CLI Reference

dewee CLI Reference

The dewee binary is the canonical control-plane client for managing local and remote Dewee gateways.

Machine-readable manifest: dewee meta commands -o json lists every command with its flags and safety properties (mutating, destructive, interactive, JSON, dry-run, idempotency), derived from the same command tree as this page.

Global Persistent Flags

| Flag | Type | Description | Default | |---|---|---|---| | --config | string | config file (default: config.json or $GOCLAW_CONFIG) | - | | --request-id | string | correlation id sent as X-Request-Id on every gateway request of this run and reported in the error envelope (default: a generated UUID) | - | | --server | string | gateway server URL override | - | | --tenant | string | gateway tenant ID or slug to scope operator commands to (default: master tenant) | - | | --timeout | duration | bound for each gateway HTTP request and WebSocket dial/read, e.g. 30s (default 0: each command keeps its own default) | 0s | | --token | string | gateway bearer token override | - | | --user-id | string | caller identity attributed to Gateway HTTP admin requests (api-keys, skills upload, tenant transfer, etc; default “system”; also settable via GOCLAW_GATEWAY_USER_ID). Attribution/context only — does not grant authorization; server-side role/tenant checks still apply. Does not affect dewee chat’s WebSocket session identity (GOCLAW_USER_ID) | - | | --verbose | bool | enable debug logging | false |

---

Command Tree Overview

• dewee activity — Read the workspace activity/audit feed
• dewee admin — Operate the Admin Control Plane (promotions, Early Access campaign, licenses, access grants, orders, API keys)
• dewee agent — Manage agents (create, add, list, get, status, update, delete)
• dewee api-keys — Manage gateway API keys
• dewee auth — Authenticate named ChatGPT OAuth accounts
• dewee backup — Create a full system backup (database + filesystem)
• dewee bitrix-portal — Manage Bitrix24 portals (direct DB access; postgres only)
• dewee browser — Manage your connected browsers (Dewee Chrome Extension) and their grants
• dewee channels — Manage messaging channels (requires running gateway)
• dewee cli-credentials — Manage secure CLI credentials, agent credentials and agent grants
• dewee config — View and manage configuration
• dewee contacts — View the channel-collected contact directory
• dewee cron — Manage scheduled cron jobs
• dewee decisions — Manage an agent’s decision policy (shadow or active mode)
• dewee doctor — Check system environment and configuration health
• dewee files — Browse and manage workspace file storage
• dewee fleet — Manage the home-worker fleet and workspace placements
• dewee fleet-worker — Run the standalone fleet package worker
• dewee heartbeat — Inspect and manage an agent’s heartbeat schedule
• dewee hooks — Manage agent hook access (requires running gateway)
• dewee identity — Set up, inspect, test and revoke trusted user identity (Dewee Connect)
• dewee import-export — Preview and apply logical agent/team package export and import
• dewee kg — Inspect and manage agent knowledge graph data
• dewee license — Show, activate or release workspace licences
• dewee mcp — Manage MCP servers and access grants
• dewee memory — Inspect and manage agent memory documents
• dewee meta — Machine-readable facts about this CLI
• dewee migrate — Database migration management
• dewee onboard — Quick setup — configure database, generate keys, run migrations
• dewee optimize — Inspect optimization evidence and review improvement candidates
• dewee packages — Manage runtime packages
• dewee pairing — Manage device pairing (approve, list, revoke)
• dewee pricing — Inspect and refresh the global model pricing catalog
• dewee providers — Manage LLM providers (requires running gateway)
• dewee reflex — Inspect and configure the reflex decision plane
• dewee restore — Restore system from a backup archive (database + filesystem)
• dewee rgd — Operator tools for the hidden Runtime Gateway Dashboard
• dewee selfhost — Manage a self-installed Dewee: secrets, first-run and recovery links, status
• dewee sessions — View and manage chat sessions
• dewee settings — Inspect and manage tenant workspace settings
• dewee setup — Configuration wizard — providers, agents, channels
• dewee skills — List and manage skills
• dewee stt — Inspect and configure per-tenant STT (speech-to-text) settings
• dewee system-config — Read and write the deployment’s system configuration
• dewee tasks — Inspect team tasks and their comment threads
• dewee teams — Manage agent teams and their members
• dewee tenant — Manage tenants, resources, and tenant-scoped workspace settings
• dewee tenant-backup — Create a tenant-scoped backup (database rows + filesystem)
• dewee tenant-restore — Restore a tenant from a backup archive
• dewee tenant-transfer — Preview, copy, or move resources between tenants (Standard/PostgreSQL)
• dewee traces — Inspect gateway traces
• dewee triggers — Manage event triggers (external events that start agent runs)
• dewee tts — Inspect TTS provider capabilities, list voices, and test connections
• dewee upgrade — Upgrade database schema and run data migrations
• dewee usage — Inspect token usage and cost metrics
• dewee vault — Inspect and manage Knowledge Vault documents
• dewee version — Print version information
• dewee workflows — Manage deterministic visual workflows
• dewee workspace-setup — Review and drive the workspace setup plan (requires running gateway)
• dewee workstations — Manage runtime workstation nodes owned by this tenant

---

Commands

dewee activity

Read the workspace activity/audit feed

Read the activity feed (/v1/activity).

This is the same customer-safe audit/event data the CCP /activity surface renders, and is never the raw runtime log tail, which stays operator-only.

dewee activity

dewee activity list

List activity feed entries

dewee activity list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --action | string | filter by action | - | | --actor | string | filter by actor ID | - | | --from | string | inclusive start time (RFC3339) | - | | --json | bool | output as JSON | false | | --limit | int | max entries to return | 50 | | --to | string | inclusive end time (RFC3339) | - |

Examples

dewee activity list --limit 50 --json

dewee admin

Operate the Admin Control Plane (promotions, Early Access campaign, licenses, access grants, orders, API keys)

Operate the Admin Control Plane (ACP) with a scoped ACP API key.

The credential is a scoped ACP API key (dewee_acp_…) issued in ACP at /api-keys or with “dewee admin api-keys create”. It is read from DEWEE_ADMIN_TOKEN or —token-file, never from an argument. Each call needs the scope of its operation (“dewee admin whoami” lists the scopes held) and is audited by ACP. ACP accepts its old static DEWEE_ADMIN_API_TOKEN only as audited break-glass while an operator has opened that window. The target is DEWEE_ADMIN_URL or —admin-url (default https://admin.dewee.sh).

Exit codes: 2 validation, 3 credential rejected (invalid, expired or revoked key, or break-glass closed), 4 permission (missing scope), 5 not found, 6 conflict (e.g. enabling before the Polar discount is linked, a stale promotion update, or rotating a key that is no longer active), 7 transport.

dewee admin

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --admin-url | string | ACP base URL (default: $DEWEE_ADMIN_URL or https://admin.dewee.sh) | - | | -o, --output | string | output format (table|json) | table | | --token-file | string | file holding the ACP API key (default: $DEWEE_ADMIN_TOKEN) | - |

Examples

DEWEE_ADMIN_TOKEN=dewee_acp_... dewee admin whoami
  dewee admin --token-file ~/.dewee/admin-token early-access enable
  dewee admin licenses list --mode self_install -o json
  dewee admin promotions list
  dewee admin access-grants list --status pending_claim
  dewee admin orders create --customer-email buyer@example.com --purchase-mode on_prem
  dewee admin api-keys list

dewee admin access-grants

Issue, inspect, revoke and extend complimentary access grants

Issue, inspect, revoke and extend complimentary access grants.

A grant gives a workspace, user or email address free shared SaaS access or a free self-install license for a fixed number of days. Every write requires a —reason and is audited by ACP.

dewee admin access-grants

Examples

dewee admin access-grants list --status pending_claim --mode self_install
  dewee admin access-grants create --target workspace --workspace ws_123 --mode shared_saas --days 30 --reason "design partner"
  dewee admin access-grants extend grant_123 --days 60 --reason "pilot extended" --expected-version 2
  dewee admin access-grants revoke grant_123 --reason "partnership ended" --yes

dewee admin access-grants create

Issue a complimentary access grant

Issue a complimentary access grant.

Exactly one target flag must match —target: —workspace for “workspace”, —user for “user”, —email for “email”. —seats applies to self_install only.

Every create is idempotent. Without —idempotency-key a random key is generated and printed to stderr before the request; re-run with that key to retry safely after a failure. A claim token, when ACP issues one, is shown only in this command’s output; replaying the same idempotency key is the only way to see it again.

dewee admin access-grants create [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --campaign | string | campaign id to attribute the grant to | - | | --claim-window-days | int | days the grant stays claimable (1..90) | 0 | | --days | int | access duration in days (1..366) | 0 | | --email | string | email address (with —target email) | - | | --idempotency-key | string | idempotency key (8..128 of [A-Za-z0-9_.:-]; default: generated) | - | | --mode | string | purchase mode (shared_saas|self_install) | - | | --reason | string | audit reason (3..500 characters, required) | - | | --seats | int | self-install seat limit (1..5, self_install only) | 0 | | --start-policy | string | when the duration starts (at_issue|at_claim; default: ACP decides) | - | | --starts-at | string | explicit start time (RFC3339) | - | | --target | string | target kind (workspace|user|email) | - | | --user | string | user id (with —target user) | - | | --workspace | string | workspace id (with —target workspace) | - |

Examples

dewee admin access-grants create --target workspace --workspace ws_123 --mode shared_saas --days 30 --reason "design partner"
  dewee admin access-grants create --target email --email ops@example.com --mode self_install --days 90 \
    --start-policy at_claim --claim-window-days 14 --seats 2 --reason "conference giveaway" --campaign expo-2026

dewee admin access-grants extend

Lengthen an access grant to a new total duration

dewee admin access-grants extend <grantId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --days | int | new total duration in days from the grant start, longer than the current one (1..366) | 0 | | --expected-version | int | fail with a conflict unless the grant is still at this version | 0 | | --reason | string | audit reason (required) | - |

dewee admin access-grants get

Show one access grant

dewee admin access-grants get <grantId>

dewee admin access-grants list

List access grants, newest first

List access grants, newest first.

When more grants exist, the output ends with the cursor for the next page; pass it to —before.

dewee admin access-grants list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --before | string | page cursor printed by the previous page | - | | --limit | int | page size (1..200) | 50 | | --mode | string | purchase mode filter (shared_saas|self_install) | - | | --status | string | status filter (pending_claim|active|revoked|expired) | - | | --workspace | string | workspace id filter | - |

dewee admin access-grants revoke

Revoke an access grant (access granted by it ends immediately)

dewee admin access-grants revoke <grantId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --expected-version | int | fail with a conflict unless the grant is still at this version | 0 | | --reason | string | audit reason (required) | - | | --yes | bool | confirm the revocation | false |

dewee admin api-keys

List, create, rotate and revoke scoped ACP API keys

List, create, rotate and revoke scoped ACP API keys (dewee_acp_…).

An ACP API key is the normal credential for dewee admin: set it as DEWEE_ADMIN_TOKEN or put it in a file for —token-file. Each key carries an explicit scope list, expires after at most 90 days, and can be rotated or revoked. A key can be granted only scopes its creator holds. The secret is shown exactly once, by create or rotate; ACP stores only its hash.

Managing keys needs the api_keys:admin scope; listing needs api_keys:read.

dewee admin api-keys

Examples

dewee admin api-keys list
  dewee admin api-keys create --name "Release automation" --client-id ci-release \
    --scope licenses:read --scope licenses:write --expires-in-days 30
  dewee admin api-keys rotate key_123 --overlap-minutes 30
  dewee admin api-keys revoke key_123 --reason "laptop lost" --yes

dewee admin api-keys create

Create a scoped ACP API key and print its secret once

Create a scoped ACP API key and print its secret once.

—scope is repeatable and also accepts a comma-separated list. Scopes have the form resource:level (for example licenses:read or promotions:admin); ACP rejects unknown scopes and scopes the calling credential does not hold. Run “dewee admin whoami” to see the scopes you hold.

dewee admin api-keys create [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --client-id | string | client identifier: 2..63 of lowercase letters, digits, dot, dash or underscore (required) | - | | --expires-in-days | int | days until the key expires (1..90) | 30 | | --json | bool | output as JSON (same as -o json) | false | | --name | string | human-readable key name (1..80 characters, required) | - | | --scope | stringSlice | scope to grant, resource:level (repeatable or comma-separated, at least one) | [] |

Examples

dewee admin api-keys create --name "Release automation" --client-id ci-release \
    --scope licenses:read,licenses:write --expires-in-days 30

dewee admin api-keys list

List ACP API keys, newest first (never their secrets)

dewee admin api-keys list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON (same as -o json) | false |

dewee admin api-keys revoke

Revoke an ACP API key (clients using it are rejected immediately)

dewee admin api-keys revoke <keyId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON (same as -o json) | false | | --reason | string | audit reason (at most 200 characters, required) | - | | --yes | bool | confirm the revocation | false |

dewee admin api-keys rotate

Replace an active key with a new secret (same name, client and scopes)

Replace an active key with a new secret that keeps its name, client and scopes.

The new secret is printed once. With —overlap-minutes 0 (the default) the old key stops working at once; otherwise it keeps working for that many minutes (never past its own expiry) so clients can switch without an outage. Without an overlap, —yes is required.

dewee admin api-keys rotate <keyId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --expires-in-days | int | days until the new key expires (1..90) | 30 | | --json | bool | output as JSON (same as -o json) | false | | --overlap-minutes | int | minutes the old key keeps working (0..1440) | 0 | | --yes | bool | confirm a rotation without overlap | false |

Examples

dewee admin api-keys rotate key_123 --overlap-minutes 30 --expires-in-days 60

dewee admin early-access

Show and operate the Early Access self-install discount campaign

dewee admin early-access

dewee admin early-access disable

Disable the public offer

dewee admin early-access disable

dewee admin early-access enable

Enable the public offer (requires a linked Polar discount synced within the last hour)

dewee admin early-access enable

dewee admin early-access link-discount

Link the Polar discount behind the campaign (warns when its terms differ)

dewee admin early-access link-discount <polarDiscountId>

dewee admin early-access redemptions

List Early Access redemptions, newest first (emails masked)

dewee admin early-access redemptions [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --limit | int | page size (1..200) | 50 | | --offset | int | rows to skip | 0 |

dewee admin early-access status

Show campaign state, slot usage and the public offer preview

dewee admin early-access status

dewee admin early-access sync

Refresh the cached redemption count from the linked Polar discount

dewee admin early-access sync

dewee admin licenses

List licenses and operate self-install license seats and key delivery

dewee admin licenses

dewee admin licenses list

List licenses (with activation history for —mode self_install)

dewee admin licenses list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --mode | string | purchase mode filter (“self_install”) | - |

dewee admin licenses release-activation

Free a stuck self-install seat (the released runtime must activate again)

dewee admin licenses release-activation <licenseId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --activation | string | activation id to release (default: the only active one) | - | | --yes | bool | confirm the release | false |

dewee admin licenses resend-delivery

Re-send the license key email while ACP still holds the sealed key

dewee admin licenses resend-delivery <licenseId>

dewee admin orders

Create commercial orders

Create commercial orders.

Payment is never asserted at creation: a new order starts as draft or pending_payment. Payment comes only from a verified Polar order or a super admin’s manual confirmation in the ACP Orders page, which needs a signed-in session; no ACP API key can confirm a payment, whatever its scopes. Creating an order needs the orders:write scope.

dewee admin orders

Examples

dewee admin orders create --customer-email buyer@example.com --purchase-mode on_prem
  dewee admin orders create --customer-email buyer@example.com --purchase-mode shared_saas --workspace-id ws_123 --status draft -o json

dewee admin orders create

Create a commercial order (status draft or pending_payment)

dewee admin orders create [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --billing-subscription-id | string | billing subscription id to attach | - | | --customer-email | string | buyer email address (required) | - | | --purchase-mode | string | purchase mode (shared_saas|cloud_dedicated|on_prem|self_install, required) | - | | --status | string | initial status (draft|pending_payment; default: pending_payment) | - | | --workspace-id | string | workspace id the order is for | - |

dewee admin promotions

Create, inspect and operate promotion campaigns backed by Polar discounts

Create, inspect and operate promotion campaigns on ACP.

A campaign discounts the self-install license or the shared SaaS plan, by percent or by a fixed amount. Visibility “auto” applies the discount to every eligible checkout; “code” requires the customer to enter the redemption code.

The redemption code is a customer-facing secret: pass it with —redemption-code-stdin so it stays out of shell history. It is never printed.

Nullable fields are cleared with —clear-<field> (sent as null); a value flag and its clear flag cannot be combined.

dewee admin promotions

Examples

dewee admin promotions list
  printf 'LAUNCH50' | dewee admin promotions create --code launch-2026 --name "Launch 50%" \
    --product self-install --percent 50 --redemption-code-stdin --total-slots 100 \
    --ends-at 2026-12-31T23:59:59Z
  dewee admin promotions update launch-2026 --total-slots 150 --clear-ends-at
  dewee admin promotions sync launch-2026 && dewee admin promotions enable launch-2026
  dewee admin promotions redemptions launch-2026 --limit 100 -o json

dewee admin promotions create

Create a campaign (ACP creates the Polar discount unless —polar-discount-id links one)

Create a promotion campaign.

Exactly one of —percent or —amount-cents is required. —product accepts self-install|shared-saas (or self_install|shared_saas). The redemption code is read with —redemption-code-stdin (recommended) or —redemption-code; it is never printed. ACP validates every field and is authoritative.

dewee admin promotions create [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --amount-cents | int | fixed discount in cents (exclusive with —percent) | 0 | | --code | string | campaign code, the stable id (required) | - | | --eligible-email | stringArray | eligible customer email (repeatable) | [] | | --eligible-emails-file | string | file with one eligible email per line, # comments allowed (”-” reads stdin) | - | | --eligible-workspace | stringArray | eligible hosted workspace id (repeatable) | [] | | --ends-at | string | end of the offer window, inclusive (RFC3339) | - | | --name | string | display name (required) | - | | --new-customers-only | bool | restrict to customers without a previous paid order | false | | --per-customer-limit | int | redemptions allowed per customer (>= 1) | 0 | | --percent | int | percentage discount, 1..100 (exclusive with —amount-cents) | 0 | | --polar-discount-id | string | link an existing Polar discount instead of creating one | - | | --product | string | discounted product: self-install|shared-saas (required) | - | | --redemption-code | string | customer redemption code (prefer —redemption-code-stdin: argv lands in shell history) | - | | --redemption-code-stdin | bool | read the redemption code from stdin | false | | --starts-at | string | start of the offer window (RFC3339) | - | | --total-slots | int | Dewee-side cap on paid redemptions (>= 1) | 0 | | --visibility | string | code (customer enters the redemption code); auto is reserved for the Early Access campaign | code |

Examples

printf 'LAUNCH50' | dewee admin promotions create --code launch-2026 --name "Launch 50%" \
    --product self-install --percent 50 --redemption-code-stdin --total-slots 100
  printf 'VIP10' | dewee admin promotions create --code saas-vip --name "SaaS 10 off" --product shared-saas \
    --amount-cents 1000 --visibility code --redemption-code-stdin --eligible-emails-file vip.txt --ends-at 2026-12-31T23:59:59Z

dewee admin promotions disable

Disable a campaign

dewee admin promotions disable <code>

dewee admin promotions enable

Enable a campaign (ACP refuses when the Polar discount is missing or stale)

dewee admin promotions enable <code>

dewee admin promotions get

Show one campaign with slot usage and the redemption summary

dewee admin promotions get <code>

dewee admin promotions list

List promotion campaigns

dewee admin promotions list

dewee admin promotions redemptions

List a campaign’s redemptions, newest first (emails masked)

dewee admin promotions redemptions <code> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --limit | int | page size (1..200) | 50 | | --offset | int | rows to skip | 0 |

dewee admin promotions sync

Refresh the cached redemption count from the linked Polar discount

dewee admin promotions sync <code>

dewee admin promotions update

Change a campaign’s name, limits, eligibility or window (only the flags given are sent)

Change a campaign. Only explicitly given flags are sent; everything else is left unchanged. —clear-<field> removes a nullable value (no cap, no eligibility restriction, no start or end).

The update is guarded by the campaign’s updatedAt: without —expected-updated-at the CLI reads the campaign first, and ACP answers 409 (exit 6) when it changed in between. Discount, product, visibility and redemption code cannot be changed; create a new campaign instead.

dewee admin promotions update <code> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --clear-eligible-emails | bool | clear eligibleEmails (send null) | false | | --clear-eligible-workspaces | bool | clear eligibleWorkspaceIds (send null) | false | | --clear-ends-at | bool | clear endsAt (send null) | false | | --clear-per-customer-limit | bool | clear perCustomerLimit (send null) | false | | --clear-starts-at | bool | clear startsAt (send null) | false | | --clear-total-slots | bool | clear totalSlots (send null) | false | | --eligible-email | stringArray | eligible customer email (repeatable) | [] | | --eligible-emails-file | string | file with one eligible email per line, # comments allowed (”-” reads stdin) | - | | --eligible-workspace | stringArray | eligible hosted workspace id (repeatable) | [] | | --ends-at | string | end of the offer window, inclusive (RFC3339) | - | | --expected-updated-at | string | updatedAt the change is based on (default: read from ACP first) | - | | --name | string | new display name | - | | --new-customers-only | bool | restrict to customers without a previous paid order | false | | --per-customer-limit | int | redemptions allowed per customer (>= 1) | 0 | | --starts-at | string | start of the offer window (RFC3339) | - | | --total-slots | int | Dewee-side cap on paid redemptions (>= 1) | 0 |

Examples

dewee admin promotions update launch-2026 --total-slots 150 --ends-at 2026-12-31T23:59:59Z
  dewee admin promotions update launch-2026 --clear-eligible-emails --new-customers-only=false
  dewee admin promotions update launch-2026 --name "Launch" --expected-updated-at 2026-10-01T00:00:00.000Z

dewee admin whoami

Show the ACP principal behind the current credential and its scopes

dewee admin whoami [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON (same as -o json) | false |

dewee agent

Manage agents (create, add, list, get, status, update, delete)

dewee agent

dewee agent access

Manage who may use, edit or manage an agent

Manage who may use, edit or manage an agent.

Grants are stored by the gateway in the caller’s tenant (/v1/resource-grants/agent). Levels: people: use, edit, manage, admin. These are resource access grants, unrelated to the commercial dewee admin access-grants.

dewee agent access

dewee agent access activity

Show grant changes, denials and uses of an agent, newest first

Show one page of the resource’s activity feed. —type filters grant changes, runtime denials or uses; pass the printed next cursor as —cursor (with the same —type) for the next page.

dewee agent access activity <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --cursor | string | next_cursor of the previous page | - | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --limit | int | events per page, 1..200 | 50 | | -o, --output | string | output format (table|json) | table | | --type | string | only this kind of event: grant, denied or use (default all) | - |

Examples

dewee agent access activity support-bot --type denied --limit 20 -o json

dewee agent access grant

Grant agents or people access to an agent

Grant each named principal exactly —level on the agent. Levels: people: use, edit, manage, admin. Re-granting the level a principal already holds changes nothing. When some principals cannot be granted the others still are; each failure is listed and the command exits with PARTIAL_FAILURE. When none could be granted it exits with the failure’s own class instead: NOT_FOUND for a principal outside the workspace, CONFLICT for the last admin, VALIDATION_ERROR otherwise.

dewee agent access grant <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --level | string | level to grant: use, edit, manage, admin | use | | -o, --output | string | output format (table|json) | table | | --user | stringSlice | user id of a workspace member (repeatable) | [] |

Examples

dewee agent access grant support-bot --user alice --level use

dewee agent access list

List who holds access to an agent

dewee agent access list <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent access list support-bot -o json

dewee agent access revoke

Remove a principal’s access to an agent

Remove a principal’s grant. —yes (or —dry-run to preview) is required: the command never prompts. Revoking a grant the principal does not hold changes nothing.

dewee agent access revoke <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table | | --user | stringSlice | user id of a workspace member | [] | | --yes | bool | confirm the revocation (required unless —dry-run) | false |

Examples

dewee agent access revoke support-bot --user alice --yes

dewee agent access set-level

Change the level a principal holds on an agent

Raise or lower an existing grant. Levels: people: use, edit, manage, admin. A principal without a grant is NOT_FOUND; use grant first.

dewee agent access set-level <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --level | string | new level: use, edit, manage, admin | - | | -o, --output | string | output format (table|json) | table | | --user | stringSlice | user id of a workspace member | [] |

Examples

dewee agent access set-level support-bot --user alice --level manage

dewee agent add

Add a new agent (interactive, requires running gateway)

Interactive wizard for creating an agent. For scripts and agents, use dewee agent create.

dewee agent add

dewee agent chat

Chat with an agent interactively or send a one-shot message

Chat with an agent via the running gateway (WebSocket client mode).

Examples: dewee agent chat # Interactive REPL dewee agent chat —name coder # Chat with “coder” agent dewee agent chat -m “What time is it?” # One-shot message dewee agent chat -s my-session # Continue a session

dewee agent chat [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -m, --message | string | one-shot message (omit for interactive mode) | - | | -n, --name | string | agent name | default | | -s, --session | string | session key (default: auto-generated) | - |

dewee agent codex-pool

Show read-only Codex/ChatGPT OAuth pool routing activity for an agent

dewee agent codex-pool <agentId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent codex-pool <agentId>

dewee agent create

Create an agent non-interactively (requires running gateway)

Create an agent from flags, with no prompts.

—provider is the provider name shown by dewee providers list. —type accepts open or predefined; the gateway currently stores open agents as predefined. —other-config-file reads a JSON object from a file, or from stdin with ”-”.

dewee agent create --key <key> --name <name> --provider <provider> --model <model> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --description | string | agent description (summoning prompt for predefined agents) | - | | --idempotency-key | string | Idempotency-Key for this create: a retry with the same key and body returns the first result instead of a duplicate (default: generated per run) | - | | --key | string | agent key (lowercase slug, unique per tenant) | - | | --model | string | model id | - | | --name | string | display name | - | | --other-config-file | string | JSON file with additional agent config (”-” reads stdin) | - | | -o, --output | string | output format (table|json) | table | | --provider | string | provider name (see dewee providers list) | - | | --type | string | agent type: open|predefined (open is stored as predefined) | predefined |

Examples

dewee agent create --key coder --name Coder --provider anthropic --model claude-sonnet-4-5 -o json

dewee agent credential-policy

Manage which credentials an agent may ask users for

Manage an agent’s credential_request policy.

The policy lists the credentials (target type, provider_type, channel_type or binary_name, and modes create/update) the agent may request from a user in the app chat with the credential_request tool. The user answers the card; the agent never sees the value. Reading needs the tenant owner or admin role.

request-credentials turns the agent’s request_credentials tool on or off (the fixed scope of a new provider or channel instance, or the agent’s own CLI credential). When the agent also has a credential_request policy, that policy bounds request_credentials too.

dewee agent credential-policy

dewee agent credential-policy clear

Remove an agent’s credential_request policy (human only)

Remove an agent’s credential_request policy; the agent loses the credential_request tool and its open credential_request cards are cancelled (an answer to one is refused with credential_policy_revoked). Requires the owner or admin membership role. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it.

dewee agent credential-policy clear <agentId|agentKey> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent credential-policy clear support-bot

dewee agent credential-policy get

Show an agent’s credential_request policy

dewee agent credential-policy get <agentId|agentKey> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent credential-policy get support-bot -o json

dewee agent credential-policy request-credentials

Turn an agent’s request_credentials tool on or off (human only)

Turn an agent’s request_credentials tool on or off. The tool lets the agent ask a user for a new provider or channel instance credential, or for its own CLI credential, through a secure form or a single-use link. This switch is the only way to set it: a generic agent update keeps the stored value. When the agent also has a credential_request policy, request_credentials is limited to the targets that policy allows. Requires the owner or admin membership role. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it.

dewee agent credential-policy request-credentials <agentId|agentKey> <on|off> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent credential-policy request-credentials support-bot on

dewee agent credential-policy set

Replace an agent’s credential_request policy (human only)

Replace an agent’s credential_request policy with a JSON document:

{“enabled”: true, “targets”: [ {“type”: “provider”, “provider_type”: “openai_compat”, “modes”: [“create”, “update”]}, {“type”: “channel_instance”, “channel_type”: “telegram”, “modes”: [“update”]}, {“type”: “cli_agent_credential”, “binary_name”: “gh”, “modes”: [“create”]}, {“type”: “mcp_server”, “server_id”: “<server uuid>”, “modes”: [“update”]}]}

Types: provider, tts, stt (provider_type), channel_instance (channel_type), cli_agent_credential (binary_name), mcp_server (exactly one of server_id or server_name; update only; prefer server_id, since a server_name entry follows whichever server holds that name). A provider entry needs a provider_type a card can create (a keyed type from dewee workspace-setup catalog -o json, or chatgpt_oauth with mode create only); the error names close matches, for example anthropic_native for anthropic. Unknown fields are refused; at most 32 targets. Requires the owner or admin membership role. Saving a policy cancels the agent’s open credential_request cards it no longer allows. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it.

dewee agent credential-policy set <agentId|agentKey> --file <policy.json|-> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --file | string | policy JSON file, or - for stdin (required) | - | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent credential-policy set support-bot --file policy.json

dewee agent delete

Delete an agent (requires running gateway)

Delete an agent. Asks for confirmation on a terminal; pass —force to skip it (required without a TTY).

dewee agent delete <agent-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --force | bool | skip confirmation | false |

dewee agent evolution

Inspect and review an agent’s evolution metrics and suggestions

dewee agent evolution

dewee agent evolution metrics

Show an agent’s evolution metrics

dewee agent evolution metrics <agentId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent evolution metrics <agentId>

dewee agent evolution review

Review an agent evolution suggestion

dewee agent evolution review <agentId> <suggestionId> --status <accepted|rejected> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --status | string | review outcome (accepted|rejected) | - |

Examples

dewee agent evolution review <agentId> <suggestionId> --status accepted

dewee agent evolution suggestions

List an agent’s evolution suggestions

dewee agent evolution suggestions <agentId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent evolution suggestions <agentId>

dewee agent files

Read and edit an agent’s allowlisted context files (IDENTITY.md, SOUL.md, …)

Read and edit the agent context files the Gateway allowlists.

The allowlist is enforced server-side against the same logical-name set as the agents.files.* WebSocket methods, and each write is size-bounded.

dewee agent files

dewee agent files get

Read one agent context file

dewee agent files get <agentId> <name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent files get <agentId> SOUL.md

dewee agent files list

List an agent’s context files

dewee agent files list <agentId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent files list <agentId>

dewee agent files set

Write an agent context file

Write an allowlisted agent context file.

Content is read from a file so multi-line prompts are not mangled by shell quoting.

dewee agent files set <agentId> <name> --content-file <path> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --content-file | string | path to the file holding the new content | - | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --propagate | bool | push the change to existing user instances | false |

Examples

dewee agent files set <agentId> SOUL.md --content-file ./soul.md

dewee agent get

Get agent details

dewee agent get <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee agent list

List all agents (requires running gateway)

dewee agent list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --type | string | filter by agent type (open|predefined) | - |

dewee agent status

Show agent configuration and live router status

dewee agent status <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee agent update

Update agent fields

Update agent fields.

Reasoning effort controls (OpenAI GPT/Codex only): use —reasoning-mode inherit to fall back to the provider’s default reasoning policy, or —reasoning-effort (optionally with —reasoning-fallback) to set a per-agent override. Effective behavior still depends on the selected model’s reasoning capability.

dewee agent update <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --enabled | bool | set status active/inactive | true | | --human-handoff-file | string | JSON file with the human-handoff route config | - | | --json | bool | output as JSON | false | | --model | string | model name | - | | --model-fallback-file | string | JSON file with the model fallback config | - | | --name | string | display name | - | | --oauth-routing-file | string | JSON file with the ChatGPT OAuth routing config | - | | --other-config-file | string | JSON file with additional agent config (compaction, pruning, memory, …) | - | | -o, --output | string | output format (table|json) | table | | --provider | string | provider type/name | - | | --reasoning-effort | string | per-agent reasoning effort override: off|auto|none|minimal|low|medium|high|xhigh|max | - | | --reasoning-fallback | string | fallback policy when the model does not support the requested effort: downgrade|off|provider_default | - | | --reasoning-mode | string | reasoning override mode: inherit|custom (default custom when —reasoning-effort is set) | - | | --status | string | agent status | - |

dewee agent versions

Inspect an agent’s configuration version history

Inspect an agent’s configuration version history.

Each change to an agent’s versioned configuration records an immutable version with a content hash. The list needs access to the agent; reading a snapshot or a diff needs agent edit permission, because snapshots carry context-file text.

dewee agent versions

dewee agent versions diff

Show the configuration changes between two agent versions

dewee agent versions diff <agentId|agentKey> <fromVersion> <toVersion> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent versions diff <agentId> 2 5

dewee agent versions get

Show one agent version with its configuration snapshot

dewee agent versions get <agentId|agentKey> <version> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent versions get <agentId> 3 --json

dewee agent versions list

List an agent’s versions, newest first

dewee agent versions list <agentId|agentKey> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --limit | int | Maximum versions to return, at most 200 (default 50) | 0 | | -o, --output | string | output format (table|json) | table |

Examples

dewee agent versions list <agentId> --limit 20

dewee api-keys

Manage gateway API keys

Manage gateway-issued API keys: list, create, and revoke scoped credentials for tenant, workspace, and user callers.

Authentication uses —token or these environment variables: GOCLAW_GATEWAY_TOKEN bearer token for operator API calls GOCLAW_GATEWAY_URL gateway base URL GOCLAW_SERVER gateway base URL alias

Attribution limitation: the CLI authenticates to the gateway as the fixed identity “system”, so every key created through this command is recorded with created_by=“system” rather than an individual operator identity.

dewee api-keys

dewee api-keys create

Create an API key

Create a new API key. The raw secret is returned only once in the create response and cannot be retrieved again afterward — store it securely.

MCP scopes (mcp.tools.read, mcp.tools.write) gate the public MCP endpoint (/mcp/server) only. They do not grant gateway read/write access, and they require —owner-id: an ownerless API key would take its user identity from a request header, so the gateway rejects an MCP-scoped key without a bound owner.

The agent.chat scope creates an agent-scoped chat key: it may only call POST /v1/chat/completions, always with the agent given by —agent-id (and, when —user-id is set, always as that runtime user). Every other route answers 403. agent.chat cannot be combined with other scopes and requires a tenant.

—tenant-id is only honored for callers with owner-scope credentials; the gateway silently falls back to the caller’s own tenant otherwise. This command warns on stderr if the created key does not carry the tenant/owner you requested.

dewee api-keys create [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent-id | string | agent UUID an agent.chat key is bound to (agent.chat only) | - | | --expires-in | int | TTL in seconds (omit for a key that never expires) | 0 | | --json | bool | output as JSON | false | | --name | string | human-readable label (required) | - | | --owner-id | string | user ID to bind the key to | - | | --scopes | stringSlice | comma-separated permission scopes (required) | [] | | --tenant-id | string | tenant UUID to bind the key to (owner-scope callers only; ignored otherwise) | - | | --user-id | string | fixed runtime user ID for an agent.chat key (agent.chat only, optional) | - |

dewee api-keys list

List API keys

dewee api-keys list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --kind | string | filter by key kind: “api_key” (default, hides session tokens), “session”, or “all” | - | | --revoked | bool | filter to revoked (—revoked) or active (—revoked=false) keys; omit to show both | false | | --tenant-id | string | filter to keys bound to this tenant ID | - |

dewee api-keys revoke

Revoke an API key

dewee api-keys revoke <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --force | bool | skip confirmation prompt | false | | --json | bool | output as JSON | false |

dewee auth

Authenticate named ChatGPT OAuth accounts

Manage ChatGPT OAuth authentication via the running gateway. Requires the gateway to be running.

dewee auth

dewee auth logout

Disconnect stored ChatGPT OAuth tokens

dewee auth logout [provider]

dewee auth status

Show OAuth authentication status

Check if a named ChatGPT OAuth account is authenticated on the running gateway.

dewee auth status [provider]

dewee backup

Create a full system backup (database + filesystem)

Produces a .tar.gz archive containing a pg_dump of the database and all workspace/data files.

dewee backup [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --exclude-db | bool | skip database dump (filesystem only) | false | | --exclude-files | bool | skip filesystem archive (database only) | false | | -o, --output | string | output path for .tar.gz (default: ./backup-<timestamp>.tar.gz) | - | | --upload-s3 | bool | upload backup to S3 after creation (requires s3 config in config_secrets) | false |

dewee bitrix-portal

Manage Bitrix24 portals (direct DB access; postgres only)

Manage Bitrix24 portal rows in the database.

dewee expects a bitrix_portals row to exist before an operator runs the OAuth install flow at /bitrix24/install. This command seeds that row without requiring SQL access to the database.

dewee bitrix-portal

dewee bitrix-portal create

Create a bitrix_portals row with client_id/client_secret

Create a new Bitrix24 portal registration.

After the row exists, direct the portal admin to https://<public_url>/bitrix24/install?state=<tenant_id>:<name> to authorize the app — the install handler writes the OAuth token into the state column of this same row.

dewee bitrix-portal create [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --client-id | string | Bitrix24 application client_id / application_id (required) | - | | --client-secret | string | Bitrix24 application client_secret / application key (required) | - | | --domain | string | Bitrix24 portal host, e.g. mycompany.bitrix24.com (required) | - | | --name | string | Short portal name, referenced by channel_instance.config.portal (required) | - | | --tenant-id | string | Tenant UUID this portal belongs to (required) | - |

dewee bitrix-portal list

List bitrix_portals rows (optionally scoped to one tenant)

dewee bitrix-portal list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --tenant-id | string | Filter to one tenant UUID (optional) | - |

dewee bitrix-portal set-public-url

Backfill state.public_url for a portal installed pre Phase-01

Set the gateway-public URL used to register Bitrix24 imbot event handlers.

Required for portals that were installed before the dewee release that auto-captures the URL from the /bitrix24/install callback. Without it, the factory cannot build a valid EVENT_MESSAGE_ADD URL for new channels.

After running once, the value is persisted in bitrix_portals.state.public_url and reused on every restart. Subsequent reinstalls (when the public URL rotates) overwrite the value automatically — this command is only for the initial backfill.

dewee bitrix-portal set-public-url [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --name | string | Portal name (required) | - | | --tenant-id | string | Tenant UUID this portal belongs to (required) | - | | --url | string | Gateway public URL, e.g. https://dewee.mycompany.com (required) | - |

dewee bitrix-portal update-credentials

Replace client_id/client_secret on an existing portal row

Update OAuth credentials on an existing bitrix_portals row.

Use this when rotating client_secret or migrating from local app to marketplace app. The OAuth state token is cleared by default (state from old credentials cannot refresh under new client_id/secret); pass —keep-state only if rotating the secret of the SAME application.

dewee bitrix-portal update-credentials [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --client-id | string | New Bitrix24 application client_id (required) | - | | --client-secret | string | New Bitrix24 application client_secret (required) | - | | --keep-state | bool | Keep existing OAuth state token (only safe when rotating secret of SAME application) | false | | --name | string | Portal name to update (required) | - | | --tenant-id | string | Tenant UUID this portal belongs to (required) | - |

dewee browser

Manage your connected browsers (Dewee Chrome Extension) and their grants

Manage the Chrome browsers you connected through the Dewee Chrome Extension and the grants that let agents drive them.

These commands act for the person who owns the API key: pass a personal API key bound to your user with —token or GOCLAW_GATEWAY_TOKEN. The gateway master token, unbound keys and pairing connections are refused. Devices are enrolled and grants are created only in the extension; here you can list, rename and revoke them.

dewee browser

dewee browser devices

List, rename or revoke connected browsers

dewee browser devices

dewee browser devices list

List your connected browsers

dewee browser devices list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee browser devices rename

Rename a connected browser

dewee browser devices rename <device-id> <name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee browser devices revoke

Revoke a connected browser, its grants and its in-flight commands

dewee browser devices revoke <device-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --force | bool | skip confirmation prompt | false | | --json | bool | output as JSON | false |

dewee browser grants

List or revoke the grants of a connected browser

dewee browser grants

dewee browser grants list

List the active grants of a connected browser

dewee browser grants list --device <device-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --device | string | device id (see dewee browser devices list) | - | | --json | bool | output as JSON | false |

dewee browser grants revoke

Revoke a grant and cancel the commands running under it

dewee browser grants revoke <grant-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --force | bool | skip confirmation prompt | false | | --json | bool | output as JSON | false |

dewee channels

Manage messaging channels (requires running gateway)

dewee channels

dewee channels access

Inspect a channel’s access gate and invalidate cached decisions

Inspect the channel access gate of a database-backed channel instance, or drop its cached entitlement decisions after a sender’s entitlement changed. The cache is per gateway process.

dewee channels access

dewee channels access invalidate

Drop cached access decisions of one sender or of all senders

dewee channels access invalidate <instance-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --all | bool | invalidate every sender of the instance | false | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --sender | string | channel sender id to invalidate | - |

Examples

dewee channels access invalidate <instance-id> --sender 123456789
  dewee channels access invalidate <instance-id> --all

dewee channels access status

Show a channel’s access gate state and counters

dewee channels access status <instance-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee channels access status 0199a571-6ad2-78be-8caa-43ab429f43da --json

dewee channels add

Add a new channel instance (interactive)

Interactive wizard for telegram, discord and slack channels. For scripts, agents and every other channel type, use dewee channels create.

dewee channels add

dewee channels bind

Bind a channel instance to an agent

Route a channel instance’s messages to an agent (UUID or key). It sends exactly what dewee channels update <id> --agent <agent> sends.

dewee channels bind <id> --agent <id|key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or agent key to bind the channel to | - | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee channels bind <id> --agent coder -o json
  dewee channels bind <id> --agent coder --dry-run

dewee channels create

Create a channel instance non-interactively

Create a channel instance from flags, with no prompts.

—type is any channel type the gateway supports; the gateway validates it. —agent takes an agent UUID or agent key. Credentials are read from a JSON file, or from stdin with —credentials-file -, never from a flag value.

dewee channels create --type <type> --name <name> --agent <id|key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or agent key to bind the channel to | - | | --config-file | string | JSON object file with the channel config (”-” reads stdin) | - | | --credential-ref | string | reuse a stored secret by reference (cred:v1:channel_instance:<id>) instead of supplying one | - | | --credentials-file | string | JSON object file with the channel credentials (”-” reads stdin) | - | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --enabled | bool | enable the channel | true | | --idempotency-key | string | Idempotency-Key for this create: a retry with the same key and body returns the first result instead of a duplicate (default: generated per run) | - | | --name | string | instance name | - | | -o, --output | string | output format (table|json) | table | | --type | string | channel type (e.g. telegram, discord, slack, zalo, feishu, whatsapp) | - |

Examples

printf '{"token":"%s"}' "$TELEGRAM_BOT_TOKEN" | dewee channels create --type telegram --name my-bot --agent coder --credentials-file - -o json

dewee channels delete

Delete a channel instance

Delete a channel instance. Asks for confirmation on a terminal; pass —force to skip it (required without a TTY).

dewee channels delete <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --force | bool | skip confirmation | false |

dewee channels guard

Manage a channel’s MCP pre-inbound guard

Inspect or change the MCP inbound guard of a database-backed Zalo Personal channel instance. Static channels are configured in channels.zalo_personal.inbound_guard of the gateway config file.

dewee channels guard

dewee channels guard disable

Disable a channel’s MCP inbound guard

dewee channels guard disable <instance-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the saved guard as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee channels guard disable <instance-id>

dewee channels guard get

Show a channel’s MCP inbound guard

dewee channels guard get <instance-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee channels guard get 0199a571-6ad2-78be-8caa-43ab429f43da --json

dewee channels guard set

Enable a Zalo Personal MCP inbound guard

dewee channels guard set <instance-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the saved guard as JSON | false | | -o, --output | string | output format (table|json) | table | | --server | string | tenant-scoped MCP server UUID (or config:<name> in master scope) | - | | --timeout-ms | int | guard timeout in milliseconds (100-30000) | 5000 | | --tool | string | MCP guard tool name | - |

Examples

dewee channels guard set <instance-id> --server <tenant-mcp-server-uuid> --tool check_sender --timeout-ms 5000

dewee channels inbox

Review and triage messages recorded by a channel in observe mode

A channel with observe mode records every in-scope group message so an agent can triage it (normally from a cron job using the channel_inbox tool). Use these commands to review the inbox and correct a triage decision.

dewee channels inbox

dewee channels inbox list

List inbox messages, newest first

dewee channels inbox list <instance-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --chat | string | filter by channel or thread ID | - | | --json | bool | output as JSON | false | | --limit | int | max results (1-500) | 50 | | --offset | int | pagination offset | 0 | | -o, --output | string | output format (table|json) | table | | --status | string | filter: pending, ignored, answered, handed_off, staff, live | - |

Examples

dewee channels inbox list <instance-id> --status pending
  dewee channels inbox list <instance-id> --chat 123456789012345678 --json

dewee channels inbox mark

Set the triage status of an inbox message

dewee channels inbox mark <instance-id> <message-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the updated message as JSON | false | | --note | string | short reason (max 500 characters) | - | | -o, --output | string | output format (table|json) | table | | --status | string | pending, ignored, answered or handed_off (required) | - |

Examples

dewee channels inbox mark <instance-id> 1290000000000000000 --status ignored --note "duplicate"
  dewee channels inbox mark <instance-id> 1290000000000000000 --status pending   # re-queue for the agent

dewee channels list

List channel instances

dewee channels list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee channels support-threads

List or close threads where the agent talks directly with a user

dewee channels support-threads

dewee channels support-threads close

Stop the agent from answering directly in a support thread

dewee channels support-threads close <instance-id> <thread-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --yes | bool | confirm closing the thread | false |

Examples

dewee channels support-threads close <instance-id> 1290000000000000000 --yes

dewee channels support-threads list

List support threads opened by the agent

dewee channels support-threads list <instance-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --active | bool | only threads that still accept messages | false | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee channels support-threads list <instance-id> --active

dewee channels test

Test a channel instance’s connection

Ask the gateway whether the channel’s adapter is running, with its last error and a recovery step when it is not. Changes nothing.

dewee channels test <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee channels test <id> -o json

dewee channels update

Update a channel instance

Update a channel instance by UUID, sending only the given fields.

—agent rebinds the channel (agent UUID or key). Credentials and config are read from JSON files, or one of them from stdin with ”-”.

dewee channels update <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or agent key to rebind the channel to | - | | --config-file | string | JSON object file with the channel config (”-” reads stdin) | - | | --credential-ref | string | reuse a stored secret by reference (cred:v1:channel_instance:<id>) instead of supplying one | - | | --credentials-file | string | JSON object file with the channel credentials (”-” reads stdin) | - | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --enabled | bool | enable or disable the channel | true | | --name | string | new instance name | - | | -o, --output | string | output format (table|json) | table |

Examples

dewee channels update <id> --enabled=false -o json
  dewee channels update <id> --credentials-file ./creds.json

dewee channels verify-inbound

Verify that a channel receives messages, with a probe code the user sends

start issues a probe code and the instructions for sending it to the channel from the user’s own account; check reports whether the probe arrived (inbound_ok) and the reply went out (outbound_ok). —step-id links the check to a setup plan step.

dewee channels verify-inbound <id> <start|check> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table | | --step-id | string | setup plan step this verification completes | - |

Examples

dewee channels verify-inbound <id> start --step-id channel.telegram -o json
  dewee channels verify-inbound <id> check -o json

dewee cli-credentials

Manage secure CLI credentials, agent credentials and agent grants

Manage SecureCLI credentials: the binaries agents may run with injected env (list, get, presets, create, update, delete, test), per-agent credentials (agent-credentials) and per-agent grants (grants). Env values are secrets: they are read only from a JSON file or stdin (—env-file), and output shows key names only.

dewee cli-credentials

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

dewee cli-credentials agent-credentials

Manage per-agent env for a secure CLI credential

Per-agent credentials override the binary’s env for one agent. They do not grant access: a non-global binary still needs dewee cli-credentials grants create.

dewee cli-credentials agent-credentials

dewee cli-credentials agent-credentials list

List the agents with their own credential for a binary (env key names only)

dewee cli-credentials agent-credentials list <binary-name|credential-id>

Examples

dewee cli-credentials agent-credentials list gh -o json

dewee cli-credentials agent-credentials set

Set an agent’s own env for a binary

Set the env one agent gets when it runs the binary, merged into any stored values (an empty value keeps the stored secret). Env values are read only from a JSON file or stdin and are never printed.

—credential-ref cred:v1:cli_agent_credential:<binary-id>:<agent-id> confirms that this agent’s stored credential is in place without sending a secret (status “unchanged”). The gateway cannot copy a per-agent CLI secret to another binary or agent: a ref to another record is refused; collect that secret with a secret_request card instead.

dewee cli-credentials agent-credentials set <binary-name|credential-id> <agent-id-or-key> (--env-file <file> | --credential-ref <ref>) [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --credential-ref | string | reuse a stored secret by reference (cred:v1:cli_agent_credential:<id>) instead of supplying one | - | | --env-file | string | JSON object file of env values for this agent (”-” reads stdin) | - |

Examples

printf '{"GH_TOKEN":"%s"}' "$GH_TOKEN" | dewee cli-credentials agent-credentials set gh coder --env-file - -o json
  dewee cli-credentials agent-credentials set gh coder --credential-ref cred:v1:cli_agent_credential:<binary-id>:<agent-id> -o json

dewee cli-credentials create

Create a secure CLI credential non-interactively

Register a binary agents may run with injected env, from a preset (see dewee cli-credentials presets) or a binary name. The binary name is the natural key: the gateway would overwrite an existing credential of the same binary, so the CLI refuses with CONFLICT (exit 6) instead; use dewee cli-credentials update.

dewee cli-credentials create (--preset <preset> | --binary <name>) [--env-file <file>] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --binary | string | binary name (overrides the preset’s binary) | - | | --description | string | description shown to agents | - | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --enabled | bool | enable the credential | true | | --env-file | string | JSON object file of env values to inject (”-” reads stdin) | - | | --global | bool | make the binary available to every agent (false: only agents with a grant) | true | | --preset | string | preset key that fills the binary, deny rules and tips | - |

Examples

printf '{"GH_TOKEN":"%s"}' "$GH_TOKEN" | dewee cli-credentials create --preset github --env-file - -o json
  dewee cli-credentials create --binary mytool --env-file ./mytool-env.json --global=false

dewee cli-credentials delete

Delete a secure CLI credential

Delete a credential with its agent credentials and grants. —yes is required: the command never prompts.

dewee cli-credentials delete <binary-name|credential-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --yes | bool | confirm the deletion (required) | false |

Examples

dewee cli-credentials delete gh --yes -o json

dewee cli-credentials effective-env

Show which credential layer supplies each env key for an agent

Resolve the env a credentialed exec of the binary would inject for one agent, and show which layer supplies each key: binary, agent_grant, context_grant, context, agent, or user. Only key names and layer names are shown, never values.

Use it when a rotated secret seems to have no effect: an older user, channel context, or agent credential still carrying the same key overrides the binary and grant env.

dewee cli-credentials effective-env <binary-name|credential-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent-id | string | agent UUID to resolve for (required) | - | | --channel | string | channel instance name to include channel context grants and credentials | - | | --scope-key | string | channel context scope key for group, user, or role scopes | - | | --scope-type | string | channel context scope type: channel (default), group, user, or role | - | | --user | string | credential user ID to include per-user credentials | - |

Examples

dewee cli-credentials effective-env disco --agent-id 7c1f...
  dewee cli-credentials effective-env disco --agent-id 7c1f... --channel support-discord -o json

dewee cli-credentials get

Show one secure CLI credential (env key names only)

dewee cli-credentials get <binary-name|credential-id>

Examples

dewee cli-credentials get gh -o json

dewee cli-credentials grants

Manage which agents may run a secure CLI binary

A grant lets one agent run a non-global binary, optionally with its own env, deny rules and timeout. One agent has at most one grant per binary.

dewee cli-credentials grants

dewee cli-credentials grants create

Grant an agent access to a binary

Grant one agent access to a binary, optionally with grant-level env read from a JSON file or stdin. The (binary, agent) pair is the natural key: a second grant for the same agent fails with CONFLICT (exit 6).

dewee cli-credentials grants create <binary-name|credential-id> --agent <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or agent key to grant | - | | --enabled | bool | enable the grant | true | | --env-file | string | JSON object file of grant-level env values (”-” reads stdin) | - |

Examples

dewee cli-credentials grants create gh --agent coder -o json
  dewee cli-credentials grants create gh --agent coder --env-file ./gh-grant-env.json

dewee cli-credentials grants delete

Delete an agent grant

Delete one agent grant of a binary. —yes is required: the command never prompts.

dewee cli-credentials grants delete <binary-name|credential-id> <grant-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --yes | bool | confirm the deletion (required) | false |

Examples

dewee cli-credentials grants delete gh <grant-id> --yes -o json

dewee cli-credentials grants list

List the agent grants of a binary (env key names only)

dewee cli-credentials grants list <binary-name|credential-id>

Examples

dewee cli-credentials grants list gh -o json

dewee cli-credentials list

List secure CLI credentials

dewee cli-credentials list

Examples

dewee cli-credentials list -o json

dewee cli-credentials presets

List the built-in CLI credential presets

dewee cli-credentials presets

Examples

dewee cli-credentials presets -o json

dewee cli-credentials test

Dry-run commands against a credential’s deny rules

Check whether each —command would pass the credential’s deny_args and deny_verbose rules. Nothing is executed and no credential is used: this is a policy dry run.

dewee cli-credentials test <binary-name|credential-id> --command <cmd> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --command | stringArray | command line to check (repeat for several) | [] |

Examples

dewee cli-credentials test gh --command "gh pr list" --command "gh auth token" -o json

dewee cli-credentials update

Update a secure CLI credential

Update a credential, sending only the given fields. —env-file values are merged into the stored env; an empty value keeps the stored secret.

dewee cli-credentials update <binary-name|credential-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --description | string | description shown to agents | - | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --enabled | bool | enable the credential | true | | --env-file | string | JSON object file of env values to inject (”-” reads stdin) | - | | --global | bool | make the binary available to every agent (false: only agents with a grant) | true |

Examples

dewee cli-credentials update gh --env-file ./gh-env.json -o json
  dewee cli-credentials update gh --enabled=false

dewee config

View and manage configuration

dewee config

dewee config path

Print the config file path

dewee config path

dewee config show

Display current configuration (secrets redacted)

dewee config show

dewee config validate

Validate configuration file

dewee config validate

dewee contacts

View the channel-collected contact directory

dewee contacts

dewee contacts get

Get a single contact by ID

dewee contacts get <contact-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee contacts list

List contacts with pagination and filters

dewee contacts list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --channel-instance | string | filter by channel instance name | - | | --channel-type | string | filter by platform (telegram, discord, slack, …) | - | | --contact-type | string | filter by contact type (user, group) | - | | --json | bool | output as JSON | false | | --limit | int | max results (1-200) | 50 | | --offset | int | pagination offset | 0 | | --peer-kind | string | filter by peer kind (direct, group) | - | | --search | string | filter by display name, username, or sender ID | - |

dewee contacts merge

Merge contacts into a single person identity

Merge two or more contacts into one person identity.

The Gateway re-resolves every contact against the caller’s tenant before merging, so a contact outside the tenant is rejected rather than merged.

dewee contacts merge [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --contact | stringSlice | contact ID to merge (repeatable, minimum two) | [] | | --create-display-name | string | display name for —create-user | - | | --create-user | string | create a new tenant user with this ID | - | | --json | bool | output as JSON | false | | --tenant-user | string | existing tenant user to merge into | - |

Examples

dewee contacts merge --contact <id> --contact <id>
  dewee contacts merge --contact <id> --tenant-user <userId>

dewee contacts unmerge

Split contacts back out of a merged person identity

dewee contacts unmerge [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --contact | stringSlice | contact ID to unmerge (repeatable) | [] | | --json | bool | output as JSON | false |

Examples

dewee contacts unmerge --contact <id>

dewee cron

Manage scheduled cron jobs

dewee cron

dewee cron create

Create a cron job

dewee cron create [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent id/key | - | | --channel | string | delivery channel | - | | --deliver | bool | deliver result to a channel | false | | -i, --input | stringSlice | workflow input key=value pairs | [] | | --json | bool | output as JSON | false | | --message | string | message to send when the job runs | - | | --name | string | job name | - | | --schedule | string | schedule JSON, @every/duration, at:RFC3339, or cron expression | - | | --stateless | bool | run without retaining session state | false | | --to | string | delivery target | - | | --wake-heartbeat | bool | wake heartbeat before run | false | | --workflow | string | workflow slug or ID to trigger | - |

dewee cron delete

Delete a cron job

dewee cron delete [jobId] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee cron get

Get a cron job

dewee cron get <job-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee cron list

List all cron jobs

dewee cron list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --all | bool | include disabled jobs | false | | --json | bool | output as JSON | false |

dewee cron run

Run a cron job now

dewee cron run <job-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --force | bool | force run even if not due | false | | --json | bool | output as JSON | false |

dewee cron runs

List cron run history

dewee cron runs <job-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --limit | int | max run records | 20 | | --offset | int | run record offset | 0 |

dewee cron status

Show cron scheduler status

dewee cron status [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee cron toggle

Enable or disable a cron job

dewee cron toggle [jobId] [true|false] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee cron update

Update a cron job

dewee cron update <job-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent id/key | - | | --channel | string | delivery channel | - | | --delete-after-run | bool | delete after a successful run | false | | --deliver | bool | deliver result to a channel | false | | --enabled | bool | enable or disable | true | | --json | bool | output as JSON | false | | --message | string | message | - | | --name | string | job name | - | | --schedule | string | schedule JSON, @every/duration, at:RFC3339, or cron expression | - | | --stateless | bool | run without retaining session state | false | | --to | string | delivery target | - | | --wake-heartbeat | bool | wake heartbeat before run | false |

dewee decisions

Manage an agent’s decision policy (shadow or active mode)

Manage an agent’s decision policy, the DECISIONS.md document an admin writes to describe how the agent should treat an inbound message (continue, ignore or request_clarification).

The policy holds exactly one fenced yaml block; the prose around it is for people and is never sent anywhere. Overlays in the same block narrow the question per channel, group or sender; the most specific match wins each field.

Mode is off (the default: no evaluation, no Jev call), shadow or active. In shadow each admitted person message is evaluated by Jev off the message path and recorded as a decision.evaluate trace span; delivery and scheduling never change. In active the evaluation runs just before scheduling and is acted on: continue runs as usual, request_clarification makes the agent ask one question, ignore (group messages only) schedules nothing; every failure continues. Switching to active needs a passing replay of the exact document (see replay).

test asks Jev about a sample message without storing or recording anything; replay measures the policy against labelled messages; evaluations summarises the recorded decisions by scope. Reading needs the tenant owner or admin role; writing also needs a person. See docs/decision-policies.md.

dewee decisions

dewee decisions evaluations

Summarise the agent’s recent decisions

List the agent’s recent decision.evaluate spans, newest first, with a summary: how many were evaluated, skipped or enforced (active mode), what the policy would apply, the fallback reasons, the options Jev chose, the breakdown by scope (agent, channel, group, sender) and overlay, latency p50/p95 and the policy revisions involved. The sample is the newest —limit spans (1-500, default 100) since —since (default 7 days ago). Requires the owner or admin membership role.

dewee decisions evaluations <agentId|agentKey> [--limit N] [--since RFC3339] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --limit | int | newest spans to read (1-500) | 100 | | -o, --output | string | output format (table|json) | table | | --since | string | earliest span time, RFC3339 (default 7 days ago) | - |

Examples

dewee decisions evaluations support-bot --limit 50 --json

dewee decisions get

Show an agent’s decision policy document and mode

dewee decisions get <agentId|agentKey> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee decisions get support-bot --json

dewee decisions replay

Measure the decision policy against labelled messages

Run the decision policy over labelled cases through the same Jev path as live messages and print precision and recall per option, the confusion matrix and the active-mode gate verdict.

—fixtures is a JSON array, an object with a “cases” array, or JSON Lines (one case per line; lines starting with # or // are skipped). Each case has an id, the message, peer_kind (direct or group), optional channel, chat_id and sender_id (to exercise overlays) and the expected action. 1-100 cases.

—file replays a draft document instead of the stored one. The gateway stores the measurement (never the messages) and audits it as agent.decision_policy.replayed. A passing replay of the exact document, at most 30 days old, is what allows ‘dewee decisions set —mode active’. —require-pass exits with VALIDATION_ERROR when the gate is not met. Uses the tenant’s Jev credential and is rate limited. Requires the owner or admin membership role.

dewee decisions replay <agentId|agentKey> --fixtures <cases.jsonl|-> [--file <DECISIONS.md|->] [--require-pass] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --file | string | draft DECISIONS.md to replay instead of the stored policy, or - for stdin | - | | --fixtures | string | labelled cases (JSON or JSON Lines), or - for stdin (required) | - | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --require-pass | bool | exit with VALIDATION_ERROR unless the active-mode gate is met | false |

Examples

dewee decisions replay support-bot --fixtures cases.jsonl
  dewee decisions replay support-bot --fixtures cases.jsonl --file DECISIONS.md --require-pass --json

dewee decisions replays

List the agent’s recorded replays, newest first

List the agent’s stored replay measurements, newest first (the gateway keeps the newest 50): the policy hash and revision each one measured, whether it was a draft, the case count and whether it met the active-mode gate. Requires the owner or admin membership role.

dewee decisions replays <agentId|agentKey> [--limit N] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --limit | int | newest replays to list (1-50) | 10 | | -o, --output | string | output format (table|json) | table |

Examples

dewee decisions replays support-bot --limit 5 --json

dewee decisions set

Write an agent’s decision policy or switch its mode (human only)

Write an agent’s decision policy document, switch its mode, or both.

—file replaces the document (- reads stdin); it is validated before anything is sent. —mode is off, shadow or active; a new policy starts off unless —mode is given. active (and any new document while active) is refused with a conflict unless ‘dewee decisions replay’ has passed the active-mode gate for that exact document within the last 30 days. —expected-revision makes the write fail with a conflict unless the stored revision still matches (0: no policy yet); without it the write applies to the revision the gateway reads in the same request. Requires the owner or admin membership role. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it.

dewee decisions set <agentId|agentKey> [--file <DECISIONS.md|->] [--mode off|shadow|active] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --expected-revision | int64 | fail unless the stored revision matches (0: no policy yet) | 0 | | --file | string | DECISIONS.md file, or - for stdin | - | | --json | bool | output as JSON | false | | --mode | string | off, shadow or active | - | | -o, --output | string | output format (table|json) | table |

Examples

dewee decisions set support-bot --file DECISIONS.md
  dewee decisions set support-bot --mode shadow --expected-revision 1
  dewee decisions set support-bot --mode active

dewee decisions status

Show an agent’s decision policy mode, revision and hash

dewee decisions status <agentId|agentKey> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee decisions status support-bot --json

dewee decisions test

Ask Jev what the decision policy would decide for a sample message

Run the decision policy against a sample message and print Jev’s proposal, what the policy would do, and why. —channel, —chat-id and —sender-id pick the overlays that apply to the sample. —file tests a draft document instead of the stored one; nothing is stored, no message is sent, and no decision.evaluate span is recorded. The call uses the tenant’s Jev credential and is audited as agent.decision_policy.tested without the message text. Requires the owner or admin membership role.

dewee decisions test <agentId|agentKey> --message <text> [--peer-kind direct|group] [--channel C --chat-id G --sender-id S] [--file <DECISIONS.md|->] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --channel | string | channel instance the sample arrives on (selects channel overlays) | - | | --chat-id | string | group or chat id of the sample (selects group overlays) | - | | --file | string | draft DECISIONS.md to test instead of the stored policy, or - for stdin | - | | --json | bool | output as JSON | false | | --message | string | sample inbound message (required) | - | | -o, --output | string | output format (table|json) | table | | --peer-kind | string | direct or group | direct | | --sender-id | string | sender id of the sample (selects sender overlays) | - |

Examples

dewee decisions test support-bot --message "ok thanks" --peer-kind group
  dewee decisions test support-bot --message "refund?" --file DECISIONS.md --json

dewee decisions validate

Check a decision policy document without storing it

Check a DECISIONS.md document locally with the parser this build ships, the same one the gateway applies on write. Nothing is sent or stored. An invalid document lists every issue and exits with VALIDATION_ERROR.

dewee decisions validate --file <DECISIONS.md|-> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --file | string | DECISIONS.md file, or - for stdin (required) | - | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee decisions validate --file DECISIONS.md --json

dewee doctor

Check system environment and configuration health

dewee doctor

dewee files

Browse and manage workspace file storage

Browse and manage files under the tenant-scoped workspace storage directory (the same tree served by the Runtime Gateway Dashboard and Customer Control Plane Storage pages).

Upload, delete, and move require an admin-scoped gateway token.

dewee files

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee files delete

Delete a file or directory from storage

dewee files delete <path> --yes [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --yes | bool | confirm deletion | false |

dewee files get

Get (read or download) a file from storage

dewee files get <path> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --force | bool | overwrite —out if the local file already exists | false | | --out | string | save file content to this local path instead of printing it | - |

dewee files list

List files and directories in storage

dewee files list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --depth | int | maximum depth to walk (1-20) | 3 | | --path | string | sub path to scope the listing | - |

dewee files move

Move or rename a file within storage

dewee files move --from <path> --to <path> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --from | string | source path | - | | --to | string | destination path | - |

dewee files size

Show total storage size for the tenant workspace

dewee files size

dewee files upload

Upload a local file into storage

dewee files upload --file <local-file> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --file | string | local file to upload | - | | --path | string | destination sub path (directory) in storage | - |

dewee fleet

Manage the home-worker fleet and workspace placements

Operator control-plane for the shared-SaaS home-worker fleet.

Authenticates with the gateway token and requires master scope; the server keeps the HMAC provisioning secret. Placement itself stays server-side (allocate/activate/release happen automatically); these commands cover operator visibility and the audited super-admin moves.

dewee fleet

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

dewee fleet assignment

Inspect and migrate workspace placements

dewee fleet assignment

dewee fleet assignment migrate

Move a workspace to a new home worker (audited super-admin action)

dewee fleet assignment migrate [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --actor | string | operator identity recorded in the audit trail | - | | --destination | string | destination worker key | - | | --dry-run | bool | print the planned migration without executing it | false | | --expected-version | int64 | current assignment version to fence a lost update | 0 | | --reason | string | audited reason for the migration | - | | --source | string | placement source (e.g. dewee-app) | - | | --workspace | string | external workspace id | - | | --yes | bool | skip the interactive confirmation | false |

dewee fleet assignment resolve

Resolve the active home-worker route for a workspace

dewee fleet assignment resolve [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --source | string | placement source (e.g. dewee-app) | - | | --workspace | string | external workspace id | - |

dewee fleet worker

Inspect and manage fleet workers

dewee fleet worker

dewee fleet worker create

Register a new fleet worker

dewee fleet worker create [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --actor | string | operator identity recorded in the audit trail | - | | --display-name | string | human-readable worker name | - | | --endpoint-ref | string | environment-scoped internal endpoint reference | - | | --max-workspaces | int | maximum paid workspaces the worker hosts | 0 | | --worker-key | string | unique worker key (lowercase letters, digits, hyphens) | - |

dewee fleet worker list

List fleet workers with capacity and health

dewee fleet worker list

dewee fleet worker status

Set a fleet worker status (registered|active|draining|disabled)

dewee fleet worker status <worker-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --actor | string | operator identity recorded in the audit trail | - | | --status | string | new status: registered|active|draining|disabled | - |

dewee fleet-worker

Run the standalone fleet package worker

dewee fleet-worker

dewee fleet-worker run

Pull and reconcile exact fleet package jobs

dewee fleet-worker run

dewee heartbeat

Inspect and manage an agent’s heartbeat schedule

dewee heartbeat

dewee heartbeat get

Show an agent’s heartbeat configuration

dewee heartbeat get <agentId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

Examples

dewee heartbeat get <agentId>

dewee heartbeat logs

List recent heartbeat runs

dewee heartbeat logs <agentId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --limit | int | max runs to return | 20 |

Examples

dewee heartbeat logs <agentId> --limit 20

dewee heartbeat set

Update an agent’s heartbeat configuration

dewee heartbeat set <agentId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --enabled | bool | enable the heartbeat | false | | --interval-sec | int | interval in seconds (minimum 300) | 0 | | --json | bool | output as JSON | false | | --model | string | model for heartbeat runs | - | | --prompt | string | heartbeat prompt | - | | --timezone | string | timezone for active hours | - |

Examples

dewee heartbeat set <agentId> --enabled --interval-sec 600 --prompt "Check the queue"

dewee heartbeat targets

List an agent’s heartbeat delivery targets

dewee heartbeat targets <agentId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

Examples

dewee heartbeat targets <agentId>

dewee heartbeat test

Dispatch a heartbeat run now

dewee heartbeat test <agentId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

Examples

dewee heartbeat test <agentId>

dewee heartbeat toggle

Enable or disable an agent’s heartbeat

dewee heartbeat toggle <agentId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --enabled | bool | desired enabled state | false | | --json | bool | output as JSON | false |

Examples

dewee heartbeat toggle <agentId> --enabled=false

dewee hooks

Manage agent hook access (requires running gateway)

dewee hooks

dewee hooks access

Manage who may use, edit or manage a hook

Manage who may use, edit or manage a hook.

Grants are stored by the gateway in the caller’s tenant (/v1/resource-grants/hook). Levels: agents: use (the hook runs for the agent); people: edit, manage. These are resource access grants, unrelated to the commercial dewee admin access-grants.

dewee hooks access

dewee hooks access activity

Show grant changes, denials and uses of a hook, newest first

Show one page of the resource’s activity feed. —type filters grant changes, runtime denials or uses; pass the printed next cursor as —cursor (with the same —type) for the next page.

dewee hooks access activity <hook-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --cursor | string | next_cursor of the previous page | - | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --limit | int | events per page, 1..200 | 50 | | -o, --output | string | output format (table|json) | table | | --type | string | only this kind of event: grant, denied or use (default all) | - |

Examples

dewee hooks access activity 0b6c1f9e-4a57-4c1d-9a3e-2f8d7c6b5a40 --type denied --limit 20 -o json

dewee hooks access grant

Grant agents or people access to a hook

Grant each named principal exactly —level on the hook. Levels: agents: use (the hook runs for the agent); people: edit, manage. Re-granting the level a principal already holds changes nothing. When some principals cannot be granted the others still are; each failure is listed and the command exits with PARTIAL_FAILURE. When none could be granted it exits with the failure’s own class instead: NOT_FOUND for a principal outside the workspace, CONFLICT for the last admin, VALIDATION_ERROR otherwise.

dewee hooks access grant <hook-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key (repeatable) | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --level | string | level to grant: use, edit, manage, admin | use | | -o, --output | string | output format (table|json) | table | | --user | stringSlice | user id of a workspace member (repeatable) | [] |

Examples

dewee hooks access grant 0b6c1f9e-4a57-4c1d-9a3e-2f8d7c6b5a40 --agent support-bot --level use

dewee hooks access list

List who holds access to a hook

dewee hooks access list <hook-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee hooks access list 0b6c1f9e-4a57-4c1d-9a3e-2f8d7c6b5a40 -o json

dewee hooks access revoke

Remove a principal’s access to a hook

Remove a principal’s grant. —yes (or —dry-run to preview) is required: the command never prompts. Revoking a grant the principal does not hold changes nothing.

dewee hooks access revoke <hook-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table | | --user | stringSlice | user id of a workspace member | [] | | --yes | bool | confirm the revocation (required unless —dry-run) | false |

Examples

dewee hooks access revoke 0b6c1f9e-4a57-4c1d-9a3e-2f8d7c6b5a40 --agent support-bot --yes

dewee hooks access set-level

Change the level a principal holds on a hook

Raise or lower an existing grant. Levels: agents: use (the hook runs for the agent); people: edit, manage. A principal without a grant is NOT_FOUND; use grant first.

dewee hooks access set-level <hook-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --level | string | new level: use, edit, manage, admin | - | | -o, --output | string | output format (table|json) | table | | --user | stringSlice | user id of a workspace member | [] |

Examples

dewee hooks access set-level 0b6c1f9e-4a57-4c1d-9a3e-2f8d7c6b5a40 --user alice --level manage

dewee identity

Set up, inspect, test and revoke trusted user identity (Dewee Connect)

Manage the identity integrator surface of the current tenant: partner applications (setup), readiness (status), Developer Test Mode (test), revocation (revoke) and read-only diagnostics of chat-account links and principals. Requires a tenant admin.

dewee identity

dewee identity links

Inspect chat-account links (bindings) of identity principals

dewee identity links

dewee identity links get

Show one chat-account link

dewee identity links get <binding-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee identity links get 0199a571-6ad2-78be-8caa-43ab429f4430 -o json

dewee identity links list

List chat-account links of the tenant, newest first

dewee identity links list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --app | string | only links of this application id | - | | --limit | int | page size (default 50, at most 200) | 0 | | --offset | int | rows to skip | 0 | | -o, --output | string | output format (table|json) | table | | --principal | string | only links of this principal id | - | | --status | string | linked or revoked | - |

Examples

dewee identity links list --principal 0199a571-6ad2-78be-8caa-43ab429f4430 -o json
  dewee identity links list --status revoked

dewee identity principals

Inspect verified partner users (principals)

dewee identity principals

dewee identity principals get

Show one principal

dewee identity principals get <principal-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee identity principals get 0199a571-6ad2-78be-8caa-43ab429f4430 -o json

dewee identity principals list

List principals of the tenant, oldest first

List principals. —subject-file filters by the partner’s user id, read from a file (”-” reads stdin) so the subject never lands in shell history.

dewee identity principals list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --app | string | only principals of this application id | - | | --limit | int | page size (default 50, at most 200) | 0 | | --offset | int | rows to skip | 0 | | -o, --output | string | output format (table|json) | table | | --subject-file | string | file holding the partner user id to find (”-” reads stdin) | - |

Examples

dewee identity principals list --app 0199a571-6ad2-78be-8caa-43ab429f4430 -o json

dewee identity revoke

Unlink a chat account, or log out, suspend or delete a principal

Revoke trusted identity: —binding <id> unlink one chat account (the sender becomes unlinked) —principal <id> —logout revoke every session of the principal —principal <id> —suspend suspend the principal (sessions revoked; reactivate via the API) —principal <id> —delete delete the principal and unlink all its chat accounts Every change bumps the grant version, so cached access stops at once. —yes is required (the command never prompts); —dry-run prints the request instead.

dewee identity revoke (--binding <id> | --principal <id> --logout|--suspend|--delete) [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --binding | string | link (binding) id to unlink | - | | --delete | bool | delete —principal and unlink its chat accounts | false | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --logout | bool | revoke every session of —principal | false | | -o, --output | string | output format (table|json) | table | | --principal | string | principal id to log out, suspend or delete | - | | --suspend | bool | suspend —principal | false | | --yes | bool | confirm the revocation (required unless —dry-run) | false |

Examples

dewee identity revoke --binding 0199a571-6ad2-78be-8caa-43ab429f4430 --yes
  dewee identity revoke --principal 0199a571-6ad2-78be-8caa-43ab429f4430 --suspend --yes -o json
  dewee identity revoke --principal 0199a571-6ad2-78be-8caa-43ab429f4430 --delete --dry-run

dewee identity setup

Create, update or rotate the secret of a partner application

Without —app, create a partner application; with —app, update the flags given, or with —rotate-secret issue a new hmac assertion secret (the old one stays valid for —overlap-seconds). Only one replaced secret is kept, so while the previous rotation’s overlap is still running the gateway refuses another one (CONFLICT, exit code 6); —drop-previous-secret rotates anyway and stops that older secret at once. The audience is issued by Dewee and shown in the result. —issuer, —jwks-url and —oidc-client-id are refused as a conflict once the application has users; create a new application for a new identity provider.

Secrets issued by create and rotate are shown once. —secret-file writes them to a new file with mode 0600 and keeps them out of stdout; JSON output requires it, so a secret never reaches a JSON consumer or a log. The OIDC client secret is read only from stdin, a file or an environment variable, never from a flag value.

dewee identity setup [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --app | string | application id to update (omit to create) | - | | --connect-start-url | string | partner page that starts a Connect login | - | | --drop-previous-secret | bool | with —rotate-secret, rotate even while the previous rotation’s overlap is running (its old secret stops at once) | false | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --issuer | string | partner issuer (iss); an https URL for oidc | - | | --jwks-url | string | https URL of the partner’s key set (jwks mode) | - | | --mode | string | assertion mode at create: hmac (default), jwks or oidc | - | | --name | string | application name (unique in the tenant) | - | | --oidc-client-id | string | OAuth client id (oidc mode) | - | | --oidc-client-secret-env | string | read the OAuth client secret from this environment variable | - | | --oidc-client-secret-file | string | read the OAuth client secret from a file (”-” reads stdin) | - | | --oidc-client-secret-stdin | bool | read the OAuth client secret from stdin | false | | -o, --output | string | output format (table|json) | table | | --overlap-seconds | int64 | seconds the replaced secret stays valid (0-86400) | 3600 | | --return-origin | stringArray | allowed return origin (repeat; https, or http on localhost) | [] | | --rotate-secret | bool | issue a new hmac assertion secret (with —app) | false | | --secret-file | string | write issued secrets to this new file (mode 0600) instead of stdout | - | | --status | string | active or disabled (update only) | - | | --test-mode | bool | Developer Test Mode: simulated users only (refused once real users exist) | false |

Examples

dewee identity setup --name acme --issuer https://acme.example --return-origin https://app.acme.example --secret-file ./acme-secrets.json -o json
  dewee identity setup --name sandbox --issuer acme-dev --test-mode --secret-file ./sandbox.json
  dewee identity setup --app 0199a571-6ad2-78be-8caa-43ab429f4430 --status disabled
  dewee identity setup --app 0199a571-6ad2-78be-8caa-43ab429f4430 --rotate-secret --overlap-seconds 3600 --secret-file ./rotated.json

dewee identity status

Show identity readiness: switches, applications, secrets, key sets and refusals

Show the identity readiness report of the tenant: whether session exchange and Developer Test Mode are on, the invalidation mode, and per application its secret health, key set reachability and principal, link, session and pending-link counts. —app limits the report to one application.

dewee identity status [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --app | string | only this application id | - | | -o, --output | string | output format (table|json) | table |

Examples

dewee identity status
  dewee identity status --app 0199a571-6ad2-78be-8caa-43ab429f4430 -o json

dewee identity test

Run Developer Test Mode scenarios against a test-mode application

Run canned identity checks with simulated users and the simulated identity_test channel: link_happy, link_deny, revoke, cross_user, webhook (all by default). Each scenario first resets the application’s test users. The application must be in test mode and the gateway must run with GOCLAW_IDENTITY_TEST_MODE_ENABLED on a development (dev) build.

The report is printed even when a step fails; a failed step exits 1 with PARTIAL_FAILURE, so a CI job fails on it.

dewee identity test --app <id> --agent <id-or-key> [--scenario <name>...] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent id or key the simulated users talk to (required) | - | | --app | string | test-mode application id (required) | - | | -o, --output | string | output format (table|json) | table | | --scenario | stringArray | scenario to run (repeat; default all) | [] |

Examples

dewee identity test --app 0199a571-6ad2-78be-8caa-43ab429f4430 --agent support
  dewee identity test --app 0199a571-6ad2-78be-8caa-43ab429f4430 --agent support --scenario revoke -o json

dewee import-export

Preview and apply logical agent/team package export and import

Preview and apply logical package import/export for agents, teams, skills and MCP servers.

These operate on logical workspace resources. Host filesystem paths are never accepted — the Gateway rejects them.

dewee import-export

dewee import-export export

Download the export archive for a resource kind

Download the export archive the Gateway builds for a resource kind.

Agents and teams are exported one resource at a time (—id is required); skills, MCP servers and LLM providers are exported workspace-wide. Provider archives never carry API keys or other credentials: they are omitted and listed as needs_credentials in the manifest. The file is saved under the name the Gateway proposes unless —output is given; pass —output - to write the archive to stdout.

dewee import-export export --kind <agents|teams|skills|mcp|providers> [--id <resourceId>] [--output <path>|-] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --force | bool | overwrite —output if the file already exists | false | | --id | string | resource ID (required for agents and teams) | - | | --json | bool | print a JSON summary of the saved file | false | | --kind | string | resource kind (agents|teams|skills|mcp|providers) | - | | -o, --output | string | file to save the archive to, or - for stdout | - |

Examples

dewee import-export export --kind agents --id <agentId>
  dewee import-export export --kind skills --output ./skills.tar.gz
  dewee import-export export --kind mcp --output - > mcp.tar.gz
  dewee import-export export --kind providers --output ./providers.tar.gz

dewee import-export import

Apply an import for a resource kind from an exported archive

Without —into, the archive creates new resources; an agent whose key is already taken is imported under a suffixed key.

With —into (agents only), the archive is merged into an existing agent, overwriting the selected sections of its data. —include limits the merge to a comma-separated list of sections (context_files, memory, knowledge_graph, cron, user_profiles, user_overrides, workspace, team, episodic, evolution, vault, decision_policy); without it every section is merged. The merge asks for confirmation first: pass —yes to skip it. Without a terminal and without —yes the command fails before uploading anything; —json does not imply consent. There is no merge dry-run: import-export preview --file describes a new-agent import, not a merge. A merge is not retried automatically and has no rollback: after a transport or server error, check the agent before running it again.

—conflict (providers only) decides what happens to a provider whose name already exists. Provider imports never carry credentials: a provider that needs an API key or OAuth login arrives disabled until it is re-entered. When any provider is rejected the command reports each item and exits with PARTIAL_FAILURE.

dewee import-export import --kind <agents|teams|skills|mcp|providers> --file <archive> [--conflict <skip|rename|replace>] [--into <agentId|agentKey> [--include <sections>] [--yes]] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --conflict | string | how an existing resource with the same name is handled (skip|rename|replace; default skip). Only —kind providers reads resource archives with conflict strategies | - | | --file | string | archive to import (.tar.gz or .zip) — required | - | | --include | string | comma-separated sections to merge (requires —into; default: all sections) | - | | --into | string | merge the archive into this existing agent (ID or key) instead of creating a new one; —kind agents only | - | | --json | bool | output as JSON | false | | --kind | string | resource kind (agents|teams|skills|mcp|providers) | - | | --yes | bool | merge without a confirmation prompt (requires —into) | false |

Examples

dewee import-export import --kind agents --file ./agent-export.tar.gz
  dewee import-export import --kind agents --file ./agent-export.tar.gz --into writer
  dewee import-export import --kind agents --file ./agent-export.tar.gz --into writer --include memory,workspace --yes --json
  dewee import-export import --kind providers --file ./providers.tar.gz --conflict replace

dewee import-export preview

Preview an export, or dry-run an import archive, without applying it

dewee import-export preview --kind <agents|teams|skills|mcp|providers> [--id <resourceId>] [--file <archive>] [--conflict <skip|rename|replace>] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --conflict | string | how an existing resource with the same name is handled (skip|rename|replace; default skip). Only —kind providers reads resource archives with conflict strategies | - | | --file | string | archive to dry-run import (.tar.gz or .zip); when set, previews an import instead of an export | - | | --id | string | resource ID for an export preview (not combinable with —file) | - | | --json | bool | output as JSON | false | | --kind | string | resource kind (agents|teams|skills|mcp|providers) | - |

Examples

dewee import-export preview --kind agents --id <agentId>
  dewee import-export preview --kind skills --file ./skills-export.tar.gz
  dewee import-export preview --kind providers --file ./providers.tar.gz --conflict rename

dewee kg

Inspect and manage agent knowledge graph data

Aliases: knowledge-graph

dewee kg

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee kg dedup

Manage KG dedup candidates

dewee kg dedup

dewee kg dedup dismiss

Dismiss a KG dedup candidate

dewee kg dedup dismiss --agent <agent> <candidate-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --user | string | user ID for scoped KG | - |

dewee kg dedup list

List KG dedup candidates

dewee kg dedup list --agent <agent> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --limit | int | maximum candidates | 50 | | --user | string | user ID for scoped KG | - |

dewee kg dedup scan

Scan KG entities for duplicates

dewee kg dedup scan --agent <agent> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --limit | int | maximum scan pairs | 100 | | --threshold | float64 | similarity threshold | 0.9 | | --user | string | user ID for scoped KG | - |

dewee kg entities

List or search KG entities

dewee kg entities --agent <agent> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --limit | int | page size | 50 | | --offset | int | pagination offset | 0 | | -q, --query | string | search query | - | | --type | string | entity type filter | - | | --user | string | user ID for scoped KG | - |

dewee kg entity

Get one KG entity with relations

dewee kg entity --agent <agent> <entity-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --user | string | user ID for scoped KG | - |

dewee kg extract

Extract KG entities from text

dewee kg extract --agent <agent> (--file <file>|--text <text>) --provider <provider> --model <model> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --file | string | text file to extract | - | | --min-confidence | float64 | minimum extraction confidence | 0.75 | | --model | string | model name | - | | --provider | string | provider name | - | | --text | string | inline text to extract | - | | --user | string | user ID for scoped KG | - |

dewee kg graph

Show KG graph

dewee kg graph --agent <agent> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --limit | int | maximum entities | 200 | | --user | string | user ID for scoped KG | - |

dewee kg graph compact

Show compact KG graph

dewee kg graph compact --agent <agent> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --limit | int | maximum nodes | 2000 | | --user | string | user ID for scoped KG | - |

dewee kg merge

Merge duplicate KG entities

dewee kg merge --agent <agent> --target <entity-id> --source <entity-id> --yes [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --source | string | source entity ID | - | | --target | string | target entity ID | - | | --user | string | user ID for scoped KG | - | | --yes | bool | confirm merge | false |

dewee kg stats

Show KG statistics

dewee kg stats --agent <agent> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --user | string | user ID for scoped KG | - |

dewee kg traverse

Traverse KG relationships

dewee kg traverse --agent <agent> --entity <entity-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --depth | int | maximum traversal depth | 2 | | --entity | string | start entity ID | - | | --user | string | user ID for scoped KG | - |

dewee license

Show, activate or release workspace licences

Show, activate or release the licences of this runtime.

When channels are licensed per workspace (self-install builds), every workspace needs its own active licence before it can connect messaging channels. Agents, providers and chat keep working without one.

Licence commands act for the whole runtime, so they run in master scope: do not combine them with —tenant, name the workspace with —workspace instead. The licence key is read only from a file or stdin, never from an argument.

dewee license

dewee license activate

Activate a licence key for one workspace

dewee license activate --workspace ID (--key-file PATH | --key-stdin) [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --key-file | string | read the licence key from this file | - | | --key-stdin | bool | read the licence key from stdin | false | | -o, --output | string | output format (table|json) | table | | --workspace | string | workspace ID or slug (required) | - |

dewee license deactivate

Release a workspace’s licence so the key can be used elsewhere

dewee license deactivate --workspace ID [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table | | --workspace | string | workspace ID or slug (required) | - | | -y, --yes | bool | skip the confirmation prompt | false |

dewee license status

Show licence status (one workspace with —workspace, otherwise all)

dewee license status [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table | | --workspace | string | workspace ID or slug | - |

dewee mcp

Manage MCP servers and access grants

Manage MCP servers (create, update, delete), tools, connection tests, reloads, and access grants.

Public MCP endpoint for this workspace: “mcp status” shows the endpoint, limits and exported tools; “mcp activate” / “mcp deactivate” turn workspace access on or off (workspace admin); “mcp test” without a server argument tests a public MCP key.

Authentication uses —token or these environment variables: GOCLAW_GATEWAY_TOKEN bearer token for operator API calls GOCLAW_GATEWAY_URL gateway base URL GOCLAW_SERVER gateway base URL alias

dewee mcp

dewee mcp access

Manage MCP server access grants

Manage MCP server access grants.

Grants are stored by the gateway in the caller’s tenant (/v1/resource-grants/mcp_server). Levels: agents: use (tool allow/deny stays on mcp grant agent); people: use, edit, manage. These are resource access grants, unrelated to the commercial dewee admin access-grants.

dewee mcp access

dewee mcp access activity

Show grant changes, denials and uses of an MCP server, newest first

Show one page of the resource’s activity feed. —type filters grant changes, runtime denials or uses; pass the printed next cursor as —cursor (with the same —type) for the next page.

dewee mcp access activity <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --cursor | string | next_cursor of the previous page | - | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --limit | int | events per page, 1..200 | 50 | | -o, --output | string | output format (table|json) | table | | --type | string | only this kind of event: grant, denied or use (default all) | - |

Examples

dewee mcp access activity docs --type denied --limit 20 -o json

dewee mcp access agent

List MCP grants visible to an agent

dewee mcp access agent <agent-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp access get

List access grants for an MCP server

dewee mcp access get <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp access grant

Grant agents or people access to an MCP server

Grant each named principal exactly —level on the MCP server. Levels: agents: use (tool allow/deny stays on mcp grant agent); people: use, edit, manage. Re-granting the level a principal already holds changes nothing. When some principals cannot be granted the others still are; each failure is listed and the command exits with PARTIAL_FAILURE. When none could be granted it exits with the failure’s own class instead: NOT_FOUND for a principal outside the workspace, CONFLICT for the last admin, VALIDATION_ERROR otherwise.

dewee mcp access grant <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key (repeatable) | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --level | string | level to grant: use, edit, manage, admin | use | | -o, --output | string | output format (table|json) | table | | --user | stringSlice | user id of a workspace member (repeatable) | [] |

Examples

dewee mcp access grant docs --agent support-bot --level use

dewee mcp access list

List who holds access to an MCP server

dewee mcp access list <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee mcp access list docs -o json

dewee mcp access revoke

Remove a principal’s access to an MCP server

Remove a principal’s grant. —yes (or —dry-run to preview) is required: the command never prompts. Revoking a grant the principal does not hold changes nothing.

dewee mcp access revoke <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table | | --user | stringSlice | user id of a workspace member | [] | | --yes | bool | confirm the revocation (required unless —dry-run) | false |

Examples

dewee mcp access revoke docs --agent support-bot --yes

dewee mcp access set-level

Change the level a principal holds on an MCP server

Raise or lower an existing grant. Levels: agents: use (tool allow/deny stays on mcp grant agent); people: use, edit, manage. A principal without a grant is NOT_FOUND; use grant first.

dewee mcp access set-level <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --level | string | new level: use, edit, manage, admin | - | | -o, --output | string | output format (table|json) | table | | --user | stringSlice | user id of a workspace member | [] |

Examples

dewee mcp access set-level docs --user alice --level manage

dewee mcp activate

Turn public MCP access on for this workspace

Turn public MCP access on for this workspace. Requires a workspace owner or admin. Asks for confirmation on a terminal; pass —yes to skip it (required without a TTY). —dry-run prints the request without sending it.

dewee mcp activate [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output as JSON | false | | --yes | bool | skip the confirmation prompt | false |

dewee mcp connect-config

Render client configuration for connecting an external MCP client to this Dewee

Render ready-to-merge configuration that points an external MCP client at this Dewee instance’s public MCP endpoint.

The endpoint is <gateway>/mcp/server, not /mcp/bridge (the internal Claude CLI bridge) and not /v1/mcp/servers (Dewee acting as a client of somebody else’s MCP server). The older bare <gateway>/mcp path still serves MCP clients but is deprecated; re-run this command to move a client to the canonical endpoint.

This command NEVER renders a credential value. Every snippet references the environment variable DEWEE_MCP_TOKEN and lets the client expand it, because an MCP API key is a live internet-facing secret and embedding it in a config file or terminal scrollback leaks it. Export it once instead:

export DEWEE_MCP_TOKEN=‘<mcp-scoped api key>’

Create that key with an explicit MCP scope and an owner, for example:

dewee api-keys create —name “laptop mcp”
—scopes mcp.tools.read —owner-id “$USER”

The gateway serves the endpoint only when public MCP is enabled (tools.mcp.public.enabled or GOCLAW_MCP_PUBLIC_ENABLED). If the endpoint is disabled the client will receive a 404.

The gateway base URL comes from —server / DEWEE_SERVER / GOCLAW_SERVER / GOCLAW_GATEWAY_URL, or the local configuration when none is set.

dewee mcp connect-config --client <claude|cursor|vscode|gemini|generic> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | optional Dewee agent selector to send as X-Dewee-Agent (resolved inside your tenant) | - | | --client | string | target client: claude|cursor|gemini|generic|vscode (required) | - | | --json | bool | output as JSON | false |

dewee mcp create

Create an MCP server non-interactively

Create an MCP server from flags, with no prompts.

stdio servers need —command (and —args); sse and streamable-http servers need —url. The API key is read from stdin, a file or an environment variable, never from a flag value. The name is the natural key: creating a name that already exists fails with CONFLICT (exit 6) instead of creating a duplicate; use dewee mcp update to change it.

dewee mcp create --name <name> --transport <transport> (--command <cmd> | --url <url>) [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --api-key-env | string | read the API key from the named environment variable | - | | --api-key-file | string | read the API key from a file (”-” reads stdin) | - | | --api-key-stdin | bool | read the API key from stdin | false | | --args | stringArray | command argument (stdio transport; repeat for each argument) | [] | | --command | string | command to launch (stdio transport) | - | | --display-name | string | human-readable server name | - | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --enabled | bool | enable the server | true | | --headers-file | string | JSON object file of HTTP headers sent to the server (”-” reads stdin) | - | | --identity-app | string | partner application id the principal identity scope serves | - | | --identity-scope | string | identity scope: none, or principal (serve only verified users of —identity-app; needs trusted user context) | - | | --name | string | server name (a slug: lowercase letters, digits and hyphens) | - | | -o, --output | string | output format (table|json) | table | | --timeout-sec | int | tool call timeout in seconds (1-600) | 0 | | --transport | string | transport: stdio, sse, streamable-http | - | | --url | string | server URL (sse and streamable-http transports) | - |

Examples

dewee mcp create --name fs --transport stdio --command npx --args -y --args @modelcontextprotocol/server-filesystem -o json
  printf '%s' "$DOCS_MCP_KEY" | dewee mcp create --name docs --transport streamable-http --url https://mcp.example.com/mcp --api-key-stdin -o json

dewee mcp deactivate

Turn public MCP access off for this workspace

Turn public MCP access off for this workspace. Requires a workspace owner or admin. Asks for confirmation on a terminal; pass —yes to skip it (required without a TTY). —dry-run prints the request without sending it.

dewee mcp deactivate [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output as JSON | false | | --yes | bool | skip the confirmation prompt | false |

dewee mcp delete

Delete an MCP server

Delete an MCP server and its grants. —yes is required: the command never prompts. A non-admin needs a manage grant on the server.

dewee mcp delete <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table | | --yes | bool | confirm the deletion (required) | false |

Examples

dewee mcp delete docs --yes -o json

dewee mcp get

Get an MCP server

dewee mcp get <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp grant

Grant MCP access

dewee mcp grant

dewee mcp grant agent

Grant an agent access to an MCP server

dewee mcp grant agent <server-id-or-name> <agent-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp list

List MCP servers

dewee mcp list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp oauth

Manage MCP server OAuth configuration and lifecycle

dewee mcp oauth

dewee mcp oauth config

Get or update redacted MCP OAuth config

dewee mcp oauth config <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --clear-client-secret | bool | clear stored client secret | false | | --client-id | string | OAuth client ID | - | | --client-secret | string | write-only client secret (omit to preserve) | - | | --json | bool | output as JSON | false | | --registration-mode | string | pre_registered|client_id_metadata|dynamic | - | | --scope | stringSlice | requested OAuth scope (repeatable) | [] | | --write | bool | force a write even when only optional flags are empty | false |

dewee mcp oauth disconnect

Disconnect MCP OAuth credentials while preserving registration config

dewee mcp oauth disconnect <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp oauth start

Start MCP OAuth authorization for a server

dewee mcp oauth start <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp oauth status

Show MCP OAuth status for a server

dewee mcp oauth status <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp oauth test

Test saved MCP server connection using runtime OAuth credentials

dewee mcp oauth test <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp reload

Reload an MCP server connection

dewee mcp reload <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp revoke

Revoke MCP access

dewee mcp revoke

dewee mcp revoke agent

Revoke an agent’s MCP server access

dewee mcp revoke agent <server-id-or-name> <agent-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp safe-context

Approve MCP tools as safe read-only context

Approve specific MCP tools as safe read-only context.

An approved tool may run before an agent has created its session-task ledger, so the agent can load rules or playbooks in its first batch of tool calls. Approval is per server and exact tool name, applies only to this tenant, and is cleared when the server’s URL, transport, command, args, env or headers change. A server’s own readOnlyHint is never trusted for this. Changing an approval requires a tenant owner or admin.

dewee mcp safe-context

dewee mcp safe-context disable

Withdraw a tool’s safe-context approval

Withdraw a tool’s safe-context approval.

<tool-name> is the tool’s name as the MCP server reports it (see “mcp tools”), without the mcp_<prefix>__ part an agent sees. The change is audited.

dewee mcp safe-context disable <server-id-or-name> <tool-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp safe-context enable

Approve a tool as safe read-only context

Approve a tool as safe read-only context.

<tool-name> is the tool’s name as the MCP server reports it (see “mcp tools”), without the mcp_<prefix>__ part an agent sees. The change is audited.

dewee mcp safe-context enable <server-id-or-name> <tool-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp safe-context list

List the tools of an MCP server approved as safe context

dewee mcp safe-context list <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp status

Show public MCP endpoint status for this workspace

Show whether this instance serves the public MCP endpoint, whether public MCP access is active for the authenticated workspace, the endpoint URL, the agent header, the effective limits and how many tools the public export policy exposes.

dewee mcp status [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp test

Test an MCP server connection, or a public MCP key when no server is given

With a server argument, test the connection to that configured MCP server.

Without an argument, test a public MCP key for this workspace: initialize, tools/list and, with —call-tool, one call of an allow-listed exported read tool with known harmless test arguments (never a write tool, a web search or a paid call), and only on an endpoint that identifies itself as dewee’s public MCP server; otherwise the call is skipped and the check still passes at tools_list, with tool_call_skipped set (and, with —remote, tool_call_skip_reason: no_safe_read_tool or not_dewee_endpoint). The key is read from DEWEE_MCP_TOKEN or, with —mcp-token-stdin, from stdin; it is never accepted as an argument. By default the gateway runs the check in-process; —remote runs the handshake from this machine against the advertised endpoint URL, which must be on the same origin as the configured gateway. —endpoint <url> names another destination explicitly (a warning is printed when it is a different origin). A failed check exits non-zero: key_rejected 3, workspace_inactive/missing_mcp_scope/owner_binding 4, agent_not_found/endpoint_disabled 5, rate_limited/tool_error/internal 1.

dewee mcp test [server-id-or-name] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent key sent as the X-Dewee-Agent header (public MCP test only) | - | | --call-tool | bool | also call one exported read tool that is safe to test; skipped, not failed, when none is (public MCP test only) | false | | --endpoint | string | with —remote, send the key to this endpoint URL instead of the advertised one, even on another origin than the gateway (public MCP test only) | - | | --json | bool | output as JSON | false | | --mcp-token-stdin | bool | read the MCP key from stdin instead of DEWEE_MCP_TOKEN (public MCP test only) | false | | --remote | bool | run the handshake from this machine against the advertised endpoint URL instead of inside the gateway (public MCP test only) | false |

dewee mcp tools

List tools exposed by an MCP server

dewee mcp tools <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee mcp update

Update an MCP server

Update an MCP server by id or name, sending only the given fields.

The API key and headers are read from stdin, a file or an environment variable. A non-admin with an edit grant may change —display-name and —timeout-sec; a manage grant also allows —enabled. Every other field needs an admin.

dewee mcp update <server-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --api-key-env | string | read the API key from the named environment variable | - | | --api-key-file | string | read the API key from a file (”-” reads stdin) | - | | --api-key-stdin | bool | read the API key from stdin | false | | --args | stringArray | command argument (stdio transport; repeat for each argument) | [] | | --command | string | command to launch (stdio transport) | - | | --display-name | string | human-readable server name | - | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --enabled | bool | enable the server | true | | --headers-file | string | JSON object file of HTTP headers sent to the server (”-” reads stdin) | - | | --identity-app | string | partner application id the principal identity scope serves | - | | --identity-scope | string | identity scope: none, or principal (serve only verified users of —identity-app; needs trusted user context) | - | | --name | string | server name (a slug: lowercase letters, digits and hyphens) | - | | -o, --output | string | output format (table|json) | table | | --replay-trust-read-only | bool | let optimizer replay call this server’s tools that declare readOnlyHint (admin opt-in; withdrawn when the URL or command changes) | false | | --timeout-sec | int | tool call timeout in seconds (1-600) | 0 | | --transport | string | transport: stdio, sse, streamable-http | - | | --url | string | server URL (sse and streamable-http transports) | - |

Examples

dewee mcp update docs --enabled=false -o json
  dewee mcp update docs --display-name "Docs search" --timeout-sec 120
  dewee mcp update docs --api-key-env DOCS_MCP_KEY
  dewee mcp update campus --identity-scope principal --identity-app 0192f0c4-1d2e-7a3b-9c4d-5e6f7a8b9c0d -o json

dewee memory

Inspect and manage agent memory documents

dewee memory

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee memory chunks

List memory chunks for a document

dewee memory chunks --agent <agent-id-or-key> --path <path> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --path | string | document path | - | | --user | string | user ID for scoped memory | - |

dewee memory delete

Delete a memory document

dewee memory delete --agent <agent-id-or-key> <path> --yes [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --user | string | user ID for scoped memory | - | | --yes | bool | confirm deletion | false |

dewee memory facts

Inspect and manage an agent’s memory facts

Memory facts are scoped, versioned statements an agent keeps about users and topics, each with its source. Changes go through the same reconciliation the agent uses.

dewee memory facts

dewee memory facts assert

Assert a fact as an operator (explicit, cited as a manual source)

dewee memory facts assert --agent <agent-id-or-key> --subject <s> --predicate <p> --value <v> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --expires-at | string | RFC 3339 time the fact stops being used | - | | --predicate | string | predicate from the fact registry, e.g. employer | - | | --qualifier | string | optional qualifier that splits a slot | - | | --subject | string | subject, e.g. user or a project name | - | | --user | string | user the fact is about (empty for a shared fact) | - | | --valid-from | string | RFC 3339 time the fact became true (default now) | - | | --value | string | fact value | - |

dewee memory facts delete

Soft-delete one fact (kept for history, no longer used)

dewee memory facts delete --agent <agent-id-or-key> <fact-id> --yes [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --yes | bool | confirm deletion | false |

dewee memory facts forget

Permanently erase a user’s facts or the facts about a subject, history included

dewee memory facts forget --agent <agent-id-or-key> (--user <id> | --subject <s>) --yes [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --subject | string | erase the facts about this subject | - | | --user | string | erase this user’s facts (with —subject: only theirs about it) | - | | --yes | bool | confirm permanent erasure | false |

dewee memory facts get

Show one memory fact with its supersede history and sources

dewee memory facts get --agent <agent-id-or-key> <fact-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - |

dewee memory facts list

List memory facts (current facts unless —status is given)

dewee memory facts list --agent <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --as-of | string | facts in effect at this RFC 3339 time | - | | --limit | int | maximum facts (server caps at 500) | 50 | | --offset | int | facts to skip | 0 | | --predicate | string | only facts with this predicate | - | | -q, --query | string | text search over subject, predicate and value | - | | --status | string | comma-separated statuses (active,disputed,superseded,deleted) or all | - | | --subject | string | only facts about this subject | - | | --user | string | only this user’s facts (an empty value selects shared facts) | - |

dewee memory facts resolve

Accept or reject a disputed fact

dewee memory facts resolve --agent <agent-id-or-key> <fact-id> --action accept|reject [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --action | string | accept or reject | - | | --agent | string | agent UUID or key | - |

dewee memory get

Get one memory document

dewee memory get --agent <agent-id-or-key> <path> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --full | bool | print full content in table output | false | | --user | string | user ID for scoped memory | - |

dewee memory index

Index one memory document

dewee memory index --agent <agent-id-or-key> <path> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --user | string | user ID for scoped memory | - |

dewee memory index-all

Index all memory documents for an agent

dewee memory index-all --agent <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --user | string | user ID for scoped memory | - |

dewee memory list

List memory documents for an agent

dewee memory list --agent <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --user | string | user ID for scoped memory | - |

dewee memory put

Put or update a memory document

dewee memory put --agent <agent-id-or-key> <path> --file <file> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --file | string | file content to store | - | | --user | string | user ID for scoped memory | - |

dewee memory search

Search agent memory

dewee memory search --agent <agent-id-or-key> --query <query> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID or key | - | | --limit | int | maximum results | 20 | | --min-score | float64 | minimum score | 0 | | -q, --query | string | search query | - | | --user | string | user ID for scoped memory | - |

dewee meta

Machine-readable facts about this CLI

dewee meta

dewee meta commands

List every command with its flags and safety properties

List every visible command with its flags and safety properties: whether it changes state, is destructive, prompts, supports JSON output, —dry-run, —yes/—force and idempotent retries, and what it reads from stdin. The JSON form (schema dewee.command-manifest.v1) is derived from the live command tree.

dewee meta commands [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee meta commands -o json
  dewee meta commands

dewee migrate

Database migration management

dewee migrate

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --migrations-dir | string | path to migrations directory (default: ./migrations) | - |

dewee migrate down

Roll back migrations (default: 1 step)

dewee migrate down [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -n, --steps | int | number of steps to roll back | 1 |

dewee migrate drop

Drop all tables (DANGEROUS)

dewee migrate drop

dewee migrate force

Force set migration version (no migration applied)

dewee migrate force <version>

dewee migrate goto

Migrate to a specific version

dewee migrate goto <version>

dewee migrate up

Apply all pending migrations

dewee migrate up

dewee migrate version

Show current migration version

dewee migrate version

dewee onboard

Quick setup — configure database, generate keys, run migrations

dewee onboard

dewee optimize

Inspect optimization evidence and review improvement candidates

Inspect optimization episodes via the Gateway’s /v1/optimization endpoints.

An episode is the redacted evidence record of one terminal agent run: runtime metrics, the tools, skills and retrieval sources used, and the semantic evaluation when one exists. User, session and path identifiers are stored only as per-tenant HMAC hashes. Episodes are written only when the gateway runs with optimizer.enabled; they never change an agent run.

Improvement candidates are proposed agent or skill changes awaiting review; see “dewee optimize candidates —help”. Tenant admins replay a candidate against a frozen regression corpus before deciding; see “dewee optimize corpus —help” and “dewee optimize evaluate —help”. Per-agent and per-skill evolution modes, budgets and locks are in “dewee optimize settings —help”; “dewee optimize promote” applies a candidate now, “dewee optimize rollback” withdraws a canary or undoes a promoted candidate, and “dewee optimize pause|resume” stops and restarts automatic optimization of one target (all human only). “dewee optimize canary” shows a candidate’s canary. “dewee optimize erase-user” removes one user’s optimizer data from the tenant.

dewee optimize

dewee optimize attributions

Show the outcome attributions of one optimization episode

Show the outcome attributions of one optimization episode.

Each participant of the run (skill, skill version, tool, MCP tool, workflow, retrieval source, delegate, model profile) carries a conservative label: participated, likely_helpful, neutral, likely_harmful or unknown. Labels come from deterministic rules over the episode’s semantic evaluation; a run that was not evaluated is unknown. Access is the episode’s: non-admins see only their own episodes.

dewee optimize attributions <episodeId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize attributions <episodeId> --json

dewee optimize canary

Show a candidate’s newest canary: cohorts, metrics and decision

Show the newest canary of a candidate: its traffic share, evidence floor, per-cohort metrics, the decision evidence and the decision reason.

A canary runs the candidate for a deterministic share of sessions while an equal share stays on the live configuration as the baseline. It is promoted, rolled back or ended for insufficient evidence by the decision rule; see docs/21-agent-evolution-and-skill-management.md.

dewee optimize canary <candidateId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize canary <candidateId> --json

dewee optimize candidates

Review improvement candidates (list, get, approve, reject)

Review improvement candidates.

A candidate is a proposed change to an agent or skill, for example a SOUL.md update an agent proposed during a chat. Approving applies the change as one new agent version, but only while the agent is still at the version the candidate was proposed against; otherwise the candidate is marked stale and the command fails with version_conflict. user_memory candidates are proposals only.

dewee optimize candidates

dewee optimize candidates approve

Approve a candidate and apply it as a new agent version (human only)

Approve a candidate: its patch is classified again and applied as one new agent version, only while the agent is still at the candidate’s base version. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it.

dewee optimize candidates approve <candidateId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --note | string | Optional review note (at most 1000 characters) | - | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize candidates approve <candidateId> --note "reviewed the SOUL diff"

dewee optimize candidates get

Show one candidate with its event history

dewee optimize candidates get <candidateId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize candidates get <candidateId> --json

dewee optimize candidates list

List improvement candidates, newest first

dewee optimize candidates list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | Filter by agent id or key | - | | --json | bool | output as JSON | false | | --kind | string | Filter by kind (agent_config|context_file|skill|workflow|hook|user_memory|…) | - | | --limit | int | Maximum candidates to return | 0 | | -o, --output | string | output format (table|json) | table | | --source | string | Filter by source (e.g. self_evolve) | - | | --status | string | Filter by status (proposed|evaluating|approved|promoted|rejected|stale|…) | - | | --target-kind | string | Filter by target kind; same as —kind | - |

Examples

dewee optimize candidates list --agent <agentId> --status proposed --json
  dewee optimize candidates list --kind workflow

dewee optimize candidates reject

Reject an open candidate (human only)

Reject an open candidate; the note is kept on its event history. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it.

dewee optimize candidates reject <candidateId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --note | string | Optional review note (at most 1000 characters) | - | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize candidates reject <candidateId> --note "too broad"

dewee optimize corpus

Manage regression corpora (list, build, get, delete, pin, unpin)

Manage regression corpora (tenant admin only).

A corpus is a frozen, versioned sample of an agent’s past runs, stratified by category (success, failure, correction, edge, long_context, high_cost, delegation, provider_failure). Each case keeps the redacted user turn, a bounded prior context and recorded network tool results, sealed with the tenant key; they are never returned by the API. Building a corpus re-runs every sampled turn once in replay mode to record its tool fixtures, which spends the tenant’s daily replay budget. Corpora expire after 90 days.

Pinned cases are carried into the agent’s next corpus.

dewee optimize corpus

dewee optimize corpus build

Start building a new regression corpus for an agent

Start building a new corpus version from the agent’s semantically evaluated episodes. The freeze runs in the background; poll “dewee optimize corpus get <corpusId>” until its status is frozen or failed. Only one build per agent runs at a time.

dewee optimize corpus build <agentId|agentKey> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --size | int | Number of cases, 1..200 (default 30) | 0 |

Examples

dewee optimize corpus build <agentKey> --size 30 --json

dewee optimize corpus delete

Delete a corpus and its cases

Delete a corpus and its sealed cases. Experiments keep their results; their corpus reference is cleared. —yes is required: the command never prompts.

dewee optimize corpus delete <corpusId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --yes | bool | confirm the deletion (required) | false |

Examples

dewee optimize corpus delete <corpusId> --yes

dewee optimize corpus get

Show a corpus and its cases’ metadata

dewee optimize corpus get <corpusId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize corpus get <corpusId> --json

dewee optimize corpus list

List an agent’s regression corpora, newest first

dewee optimize corpus list <agentId|agentKey> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --limit | int | Maximum corpora to return (default 20) | 0 | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize corpus list <agentKey> --json

dewee optimize corpus pin

Pin a case so the agent’s next corpus carries it forward

dewee optimize corpus pin <corpusId> <caseId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize corpus pin <corpusId> <caseId>

dewee optimize corpus unpin

Unpin a case so the next corpus samples afresh

dewee optimize corpus unpin <corpusId> <caseId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize corpus unpin <corpusId> <caseId>

dewee optimize episodes

List, show and backfill optimization episodes

dewee optimize episodes

dewee optimize episodes backfill

Build episodes for recent terminal traces that have none

Build optimization episodes for the tenant’s terminal agent traces that have none yet, newest first. Tenant admins only. Start with —dry-run: the gateway then only reports the candidate traces. Building is idempotent per (trace, run).

dewee optimize episodes backfill [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | Only traces of this agent UUID | - | | --dry-run | bool | Report candidate traces without building anything | false | | --json | bool | output as JSON | false | | --limit | int | Maximum traces to process, capped at 1000 (default 200) | 0 | | -o, --output | string | output format (table|json) | table | | --since | string | RFC3339 lower bound on trace creation time (default: 7 days ago) | - |

Examples

dewee optimize episodes backfill --since 2026-10-01T00:00:00Z --dry-run --json

dewee optimize episodes get

Show one optimization episode

dewee optimize episodes get <episodeId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize episodes get <episodeId> --json

dewee optimize episodes list

List an agent’s optimization episodes, newest first

List an agent’s optimization episodes, newest first. A non-admin caller sees only episodes of their own runs; tenant admins see every episode of the agent.

dewee optimize episodes list <agentId|agentKey> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --limit | int | Maximum episodes to return, capped at 200 by the gateway (default 50) | 0 | | --offset | int | Episodes to skip, for paging | 0 | | -o, --output | string | output format (table|json) | table | | --semantic-status | string | Filter by semantic status (pending|completed|skipped|failed|disabled|uncovered) | - | | --since | string | RFC3339 lower bound on episode creation time | - |

Examples

dewee optimize episodes list <agentId> --semantic-status completed --limit 20 --json

dewee optimize erase-user

Erase one user’s optimizer data from the tenant

Erase one user’s optimizer data from the current tenant: optimization episodes, attributions, feedback, sealed regression cases and user-memory candidates. Corpora that held the user’s cases are marked failed and active experiments on them end without a verdict, so replay never uses the removed cases. Later episode rebuilds skip the user’s earlier runs. Tenant admin only; repeating it is safe.

—dry-run reports the counts without changing anything. Otherwise —yes is required: the command never prompts. This erases optimizer data only, not the user’s traces, sessions or memory.

dewee optimize erase-user <userId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | report what would be erased without changing anything | false | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --yes | bool | confirm the erasure (required unless —dry-run) | false |

Examples

dewee optimize erase-user <userId> --dry-run
  dewee optimize erase-user <userId> --yes

dewee optimize evaluate

Replay a candidate against a frozen regression corpus (tenant admin)

Queue a replay experiment for a proposed candidate (tenant admin only).

Every case of the corpus (default: the agent’s newest frozen corpus) runs under the agent’s current version and under the candidate, in an isolated replay: network tools answer from recorded fixtures, mutating tools are stubbed, and nothing is written as production data. Runs are scored by the semantic evaluator plus the case assertions, then judged by a lexicographic gate (security, task success, reliability, tokens, latency, cost).

The candidate moves to evaluating; a failed gate or experiment rejects it with the reason. Each run spends the tenant’s daily replay budget. Poll “dewee optimize experiments get <experimentId>” for the result.

dewee optimize evaluate <candidateId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --corpus | string | Corpus id (default: the agent’s newest frozen corpus) | - | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --runs | int | Runs per case and arm, 1..5 (default: 2 below 50 cases, else 1) | 0 |

Examples

dewee optimize evaluate <candidateId> --runs 2 --json

dewee optimize experiments

Show replay experiments

dewee optimize experiments

dewee optimize experiments get

Show one experiment with its gate verdict, aggregates and per-case results

dewee optimize experiments get <experimentId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize experiments get <experimentId> --json

dewee optimize hints

Show the utility of an agent’s hints and context sources per task cluster

Show the utility of an agent’s runtime hints and context sources per task cluster.

A hint (iteration budget, truncation recovery, skill nudge, team progress, sandbox, channel formatting, MCP hint) is resolved in a run when it fired once and the run then completed without a failed outcome; the baseline is the same cluster’s runs in which it did not fire. A context source is resolved when an evaluated run that received it did not fail and its failure mode does not blame context. Clusters below —min-samples are unknown; a rate under 0.5 is low and 0.8 or more is high. Low-utility knobs become rule-authored candidates (see “dewee optimize candidates list”). Aggregates span every user’s runs, so only tenant admins may read them.

dewee optimize hints <agentId|agentKey> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --days | int | Window in days (1-90) | 14 | | --json | bool | output as JSON | false | | --min-samples | int | Samples a cluster needs before it is labelled (1-1000) | 20 | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize hints <agentId> --days 30 --min-samples 10 --json

dewee optimize pause

Pause automatic optimization of an agent or skill (human only)

Pause automatic optimization of an agent or skill (human only).

A paused target is never analyzed or promoted automatically; candidates still wait for a person’s decision. The gateway also refuses customer sessions. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it.

dewee optimize pause <agent|skill> <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize pause agent <agentId>

dewee optimize profiles

Show an agent’s per-cluster tool and routing profiles

dewee optimize profiles

dewee optimize profiles list

List an agent’s cluster profiles and per-cluster tool and model analysis

List an agent’s cluster profiles and the per-cluster analysis behind them.

A run’s first user message is classified into an intent cluster. When the classifier is confident and the agent has a profile for that cluster, the run uses the profile: a configured model, reasoning effort, budgets, fallback order, advisor policy and a list of the agent’s tools to hide for that cluster (skill_manage, session_tasks, human_handoff and per-user MCP tools are never hidden). Otherwise the run keeps the agent’s defaults and full tool set. Trace and episode routing evidence carries the cluster and the profile id shown here. A profile whose model or fallback the agent no longer runs is shown as inactive with the reason; its cluster runs the agent’s defaults until the next profile change drops it.

The analysis lists, per cluster, the tools exposed but never used, tools a run needed that its profile hid, wrong tool selections, the median tool schema tokens, each configured model’s outcomes (Pareto marks the quality, tokens, latency and cost frontier) and advisor attribution. Profile changes come from rule-authored candidates (see “dewee optimize candidates list”) and go through a canary. Aggregates span every user’s runs, so only tenant admins may read them.

dewee optimize profiles list <agentId|agentKey> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --days | int | Window in days (1-90) | 14 | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize profiles list <agentId> --days 30 --json

dewee optimize promote

Apply a candidate now, skipping its canary or policy wait (human only, needs —yes)

Apply an open candidate now. Its patch is classified again (R5 is refused) and applied only while the target is still at the candidate’s base version; otherwise the candidate is marked stale and the command fails with version_conflict.

Promotion overrides the promotion policy: a candidate waiting for approval or for its canary is applied at once, so the command needs —yes. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it.

dewee optimize promote <candidateId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --note | string | Optional review note (at most 1000 characters) | - | | -o, --output | string | output format (table|json) | table | | --yes | bool | Confirm applying the candidate now | false |

Examples

dewee optimize promote <candidateId> --yes --note "reviewed the diff"

dewee optimize resume

Resume automatic optimization of an agent or skill (human only)

Resume automatic optimization of an agent or skill (human only).

A paused target is never analyzed or promoted automatically; candidates still wait for a person’s decision. The gateway also refuses customer sessions. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it.

dewee optimize resume <agent|skill> <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize resume agent <agentId>

dewee optimize rollback

Withdraw a candidate’s canary or undo a promoted candidate (human only, needs —yes)

Undo a candidate.

A candidate in canary has its canary withdrawn; the live configuration never changed. A promoted agent candidate gets the inverse of its change as a new agent version: every field and file it changed is restored to its value before the candidate, while edits made since to anything else are kept. When one of those fields or files changed since the candidate was applied, nothing is written, the agent’s optimizer is paused and the command fails with rollback_conflict.

Skill candidates are rolled back through the skill’s version history. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it.

dewee optimize rollback <candidateId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --note | string | Optional review note (at most 1000 characters) | - | | -o, --output | string | output format (table|json) | table | | --yes | bool | Confirm the rollback | false |

Examples

dewee optimize rollback <candidateId> --yes --note "answers got worse"

dewee optimize settings

Show and change optimization settings of an agent or skill

Show and change the optimization settings of an agent or skill.

evolution_mode is observe (collect evidence only), suggest (draft candidates for review), auto_safe (also apply low-risk rule-authored candidates whose replay gate passed) or auto_canary (also approve medium-risk candidates for a canary). LLM-authored text always waits for a person.

Changes that widen what the optimizer may do or spend (an automatic mode, a higher or removed budget, lower evidence floors, a wider canary, a removed lock) are person-only.

dewee optimize settings

dewee optimize settings get

Show the optimization settings of an agent or skill

dewee optimize settings get <agent|skill> <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize settings get agent <agentId> --json

dewee optimize settings set

Change optimization settings of an agent or skill (only the flags given)

Change optimization settings of an agent or skill. Only the flags given are changed. Pass an empty —locked-fields "" to clear a list. Use “dewee optimize pause|resume” for the pause switch. Pass —expected-updated-at with the updated_at you read to refuse the change when the settings changed since.

dewee optimize settings set <agent|skill> <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --canary-max-days | int | Days a canary may run before it ends without enough evidence (1-90) | 0 | | --canary-max-traffic-pct | int | Largest share of runs a canary may serve (1-50) | 0 | | --canary-min-evaluated-runs | int | Evaluated runs per cohort before a canary decides (5-10000) | 0 | | --daily-budget-usd | float64 | Daily optimization spend cap of the target in USD (0: tenant budget only) | 0 | | --expected-updated-at | string | Refuse the change unless the settings’ updated_at still equals this RFC 3339 time | - | | --json | bool | output as JSON | false | | --locked-fields | stringSlice | Fields or files the optimizer never changes automatically (comma-separated) | [] | | --min-distinct-users | int | Distinct users a candidate’s evidence needs (1-1000) | 0 | | --min-samples | int | Evidence samples a candidate needs before automatic promotion (5-1000) | 0 | | --mode | string | Evolution mode (observe|suggest|auto_safe) | - | | --never-auto-edit-sections | stringSlice | Markdown section headings never edited automatically (comma-separated) | [] | | -o, --output | string | output format (table|json) | table |

Examples

dewee optimize settings set skill <skillId> --mode suggest --daily-budget-usd 2

dewee packages

Manage runtime packages

Manage runtime package inventory, installs, updates, removals, verification, approvals, and logs.

Authentication uses —token or these environment variables: GOCLAW_GATEWAY_TOKEN bearer token for operator API calls GOCLAW_GATEWAY_URL gateway base URL GOCLAW_SERVER gateway base URL alias

dewee packages

dewee packages access

Manage who may use, edit or manage a package

Manage who may use, edit or manage a package.

Grants are stored by the gateway in the caller’s tenant (/v1/resource-grants/package). Levels: agents: use. A GitHub package may also be named by its install spec github:owner/repo[@tag]. These are resource access grants, unrelated to the commercial dewee admin access-grants.

dewee packages access

dewee packages access activity

Show grant changes, denials and uses of a package, newest first

Show one page of the resource’s activity feed. —type filters grant changes, runtime denials or uses; pass the printed next cursor as —cursor (with the same —type) for the next page.

dewee packages access activity <manager:name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --cursor | string | next_cursor of the previous page | - | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --limit | int | events per page, 1..200 | 50 | | -o, --output | string | output format (table|json) | table | | --type | string | only this kind of event: grant, denied or use (default all) | - |

Examples

dewee packages access activity pip:requests --type denied --limit 20 -o json

dewee packages access grant

Grant agents or people access to a package

Grant each named principal exactly —level on the package. Levels: agents: use. A GitHub package may also be named by its install spec github:owner/repo[@tag]. Re-granting the level a principal already holds changes nothing. When some principals cannot be granted the others still are; each failure is listed and the command exits with PARTIAL_FAILURE. When none could be granted it exits with the failure’s own class instead: NOT_FOUND for a principal outside the workspace, CONFLICT for the last admin, VALIDATION_ERROR otherwise.

dewee packages access grant <manager:name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key (repeatable) | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --level | string | level to grant: use, edit, manage, admin | use | | -o, --output | string | output format (table|json) | table |

Examples

dewee packages access grant pip:requests --agent support-bot --level use

dewee packages access list

List who holds access to a package

dewee packages access list <manager:name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee packages access list pip:requests -o json

dewee packages access mode

Show or set whether a package is open to every agent or restricted to granted ones

dewee packages access mode

dewee packages access mode get

Show the access mode of a package

dewee packages access mode get <manager:name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee packages access mode get pip:requests

dewee packages access mode set

Open a package to every agent or restrict it to granted agents

Set the access mode. Restricting cuts off every agent without a use grant at once, so it asks for confirmation in a terminal; elsewhere it needs —yes (or —dry-run to preview). The gateway answers with the agents that lost access (affected_agents), which are printed so you can grant them. Opening needs no confirmation.

dewee packages access mode set <manager:name> <open|restricted> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table | | --yes | bool | confirm restricting without a prompt (required for restricted outside a terminal unless —dry-run) | false |

Examples

dewee packages access mode set pip:requests restricted --dry-run
  dewee packages access mode set pip:requests restricted --yes

dewee packages access revoke

Remove a principal’s access to a package

Remove a principal’s grant. —yes (or —dry-run to preview) is required: the command never prompts. Revoking a grant the principal does not hold changes nothing.

dewee packages access revoke <manager:name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table | | --yes | bool | confirm the revocation (required unless —dry-run) | false |

Examples

dewee packages access revoke pip:requests --agent support-bot --yes

dewee packages access set-level

Change the level a principal holds on a package

Raise or lower an existing grant. Levels: agents: use. A GitHub package may also be named by its install spec github:owner/repo[@tag]. A principal without a grant is NOT_FOUND; use grant first.

dewee packages access set-level <manager:name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --level | string | new level: use, edit, manage, admin | - | | -o, --output | string | output format (table|json) | table |

Examples

dewee packages access set-level pip:requests --agent support-bot --level use

dewee packages approvals

Manage pending package install approvals

dewee packages approvals

dewee packages approvals approve

Approve a pending package install request

dewee packages approvals approve <approval-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --always | bool | create a scoped, expiring package-install grant when enabled | false | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee packages approvals deny

Deny a pending package install request

dewee packages approvals deny <approval-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --reason | string | reviewer reason recorded with the denial | - |

dewee packages approvals list

List pending package install approvals

dewee packages approvals list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --all | bool | include non-package exec approvals | false | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee packages get

Get an installed package from inventory

dewee packages get <package-or-source:name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee packages install

Install a runtime package

Install a package. Examples: ripgrep, pip:pandas, npm:typescript, github:cli/cli.

dewee packages install <package> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee packages list

List installed runtime packages

dewee packages list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee packages logs

Show package install logs when gateway log persistence is available

dewee packages logs <install-run-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee packages remove

Remove a runtime package

Aliases: uninstall

dewee packages remove <package> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee packages runtimes

Show runtime availability

dewee packages runtimes [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee packages update

Update a runtime package to a newer version

Update one runtime package. The package names its source: github:<name>, pip:<name>, npm:<name> or apk:<name>. Without —to-version the gateway uses the latest version from its update cache (see “dewee packages updates”); if the cache has no entry for the package, pass —to-version (apk: run “dewee packages updates —refresh” instead). —to-version pins the exact version: a GitHub release tag, a pip version, or an npm semver version (no dist-tags, ranges or archive names); apk cannot pin. Requires master-scope admin credentials.

dewee packages update <source:name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --to-version | string | target version (default: latest version in the update cache) | - |

Examples

dewee packages update github:lazygit
  dewee packages update npm:typescript --to-version 5.6.3 -o json

dewee packages updates

List available runtime package updates

List runtime packages with a newer upstream version, from the gateway’s update cache.

The gateway refreshes a stale cache in the background on every read; —refresh re-checks every source now and waits for the result (requires master-scope admin credentials).

dewee packages updates [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --refresh | bool | re-check every source now before listing (master-scope admin) | false |

Examples

dewee packages updates
  dewee packages updates --refresh -o json

dewee packages verify

Verify a package is present in runtime inventory

dewee packages verify <package-or-source:name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee pairing

Manage device pairing (approve, list, revoke)

dewee pairing

dewee pairing approve

Approve a pairing code (interactive if no code given)

dewee pairing approve [code]

dewee pairing list

List pending and paired devices

dewee pairing list

dewee pairing revoke

Revoke a paired device

dewee pairing revoke <channel> <senderId>

dewee pricing

Inspect and refresh the global model pricing catalog

The gateway prices model usage from a global catalog synced from OpenRouter, plus per-provider overrides (see dewee providers pricing). The catalog refreshes on a schedule (GOCLAW_PRICING_SYNC_INTERVAL, default 6h); a failed refresh keeps the last good prices.

dewee pricing

dewee pricing status

Show pricing catalog freshness and the latest sync attempts

dewee pricing status [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee pricing status
  dewee pricing status --json

dewee pricing sync

Refresh the pricing catalog now (master scope)

Fetches the source catalog, validates it and replaces the stored prices in one transaction. A failed refresh leaves the current catalog unchanged. Exit code 6 means another refresh is already running.

A feed with fewer than half of the last good model count is rejected (catalog_shrunk). After confirming upstream really dropped those models, re-run with —allow-shrink.

dewee pricing sync [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --allow-shrink | bool | accept a feed below half of the last good model count | false | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --source | string | catalog source (openrouter) | openrouter |

Examples

dewee pricing sync --source openrouter
  dewee pricing sync --json
  dewee pricing sync --allow-shrink

dewee providers

Manage LLM providers (requires running gateway)

dewee providers

dewee providers access

Manage who may use, edit or manage a provider

Manage who may use, edit or manage a provider.

Grants are stored by the gateway in the caller’s tenant (/v1/resource-grants/provider). Levels: agents: use. These are resource access grants, unrelated to the commercial dewee admin access-grants.

dewee providers access

dewee providers access activity

Show grant changes, denials and uses of a provider, newest first

Show one page of the resource’s activity feed. —type filters grant changes, runtime denials or uses; pass the printed next cursor as —cursor (with the same —type) for the next page.

dewee providers access activity <provider-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --cursor | string | next_cursor of the previous page | - | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --limit | int | events per page, 1..200 | 50 | | -o, --output | string | output format (table|json) | table | | --type | string | only this kind of event: grant, denied or use (default all) | - |

Examples

dewee providers access activity anthropic --type denied --limit 20 -o json

dewee providers access grant

Grant agents or people access to a provider

Grant each named principal exactly —level on the provider. Levels: agents: use. Re-granting the level a principal already holds changes nothing. When some principals cannot be granted the others still are; each failure is listed and the command exits with PARTIAL_FAILURE. When none could be granted it exits with the failure’s own class instead: NOT_FOUND for a principal outside the workspace, CONFLICT for the last admin, VALIDATION_ERROR otherwise.

dewee providers access grant <provider-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key (repeatable) | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --level | string | level to grant: use, edit, manage, admin | use | | -o, --output | string | output format (table|json) | table |

Examples

dewee providers access grant anthropic --agent support-bot --level use

dewee providers access list

List who holds access to a provider

dewee providers access list <provider-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee providers access list anthropic -o json

dewee providers access mode

Show or set whether a provider is open to every agent or restricted to granted ones

dewee providers access mode

dewee providers access mode get

Show the access mode of a provider

dewee providers access mode get <provider-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee providers access mode get anthropic

dewee providers access mode set

Open a provider to every agent or restrict it to granted agents

Set the access mode. Restricting cuts off every agent without a use grant at once, so it asks for confirmation in a terminal; elsewhere it needs —yes (or —dry-run to preview). The gateway answers with the agents that lost access (affected_agents), which are printed so you can grant them. Opening needs no confirmation.

Before restricting, the confirmation and —dry-run list the agents that would lose access, read from the gateway’s preview (GET …/affected-agents); a dry run sends that read and nothing else.

dewee providers access mode set <provider-id-or-name> <open|restricted> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without changing anything; restricting first reads the affected-agents preview (one GET) and sends no change | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table | | --yes | bool | confirm restricting without a prompt (required for restricted outside a terminal unless —dry-run) | false |

Examples

dewee providers access mode set anthropic restricted --dry-run
  dewee providers access mode set anthropic restricted --yes

dewee providers access revoke

Remove a principal’s access to a provider

Remove a principal’s grant. —yes (or —dry-run to preview) is required: the command never prompts. Revoking a grant the principal does not hold changes nothing.

dewee providers access revoke <provider-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table | | --yes | bool | confirm the revocation (required unless —dry-run) | false |

Examples

dewee providers access revoke anthropic --agent support-bot --yes

dewee providers access set-level

Change the level a principal holds on a provider

Raise or lower an existing grant. Levels: agents: use. A principal without a grant is NOT_FOUND; use grant first.

dewee providers access set-level <provider-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --level | string | new level: use, edit, manage, admin | - | | -o, --output | string | output format (table|json) | table |

Examples

dewee providers access set-level anthropic --agent support-bot --level use

dewee providers activity

List a provider’s recent model calls (metadata only)

List the most recent model calls served by one provider over the last 7 days, newest first, for any provider type. Each call shows time, status, duration, model, agent and the trace id (open it with dewee traces get <trace-id>); failed calls carry a capped, credential-scrubbed failure message. Prompts, responses and request bodies are never returned.

Calls are matched by the provider’s current name: after a rename, calls recorded under the old name are not listed.

dewee providers activity <id|name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --limit | int | maximum calls to list (1-50) | 20 | | -o, --output | string | output format (table|json) | table |

Examples

dewee providers activity openai
  dewee providers activity openai --limit 50 -o json

dewee providers add

Add a new provider (interactive)

Interactive wizard for adding a provider. For scripts and agents, use dewee providers create.

dewee providers add

dewee providers create

Create a provider non-interactively

Create an LLM provider from flags, with no prompts.

The API key is read from stdin (—api-key-stdin), a file (—api-key-file) or an environment variable (—api-key-env NAME), never from a flag value, or reused from a stored provider with —credential-ref cred:v1:provider:<id>. The gateway validates —type and stores the key encrypted; responses mask it. —dry-run prints the request.

dewee providers create --type <type> --name <name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --api-base | string | API base URL (default: the type’s standard endpoint) | - | | --api-key-env | string | read the API key from the named environment variable | - | | --api-key-file | string | read the API key from a file (”-” reads stdin) | - | | --api-key-stdin | bool | read the API key from stdin | false | | --credential-ref | string | reuse a stored secret by reference (cred:v1:provider:<id>) instead of supplying one | - | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --enabled | bool | enable the provider | true | | --idempotency-key | string | Idempotency-Key for this create: a retry with the same key and body returns the first result instead of a duplicate (default: generated per run) | - | | --name | string | provider name (lowercase slug, unique per tenant) | - | | -o, --output | string | output format (table|json) | table | | --type | string | provider type (e.g. anthropic_native, openai_compat, openrouter; see dewee workspace-setup catalog) | - |

Examples

printf '%s' "$ANTHROPIC_API_KEY" | dewee providers create --type anthropic --name anthropic --api-key-stdin -o json
  dewee providers create --type openai --name openai --api-key-env OPENAI_API_KEY

dewee providers delete

Delete a provider

Delete a provider. Asks for confirmation on a terminal; pass —force to skip it (required without a TTY).

dewee providers delete <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --force | bool | skip confirmation | false |

dewee providers list

List configured providers

dewee providers list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --models | bool | also show available models per provider (table output only) | false | | -o, --output | string | output format (table|json) | table |

dewee providers models

Manage model names shared by a provider type in the current scope

Manage provider-type model catalogs. Master edits become the baseline for tenants; tenant edits apply only in that tenant. Reset restores the inherited Master or built-in catalog. Authentication and scope are enforced by the Gateway.

dewee providers models

Examples

dewee providers models get <provider-id> --json
  dewee providers models set <provider-id> --model gpt-6.1-sol --model gpt-6-sol
  dewee providers models reset <provider-id> --force

dewee providers models get

Show effective and inherited model catalogs

dewee providers models get <provider-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the server catalog as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee providers models reset

Remove this scope’s override and restore inheritance

dewee providers models reset <provider-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | show the current catalog without resetting it | false | | --force | bool | confirm removal of this scope’s catalog override | false | | --json | bool | output the server catalog as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee providers models set

Replace this scope’s model names for the provider type

dewee providers models set <provider-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the server catalog as JSON | false | | --model | stringArray | model name; repeat for each model (1..500, max 255 bytes each) | [] | | -o, --output | string | output format (table|json) | table |

dewee providers pricing

List a provider’s model pricing overrides

dewee providers pricing <provider-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee providers pricing 0192...
  dewee providers pricing set 0192... --model deepseek-chat --input 0.00000027 --output 0.0000011
  dewee providers pricing delete <override-id>

dewee providers pricing delete

Delete one pricing override

dewee providers pricing delete <override-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --force | bool | skip confirmation | false |

dewee providers pricing set

Create or replace the pricing override for one model

dewee providers pricing set <provider-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --cache-read | string | USD per cache-read token | - | | --cache-write | string | USD per cache-write token | - | | --image | string | USD per image | - | | --input | string | USD per input token | - | | --model | string | model id the prices apply to | - | | --output | string | USD per output token | - | | --reasoning | string | USD per reasoning token | - | | --request | string | USD per request | - | | --web-search | string | USD per web search | - |

dewee providers settings

Show a provider’s memory-embedding and reasoning defaults

Show the memory-embedding settings (enabled, model, endpoint override) and the provider reasoning defaults (effort, fallback) of one provider, by UUID or exact name. Change them with dewee providers settings set.

dewee providers settings <id|name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee providers settings openai
  dewee providers settings 0199a571-6ad2-78be-8caa-43ab429f43da -o json

dewee providers settings set

Change a provider’s memory-embedding or reasoning defaults

Change individual memory-embedding and reasoning-default fields of one provider.

Only the flags you pass are changed; every other setting (default model, OAuth pool routing, embedding dimensions, keys this CLI does not know) is kept by the Gateway, which merges the change on the server. A concurrent edit is merged, not overwritten; after repeated conflicts the Gateway answers 409 and the command is safe to rerun. Clearing is explicit: —clear-embedding-model and —clear-embedding-api-base return to the provider default, and —reset-reasoning removes the provider reasoning default (effort off, fallback downgrade).

Reasoning effort: off, auto, none, minimal, low, medium, high, xhigh, max. Reasoning fallback: downgrade, off, provider_default.

dewee providers settings set <id|name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --clear-embedding-api-base | bool | remove the embedding endpoint override so the provider base URL applies | false | | --clear-embedding-model | bool | remove the embedding model so the provider default applies | false | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --embedding-api-base | string | embedding endpoint override (http/https URL); the provider’s stored key is used | - | | --embedding-enabled | bool | enable (—embedding-enabled) or disable (—embedding-enabled=false) memory embeddings | false | | --embedding-model | string | embedding model id | - | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --reasoning-effort | string | provider reasoning default effort | - | | --reasoning-fallback | string | what to do when a model cannot honour the effort | - | | --reset-reasoning | bool | remove the provider reasoning default (effort off, fallback downgrade) | false |

Examples

dewee providers settings set openai --embedding-enabled --embedding-model text-embedding-3-small
  dewee providers settings set openai --reasoning-effort high --reasoning-fallback provider_default -o json
  dewee providers settings set openai --clear-embedding-api-base --reset-reasoning
  dewee providers settings set openai --embedding-enabled=false --dry-run

dewee providers update

Update a provider

Update a provider by UUID or exact name.

With any field flag it runs non-interactively and sends only the given fields. Without field flags it opens the interactive wizard, which needs a terminal. A name matching several providers is rejected with the candidate ids.

dewee providers update <id|name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --api-base | string | new API base URL | - | | --api-key-env | string | read the API key from the named environment variable | - | | --api-key-file | string | read the API key from a file (”-” reads stdin) | - | | --api-key-stdin | bool | read the API key from stdin | false | | --credential-ref | string | reuse a stored secret by reference (cred:v1:provider:<id>) instead of supplying one | - | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --enabled | bool | enable or disable the provider | true | | --name | string | new provider name | - | | -o, --output | string | output format (table|json) | table |

Examples

dewee providers update openai --api-key-env OPENAI_API_KEY -o json
  dewee providers update 0199a571-6ad2-78be-8caa-43ab429f43da --enabled=false

dewee providers verify

Verify provider connectivity (ping) or a specific model

Without —model: pings the provider (registered + reachable check). With —model: sends a small chat request to validate the model alias.

dewee providers verify <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --model | string | model alias to verify (omit for connectivity ping) | - |

dewee providers verify-embedding

Verify a provider’s embedding model with one real embedding call

dewee providers verify-embedding <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the verification result as JSON | false | | --model | string | embedding model to verify (default: the provider’s saved embedding model) | - | | -o, --output | string | output format (table|json) | table |

dewee reflex

Inspect and configure the reflex decision plane

Inspect and configure Dewee’s reflex decision plane via the Gateway’s /v1/reflex endpoints: status, config, test and eval for the instance (master scope), and settings, overrides and decisions for a workspace admin.

Reflex is an opt-in, default-off admission layer: with mode “off” no third-party request is made and runtime behavior is unchanged. Enabling “shadow” or “gate” sends redacted memory and channel content to api.typesafe.ai. The instance configuration applies to every workspace; a workspace can only narrow it with dewee reflex overrides, never widen it.

Authentication uses —token or these environment variables: GOCLAW_GATEWAY_TOKEN bearer token for operator API calls GOCLAW_GATEWAY_URL gateway base URL GOCLAW_SERVER gateway base URL alias

Server-side RBAC and master-scope checks are authoritative; this CLI performs no client-side authorization.

dewee reflex

dewee reflex config

Configure the reflex decision plane

Configure reflex. Non-secret settings are written to the Gateway’s system config; the TypeSafe API key is written to the encrypted secret store and is never accepted as a positional argument (it would land in shell history).

dewee reflex config

dewee reflex config reset

Return instance settings to their built-in defaults

Delete instance reflex settings so they fall back to the built-in default. Workspace overrides are not touched; use dewee reflex overrides reset for those.

Fields: enabled, mode, model, endpoint, budget_rpm, provider, retrieval_max_candidates, retrieval_per_source, retrieval_max_tokens, retrieval_admit_threshold, retrieval_min_confidence, read_timeout_ms, intent_mode, intent_confidence_threshold, intent_timeout_ms, seam_modes.<seam>, seam_sampling.<seam>, intent_confidence_threshold_by_locale.<locale>.

dewee reflex config reset endpoint dewee reflex config reset seam_modes.kg_chunk seam_sampling.kg_chunk dewee reflex config reset intent_confidence_threshold_by_locale.vi

The API key is not a resettable field; replace it with set-key.

dewee reflex config reset <field>... [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the resulting status as JSON | false |

dewee reflex config set

Write reflex settings

Write reflex settings.

Selecting a mode other than “off” also sets the opt-in flag, so a mode is never stored without consent to egress. Per-seam promotion is expressed with —seam-mode, and —seam-sampling changes how often a seam is evaluated:

dewee reflex config set —mode shadow dewee reflex config set —seam-mode kg_chunk=shadow —seam-sampling kg_chunk=0.25 dewee reflex config set —mode off

The busy-agent intent classifier is configured separately because it is a different decision with its own switch. It shares the vendor, the endpoint and the credential, but —intent-mode does NOT set the reflex opt-in flag and —mode has no effect on it:

dewee reflex config set —intent-mode shadow dewee reflex config set —intent-confidence 0.8 —intent-timeout-ms 1200 dewee reflex config set —intent-mode active

A mode other than “off” is inert until a TypeSafe API key is stored (see set-key); dewee reflex status reports key_present.

Returning to “off” restores byte-identical behavior: no migration was applied and no caller behaves differently when reflex is off.

dewee reflex config set [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --budget-rpm | int | outbound request cap per minute | 0 | | --disable | bool | clear the opt-in flag | false | | --enable | bool | set the opt-in flag without changing the mode | false | | --endpoint | string | vendor API root, for example https://api.typesafe.ai | - | | --intent-confidence | float64 | Jev confidence floor for accepting a Jev intent, in (0, 1] | 0 | | --intent-confidence-by-locale | stringArray | per-locale Jev confidence floor, repeatable: locale=0.8 (other locales keep —intent-confidence) | [] | | --intent-mode | string | busy-agent intent classifier mode: off, shadow, or active (independent of —mode) | - | | --intent-timeout-ms | int | intent evaluation timeout in milliseconds (max 5000) | 0 | | --json | bool | output the resulting status as JSON | false | | --mode | string | gateway-wide mode: off, shadow, or gate | - | | --model | string | vendor model id (pinned, for example jev-1.13.0) | - | | --provider | string | decision provider (only typesafe is implemented) | - | | --read-timeout-ms | int | read-side admission deadline in milliseconds | 0 | | --retrieval-admit-threshold | float64 | read-side usefulness floor in (0,1] | 0 | | --retrieval-max-candidates | int | read-side candidate-pool cap per evaluation | 0 | | --retrieval-max-tokens | int | maximum injected memory-section tokens | 0 | | --retrieval-min-confidence | float64 | read-side rejection confidence floor in (0,1] | 0 | | --retrieval-per-source | int | read-side cap per retrieval source | 0 | | --seam-mode | stringArray | per-seam mode, repeatable: seam=off|shadow|gate | [] | | --seam-sampling | stringArray | per-seam sampling rate, repeatable: seam=0.25 | [] |

dewee reflex config set-key

Store the TypeSafe API key (read from stdin)

Store the TypeSafe API key through the Gateway’s encrypted secret store.

The key is read from stdin so it never appears in shell history or in a process argument list, and it is never echoed back:

read -rs TYPESAFE_KEY && printf ‘%s’ “$TYPESAFE_KEY” | dewee reflex config set-key

Write-only: no command returns the key, and “reflex status” reports only whether a key is present.

dewee reflex config set-key

dewee reflex decisions

List recent reflex decisions for the caller’s workspace

List recent reflex decisions, newest first: the seam, the mode, the outcome (admit, skip, would_skip in shadow mode, or error), the reason, latency and model, and the trace each decision belongs to. The evaluated content and the model’s answers are never returned.

A workspace admin sees their own workspace; a master-scope caller sees the master tenant. Pass the printed next cursor as —cursor for the next page.

dewee reflex decisions [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --cursor | string | opaque cursor from a previous page | - | | --json | bool | output as JSON | false | | --limit | int | decisions per page (1-100) | 25 |

dewee reflex eval

Score thresholds against operator-labelled samples

Score admission thresholds against a labelled sample set.

The labels file is JSON Lines, one record per sample:

{“seam”:“channel_batch”,“state”:”…”,“expected”:“skip”,“state_ref”:“sample-1”,“note”:”…”}

Labels must come from a human. Using Jev’s own answers to label a Jev calibration would make the result self-confirming: the harness would measure how well the model agrees with itself.

The report separates the two error directions because they are not symmetric. For a continuity seam a false skip loses memory and is materially worse than a false admit, which costs one generative call; —sweep therefore recommends the lowest skip threshold whose false-skip rate is within —false-skip-tolerance, not the most accurate one.

Calibration selects thresholds for the labelled sample, not for the population.

dewee reflex eval [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --false-skip-tolerance | float64 | acceptable false-skip rate used to pick a recommendation | 0.05 | | --json | bool | output as JSON | false | | --labels | string | JSON Lines labels file | - | | --min-confidences | float64Slice | confidence floors to sweep (default: a built-in grid) | [] | | --skip-thresholds | float64Slice | skip thresholds to sweep (default: a built-in grid) | [] | | --sweep | bool | sweep thresholds instead of scoring the shipped ones | false |

dewee reflex overrides

Narrow reflex settings for the caller’s workspace

Narrow reflex settings for the caller’s workspace via PUT /v1/reflex/overrides.

A workspace override can only narrow the instance configuration: disable reflex, lower a mode (off < shadow < gate; off < shadow < active for intent), lower a seam’s sampling or the intent timeout, or raise the intent confidence floor. A value wider than the current instance value is rejected. The endpoint, model, provider, budget and API key are instance-only.

The master tenant has no overrides; change the instance with dewee reflex config set.

dewee reflex overrides

dewee reflex overrides reset

Return workspace overrides to the instance value

Delete workspace overrides so the fields inherit the instance value again.

Fields: enabled, mode, intent_mode, intent_confidence_threshold, intent_timeout_ms, seam_modes.<seam>, seam_sampling.<seam>.

legacy_instance_rows deletes instance-only reflex rows and a reflex API key stored under the workspace by older releases. They are ignored (instance values come from the master tenant only); the gateway names them in a reflex.legacy_tenant_rows_ignored warning at startup.

dewee reflex overrides reset mode dewee reflex overrides reset seam_modes.kg_chunk seam_sampling.kg_chunk dewee —tenant <tenant-id> reflex overrides reset legacy_instance_rows

dewee reflex overrides reset <field>... [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the resulting settings as JSON | false |

dewee reflex overrides set

Set workspace overrides

Set workspace overrides. Only the flags passed are written; every other field keeps its current override or inherits the instance value.

dewee reflex overrides set —mode shadow dewee reflex overrides set —enabled=false dewee reflex overrides set —seam-mode kg_chunk=off —seam-sampling channel_batch=0.1 dewee reflex overrides set —intent-mode off dewee reflex overrides set —intent-confidence 0.9 —intent-timeout-ms 800

Return a field to the instance value with dewee reflex overrides reset.

dewee reflex overrides set [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --enabled | bool | workspace opt-in; —enabled=false disables reflex for the workspace | false | | --intent-confidence | float64 | intent confidence floor in (0, 1] (at least the instance floor) | 0 | | --intent-mode | string | intent classifier mode: off, shadow, or active (at most the instance mode) | - | | --intent-timeout-ms | int | intent timeout in milliseconds (at most the instance timeout) | 0 | | --json | bool | output the resulting settings as JSON | false | | --mode | string | workspace mode: off, shadow, or gate (at most the instance mode) | - | | --seam-mode | stringArray | per-seam mode, repeatable: seam=off|shadow|gate | [] | | --seam-sampling | stringArray | per-seam sampling rate, repeatable: seam=0.25 | [] |

dewee reflex settings

Show reflex settings by scope: instance, workspace override, effective

Show the reflex settings the caller’s workspace runs with, broken down by scope: the instance value set by an operator, the workspace override (if any), and the effective value, plus each seam’s mode and sampling.

A workspace admin sees their own workspace. A master-scope caller sees the instance configuration, can_edit_instance is true, and the stored API key is identified by its last four characters (never more, and only for keys of at least twelve characters). A workspace caller sees only whether a key is stored.

Exit codes follow the dewee CLI convention (2 validation, 3 auth, 4 permission, 5 not found, 7 transport).

dewee reflex settings [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee reflex status

Show reflex configuration and process guard state

Show the resolved reflex configuration, the effective per-seam mode and sampling, the API key’s presence as a boolean, and the process-local circuit breaker and request budget. When a busy-agent intent classifier is wired, its counters are reported too: how often each lane decided, how often the vendor answer was accepted or declined, per-lane latency, and the estimated tokens and cost saved.

The API key value is never returned by the Gateway, so it cannot be printed here. The breaker and budget are per process: with multiple Gateway replicas each replica holds its own, and the effective vendor ceiling is budget_rpm x replicas. The intent counters are per process for the same reason.

—price-per-m supplies the generative model’s price for the cost estimate. It is a read-time input, not stored configuration: the price is your contract with your model provider. Omitting it uses the documented default price, so the estimate is always present rather than conditional on a flag.

Exit codes follow the dewee CLI convention (2 validation, 3 auth, 4 permission, 5 not found, 7 transport).

dewee reflex status [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --price-per-m | float64 | generative model price in USD per million tokens, used only to estimate the cost avoided; omit to use the documented default | 0 |

dewee reflex test

Run one real evaluation against a seam, or a connection test

Run one real evaluation and print the typed answers, probabilities, confidence, verdict, reason, and latency.

Without —set and —state it runs a connection test instead: one evaluation of a fixed synthetic passage that carries no workspace content, reporting latency, model, breaker state and any error. Use it to check the stored key, endpoint and model:

dewee reflex test dewee reflex test —set kg_chunk —state-file chunk.txt

The evaluation runs server-side because the Gateway owns the API key. The state is redacted at the reflex boundary before it is sent, so an API key, email, or phone number in the supplied text is stripped first.

This is the operator smoke test: it tells you whether the key works, whether the question set is accepted, and what the gate would decide.

dewee reflex test [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --set | string | question set / seam to evaluate (omit with —state for a connection test) | - | | --state | string | state text to evaluate | - | | --state-file | string | read the state text from a file (use - for stdin) | - |

dewee restore

Restore system from a backup archive (database + filesystem)

Restores dewee from a .tar.gz backup archive produced by ‘dewee backup’.

WARNING: This is a destructive operation. The database will be overwritten. Requires —force flag to proceed. Stop the gateway before restoring.

Use —list-s3 to list available S3 backups. Use —from-s3 <key> to download and restore from S3.

dewee restore [archive-path] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | inspect archive and show restore plan without executing | false | | --force | bool | required: confirm destructive restore operation | false | | --from-s3 | string | download and restore from this S3 key (e.g. backups/backup-20260409.tar.gz) | - | | --list-s3 | bool | list available backups in S3 and exit | false | | --skip-db | bool | skip database restore (filesystem only) | false | | --skip-files | bool | skip filesystem restore (database only) | false |

dewee restore smoke

Restore an archive into disposable targets as a smoke test

Restores a backup archive into explicitly isolated targets.

The smoke command refuses the configured live database, data dir, and workspace path. It is intended for proving that a backup can be restored before promoting the archive or resuming replicas after a disaster-recovery drill.

dewee restore smoke <archive-path> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --keep-target | bool | preserve temporary filesystem smoke targets for inspection | false | | --skip-db | bool | skip database restore smoke | false | | --skip-files | bool | skip filesystem restore smoke | false | | --target-data-dir | string | disposable data dir for filesystem restore smoke (default: temp dir) | - | | --target-dsn | string | disposable database DSN for database restore smoke | - | | --target-workspace | string | disposable workspace dir for filesystem restore smoke (default: temp dir) | - | | --verify-secrets | bool | verify encrypted restored secrets with GOCLAW_ENCRYPTION_KEY | false |

dewee rgd

Operator tools for the hidden Runtime Gateway Dashboard

Operator tools for the Runtime Gateway Dashboard when the runtime serves it on the hidden mount (DEWEE_RGD_MOUNT=hidden), where it is reachable only at /{workspaceId}-rgd/ with an NLB-signed operator grant. These commands run offline and never contact a gateway.

dewee rgd

dewee rgd grant

Mint, inspect and verify NLB operator grants

dewee rgd grant

dewee rgd grant mint

Sign an operator grant for one workspace

Sign an operator grant that opens /{workspaceId}-rgd/ on a runtime serving the hidden dashboard mount. The grant is bound to one workspace id, optionally to one runtime instance (DEWEE_LICENSE_RUNTIME_INSTANCE_ID on that runtime), and expires after —ttl (max 72h0m0s).

The NLB signing key is read from DEWEE_RGD_GRANT_SIGNING_KEY (PEM or base64), from the file named by —key-file or DEWEE_RGD_GRANT_SIGNING_KEY_FILE. It is never accepted on the command line.

The grant is printed to stdout. Treat it as a secret until it expires.

dewee rgd grant mint [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --key-file | string | path to the NLB signing key (PEM or base64) | - | | --runtime-instance | string | bind the grant to one runtime instance id | - | | --subject | string | operator identity recorded in the runtime audit log, e.g. an e-mail (required) | - | | --ttl | duration | grant lifetime | 12h0m0s | | --workspace | string | workspace id the grant opens (required) | - |

Examples

DEWEE_RGD_GRANT_SIGNING_KEY_FILE=~/.nlb/rgd-operator.pem \
    dewee rgd grant mint --workspace ws_123 --subject ops@nextlevelbuilder.io --ttl 2h

dewee rgd grant public-key

Print the public key and key id for the NLB signing key

Print the base64 Ed25519 public key for the configured signing key, in the form internal/rgdgrant/nlb_operator_public_keys.go expects, together with its key id.

dewee rgd grant public-key [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --key-file | string | path to the NLB signing key (PEM or base64) | - |

dewee rgd grant verify

Check a grant from stdin against the keys embedded in this build

Read a grant from stdin and check its signature against the operator keys embedded in this dewee build, then its expiry and, when —workspace is given, its workspace and runtime binding exactly as a runtime would. Exits non-zero when the runtime would refuse it.

dewee rgd grant verify [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --runtime-instance | string | runtime instance id of the target runtime (with —workspace) | - | | --workspace | string | workspace id the grant must open | - |

Examples

pbpaste | dewee rgd grant verify --workspace ws_123

dewee selfhost

Manage a self-installed Dewee: secrets, first-run and recovery links, status

Commands for a self-installed Dewee (install script or Docker compose).

The control panel runs at http://localhost:4321. On a fresh install, open the one-time setup link from “dewee selfhost access-link” to create the owner account.

dewee selfhost

dewee selfhost access-link

Print a one-time link to set up the owner account or reset a password

Prints a single-use link to the local control panel, valid for 30 minutes.

—purpose setup creates the first owner account (only while no account exists) —purpose recovery sets a new password for —email and signs out its other sessions

The link is signed with DEWEE_APP_ACCESS_SECRET, read from the environment, —env-file, or $DEWEE_HOME/dewee.env (default ~/.dewee/dewee.env). Anyone holding the link can use it, so share it only with the account owner.

dewee selfhost access-link [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --base-url | string | control panel address the link opens | http://localhost:4321 | | --email | string | account email (required for recovery; optional for setup) | - | | --env-file | string | secrets file to read DEWEE_APP_ACCESS_SECRET from | - | | --json | bool | output as JSON | false | | --purpose | string | setup or recovery | setup |

Examples

dewee selfhost access-link --purpose setup
  dewee selfhost access-link --purpose recovery --email owner@example.com
  docker compose exec dewee dewee selfhost access-link --purpose setup

dewee selfhost init-secrets

Create the secrets file, or add only the keys it is missing

Creates the self-install secrets file (mode 0600) with every key the runtime and the control panel need. Running it again only adds missing keys: existing values are never rewritten, and a weak or placeholder value is reported by key name so you can replace it. Secret values are never printed.

With —docker it also writes the compose-network database URLs and the postgres_password / app_postgres_password files the database containers read. Those files get group 999 (the postgres containers’ user) and mode 0640, which needs root: run it as the compose init service does.

dewee selfhost init-secrets [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --docker | bool | also write compose database URLs and postgres password files | false | | --json | bool | output as JSON | false | | --out | string | path of the secrets file to create or complete (required) | - |

Examples

dewee selfhost init-secrets --out ~/.dewee/dewee.env
  dewee selfhost init-secrets --out /secrets/dewee.env --docker

dewee selfhost rgd-url

Print the operator sign-in address of the runtime dashboard for a workspace

Prints the hidden runtime dashboard (RGD) address for one workspace. It is for Dewee operators only: the page asks for an NLB-signed operator grant, and the control panel never links to it.

dewee selfhost rgd-url [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --base-url | string | control panel address | http://localhost:4321 | | --json | bool | output as JSON | false | | --workspace | string | workspace ID (required) | - |

Examples

dewee selfhost rgd-url --workspace 0190b1c2-1234-7abc-9def-0123456789ab

dewee selfhost status

Show service state, versions, readiness and the licence summary

Reports whether the runtime and the control panel are installed as services and running, whether each answers /readyz (with its version), and the licence summary from the runtime, and whether the runtime serves guided setup (the setup assistant a new workspace opens with). Exits non-zero when either service is not ready.

Inside the runtime container of a Docker Compose install it reaches the control panel at $DEWEE_SELFHOST_APP_URL (set by the compose file) and reads the gateway token from $DEWEE_HOME/dewee.env when none is configured.

dewee selfhost status [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --app-url | string | control panel address (when unset: $DEWEE_SELFHOST_APP_URL, else this default) | http://localhost:4321 | | --json | bool | output as JSON | false |

Examples

dewee selfhost status
  dewee selfhost status --json
  docker compose exec dewee dewee selfhost status

dewee sessions

View and manage chat sessions

dewee sessions

dewee sessions delete

Delete a session

dewee sessions delete [key]

dewee sessions feedback

Rate a session’s run up or down (explicit feedback)

Rate a run of a session up or down.

Without —run-id or —trace-id the session’s newest run is rated, and only once it finished (pass —run-id to rate an earlier answer). Rating the same run again replaces your earlier rating. Only the session owner or a tenant admin may rate; the gateway rate-limits ratings per user. No message text is stored, only the rating and an optional reason code: up: helpful, accurate, well_explained, other down: incorrect, incomplete, unhelpful, wrong_action, too_slow, unsafe, other Requires optimizer.enabled on the gateway.

dewee sessions feedback <session-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --rating | string | up or down (required) | - | | --reason | string | Optional reason code matching the rating | - | | --run-id | string | Rate this run instead of the latest one | - | | --trace-id | string | Rate the run of this trace instead of the latest one | - |

Examples

dewee sessions feedback <session-key> --rating down --reason incorrect

dewee sessions get

Get session summary and preview

dewee sessions get <session-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee sessions history

Show session message history

dewee sessions history <session-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --include-tools | bool | include tool messages | false | | --json | bool | output as JSON | false | | --limit | int | max messages | 50 |

dewee sessions list

List all sessions

dewee sessions list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | filter by agent ID | - | | --json | bool | output as JSON | false |

dewee sessions rename

Rename a session (patch its label)

dewee sessions rename <key> <title> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --model | string | also set the session model | - |

Examples

dewee sessions rename <session-key> "Release triage"

dewee sessions reset

Clear session history (keep session)

Clear session history (keep session). The reset is saved before the command returns, so a restart or a fresh load sees it. When an administrator resets a verified user’s session while that user’s reply is still running, the reset is reported as pending: it is saved with that reply, and until then other instances still show the previous history.

dewee sessions reset [key]

dewee sessions send

Send a message into a session via chat.send

dewee sessions send <session-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent id/key override | - | | --json | bool | output as JSON | false | | -m, --message | string | message content | - |

dewee sessions status

Show live session run status

dewee sessions status <session-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee settings

Inspect and manage tenant workspace settings

Inspect and manage tenant workspace settings (defaults vs overrides).

Scoped to the target tenant specified via —tenant flag or environment. If —tenant is not specified, defaults to the master tenant.

Aliases: setting

dewee settings

dewee settings get

Get tenant workspace settings or a specific setting key

dewee settings get [key] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --tenant | string | target tenant ID or slug (default: master) | - |

dewee settings list

List all tenant workspace settings

dewee settings list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --tenant | string | target tenant ID or slug (default: master) | - |

dewee settings reset

Reset a tenant workspace setting back to default

dewee settings reset <key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --tenant | string | target tenant ID, slug, or ‘master’ (required) | - |

dewee settings set

Set a tenant workspace setting override

dewee settings set <key> <value> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --tenant | string | target tenant ID, slug, or ‘master’ (required) | - |

dewee setup

Configuration wizard — providers, agents, channels

Interactive setup for providers, models, agents, and channels. Requires a running gateway.

dewee setup

dewee skills

List and manage skills

dewee skills

dewee skills access

Manage skill access mode, grants and effective access

Manage skill access mode, grants and effective access.

Grants are stored by the gateway in the caller’s tenant (/v1/resource-grants/skill). Levels: agents: use, manage; people: use, edit, manage. These are resource access grants, unrelated to the commercial dewee admin access-grants.

dewee skills access

dewee skills access activity

Show grant changes, denials and uses of a skill, newest first

Show one page of the resource’s activity feed. —type filters grant changes, runtime denials or uses; pass the printed next cursor as —cursor (with the same —type) for the next page.

dewee skills access activity <skill-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --cursor | string | next_cursor of the previous page | - | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --limit | int | events per page, 1..200 | 50 | | -o, --output | string | output format (table|json) | table | | --type | string | only this kind of event: grant, denied or use (default all) | - |

Examples

dewee skills access activity git-helper --type denied --limit 20 -o json

dewee skills access effective

Inspect effective access for an agent and user

dewee skills access effective [skill-id] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent ID | - | | --json | bool | output as JSON | false | | --user | string | user ID | - |

dewee skills access get

Show skill access mode and grants

dewee skills access get [skill-id] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee skills access grant

Grant agents or people access to a skill

Grant each named principal exactly —level on the skill. Levels: agents: use, manage; people: use, edit, manage. Re-granting the level a principal already holds changes nothing. When some principals cannot be granted the others still are; each failure is listed and the command exits with PARTIAL_FAILURE. When none could be granted it exits with the failure’s own class instead: NOT_FOUND for a principal outside the workspace, CONFLICT for the last admin, VALIDATION_ERROR otherwise.

dewee skills access grant <skill-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key (repeatable) | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --level | string | level to grant: use, edit, manage, admin | use | | -o, --output | string | output format (table|json) | table | | --user | stringSlice | user id of a workspace member (repeatable) | [] |

Examples

dewee skills access grant git-helper --agent support-bot --level use

dewee skills access list

List who holds access to a skill

dewee skills access list <skill-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee skills access list git-helper -o json

dewee skills access revoke

Remove a principal’s access to a skill

Remove a principal’s grant. —yes (or —dry-run to preview) is required: the command never prompts. Revoking a grant the principal does not hold changes nothing.

dewee skills access revoke <skill-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | -o, --output | string | output format (table|json) | table | | --user | stringSlice | user id of a workspace member | [] | | --yes | bool | confirm the revocation (required unless —dry-run) | false |

Examples

dewee skills access revoke git-helper --agent support-bot --yes

dewee skills access set

Set skill access mode

dewee skills access set [skill-id] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --mode | string | access mode: private, internal, public | - |

dewee skills access set-level

Change the level a principal holds on a skill

Raise or lower an existing grant. Levels: agents: use, manage; people: use, edit, manage. A principal without a grant is NOT_FOUND; use grant first.

dewee skills access set-level <skill-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | stringSlice | agent id or key | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output the gateway response as JSON (same as -o json) | false | | --level | string | new level: use, edit, manage, admin | - | | -o, --output | string | output format (table|json) | table | | --user | stringSlice | user id of a workspace member | [] |

Examples

dewee skills access set-level git-helper --user alice --level manage

dewee skills activity

Show recent self-evolution activity for a skill

dewee skills activity [skill]

dewee skills analyze

Analyze a skill’s failures and draft a reviewed improvement candidate

Analyze a skill’s recent outcomes and draft a candidate skill version.

The analyzer clusters the skill’s judged episodes by version, task cluster and failure mode, then drafts one minimal patch for the strongest recurring cluster with the model of the agent whose episodes dominate it. The patch becomes an improvement candidate that needs human review (“dewee optimize candidates”). In auto_analyze mode the candidate is also replayed against a regression corpus.

—dry-run prints the clusters and the decision for each without a model call and without creating a candidate. Tenant admins only. Requires optimizer.enabled on the gateway.

dewee skills analyze <skill> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | Show clusters and decisions without a model call or a candidate | false | | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee skills analyze my-skill --dry-run
  dewee skills analyze my-skill --json

dewee skills delete

Delete a skill

Delete a skill. —yes is required: the command never prompts. A non-admin needs a manage grant on the skill.

dewee skills delete <skill-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table | | --yes | bool | confirm the deletion (required) | false |

Examples

dewee skills delete 0199a571-6ad2-78be-8caa-43ab429f4410 --yes -o json

dewee skills deps

Scan, check, and install skill dependencies

dewee skills deps

dewee skills deps check

Check dependency availability

dewee skills deps check [skill-id-or-path] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee skills deps install

Install missing dependencies for a managed skill

dewee skills deps install [skill-id] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee skills deps scan

Scan dependency declarations

dewee skills deps scan [skill-id-or-path] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee skills deps status

Show dependency status

dewee skills deps status [skill-id-or-path] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee skills evolve

Manage per-skill self-evolution settings

dewee skills evolve

dewee skills evolve disable

disable self-evolution for a skill

dewee skills evolve disable [skill]

dewee skills evolve enable

enable self-evolution for a skill

dewee skills evolve enable [skill]

dewee skills evolve mode

Set self-evolution mode for a skill

Set self-evolution mode for a skill.

auto_analyze lets the skill analyzer draft improvement candidates once enough judged episodes accumulate (—min-samples, default 20) and replays them; suggest_only keeps candidates for manual replay.

dewee skills evolve mode [skill] [suggest_only|auto_analyze] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --min-samples | int | Judged episodes needed before the analyzer drafts a candidate (5-1000) | 0 |

dewee skills evolve status

Show self-evolution settings for a skill

dewee skills evolve status [skill]

dewee skills export

Export a skill archive (ZIP or tar.gz) from the gateway

Download and export a skill as an archive package (ZIP or tar.gz) from the gateway. If —output is not specified, saves to the filename specified in the response or <slug>.<format>.

Aliases: download

dewee skills export <id-or-slug> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -f, --format | string | archive format: zip or tar.gz | zip | | --json | bool | emit JSON summary on success | false | | -o, --output | string | output file path | - |

Examples

dewee skills export my-skill
  dewee skills export my-skill --format zip
  dewee skills export 11111111-1111-1111-1111-111111111111 --output ./downloaded.zip
  dewee skills download my-skill

dewee skills fork

Show the system skill a tenant fork was copied from and whether it was upgraded since

Show the system skill a tenant-local fork was copied from.

A system skill is shared by every tenant, so approving an improvement to it creates a fork for your tenant only: a copy with its own slug (<slug>-local), version history and grants, while the system skill is disabled for your tenant. Later system upgrades do not reach the fork; upstream_updated says when the system skill moved past the version the fork copied. Fails with not found when the skill is not a fork.

dewee skills fork <skill> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee skills fork pdf-local --json

dewee skills grant

Grant skill access

dewee skills grant

dewee skills grant agent

Grant a skill to an agent

dewee skills grant agent [skill-id] [agent-id] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --can-manage | bool | grant manage permission | false | | --json | bool | output as JSON | false | | --pinned-version | int | pin a specific skill version | 0 |

dewee skills grant user

Grant a skill to a user

dewee skills grant user [skill-id] [user-id] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee skills list

List all available skills

dewee skills list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent ID to list skills for (uses gateway API) | - | | --json | bool | output as JSON | false |

dewee skills metrics

Show recorded usage metrics for a skill

dewee skills metrics [skill] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee skills outcomes

Show a skill’s attributed outcomes (helpful, harmful, unknown) over a window

Show a skill’s attributed outcomes over a window.

Counts come from outcome attribution: each episode the skill took part in is labelled participated, likely_helpful, neutral, likely_harmful or unknown from its semantic evaluation. This is the “did the skill help” view; “skills metrics” reports only the activation rate. Tenant admins count every episode; other callers count only their own. Requires optimizer.enabled on the gateway.

dewee skills outcomes <skill> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --version | int | Restrict to one skill version | 0 | | --window | string | Window in days, e.g. 7d or 30d (1d-180d, default 30d) | - |

Examples

dewee skills outcomes my-skill --window 30d --version 3 --json

dewee skills promote

Promote an installed external skill (agents-personal source) into Dashboard Custom Skills

Resolve <slug> against the local skill loader; if it comes from the agents-personal source (~/.agents/skills/<slug>/), package and upload it. Refuses to promote skills coming from other tiers (workspace, agents-project, managed, builtin) — for those, use “dewee skills upload <dir>” with the explicit path.

dewee skills promote <slug> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | inspect the package plan without contacting the gateway | false | | --json | bool | emit machine-readable JSON output | false |

Examples

dewee skills promote hyperframes
  dewee skills promote hyperframes --dry-run

dewee skills revoke

Revoke skill access

dewee skills revoke

dewee skills revoke agent

Revoke a skill from an agent

dewee skills revoke agent [skill-id] [agent-id]

dewee skills revoke user

Revoke a skill from a user

dewee skills revoke user [skill-id] [user-id]

dewee skills selection-metrics

Show how well a skill is selected (missed and irrelevant activations, precision, recall)

Show a skill’s selection metrics over a window.

relevant_not_selected counts runs on task clusters the skill serves that did not activate it; irrelevant_selected counts activations on task clusters it never served. Precision and recall are reported overall and per task cluster, with the activation -> load accounting and the outcome per skill version. Tenant admins see every episode; other callers see only their own. Requires optimizer.enabled on the gateway.

dewee skills selection-metrics <skill> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table | | --window | string | Window in days, e.g. 7d or 30d (1d-180d, default 30d) | - |

Examples

dewee skills selection-metrics my-skill --window 30d --json

dewee skills show

Show details and content of a skill

dewee skills show [name]

dewee skills suggestions

Manage skill improvement suggestions

dewee skills suggestions

dewee skills suggestions apply

Apply an approved skill improvement suggestion

dewee skills suggestions apply [skill] [suggestion-id] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --approve | bool | approve pending suggestion before applying | false |

dewee skills suggestions approve

approve a skill improvement suggestion

dewee skills suggestions approve [skill] [suggestion-id]

dewee skills suggestions list

List suggestions for a skill

dewee skills suggestions list [skill]

dewee skills suggestions reject

reject a skill improvement suggestion

dewee skills suggestions reject [skill] [suggestion-id]

dewee skills update

Update a skill’s name, description, tags or visibility

Update a skill, sending only the given fields.

A non-admin with an edit grant may change —name, —description and —tags; a manage grant also allows —visibility.

dewee skills update <skill-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --description | string | skill description | - | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --name | string | skill name | - | | -o, --output | string | output format (table|json) | table | | --tags | stringSlice | skill tags (comma-separated or repeated; replaces the current tags, "" clears them) | [] | | --visibility | string | visibility: private, internal, public | - |

Examples

dewee skills update 0199a571-6ad2-78be-8caa-43ab429f4410 --description "Search the docs" --tags docs,search -o json
  dewee skills update 0199a571-6ad2-78be-8caa-43ab429f4410 --visibility internal

dewee skills upload

Package a local skill directory or upload an existing skill ZIP into Dashboard Custom Skills

Package a single skill directory (root SKILL.md plus references/, scripts/, assets/, and any other regular files) or upload an existing skill ZIP archive directly to POST /v1/skills/upload so the skill appears under the Dashboard Skills → Custom tab. Uses the shared —server and bearer-token model; bearer tokens are redacted in all errors.

dewee skills upload <dir-or-zip> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | inspect the package plan without contacting the gateway | false | | --json | bool | emit machine-readable JSON output | false |

Examples

dewee skills upload ~/.agents/skills/hyperframes
  dewee skills upload ./my-skill.zip
  dewee skills upload ~/.agents/skills/hyperframes --dry-run
  dewee skills upload ~/.agents/skills/hyperframes --server https://dewee.example.com

dewee stt

Inspect and configure per-tenant STT (speech-to-text) settings

Inspect and configure per-tenant STT settings against the Gateway’s existing STT endpoints.

Authentication uses —token or these environment variables: GOCLAW_GATEWAY_TOKEN bearer token for operator API calls GOCLAW_GATEWAY_URL gateway base URL GOCLAW_SERVER gateway base URL alias

dewee stt

dewee stt config

View and configure per-tenant STT provider settings

View and configure per-tenant STT provider settings via the Gateway’s GET|POST /v1/stt/config endpoints.

Authentication uses —token or these environment variables: GOCLAW_GATEWAY_TOKEN bearer token for operator API calls GOCLAW_GATEWAY_URL gateway base URL GOCLAW_SERVER gateway base URL alias

Server-side RBAC and tenant-admin scoping are authoritative; this CLI performs no client-side authorization.

dewee stt config

dewee stt config get

Show STT configuration

Show the tenant’s STT configuration via GET /v1/stt/config.

Configured API keys are returned masked by the Gateway (”***”) and are never echoed back in cleartext by either the server or this CLI.

dewee stt config get [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee stt config set

Configure STT provider settings

Configure the tenant’s STT settings via POST /v1/stt/config.

Use —provider to override the tenant’s primary STT provider (soniox|elevenlabs), or —reset-provider to clear the override and fall back to the Gateway default. —soniox-* and —elevenlabs-* fields can be set independently of —provider.

API key values are plaintext CLI flags by existing repo convention; they are sent to the Gateway but never echoed back or logged by this CLI.

dewee stt config set [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --elevenlabs-api-key | string | ElevenLabs API key (never echoed back) | - | | --elevenlabs-base-url | string | ElevenLabs API base URL override | - | | --elevenlabs-model | string | ElevenLabs STT model | - | | --fallback | string | comma-separated fallback provider order, e.g. “elevenlabs” | - | | --json | bool | output as JSON | false | | --provider | string | primary STT provider override: soniox|elevenlabs | - | | --reset-provider | bool | clear the primary provider override (falls back to the Gateway default) | false | | --soniox-api-key | string | Soniox API key (never echoed back) | - | | --soniox-base-url | string | Soniox API base URL override | - | | --soniox-diarize | bool | enable Soniox speaker diarization | false | | --soniox-language-hints | string | comma-separated Soniox language hints, e.g. “vi,en” | - | | --soniox-model | string | Soniox async model | - | | --timeout-ms | int | per-transcription deadline in milliseconds | 0 |

dewee system-config

Read and write the deployment’s system configuration

Read and write the deployment system configuration (/v1/system-configs).

Distinct from dewee config, which reads the CLI’s local config.json. Writes require admin scope on the Gateway and are masked for credential-shaped keys.

dewee system-config

dewee system-config get

Read one system configuration entry

dewee system-config get <key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

Examples

dewee system-config get <key>

dewee system-config list

List system configuration entries

dewee system-config list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

Examples

dewee system-config list --json

dewee system-config set

Write a system configuration entry

Write a system configuration entry for the caller’s tenant scope.

Saving an empty value for mcp.oauth_public_url deletes the override at that scope, so the inherited instance value or the GOCLAW_MCP_OAUTH_PUBLIC_URL / GOCLAW_PUBLIC_URL origin applies again.

dewee system-config set <key> --value <value> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --value | string | new value | - |

Examples

dewee system-config set <key> --value <value>
  dewee system-config set mcp.oauth_public_url --value https://dewee.example.com
  dewee system-config set mcp.oauth_public_url --value ""

dewee tasks

Inspect team tasks and their comment threads

dewee tasks

dewee tasks comments

Read and write a team task’s comment thread

dewee tasks comments

dewee tasks comments add

Add a comment to a team task

dewee tasks comments add [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --content | string | comment body | - | | --json | bool | output as JSON | false | | --task | string | task ID | - | | --team | string | team ID | - |

Examples

dewee tasks comments add --team <teamId> --task <taskId> --content "Reproduced on staging"

dewee tasks comments list

List a team task’s comments

dewee tasks comments list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --task | string | task ID | - | | --team | string | team ID | - |

Examples

dewee tasks comments list --team <teamId> --task <taskId>

dewee teams

Manage agent teams and their members

Manage agent teams over the gateway’s teams.* RPC methods: list, get, create, update, delete, and members add/remove. Teams and agents are named by id or name/key.

dewee teams

dewee teams create

Create an agent team non-interactively

Create a team led by —lead with at least one —member (agent ids or keys). An agent can lead only one team. The name is the natural key: a name that already exists fails with CONFLICT (exit 6) instead of creating a second team of that name.

dewee teams create --name <name> --lead <agent> --member <agent> [--member <agent>...] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --description | string | team description | - | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --lead | string | lead agent id or key | - | | --member | stringArray | member agent id or key (repeat for each member) | [] | | --name | string | team name | - | | -o, --output | string | output format (table|json) | table | | --settings-file | string | JSON object file of team settings (”-” reads stdin) | - |

Examples

dewee teams create --name research --lead researcher --member writer --member critic -o json

dewee teams delete

Delete a team

Delete a team, its members and its tasks. —yes is required: the command never prompts.

dewee teams delete <team-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table | | --yes | bool | confirm the deletion (required) | false |

Examples

dewee teams delete research --yes -o json

dewee teams get

Show a team with its members

dewee teams get <team-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee teams get research -o json

dewee teams list

List agent teams

dewee teams list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee teams list -o json

dewee teams members

Add or remove team members

dewee teams members

dewee teams members add

Add an agent to a team

dewee teams members add <team-id-or-name> <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table | | --role | string | member role: member, reviewer | member |

Examples

dewee teams members add research critic --role reviewer -o json

dewee teams members remove

Remove an agent from a team

Remove a member from a team. —yes is required: the command never prompts.

dewee teams members remove <team-id-or-name> <agent-id-or-key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table | | --yes | bool | confirm the removal (required) | false |

Examples

dewee teams members remove research critic --yes -o json

dewee teams update

Update a team’s name, description or settings

dewee teams update <team-id-or-name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --description | string | new description ("" clears it) | - | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --name | string | new team name | - | | -o, --output | string | output format (table|json) | table | | --settings-file | string | JSON object file of team settings (”-” reads stdin) | - |

Examples

dewee teams update research --description "Deep research" -o json

dewee tenant

Manage tenants, resources, and tenant-scoped workspace settings

Aliases: tenants

dewee tenant

dewee tenant settings

Inspect and manage tenant workspace settings

Inspect and manage tenant workspace settings (defaults vs overrides).

Scoped to the target tenant specified via —tenant flag or environment. If —tenant is not specified, defaults to the master tenant.

Aliases: setting

dewee tenant settings

dewee tenant settings get

Get tenant workspace settings or a specific setting key

dewee tenant settings get [key] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --tenant | string | target tenant ID or slug (default: master) | - |

dewee tenant settings list

List all tenant workspace settings

dewee tenant settings list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --tenant | string | target tenant ID or slug (default: master) | - |

dewee tenant settings reset

Reset a tenant workspace setting back to default

dewee tenant settings reset <key> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --tenant | string | target tenant ID, slug, or ‘master’ (required) | - |

dewee tenant settings set

Set a tenant workspace setting override

dewee tenant settings set <key> <value> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --tenant | string | target tenant ID, slug, or ‘master’ (required) | - |

dewee tenant tenant-backup

Create a tenant-scoped backup (database rows + filesystem)

Exports all DB rows belonging to a tenant + workspace/data dirs as a .tar.gz archive.

dewee tenant tenant-backup [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output path for .tar.gz | - | | --tenant | string | tenant slug to back up | - | | --tenant-id | string | tenant UUID (alternative to —tenant) | - | | --upload-s3 | bool | upload backup to S3 after creation | false |

dewee tenant tenant-restore

Restore a tenant from a backup archive

Restores a tenant from a .tar.gz archive produced by ‘dewee tenant-backup’.

Modes: upsert (default) — INSERT … ON CONFLICT DO NOTHING. Non-destructive. Requires —tenant or —tenant-id. replace — Wipes tenant-scoped data (keeps tenant metadata), then INSERT. Requires —tenant or —tenant-id AND —force. new — Creates a new tenant from archive metadata. Requires —new-tenant-slug. Archive’s tenant_id is remapped to the new tenant. Users, API keys, LLM providers, and all other tenant-scoped data are cloned from the archive.

dewee tenant tenant-restore <archive-path> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | inspect archive without making changes | false | | --force | bool | required for replace mode | false | | --mode | string | restore mode: upsert, replace, new | upsert | | --new-tenant-slug | string | slug for the new tenant (required for mode=new) | - | | --tenant | string | target tenant slug (for mode=upsert|replace) | - | | --tenant-id | string | target tenant UUID (for mode=upsert|replace, alternative to —tenant) | - |

dewee tenant tenant-transfer

Preview, copy, or move resources between tenants (Standard/PostgreSQL)

Remote HTTP client for tenant resource transfer.

Authentication uses —token / DEWEE_API_KEY / GOCLAW_GATEWAY_TOKEN and —server / DEWEE_SERVER / GOCLAW_GATEWAY_URL.

Subcommands: inventory List transferable source-tenant roots preview Create an exact durable preview copy Preview then execute a copy (SSE) move Preview then execute a move (SSE) status Fetch operation status/result

dewee tenant tenant-transfer

dewee tenant tenant-transfer copy

Execute a tenant resource copy

dewee tenant tenant-transfer copy [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --destination | string | destination tenant UUID (when creating preview) | - | | --id | stringSlice | resource UUID (repeatable) | [] | | --idempotency-key | string | actor-scoped idempotency key | - | | --include-knowledge | bool | include agent knowledge | false | | --include-memories | bool | include agent memories | false | | --json | bool | print JSON | false | | --kind | stringSlice | resource kind (repeatable) | [] | | --preview-id | string | existing preview ID (skip auto-preview) | - | | --source | string | source tenant UUID (when creating preview) | - |

dewee tenant tenant-transfer inventory

List transferable resources in a source tenant

dewee tenant tenant-transfer inventory [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | print raw JSON | false | | --source | string | source tenant UUID | - |

dewee tenant tenant-transfer move

Execute a tenant resource move

dewee tenant tenant-transfer move [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --destination | string | destination tenant UUID (when creating preview) | - | | --id | stringSlice | resource UUID (repeatable) | [] | | --idempotency-key | string | actor-scoped idempotency key | - | | --include-knowledge | bool | include agent knowledge | false | | --include-memories | bool | include agent memories | false | | --json | bool | print JSON | false | | --kind | stringSlice | resource kind (repeatable) | [] | | --preview-id | string | existing preview ID (skip auto-preview) | - | | --source | string | source tenant UUID (when creating preview) | - |

dewee tenant tenant-transfer preview

Create a durable transfer preview

dewee tenant tenant-transfer preview [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --destination | string | destination tenant UUID | - | | --id | stringSlice | resource UUID (repeatable; pairs with —kind) | [] | | --include-knowledge | bool | include agent knowledge (agent selections) | false | | --include-memories | bool | include agent memories (agent selections) | false | | --json | bool | print raw JSON | false | | --kind | stringSlice | resource kind (repeatable; pairs with —id) | [] | | --mode | string | preview mode (copy|move) | copy | | --source | string | source tenant UUID | - |

dewee tenant tenant-transfer status

Fetch transfer operation status

dewee tenant tenant-transfer status <operation-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | print JSON | false |

dewee tenant workspace-bindings

Attach CCP workspaces to existing tenants (platform owner only)

Inspect and change which runtime tenant a CCP workspace is bound to.

attach binds a CCP workspace to an existing tenant (for example the master tenant, alias “master”) so the platform owner can run it from CCP; detach returns the workspace to its own provisioned tenant. Neither deletes a tenant or tenant data. Both revoke the CCP-issued credentials (CCP API keys and session tokens) of the tenant the workspace leaves; CCP re-issues session tokens on the next request.

Only the platform owner may call these commands: the gateway token plus a configured owner id passed with —user-id or GOCLAW_GATEWAY_USER_ID.

dewee tenant workspace-bindings

dewee tenant workspace-bindings attach

Attach a CCP workspace to an existing tenant

Attach a CCP workspace to an existing active tenant that no other workspace is bound to.

—owner-user-id is the platform owner’s CCP user id. It gets the owner membership in the target tenant and is the only CCP user allowed to mint MCP keys when the target is the master tenant. Omit it to use the sole owner of the workspace’s own tenant.

—preview asks the gateway to validate the attach and report what would change (credentials revoked, membership added) without changing anything. —dry-run prints the request without sending it. Applying the change requires —yes; the command never prompts. Re-running an applied attach is a no-op.

dewee tenant workspace-bindings attach [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | -o, --output | string | output format (table|json) | table | | --owner-user-id | string | platform owner’s CCP user id (default: the workspace’s sole owner) | - | | --preview | bool | validate on the gateway and report the change without applying it | false | | --source | string | provisioning source (default dewee-app) | - | | --tenant-id | string | target tenant: UUID or “master” (required) | - | | --workspace | string | CCP workspace id (required) | - | | --yes | bool | apply the attach (required unless —preview or —dry-run) | false |

Examples

dewee tenant workspace-bindings attach --workspace ws_123 --tenant-id master --owner-user-id usr_owner --preview -o json
  dewee tenant workspace-bindings attach --workspace ws_123 --tenant-id master --owner-user-id usr_owner --yes

dewee tenant workspace-bindings detach

Return a CCP workspace to its own provisioned tenant

Detach a CCP workspace from the tenant it was attached to and bind it back to its own provisioned tenant. The attached tenant and all its data are kept. —expected-tenant-id refuses the detach unless the workspace currently points at that tenant.

—preview validates on the gateway without changing anything; —dry-run prints the request without sending it. Applying the change requires —yes. Re-running an applied detach is a no-op.

dewee tenant workspace-bindings detach [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --expected-tenant-id | string | refuse unless the workspace is attached to this tenant (UUID or “master”) | - | | -o, --output | string | output format (table|json) | table | | --preview | bool | validate on the gateway and report the change without applying it | false | | --source | string | provisioning source (default dewee-app) | - | | --workspace | string | CCP workspace id (required) | - | | --yes | bool | apply the detach (required unless —preview or —dry-run) | false |

Examples

dewee tenant workspace-bindings detach --workspace ws_123 --expected-tenant-id master --yes

dewee tenant workspace-bindings list

List CCP workspace bindings

dewee tenant workspace-bindings list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table | | --source | string | provisioning source (default: all) | - | | --tenant-id | string | only bindings pointing at this tenant (UUID or “master”) | - | | --workspace | string | only this CCP workspace id | - |

Examples

dewee tenant workspace-bindings list --tenant-id master -o json

dewee tenant-backup

Create a tenant-scoped backup (database rows + filesystem)

Exports all DB rows belonging to a tenant + workspace/data dirs as a .tar.gz archive.

dewee tenant-backup [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output path for .tar.gz | - | | --tenant | string | tenant slug to back up | - | | --tenant-id | string | tenant UUID (alternative to —tenant) | - | | --upload-s3 | bool | upload backup to S3 after creation | false |

dewee tenant-restore

Restore a tenant from a backup archive

Restores a tenant from a .tar.gz archive produced by ‘dewee tenant-backup’.

Modes: upsert (default) — INSERT … ON CONFLICT DO NOTHING. Non-destructive. Requires —tenant or —tenant-id. replace — Wipes tenant-scoped data (keeps tenant metadata), then INSERT. Requires —tenant or —tenant-id AND —force. new — Creates a new tenant from archive metadata. Requires —new-tenant-slug. Archive’s tenant_id is remapped to the new tenant. Users, API keys, LLM providers, and all other tenant-scoped data are cloned from the archive.

dewee tenant-restore <archive-path> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | inspect archive without making changes | false | | --force | bool | required for replace mode | false | | --mode | string | restore mode: upsert, replace, new | upsert | | --new-tenant-slug | string | slug for the new tenant (required for mode=new) | - | | --tenant | string | target tenant slug (for mode=upsert|replace) | - | | --tenant-id | string | target tenant UUID (for mode=upsert|replace, alternative to —tenant) | - |

dewee tenant-transfer

Preview, copy, or move resources between tenants (Standard/PostgreSQL)

Remote HTTP client for tenant resource transfer.

Authentication uses —token / DEWEE_API_KEY / GOCLAW_GATEWAY_TOKEN and —server / DEWEE_SERVER / GOCLAW_GATEWAY_URL.

Subcommands: inventory List transferable source-tenant roots preview Create an exact durable preview copy Preview then execute a copy (SSE) move Preview then execute a move (SSE) status Fetch operation status/result

dewee tenant-transfer

dewee tenant-transfer copy

Execute a tenant resource copy

dewee tenant-transfer copy [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --destination | string | destination tenant UUID (when creating preview) | - | | --id | stringSlice | resource UUID (repeatable) | [] | | --idempotency-key | string | actor-scoped idempotency key | - | | --include-knowledge | bool | include agent knowledge | false | | --include-memories | bool | include agent memories | false | | --json | bool | print JSON | false | | --kind | stringSlice | resource kind (repeatable) | [] | | --preview-id | string | existing preview ID (skip auto-preview) | - | | --source | string | source tenant UUID (when creating preview) | - |

dewee tenant-transfer inventory

List transferable resources in a source tenant

dewee tenant-transfer inventory [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | print raw JSON | false | | --source | string | source tenant UUID | - |

dewee tenant-transfer move

Execute a tenant resource move

dewee tenant-transfer move [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --destination | string | destination tenant UUID (when creating preview) | - | | --id | stringSlice | resource UUID (repeatable) | [] | | --idempotency-key | string | actor-scoped idempotency key | - | | --include-knowledge | bool | include agent knowledge | false | | --include-memories | bool | include agent memories | false | | --json | bool | print JSON | false | | --kind | stringSlice | resource kind (repeatable) | [] | | --preview-id | string | existing preview ID (skip auto-preview) | - | | --source | string | source tenant UUID (when creating preview) | - |

dewee tenant-transfer preview

Create a durable transfer preview

dewee tenant-transfer preview [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --destination | string | destination tenant UUID | - | | --id | stringSlice | resource UUID (repeatable; pairs with —kind) | [] | | --include-knowledge | bool | include agent knowledge (agent selections) | false | | --include-memories | bool | include agent memories (agent selections) | false | | --json | bool | print raw JSON | false | | --kind | stringSlice | resource kind (repeatable; pairs with —id) | [] | | --mode | string | preview mode (copy|move) | copy | | --source | string | source tenant UUID | - |

dewee tenant-transfer status

Fetch transfer operation status

dewee tenant-transfer status <operation-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | print JSON | false |

dewee traces

Inspect gateway traces

dewee traces

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

dewee traces export

Export a gzipped trace tree

dewee traces export <trace-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --file | string | write gzip export to file (use - for stdout) | - |

dewee traces follow

Poll trace changes for a session or agent

dewee traces follow [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent-id | string | filter by agent UUID | - | | --channel | string | filter by raw channel | - | | --include-spans | bool | include spans grouped by trace ID | false | | --limit | int | page size, max 200 | 0 | | --parent-trace-id | string | filter by parent trace UUID | - | | --run-id | string | filter by run ID | - | | --session | string | filter by session key | - | | --since | string | RFC3339 lower bound for changed traces | - | | --status | string | filter by trace status | - | | --tag | string | filter by trace tag | - | | --task-id | string | filter by metadata task ID | - | | --task-type | string | filter by task category tag | - | | --team-id | string | filter by team UUID | - | | --user | string | filter by user ID for admin callers | - |

dewee traces get

Get trace details with spans

dewee traces get <trace-id>

dewee traces list

List traces

List traces, newest first. Background worker traces (channel memory, knowledge graph and dreaming reflex decisions, and dreaming consolidation runs) are hidden by default; pass —include-background to show them, or —tag origin:background to list only them. Trace detail by id is never filtered.

Examples: dewee traces list —status error -o json dewee traces list —include-background -o json dewee traces list —tag origin:background

dewee traces list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | search agent display name or key | - | | --agent-id | string | filter by agent UUID | - | | --channel | string | filter by raw channel | - | | --channel-query | string | search channel instance labels | - | | --evaluator-model | string | restrict semantic matches to one evaluator model | - | | --evaluator-version | string | restrict semantic matches to one rubric version | - | | --from | string | start time lower bound, RFC3339 | - | | --has-tool-calls | string | filter true or false | - | | --include-background | bool | include background worker decision traces (channel memory, knowledge graph, dreaming), hidden by default | false | | --limit | int | page size, max 200 | 0 | | --max-input-tokens | int | maximum input tokens | 0 | | --max-output-tokens | int | maximum output tokens | 0 | | --max-tool-calls | int | maximum tool calls | 0 | | --min-input-tokens | int | minimum input tokens | 0 | | --min-output-tokens | int | minimum output tokens | 0 | | --min-tool-calls | int | minimum tool calls | 0 | | --offset | int | pagination offset | 0 | | --parent-trace-id | string | filter by parent trace UUID | - | | -q, --query | string | search trace text, IDs, labels, and span previews | - | | --run-id | string | filter by run ID | - | | --semantic-decision | string | filter by semantic decision name, e.g. task_outcome | - | | --semantic-min-confidence | float64 | minimum probability for the filtered decision, 0..1 (needs —semantic-decision) | -1 | | --semantic-status | string | filter by evaluation status, e.g. evaluation_failed | - | | --semantic-value | string | filter by that decision’s value, e.g. failed (needs —semantic-decision) | - | | --session | string | filter by session key | - | | --since | string | alias for —from | - | | --status | string | filter by trace status | - | | --tag | string | filter by trace tag | - | | --task-id | string | filter by metadata task ID | - | | --task-type | string | filter by task category tag | - | | --team-id | string | filter by team UUID | - | | --to | string | start time upper bound, RFC3339 | - | | --tool | string | search span tool names | - | | --until | string | alias for —to | - | | --user | string | filter by user ID for admin callers | - |

dewee traces semantic

Semantic trace evaluation (AI-derived signals)

Semantic trace evaluation: read and edit the evaluator’s configuration, inspect its metrics, and re-evaluate history.

These values are model-derived probabilistic signals, not objective measurements, and the runtime trace status remains authoritative for what actually happened. Evaluation is diagnostics only: no command here changes an agent’s prompt, tools, routing or behavior.

dewee traces semantic

dewee traces semantic backfill

Re-evaluate terminal traces that have no evaluation yet

Queue semantic evaluation for terminal traces (completed, error, cancelled) that have no persisted evaluation for the given rubric version and model, newest first.

Start with —dry-run to see how many traces are candidates. Evaluation stays diagnostics only, and re-evaluation is idempotent per (trace, rubric version, model).

dewee traces semantic backfill [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | Only traces for this agent UUID | - | | --dry-run | bool | Report the candidate count without queueing anything | false | | --evaluator-version | string | Rubric version to evaluate for (default: current) | - | | --include-failed | bool | Also retry traces whose previous evaluation failed | false | | --limit | int | Maximum traces to queue, capped at 1000 (default 100) | 0 | | --model | string | Evaluator model to evaluate with (default: configured model) | - | | --since | string | RFC3339 lower bound on trace start time | - | | --until | string | RFC3339 upper bound on trace start time | - |

dewee traces semantic config

Show the semantic evaluator configuration

Show the semantic evaluator’s effective configuration, why it is enabled or disabled, and its queue counters. Use config get and config set explicitly in scripts.

dewee traces semantic config

dewee traces semantic config get

Show the effective configuration and enabled reason

dewee traces semantic config get

dewee traces semantic config set

Change one or more evaluator settings

Change evaluator settings. Keys are listed by dewee traces semantic config get; the gateway validates every key and value and rejects the whole request on any error.

Examples: dewee traces semantic config set —set trace_semantic_enabled=true dewee traces semantic config set —set trace_semantic_sample_rate=0.25 —set trace_semantic_max_spans=500 dewee traces semantic config set —unset trace_semantic_sample_rate

dewee traces semantic config set [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --set | stringArray | key=value to set (repeatable) | [] | | --unset | stringArray | key to clear and return to its default (repeatable) | [] |

dewee traces semantic stats

Aggregate semantic evaluator health, cost and decision metrics

Aggregate semantic evaluator health, cost and decision metrics.

Values are model-derived probabilistic signals, not objective measurements, and the runtime trace status remains authoritative for what actually happened.

dewee traces semantic stats [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | Filter by agent ID | - | | --decision | string | Filter to one decision name | - | | --evaluator-version | string | Evaluator rubric version | - | | --limit | int | Maximum aggregate buckets | 0 | | --min-confidence | float64 | Only decisions at or above this confidence (0..1) | -1 | | --model | string | Filter by evaluator model | - | | --since | string | RFC3339 lower bound | - | | --until | string | RFC3339 upper bound | - |

dewee traces timeline

Show the run timeline linked to a trace

dewee traces timeline <trace-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --limit | int | page size, max 500 | 0 | | --offset | int | pagination offset | 0 |

dewee triggers

Manage event triggers (external events that start agent runs)

Manage event triggers: sources (a provider connection such as one GitHub webhook), rules (which events start which agent with which task), and the event inbox and dispatches they produce. See docs/event-triggers.md.

Every command needs a tenant admin and acts in the caller’s tenant (—tenant). The gateway mounts these routes only when GOCLAW_ENCRYPTION_KEY is set.

dewee triggers

dewee triggers dispatches

Inspect, cancel and retry dispatches (one event x rule decision)

dewee triggers dispatches

dewee triggers dispatches cancel

Cancel a queued dispatch or stop a running one

dewee triggers dispatches cancel <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers dispatches get

Show a dispatch (run id, trace id, outcome)

dewee triggers dispatches get <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers dispatches list

List dispatches

dewee triggers dispatches list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --event | string | only dispatches of this event id | - | | --json | bool | output as JSON (alias of -o json) | false | | --limit | int | page size (1-200) | 50 | | --offset | int | rows to skip | 0 | | -o, --output | string | output format (table|json) | table | | --rule | string | only dispatches of this rule id | - | | --source | string | only dispatches of this source id | - | | --status | string | queued, running, succeeded, failed, interrupted, cancelled, skipped or dead | - |

Examples

dewee triggers dispatches list --status failed -o json

dewee triggers dispatches retry

Re-queue a failed, interrupted, cancelled or dead dispatch

dewee triggers dispatches retry <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers events

Inspect the event inbox (authenticated deliveries)

dewee triggers events

dewee triggers events get

Show an event with its dispatches

dewee triggers events get <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers events list

List received events

dewee triggers events list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON (alias of -o json) | false | | --limit | int | page size (1-200) | 50 | | --offset | int | rows to skip | 0 | | -o, --output | string | output format (table|json) | table | | --source | string | only events of this source id | - | | --status | string | accepted or rejected | - |

Examples

dewee triggers events list --source <source-id> --status rejected

dewee triggers providers

List event providers with their event kinds and outcome actions

dewee triggers providers [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee triggers providers -o json

dewee triggers rules

Manage trigger rules (which events start which agent with which task)

dewee triggers rules

dewee triggers rules create

Create a trigger rule

Create a trigger rule on a source: when an event of —event-type (and —subject-type) arrives and the optional CEL —match expression is true, the rule’s policy decides whether to dispatch the task to —agent. Unset policy flags take the gateway defaults (docs/event-triggers.md).

dewee triggers rules create [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent id or agent_key that runs the task | - | | --allow-bots | bool | policy: let bot senders trigger the rule | false | | --allowed-actor | stringArray | policy: actor name or id allowed to trigger (repeatable; "" clears the list) | [] | | --disabled | bool | create the rule disabled | false | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --event-type | string | canonical event type (see dewee triggers providers) | resource.label.added | | --json | bool | output as JSON (alias of -o json) | false | | --match | string | CEL match expression, e.g. “data.label == ‘ai-handle’” (empty: always) | - | | --max-attempts | int | policy: pre-run admission attempts before dead (1-10) | 0 | | --max-duration | duration | policy: wall-clock budget of a run, e.g. 30m (60s-2h) | 0s | | --max-iterations | int | policy: tool-loop iteration cap (0 = the agent’s own limit) | 0 | | --max-per-hour | int | policy: dispatches per rule and resource per hour (1-100) | 0 | | --name | string | rule name | - | | --on-active | string | policy: coalesce or queue when a run for the resource is active | - | | --on-complete | string | outcome action, e.g. source.comment, or “none” | - | | -o, --output | string | output format (table|json) | table | | --session-mode | string | per_resource (default) or isolated | - | | --source | string | source id the rule belongs to (required) | - | | --subject-type | string | subject type, e.g. issue or pull_request (empty: any) | - | | --task | string | task template given to the agent | - | | --task-file | string | read the task template from a file (”-” = stdin) | - |

Examples

dewee triggers rules create --source <source-id> --name "AI handle" --subject-type issue \
    --match "data.label == 'ai-handle'" --agent coding-agent --task "Implement the issue" --on-complete source.comment

dewee triggers rules delete

Delete a trigger rule

Delete a trigger rule. Asks for confirmation on a terminal; pass —force to skip it (required without a TTY).

dewee triggers rules delete <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --force | bool | skip the confirmation prompt | false | | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers rules disable

Disable a trigger rule (new events no longer dispatch)

dewee triggers rules disable <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers rules enable

Enable a trigger rule

dewee triggers rules enable <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers rules get

Show a trigger rule

dewee triggers rules get <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers rules list

List trigger rules

dewee triggers rules list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON (alias of -o json) | false | | --limit | int | page size (1-200) | 50 | | --offset | int | rows to skip | 0 | | -o, --output | string | output format (table|json) | table | | --source | string | only rules of this source id | - |

Examples

dewee triggers rules list --source <source-id> -o json

dewee triggers rules test

Dry-run a canonical event against a rule (dispatches nothing)

Evaluate a rule against a canonical event envelope (docs/event-triggers.md) without storing or dispatching anything, and print whether it matches and what the rule’s policy would decide.

dewee triggers rules test <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --event-file | string | canonical event JSON file (”-” = stdin; required) | - | | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee triggers rules test <rule-id> --event-file event.json -o json

dewee triggers rules update

Update a trigger rule

Update a trigger rule. Only the given fields change; policy flags change only their own policy keys. A rule cannot move to another source.

dewee triggers rules update <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent id or agent_key that runs the task | - | | --allow-bots | bool | policy: let bot senders trigger the rule | false | | --allowed-actor | stringArray | policy: actor name or id allowed to trigger (repeatable; "" clears the list) | [] | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --event-type | string | canonical event type (see dewee triggers providers) | - | | --json | bool | output as JSON (alias of -o json) | false | | --match | string | CEL match expression, e.g. “data.label == ‘ai-handle’” (empty: always) | - | | --max-attempts | int | policy: pre-run admission attempts before dead (1-10) | 0 | | --max-duration | duration | policy: wall-clock budget of a run, e.g. 30m (60s-2h) | 0s | | --max-iterations | int | policy: tool-loop iteration cap (0 = the agent’s own limit) | 0 | | --max-per-hour | int | policy: dispatches per rule and resource per hour (1-100) | 0 | | --name | string | rule name | - | | --on-active | string | policy: coalesce or queue when a run for the resource is active | - | | --on-complete | string | outcome action, e.g. source.comment, or “none” | - | | -o, --output | string | output format (table|json) | table | | --session-mode | string | per_resource (default) or isolated | - | | --subject-type | string | subject type, e.g. issue or pull_request (empty: any) | - | | --task | string | task template given to the agent | - | | --task-file | string | read the task template from a file (”-” = stdin) | - |

Examples

dewee triggers rules update <rule-id> --match "data.label == 'ai'" --max-per-hour 5

dewee triggers sources

Manage event sources (provider connections such as a GitHub webhook)

dewee triggers sources

dewee triggers sources create

Create an event source and print its webhook secret once

Create an event source. The response carries the webhook signing secret and the webhook path exactly once: configure them in the provider (for GitHub: Settings > Webhooks, content type application/json, events Issues and Pull requests) and store the secret now. It cannot be read again; rotate-secret issues a new one.

—credential-stdin reads an optional outbound provider token (for GitHub a fine-grained token with Issues and Pull requests read/write) from stdin. It enables actor permission checks and the source.comment outcome; it is stored encrypted and never returned.

dewee triggers sources create [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --credential-stdin | bool | read the outbound provider token from stdin | false | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --ignore-actor | stringArray | sender login whose events are rejected (repeatable; maps to config.ignore_actors) | [] | | --json | bool | output as JSON (alias of -o json) | false | | --name | string | source name (required) | - | | -o, --output | string | output format (table|json) | table | | --provider | string | event provider | github | | --repo | stringArray | allowed owner/repo (repeatable; maps to config.repositories) | [] |

Examples

dewee triggers sources create --name acme --repo acme/api -o json
  printf '%s' "$GITHUB_TOKEN" | dewee triggers sources create --name acme --repo acme/api --credential-stdin

dewee triggers sources delete

Delete an event source with its rules, events and dispatches

Delete an event source with its rules, events and dispatches. Asks for confirmation on a terminal; pass —force to skip it (required without a TTY).

dewee triggers sources delete <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --force | bool | skip the confirmation prompt | false | | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers sources disable

Stop accepting deliveries for a source (they answer 404)

dewee triggers sources disable <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers sources enable

Accept deliveries for a disabled source again

dewee triggers sources enable <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers sources get

Show an event source

dewee triggers sources get <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers sources list

List event sources

dewee triggers sources list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON (alias of -o json) | false | | --limit | int | page size (1-200) | 50 | | --offset | int | rows to skip | 0 | | -o, --output | string | output format (table|json) | table |

Examples

dewee triggers sources list -o json

dewee triggers sources rotate-secret

Issue a new webhook secret and print it once

Replace a source’s webhook signing secret. The old secret stops working immediately, so update the provider’s webhook secret right away; deliveries signed with the old one answer 401.

dewee triggers sources rotate-secret <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --json | bool | output as JSON (alias of -o json) | false | | -o, --output | string | output format (table|json) | table |

dewee triggers sources update

Update an event source’s name, config or credential

Update an event source. Only the given fields change. —repo and —ignore-actor each replace their whole list (the other config keys are kept); pass —ignore-actor "" to clear it. —credential-stdin replaces the outbound provider token from stdin; —clear-credential removes it.

dewee triggers sources update <id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --clear-credential | bool | remove the stored outbound provider token | false | | --credential-stdin | bool | read a new outbound provider token from stdin | false | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --ignore-actor | stringArray | sender login whose events are rejected (repeatable; maps to config.ignore_actors) | [] | | --json | bool | output as JSON (alias of -o json) | false | | --name | string | new source name | - | | -o, --output | string | output format (table|json) | table | | --repo | stringArray | allowed owner/repo (repeatable; maps to config.repositories) | [] |

Examples

dewee triggers sources update <id> --repo acme/api --repo acme/web
  printf '%s' "$GITHUB_TOKEN" | dewee triggers sources update <id> --credential-stdin

dewee tts

Inspect TTS provider capabilities, list voices, and test connections

Inspect TTS provider capabilities, list voices, and test provider connections against the Gateway’s existing TTS endpoints.

Authentication uses —token or these environment variables: GOCLAW_GATEWAY_TOKEN bearer token for operator API calls GOCLAW_GATEWAY_URL gateway base URL GOCLAW_SERVER gateway base URL alias

dewee tts

dewee tts config

View and configure per-tenant TTS provider settings

View and configure per-tenant TTS provider settings via the Gateway’s GET|POST /v1/tts/config endpoints.

Authentication uses —token or these environment variables: GOCLAW_GATEWAY_TOKEN bearer token for operator API calls GOCLAW_GATEWAY_URL gateway base URL GOCLAW_SERVER gateway base URL alias

Server-side RBAC and tenant-admin scoping are authoritative; this CLI performs no client-side authorization.

dewee tts config

dewee tts config get

Show TTS configuration

Show the tenant’s TTS configuration via GET /v1/tts/config.

Configured API keys are returned masked by the Gateway (”***”) and are never echoed back in cleartext by either the server or this CLI.

dewee tts config get [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee tts config set

Configure TTS provider settings

Configure the tenant’s TTS settings via POST /v1/tts/config.

Use —provider to target a specific provider’s fields (—api-key, —api-base, —voice-id, —model-id, —group-id, —rate, —enabled). Add —activate to also make —provider the tenant’s active TTS provider. Global fields (—auto, —mode, —max-length, —timeout-ms) apply independently of —provider and can be set on their own.

The —api-key value is a plaintext CLI flag by existing repo convention; it is sent to the Gateway but never echoed back or logged by this CLI.

—<provider>-params (—openai-params, —elevenlabs-params, —edge-params, —minimax-params, —gemini-params) each take a raw JSON object string for that provider’s dynamic, schema-validated params blob and do not require —provider. —gemini-speakers takes a raw JSON-encoded array string (Gemini multi-speaker voices) and likewise does not require —provider. Both are checked for valid JSON client-side; unknown keys or out-of-range values are rejected by the Gateway with a 422.

dewee tts config set [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --activate | bool | also set —provider as the tenant’s active TTS provider | false | | --api-base | string | provider API base URL override (requires —provider; not supported for edge) | - | | --api-key | string | provider API key (requires —provider; not supported for edge; never echoed back) | - | | --auto | string | auto-speak mode: off|always|inbound|tagged | - | | --edge-params | string | Edge TTS params as a raw JSON object (does not require —provider) | - | | --elevenlabs-params | string | ElevenLabs TTS params as a raw JSON object (does not require —provider) | - | | --enabled | bool | enable/disable provider, Edge only (requires —provider edge) | false | | --gemini-params | string | Gemini TTS params as a raw JSON object (does not require —provider) | - | | --gemini-speakers | string | Gemini multi-speaker voices as a raw JSON-encoded array (does not require —provider) | - | | --group-id | string | group ID, MiniMax only (requires —provider minimax) | - | | --json | bool | output as JSON | false | | --max-length | int | max text length for auto TTS | 0 | | --minimax-params | string | MiniMax TTS params as a raw JSON object (does not require —provider) | - | | --mode | string | auto-speak reply-trigger mode: final|all | - | | --model-id | string | model ID (requires —provider; not supported for edge) | - | | --openai-params | string | OpenAI TTS params as a raw JSON object (does not require —provider) | - | | --provider | string | target provider for provider-specific fields (openai|elevenlabs|edge|minimax|gemini) | - | | --rate | string | speech rate, Edge only (requires —provider edge) | - | | --timeout-ms | int | provider request timeout in milliseconds | 0 | | --voice-id | string | voice ID (requires —provider) | - |

dewee tts list-providers

List TTS providers and their capabilities

dewee tts list-providers [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

dewee tts synthesize

Synthesize speech to an audio file

Synthesize speech through the tenant’s configured TTS provider and write the audio to a file. The Gateway applies the caller’s payload limits and sanitizes upstream errors.

dewee tts synthesize [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --out | string | output file (default speech.mp3) | - | | --text | string | text to synthesize | - |

Examples

dewee tts synthesize --text "Deploy finished" --out deploy.mp3

dewee tts test

Test a TTS provider connection

Test a TTS provider connection via POST /v1/tts/test-connection.

Omit —api-key to test the tenant’s previously saved provider configuration via the server’s fallback. The API key value is never echoed back or logged by the CLI.

dewee tts test [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --api-base | string | override API base URL | - | | --api-key | string | API key to test with (omit to reuse the saved provider config; never echoed) | - | | --group-id | string | group ID (MiniMax) | - | | --json | bool | output as JSON | false | | --model-id | string | model ID to test with | - | | --provider | string | TTS provider to test (required) | - | | --timeout-ms | int | request timeout in milliseconds (client waits at least ~125s by default; pass a larger value to extend further, e.g. for a tenant-configured tts.timeout_ms above 120s) | 0 | | --voice-id | string | voice ID to test with | - |

dewee tts voices

List TTS voices

List available TTS voices via GET /v1/voices.

Use —refresh to force a live upstream refresh via POST /v1/voices/refresh (requires an admin-scoped token) before listing. This is required, not just faster, when switching —provider: GET /v1/voices serves a tenant-wide voice cache that is not keyed by provider, so a plain listing right after switching providers can silently return stale voices from the previous provider.

—provider is passed through unvalidated: the server currently supports “elevenlabs” (default) and “minimax” for live voice listing, which can differ from the broader set of providers in “dewee tts list-providers”.

dewee tts voices [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | --provider | string | TTS provider (optional; server defaults to elevenlabs) | - | | --refresh | bool | force a live refresh (POST /v1/voices/refresh) instead of GET /v1/voices; use when switching providers | false |

dewee upgrade

Upgrade database schema and run data migrations

Applies pending SQL migrations and Go-based data hooks. Safe to run multiple times (idempotent).

dewee upgrade [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | show what would be done without applying changes | false | | --status | bool | show current upgrade status | false |

dewee usage

Inspect token usage and cost metrics

dewee usage

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

dewee usage events

Inspect raw usage-event analytics (tool calls, skill activations, MCP tool calls)

dewee usage events

dewee usage events list

List cost/token usage events broken down by resource, event type, or another dimension

dewee usage events list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent-id | string | filter by agent UUID | - | | --channel | string | filter by channel | - | | --event-type | string | filter by event type (tool_call, skill_activation, mcp_tool_call, runtime_tool_call) | - | | --from | string | start time, RFC3339 (default: 24h ago) | - | | --group-by | string | grouping dimension: resource_name (default), event_type, resource_type, source, status, agent, channel, provider, or model | - | | --limit | int | max rows to return (1-100, default 25) | 0 | | --model | string | filter by LLM model | - | | --provider | string | filter by LLM provider | - | | --resource-name | string | filter by resource name | - | | --resource-type | string | filter by resource type (tool, skill, mcp_tool, runtime_tool) | - | | --since | string | alias for —from | - | | --source | string | filter by source (tool_call, use_skill, slash-command) | - | | --status | string | filter by status | - | | --to | string | end time, RFC3339 (default: now) | - | | --until | string | alias for —to | - |

dewee usage events summary

Show aggregated cost/token totals from raw usage events

dewee usage events summary [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent-id | string | filter by agent UUID | - | | --channel | string | filter by channel | - | | --event-type | string | filter by event type (tool_call, skill_activation, mcp_tool_call, runtime_tool_call) | - | | --from | string | start time, RFC3339 (default: 24h ago) | - | | --model | string | filter by LLM model | - | | --provider | string | filter by LLM provider | - | | --resource-name | string | filter by resource name | - | | --resource-type | string | filter by resource type (tool, skill, mcp_tool, runtime_tool) | - | | --since | string | alias for —from | - | | --source | string | filter by source (tool_call, use_skill, slash-command) | - | | --status | string | filter by status | - | | --to | string | end time, RFC3339 (default: now) | - | | --until | string | alias for —to | - |

dewee usage events timeseries

Show cost/token usage events as time-series points

dewee usage events timeseries [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent-id | string | filter by agent UUID | - | | --channel | string | filter by channel | - | | --event-type | string | filter by event type (tool_call, skill_activation, mcp_tool_call, runtime_tool_call) | - | | --from | string | start time, RFC3339 (default: 24h ago) | - | | --group-by | string | bucket size: hour (default) or day | - | | --model | string | filter by LLM model | - | | --provider | string | filter by LLM provider | - | | --resource-name | string | filter by resource name | - | | --resource-type | string | filter by resource type (tool, skill, mcp_tool, runtime_tool) | - | | --since | string | alias for —from | - | | --source | string | filter by source (tool_call, use_skill, slash-command) | - | | --status | string | filter by status | - | | --to | string | end time, RFC3339 (default: now) | - | | --until | string | alias for —to | - |

dewee usage list

List token usage and cost broken down by provider, model, channel, or agent

dewee usage list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent-id | string | filter by agent UUID | - | | --channel | string | filter by channel | - | | --from | string | start time, RFC3339 (default: 24h ago) | - | | --group-by | string | grouping dimension: provider (default), model, channel, or agent | - | | --model | string | filter by LLM model | - | | --provider | string | filter by LLM provider | - | | --since | string | alias for —from | - | | --to | string | end time, RFC3339 (default: now) | - | | --until | string | alias for —to | - |

dewee usage snapshots

Manage precomputed usage_snapshots rollups

dewee usage snapshots

dewee usage snapshots rebuild

Delete and recompute usage_snapshots for a time range across every tenant

Rebuild discards existing usage_snapshots rows in [—from, —to) and recomputes them from raw trace/span/memory/KG data, reading each row’s tenant directly from the source table. Use this to repair rows written under the master tenant before the tenant-resolution fix landed, or after any bug produced incorrect snapshot rows. Requires master scope (operator/owner credentials, not a tenant-scoped token) since it recomputes usage across every tenant in one pass.

dewee usage snapshots rebuild [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --from | string | start of the range to rebuild, RFC3339 (required) | - | | --to | string | end of the range to rebuild, RFC3339, exclusive (required) | - |

dewee usage summary

Show token usage and cost totals for a period, compared to the previous period

dewee usage summary [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent-id | string | filter by agent UUID | - | | --channel | string | filter by channel | - | | --model | string | filter by LLM model | - | | --period | string | comparison window: 24h, today, 7d, or 30d | 24h | | --provider | string | filter by LLM provider | - |

dewee usage timeseries

Show token usage and cost as time-series points

dewee usage timeseries [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent-id | string | filter by agent UUID | - | | --channel | string | filter by channel | - | | --from | string | start time, RFC3339 (default: 24h ago) | - | | --group-by | string | bucket size: hour (default) or day | - | | --model | string | filter by LLM model | - | | --provider | string | filter by LLM provider | - | | --since | string | alias for —from | - | | --to | string | end time, RFC3339 (default: now) | - | | --until | string | alias for —to | - |

dewee vault

Inspect and manage Knowledge Vault documents

dewee vault

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee vault enrichment

Inspect or stop vault enrichment

dewee vault enrichment

dewee vault enrichment status

Show vault enrichment status

dewee vault enrichment status

dewee vault enrichment stop

Stop vault enrichment

dewee vault enrichment stop --yes [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --yes | bool | confirm stop | false |

dewee vault get

Get one vault document

dewee vault get <doc-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID for per-agent route | - |

dewee vault graph

Show vault relationship graph

dewee vault graph [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID filter | - | | --limit | int | maximum nodes | 2000 | | --team | string | team UUID filter | - |

dewee vault link

Manage vault document links

dewee vault link

dewee vault link create

Create a vault document link

dewee vault link create --from <doc-id> --to <doc-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID for per-agent route | - | | --context | string | link context | - | | --from | string | source document ID | - | | --to | string | target document ID | - | | --type | string | link type | - |

dewee vault link delete

Delete a vault document link

dewee vault link delete <link-id> --yes [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID for per-agent route | - | | --yes | bool | confirm deletion | false |

dewee vault links

Show vault document links

dewee vault links <doc-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID for per-agent route | - |

dewee vault list

List vault documents

dewee vault list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID filter | - | | --limit | int | page size | 20 | | --offset | int | pagination offset | 0 | | --scope | string | scope filter | - | | --team | string | team UUID filter | - | | --type | string | comma-separated document types | - |

dewee vault rescan

Rescan workspace files into the vault

dewee vault rescan

dewee vault search

Search vault documents

dewee vault search --query <query> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID for scoped search | - | | --limit | int | maximum results | 10 | | --query | string | search query | - | | --scope | string | scope filter | - | | --team | string | team UUID filter | - | | --types | string | comma-separated document types | - |

dewee vault tree

List vault tree entries

dewee vault tree [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID filter | - | | --path | string | path prefix | - | | --scope | string | scope filter | - | | --team | string | team UUID filter | - | | --types | string | comma-separated document types | - |

dewee vault upload

Upload a file into the vault

dewee vault upload --file <file> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --agent | string | agent UUID target | - | | --file | string | file to upload | - | | --team | string | team UUID target | - |

dewee version

Print version information

Print the CLI version, the WebSocket protocol version and the CLI contract version.

With —check-server the CLI also reads the gateway’s /v1/runtime/status and reports whether the gateway serves this CLI’s contract. An unsupported contract fails with INCOMPATIBLE_VERSION.

dewee version [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --check-server | bool | also query the gateway (/v1/runtime/status) and report contract compatibility | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee version
  dewee version -o json
  dewee version --check-server -o json

dewee workflows

Manage deterministic visual workflows

dewee workflows

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false | | -o, --output | string | output format (table|json) | table |

dewee workflows apply

Apply a workflow definition file to create or update draft

dewee workflows apply -f <file.json> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -f, --file | string | path to workflow definition JSON file | - |

dewee workflows create

Create a new workflow

dewee workflows create <slug> <name> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --desc | string | workflow description | - |

dewee workflows delete

Delete a workflow

dewee workflows delete <id_or_slug> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -y, --yes | bool | confirm deletion without interactive prompt | false |

dewee workflows disable

Disable a workflow

dewee workflows disable <id_or_slug>

dewee workflows enable

Enable a workflow

dewee workflows enable <id_or_slug>

dewee workflows export

Export workflow definition JSON

dewee workflows export <id_or_slug>

dewee workflows list

List all workflows

dewee workflows list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -q, --query | string | filter workflows by name or slug | - |

dewee workflows node-types

List all supported workflow node types

dewee workflows node-types

dewee workflows publish

Publish workflow draft as immutable version

dewee workflows publish <id_or_slug> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -y, --yes | bool | confirm publication without interactive prompt | false |

dewee workflows rollback

Roll back to an earlier published version

dewee workflows rollback <id_or_slug> --version <n> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --version | int | target version number | 0 | | -y, --yes | bool | confirm rollback | false |

dewee workflows runs

Manage and inspect workflow execution runs

dewee workflows runs

dewee workflows runs cancel

Cancel an in-flight workflow run

dewee workflows runs cancel <runId>

dewee workflows runs list

List workflow runs

dewee workflows runs list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -s, --status | string | filter by run status | - | | -w, --workflow | string | filter by workflow ID | - |

dewee workflows runs retry

Retry a failed or cancelled workflow run

dewee workflows runs retry <runId> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --from-node | string | restart from specific node ID | - |

dewee workflows runs show

Show details and node timeline for a workflow run

dewee workflows runs show <runId>

dewee workflows runs tail

Follow live progress of a workflow run until it completes

dewee workflows runs tail <runId>

dewee workflows show

Show workflow details

dewee workflows show <id_or_slug>

dewee workflows trigger

Trigger a workflow run

dewee workflows trigger <id_or_slug> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -i, --input | stringSlice | workflow input key=value pairs | [] |

dewee workflows validate

Validate a workflow definition

dewee workflows validate -f <file.json> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -f, --file | string | path to workflow definition JSON file | - |

dewee workspace-setup

Review and drive the workspace setup plan (requires running gateway)

Read and edit the durable workspace setup plan, get recommendations, check readiness and answer setup cards. Everything the setup concierge does in chat is reachable here.

plan approve, actions respond and next are human-only: the gateway rejects an agent principal for them, and the setup policy blocks them for setup operators. Writes that take —if-revision send it as If-Match; a stale revision fails with CONFLICT (exit 6): reload the plan and retry.

dewee workspace-setup

dewee workspace-setup actions

List, answer and cancel setup cards

Setup cards (choice, form, secret, approval and test requests) are what the setup concierge asks the user. respond answers one; it is human only.

dewee workspace-setup actions

dewee workspace-setup actions cancel

Cancel a pending setup card and revoke its form link

dewee workspace-setup actions cancel <card-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee workspace-setup actions cancel <card-id> -o json

dewee workspace-setup actions get

Show one setup card

dewee workspace-setup actions get <card-id> [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee workspace-setup actions get <card-id> -o json

dewee workspace-setup actions list

List the setup cards of a session (default: the setup session)

Lists a session’s setup cards oldest first. —kind narrows the list to those card kinds (repeat it or separate kinds with commas). When older cards remain, the response carries next_cursor; pass it back with —cursor (and the same filters) for the next, older page.

dewee workspace-setup actions list [--session-key <key>] [--kind <kind>]... [--limit <n>] [--cursor <next_cursor>] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --cursor | string | next_cursor of the previous page, to list older cards | - | | --kind | stringSlice | only cards of these kinds (repeatable or comma-separated): choice_request, secret_request, oauth_request, permission_request, install_request, upload_request, plan_review, connection_test, command_preview, setup_progress, handoff | [] | | --limit | int | maximum number of cards (default: the gateway’s limit) | 0 | | -o, --output | string | output format (table|json) | table | | --session-key | string | session whose cards to list (default: the setup session) | - |

Examples

dewee workspace-setup actions list -o json
  dewee workspace-setup actions list --kind connection_test --limit 50 -o json
  dewee workspace-setup actions list --kind connection_test --cursor <next_cursor> -o json

dewee workspace-setup actions respond

Answer a setup card (human only)

Answer a setup card. —file is the JSON response (”-” reads stdin). A secret_request card’s secret is read from stdin (—secret-stdin) or a file (—secret-file), never from a flag value, and is sent once without being printed; —secret-field names the card field it fills, inferred when the card asks for exactly one secret. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it.

dewee workspace-setup actions respond <card-id> [--file <response.json>] [--secret-stdin | --secret-file <path>] [--secret-field <key>] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --file | string | JSON response document (”-” reads stdin) | - | | -o, --output | string | output format (table|json) | table | | --secret-field | string | secret_request field the secret fills (default: the card’s only secret field) | - | | --secret-file | string | read the card’s secret from a file (”-” reads stdin) | - | | --secret-stdin | bool | read the card’s secret from stdin | false |

Examples

printf '%s' "$ANTHROPIC_API_KEY" | dewee workspace-setup actions respond <card-id> --secret-stdin -o json
  dewee workspace-setup actions respond <card-id> --file response.json

dewee workspace-setup capabilities

Show whether this runtime can run guided setup, with its versions and features

Ask the gateway whether it serves guided setup (the Setup Concierge). When it does not, the reason says why, for example setup_store_unavailable. The control panel asks the same question before it picks a setup surface.

dewee workspace-setup capabilities [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee workspace-setup capabilities -o json

dewee workspace-setup catalog

List the provider types setup can configure

dewee workspace-setup catalog [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee workspace-setup catalog -o json

dewee workspace-setup metrics

Show setup funnel metrics (events, durations, CLI outcomes)

dewee workspace-setup metrics [--since <RFC3339>] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table | | --since | string | start of the window (RFC3339; default: the gateway’s window) | - |

Examples

dewee workspace-setup metrics --since 2026-09-01T00:00:00Z -o json

dewee workspace-setup next

Advance the setup conversation and show the next card (human only)

Ask the setup concierge for the next step. It returns the current stage and, when input is needed, a card to answer with dewee workspace-setup actions respond. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it.

dewee workspace-setup next [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee workspace-setup next -o json

dewee workspace-setup plan

Read, edit and approve the workspace setup plan

dewee workspace-setup plan

dewee workspace-setup plan approve

Approve the setup plan (human only)

Approve the reviewed plan: —mode all approves every step, essential only the essential ones. Approval opens the batch window in which a setup operator may apply reversible configuration. Human only: the gateway answers an agent with PERMISSION_DENIED (exit 4) and the setup policy blocks it; —dry-run previews it.

dewee workspace-setup plan approve --mode <all|essential> [--if-revision <n>] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --if-revision | int64 | plan revision this write is based on (sent as If-Match; a stale revision fails with CONFLICT) | 0 | | --mode | string | approval mode: all, essential | - | | -o, --output | string | output format (table|json) | table |

Examples

dewee workspace-setup plan approve --mode essential --if-revision 3 -o json

dewee workspace-setup plan edit

Edit the setup plan (goal, step priorities, added or removed steps)

Send a plan edit document (”-” reads stdin) as PUT /v1/workspace-setup/plan. The gateway validates it strictly and rejects unknown fields. Editing an approved plan returns it to review.

dewee workspace-setup plan edit --file <edit.json> [--if-revision <n>] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --file | string | JSON plan edit document (”-” reads stdin) | - | | --if-revision | int64 | plan revision this write is based on (sent as If-Match; a stale revision fails with CONFLICT) | 0 | | -o, --output | string | output format (table|json) | table |

Examples

dewee workspace-setup plan edit --file edit.json --if-revision 3 -o json
  printf '{"goal":"customer support"}' | dewee workspace-setup plan edit --file - --dry-run

dewee workspace-setup plan get

Show the setup plan with its steps and revision

dewee workspace-setup plan get [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee workspace-setup plan get -o json

dewee workspace-setup readiness

Check whether the workspace is ready, with a recovery step per failed check

dewee workspace-setup readiness [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee workspace-setup readiness -o json

dewee workspace-setup recommend

Recommend a setup for the goal, optionally writing it into the plan

Ask the gateway’s recommender for a setup that fits the goal (default: the plan’s stored goal) and the workspace’s current providers, channels and tools. Without —apply it changes nothing; —apply writes the recommendation into the plan, and —optimize lets it replace steps the plan already has.

dewee workspace-setup recommend [--goal <text>] [--apply] [--optimize] [--if-revision <n>] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --apply | bool | write the recommendation into the plan | false | | --dry-run | bool | print the exact request (secrets redacted) and its setup policy class without sending anything | false | | --goal | string | what the workspace should help with (default: the plan’s goal) | - | | --if-revision | int64 | plan revision this write is based on (sent as If-Match; a stale revision fails with CONFLICT) | 0 | | --optimize | bool | with —apply, let the recommendation replace existing steps | false | | -o, --output | string | output format (table|json) | table |

Examples

dewee workspace-setup recommend --goal "answer customer email" -o json
  dewee workspace-setup recommend --apply --if-revision 3 --dry-run

dewee workspace-setup steps

List and update the steps of the setup plan

dewee workspace-setup steps

dewee workspace-setup steps list

List the plan steps with their priority and status

dewee workspace-setup steps list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | -o, --output | string | output format (table|json) | table |

Examples

dewee workspace-setup steps list -o json

dewee workspace-setup steps set

Set a step’s status or priority

Update one plan step. —status is one of ready, blocked, running, done, skipped, failed; —priority is one of essential, recommended, later. The gateway enforces the allowed status transitions.

dewee workspace-setup steps set <step-id> [--status <status>] [--priority <priority>] [--if-revision <n>] [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --if-revision | int64 | plan revision this write is based on (sent as If-Match; a stale revision fails with CONFLICT) | 0 | | -o, --output | string | output format (table|json) | table | | --priority | string | new step priority | - | | --status | string | new step status | - |

Examples

dewee workspace-setup steps set channel.telegram --status skipped --if-revision 3 -o json

dewee workstations

Manage runtime workstation nodes owned by this tenant

Manage workstation nodes registered to the caller’s tenant.

Only nodes owned by the caller’s tenant are returned; platform fleet inventory is not reachable from this command.

dewee workstations

dewee workstations create

Register a workstation node for this tenant

dewee workstations create [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --host | string | workstation host | - | | --json | bool | output as JSON | false | | --name | string | workstation name | - |

Examples

dewee workstations create --name build-01 --host 10.0.0.7

dewee workstations delete

Remove a workstation node owned by this tenant

dewee workstations delete <id>

Examples

dewee workstations delete <id>

dewee workstations list

List this tenant’s workstation nodes

dewee workstations list [flags]

Flags

| Flag | Type | Description | Default | |---|---|---|---| | --json | bool | output as JSON | false |

Examples

dewee workstations list --json