth profile <PROFILE_ID>         # inspect one profile
rkat auth login [<PROVIDER>] [--backend <KIND>] [--method <METHOD>] [--non-interactive --secret <SECRET>]
rkat auth status <PROFILE_ID>          # realm config shape + AuthMachine lease lifecycle state
rkat auth test <BINDING_ID>            # dry-run resolve the binding
rkat auth refresh <PROFILE_ID>         # force-refresh OAuth tokens
rkat auth logout <PROFILE_ID>          # clear persisted credentials
rkat auth profile-delete <PROFILE_ID> -y

rkat auth login provisions the reserved global realm in the home-rooted doc at ~/.rkat/config.toml — both the credential token and the [realm.global] binding section. Because global is the universal tail of every realm chain, a single sign-in is inherited by every workspace realm, across workspaces, without a per-realm re-login. Earlier dev-realm logins are migrated to global on the run path (one-time, idempotent, no-clobber), so an existing sign-in keeps working without re-auth. Credential reads inherit down the realm chain (a child realm resolves a binding defined in a parent or in global), but credential writes are strict-owner: a write targets the realm that defines the binding. --realm on an auth command selects the realm and composes its chain for resolution, without changing where an owned credential is persisted. See Realm inheritance and the auth guide for the full model.

models

rkat models

This prints the effective runtime model registry for the active realm, including configured self_hosted aliases and their server_id.

doctor

rkat doctor

For self-hosted setups, doctor checks the normalized /v1/models endpoint for each configured server and warns when configured aliases are missing from the returned model list. For Gemma 4, prefer chat_completions in your server config unless you have validated a specific responses path for your serving stack. Follow Self-hosting models for the full Gemma 4 examples.

storage

Storage administration verbs. All of them dispatch before realm resolution, so they run against the exact on-disk state they diagnose — including split-brain realms the normal resolver refuses. Because no runtime scope is resolved, the global --isolated and --default-model flags are rejected as usage errors on every storage verb rather than silently ignored; scope the sweep with --realm, --root, or --state-root instead.

rkat storage doctor [--json] [--root PATH]...

Read-only and safe against a live realm: takes no leases, opens read-only connections only, creates nothing. Sweeps the project-local (<context-root>/.rkat/realms) and user-global candidate roots by default; any explicit root (--state-root or repeatable --root) restricts the sweep to exactly those roots. --realm focuses the sweep on one realm. Reports per-root realm inventory, schema-ledger state per database, dual-root twins, dangling session→blob references, and orphaned lease/lock/backup artifacts. Exit 0 means no error-severity findings; exit 1 means errors were found.

rkat storage migrate [--apply] [--bridge-pre-0-8-10] [--json] [--root PATH]... [--adopt-root PATH] [--fence-wait-secs SECS]

migrate is dry-run by default, offline, resumable, and fail-closed. It sweeps the same roots (and honors the same --realm filter) as storage doctor. The dry run reads each realm’s schema-ledger baseline read-only — no fence, no store opens, no mutation. --apply acquires the realm’s exclusive maintenance fence (--fence-wait-secs, default 10, bounds the wait for in-flight store operations to drain), then per realm: stamps ledgers by opening every store through its normal constructor under the held fence and reports state-root adoption (report-only — realms are used where they lie). Exact 0.8.10 session-state conversion is owned by each backend’s activation transaction, which binds the released schema, key, and source bytes before installing current store authority; storage migrate does not bulk-adopt documents or defer conversion to ordinary reads. A realm materialized under multiple swept roots is a fail-closed refusal unless --apply --adopt-root <path> names the swept root whose copy to keep: every copy is fenced first, the divergence report is recomputed under the held fences, and archiving is gated on that comparison being conclusive (an unreadable entry poisons it and refuses) — then every other copy is archived read-only under the registered *.pre-<version>-<timestamp> backup naming. Divergent data is preserved and reported, never merged. Per-mob databases under mobs/ are report-only, and credential stores are never read, moved, or reported. Exit 0 = clean; exit 1 = errors or fail-closed refusals (split-brain without --adopt-root, unacquirable maintenance fence). --bridge-pre-0-8-10 is an explicit --apply-only maintenance lane for SQLite realms. JSONL and memory realms are rejected before any database is mutated. While the realm fence is held, it runs a frozen importer before the normal store constructors. The importer accepts only authenticated, supported pre-floor schema and row shapes; unknown, ambiguous, or inconsistent state refuses instead of being inferred or stamped. The maintenance transaction preserves queued and nonterminal runtime inputs in the current representation without scheduling or replaying them. A later session activation follows normal recovery. Ordinary store opens never enter this bridge.

rkat storage prune [--apply] [--older-than-days N] [--json] [--root PATH]...

prune owns the lifecycle of registered maintenance artifacts only — *.pre-<version>-<timestamp> migration backups and *.corrupt-<timestamp> index quarantines; nothing outside those naming patterns is ever touched. The default run lists artifacts with sizes and ages; --apply deletes those at least --older-than-days (default 30; 0 = all) days old. Age comes from the timestamp embedded in the registered name, not filesystem mtime — renames preserve mtime, so a long-idle file archived today would otherwise look instantly prunable. --realm restricts eligibility to one realm’s artifacts. Exit 0 = clean; exit 1 = deletion failures. Not to be confused with rkat realm prune, which deletes whole realm directories.

mcp

rkat mcp is for local and project configuration only.

rkat mcp add <NAME> [--transport stdio|http|sse] [--scope project|user|local] [-H KEY:VALUE...] [-e KEY=VALUE...] [--url <URL> | <URL> | -- <CMD...>]
rkat mcp login <NAME> [--scope project|user|local]
rkat mcp remove <NAME> [--scope project|user|local]
rkat mcp list [--scope project|user|local] [--json]
rkat mcp get <NAME> [--scope project|user|local] [--json]

Examples:

rkat mcp add filesystem -- npx -y @modelcontextprotocol/server-filesystem .
rkat mcp add linear --url https://mcp.example.com
rkat mcp add --transport http glean https://king-be.glean.com/mcp/default
rkat mcp login glean
rkat mcp list
rkat mcp get filesystem --scope project

Omit --scope on list or get to search all configured scopes. HTTP OAuth is discovered when connecting, not stored in .rkat/mcp.toml. Use rkat mcp login <NAME> to open the browser flow ahead of time, or rkat run "..." --mcp-auth interactive to allow a TTY run to authenticate when an HTTP MCP server first requires it. The default --mcp-auth stored uses persisted tokens only.

mob

rkat mob is the artifact, typed callable run, and operational run-resource surface. Runtime semantics still live in the shared mob runtime; the CLI only binds to it.

rkat mob pack <DIR> -o <OUT.mobpack> [--sign <KEY_FILE> --signer-id <ID>]
rkat mob inspect <PACK.mobpack>
rkat mob validate <PACK.mobpack> [--trust-policy <permissive|strict>]
rkat mob run <PACK.mobpack|MOB_ID> [--flow <FLOW_ID>] [--param <KEY=VALUE>...] [--prompt <TEXT>] [--detach] [--json] [--trust-policy <permissive|strict>]
rkat mob deploy <PACK.mobpack> <PROMPT> [--trust-policy <permissive|strict>] [--surface <cli|rpc>]
rkat mob web build <PACK.mobpack> -o <OUT_DIR> --wasm <PKG_DIR|name_bg.wasm> [--trust-policy <permissive|strict>]
rkat mob run-flow <MOB_ID> --flow <FLOW_ID> [--params <JSON>] [--stream|--no-stream]
rkat mob flow-status <MOB_ID> <RUN_ID>
rkat mob runs <MOB_ID> [--flow <FLOW_ID>] [--json]
rkat mob status <MOB_ID> <RUN_ID> [--json]
rkat mob logs <MOB_ID> [--after-cursor <CURSOR>] [--limit <N>] [--json]
rkat mob attach <MOB_ID> <RUN_ID> [--json]
rkat mob spawn-helper <MOB_ID> <PROMPT> --agent-identity <ID> [--profile <PROFILE>] [--model <MODEL>] [--auth-binding <REALM:BINDING[:PROFILE]>] [--json]
rkat mob fork-helper <MOB_ID> <SOURCE_MEMBER_ID> <PROMPT> --agent-identity <ID> [--profile <PROFILE>] [--model <MODEL>] [--auth-binding <REALM:BINDING[:PROFILE]>] [--fork-context <full-history|last-messages>] [--last-messages <N>] [--json]
rkat mob member-status <MOB_ID> <AGENT_IDENTITY> [--json]
rkat mob force-cancel <MOB_ID> <AGENT_IDENTITY>
rkat mob grant <MOB_ID> <PRINCIPAL> --scope <SCOPE>... [--expires-at-ms <MS>|--expires-in <DURATION>]
rkat mob revoke-grant <MOB_ID> <PRINCIPAL> [--scope <SCOPE>...]
rkat mob grants <MOB_ID> [--json]
rkat mob respawn <MOB_ID> <AGENT_IDENTITY> [--initial-message <MESSAGE>]
rkat mob wait-kickoff <MOB_ID> [--member <AGENT_IDENTITY>...] [--timeout-ms <MS>] [--json]
rkat mob host [--listen-tcp <ADDR>] [--advertise-tcp <ADDR>] [--live-ws <ADDR> --live-ws-advertise <URL>] [--identity-dir <DIR>] [--descriptor-out <FILE>] [--allow-remote] [--pairing-password-env <ENV>|--pairing-password-file <PATH>|--pairing-password <PASSWORD>]
rkat mob bind-host <MOB_ID> --descriptor <DESCRIPTOR.json>
rkat mob revoke-host <MOB_ID> <HOST_ID>
rkat mob hosts <MOB_ID> [--json]
rkat mob member-history <MOB_ID> <AGENT_IDENTITY> [--from-index <N>] [--limit <N>]
rkat mob route-installs <MOB_ID>
rkat mob live open <MOB_ID> <AGENT_IDENTITY> [--turning-mode <provider-managed|explicit-commit>] [--transport <websocket|webrtc>]
rkat mob live close <MOB_ID> <AGENT_IDENTITY> <CHANNEL_ID>
rkat mob live status <MOB_ID> <AGENT_IDENTITY> [--channel-id <ID>]
rkat mob live control <MOB_ID> <AGENT_IDENTITY> <CHANNEL_ID> <commit-input|interrupt|truncate|refresh> [--item-id <ID> --content-index <N> --audio-played-ms <MS>]

Multi-host notes:

rkat mob host starts only the signed member-host and optional live listeners. It uses the workspace-derived realm (or explicit --realm) and rejects --isolated; it does not expose an RPC, REST, or MCP console.
When enabling the host pairing branch, prefer --pairing-password-env or --pairing-password-file so the secret does not appear in process arguments. The three pairing-secret options are mutually exclusive; --pairing-password remains available for compatibility. Pairing secrets must be at least 32 bytes and are validated before host startup effects. Pairing is accepted only on an IP loopback listener because it returns the one-time binding descriptor over the plaintext comms transport. Use the 0600 descriptor out-of-band for remote hosts, or tunnel a loopback listener.
rkat mob bind-host consumes the descriptor JSON written by rkat mob host --descriptor-out; the 0600 descriptor carries a single-use bootstrap token, and the bind report (host id, authority epoch, capability record) prints as JSON.
grant, revoke-grant, and grants manage the closed control-scope set: list, read_history, subscribe_events, send_command, cancel, retire, wire_topology, live, admin_host, and admin_grants.
rkat mob live open prints the wire LiveOpenResult JSON — including the live URL and single-use token — to stdout only; stderr carries a token-free note. The socket it names is the input plane: there is no live send verb.
Mob verbs exit with typed codes for the four multi-host error classes: scope denied 45, host unavailable 46, stale cursor 47, stale fence 48, each with a one-line detail: {...} JSON rendering on stderr. Everything else keeps the generic exit 1.

Examples:

rkat mob pack ./mobs/release-triage -o dist/release-triage.mobpack
rkat mob inspect dist/release-triage.mobpack
rkat mob validate dist/release-triage.mobpack --trust-policy permissive
rkat mob run dist/release-triage.mobpack --prompt "triage the latest release regressions" --trust-policy permissive
rkat mob run release-triage --flow main --param severity='"high"' --detach
rkat mob attach release-triage <RUN_ID>
rkat mob web build dist/release-triage.mobpack -o dist/release-triage-web --wasm ./meerkat-web-runtime/pkg --trust-policy permissive

Trust policy

--trust-policy strict rejects unsigned packs and unknown signers
--trust-policy permissive allows unsigned packs with warnings but still rejects invalid signatures

Web build prerequisites

The CLI does not compile wasm32 itself. --wasm is required and must point at the prebuilt meerkat-web-runtime artifacts — either the wasm-pack --target web output directory (which holds meerkat_web_runtime.js + meerkat_web_runtime_bg.wasm) or that *_bg.wasm file (the sibling .js glue is copied alongside). mob web build copies those artifacts into its output. wasm-pack is one way to generate the required input:

cargo install wasm-pack
wasm-pack build meerkat-web-runtime --target web --out-dir pkg

The emitted bundle is self-contained and runnable: serve the output directory and open index.html (it includes the glue, a meerkat-bootstrap.js module, and the mobpack).

skill

rkat skill add <PATH_OR_ID> [--name <NAME>]
rkat skill remove <NAME_OR_ID_OR_PATH>
rkat skill get <NAME_OR_ID_OR_PATH> [--json]
rkat skill list [--json]
rkat skill inspect <skill-name> --source-uuid <uuid> [--json]

workgraph

rkat workgraph provides operator lookup plus narrow goal and attention controls for the active realm.

rkat workgraph list [--namespace <NS>] [--all-namespaces] [--status <STATUS>] [--label <LABEL>] [--include-terminal] [--limit <N>] [--json]
rkat workgraph show <ID> [--namespace <NS>] [--json]
rkat workgraph ready [--namespace <NS>] [--label <LABEL>] [--limit <N>] [--json]
rkat workgraph snapshot [--namespace <NS>] [--all-namespaces] [--status <STATUS>] [--label <LABEL>] [--include-terminal] [--limit <N>] [--json]
rkat workgraph events [--namespace <NS>] [--all-namespaces] [--after-seq <N>] [--limit <N>] [--json]
rkat workgraph goal-create <SESSION_ID> <TITLE> [--namespace <NS>] [--description <TEXT>] [--mode <MODE>] [--completion-policy self-attest|host-confirmed] [--json]
rkat workgraph goal-status <BINDING_ID> [--namespace <NS>] [--json]
rkat workgraph goal-confirm <BINDING_ID> --expected-revision <N> --kind <KIND> --id <ID> [--namespace <NS>] [--label <TEXT>] [--summary <TEXT>] [--json]
rkat workgraph goal-close <BINDING_ID> --expected-revision <N> [--status completed|cancelled|failed] [--namespace <NS>] [--json]
rkat workgraph attention-list [--namespace <NS>] [--status <STATUS>] [--json]
rkat workgraph attention-pause <BINDING_ID> --expected-revision <N> [--namespace <NS>] [--json]
rkat workgraph attention-resume <BINDING_ID> --expected-revision <N> [--namespace <NS>] [--json]

Agents mutate WorkGraph through workgraph_* tools. The CLI exposes only the narrow trusted goal/attention controls above; attention continuation injection remains runtime-host owned rather than a REST-backed CLI command.

models

rkat models

Lists all available models grouped by provider, including display name, tier, context window, max output tokens, and profile capabilities (temperature, thinking, reasoning support). Data is compiled from the meerkat-models catalog (injected into meerkat-core as a ModelCatalog).

capabilities

rkat capabilities

Shows status for compiled/runtime capabilities.

doctor

rkat doctor

Checks:

config readability
common provider API keys
MCP config loading
wasm-pack availability as one way to generate the required --wasm artifacts; mob web build copies them and does not invoke wasm-pack

init

rkat init

Creates .rkat/config.toml from the global template.

​Global flags

​Common commands

​Prompt-first usage

​Common run flags

​Tool presets

​Provider and structured output controls

​Streaming defaults

​Stdin modes and Unix pipes

​run —resume

​session

​config

​auth

​models

​doctor

​storage

​mcp

​mob

​Trust policy

​Web build prerequisites

​skill

​workgraph

​models

​capabilities

​doctor

​init

Global flags

Common commands

Prompt-first usage

Common run flags

Tool presets

Provider and structured output controls

Streaming defaults

Stdin modes and Unix pipes

run —resume

session

config

auth

models

doctor

storage

mcp

mob

Trust policy

Web build prerequisites

skill

workgraph

models

capabilities

doctor

init