Skip to content

cli.md

Latest commit

 

History

History
2926 lines (1866 loc) · 78.2 KB

cli.md

File metadata and controls

2926 lines (1866 loc) · 78.2 KB
Raw

Command-line reference

Generated from cyber's argument definitions; cyber <command> --help prints the same text. Options under cyber marked Global apply to every subcommand and are not repeated below.

cyber

Cyber Code: a model-independent coding agent you can interrupt, inspect and resume

cyber [OPTIONS] [COMMAND]

Options:

  • -V, --version: Print version information.
  • --cwd <PATH>: Working directory (the Location). The only working-directory flag. Global.
  • --profile <NAME>: Named profile from the profiles config key. Global.
  • --config <KEY=VALUE>: Set one config value for this process, as a dotted key and a JSON or string value. Global.
  • -m, --model <MODEL>: Model as provider/model[#variant]. Global.
  • --mode <MODE>: Permission mode: default, accept-edits, plan, auto, dont-ask or bypass. Global.
  • --log-level <LEVEL>: Minimum log level: error, warn, info (default), debug or trace. Also CYBER_LOG_LEVEL. Global.
  • --print-logs: Mirror log lines to stderr. Global.
  • --format <FORMAT>: Output format. The only output-format flag. Values: table, json, text, stream-json, md, html. Global.
  • --pure: Disable plugins and every hook and MCP server not managed by organization policy for this process. Also CYBER_PURE=1. Global.
  • --features <LIST>: Turn features on or off for this process, as a comma list where -name turns one off (teams,-other). Above CYBER_FEATURES and config; below organization policy. Commands served by the background server (cyber teams list, the TUI) follow its configuration instead: use cyber features enable, or the TUI with --embedded. Global.
  • --worktree [<NAME>]: Start a new Session in a managed worktree; omit NAME to generate one.
  • -c, --continue: Resume the most recent Session of the Location.
  • -r, --resume [<RESUME>]: Resume a Session by ID or name; without a value, open the picker.
  • --fork: Copy the selected Session into a new one.
  • --agent <AGENT>
  • --prompt <PROMPT>: Submit an initial prompt (piped stdin is prepended)
  • --embedded: Run a private in-process server instead of the background service.
  • --sandbox <SANDBOX>: Sandbox policy for an embedded server: read-only, workspace-write or full-access.
  • --dangerously-bypass-permissions: Allow bypass mode in an embedded server without a sandbox or a container.
  • --dangerously-skip-permissions: Claude Code's name for running without prompts: start in bypass mode with --dangerously-bypass-permissions, so every action runs without approval and, outside a sandbox or a container, without OS confinement. Needs --embedded: the shared server cannot take the override for one TUI (there, use --mode bypass where its sandbox or a container already admits it). An organization policy that disables bypass still refuses it.
  • --from-pr <NUMBER|URL>: Open the Session picker over the Sessions linked to this pull request.

Subcommands:

  • hex: Open the project file in the owner hex/ASCII workspace without inference
  • login: Sign in to a Cyber Account for collaboration and other networked features
  • whoami: Show the current Cyber Account without exposing tokens
  • logout: Remove Cyber Account credentials, keeping provider logins and local Sessions
  • import: Import Claude Code, Codex or OpenCode configuration: detect, preview or write
  • lsp: Inspect installed language servers for the current Location
  • fmt: Inspect detected formatters for the current Location
  • memory: Review and edit durable project/global memory
  • sessions: List, show, rename and delete the Location's Sessions
  • skills: Inspect skills: source, scope, permission effect and diagnostics
  • commands: Inspect slash commands and command discovery diagnostics
  • mcp: Review MCP server definitions, individual server approvals and OAuth credentials
  • teams: Agent teams (feature teams): list, show, stop and resume teams; list definitions
  • computer: Inspect, set up, arm and stop experimental native computer control
  • features: List the feature registry; enable or disable a feature in config
  • workflows: List saved Workflows; run, inspect and control Workflow Runs
  • worktree: List, remove and prune managed Git worktrees of the current repository
  • debug: Inspect resolved paths, configuration and build information
  • models: List models from the catalog, available first
  • providers: Sign in to or out of a provider (today: chatgpt, a ChatGPT Plus/Pro subscription, and copilot, a GitHub Copilot plan)
  • permissions: Dry-run permission rules; inspect or reset checkout-scoped auto-mode statistics
  • db: Inspect the local database
  • plugins: Install, list, enable, disable, update and remove plugins
  • hooks: Review hook definitions and individual handler trust
  • sandbox: Test, explain or run a command under the effective OS sandbox policy
  • trust: Inspect and approve repository-controlled configuration for this checkout
  • exec: Run one prompt non-interactively (alias: cyber -p)
  • attach: Open the TUI on a Session of a paired machine: cyber attach @
  • review: Review uncommitted changes, a range, a commit or a pull request
  • pr: Check out a pull request and resume the Session linked to it
  • git: Generate commit and pull request text with the small model
  • web: Open the local web dashboard and remote approval inbox
  • serve: Run the server in the foreground
  • service: Manage the background server
  • api: Send one request to the server API
  • collab: Work with people and their locally running agents through a project hub
  • peers: Pair with other machines' cyber servers to message their Sessions
  • messages: Send messages between Sessions and read their message history
  • doctor: Check configuration, skills, commands, credentials, catalog, database, sandbox, tools and server
  • stats: Usage statistics: activity, streaks, tokens, cost and per-model totals
  • telemetry: The server's OpenTelemetry export status: settings, sources and counters
  • upgrade: Upgrade cyber to the channel's latest version or to VERSION
  • uninstall: Remove cyber: its binary (script installs), PATH lines and directories
  • eval: Run evaluation manifests and write reports

cyber hex

Open the project file in the owner hex/ASCII workspace without inference

cyber hex [OPTIONS] <PATH>

Arguments:

  • <PATH>: File, resolved against --cwd and confined to its project.

Options:

  • --offset <OFFSET>: Initial byte offset, as decimal or 0x hexadecimal. Default: 0.
  • --session <SESSION>: Open an existing Session without rebinding its Location.
  • --read-only: Inspect bytes without enabling draft edits.
  • --recover <RECOVER>: Reopen a kept manual draft in its original --session.

cyber login

Sign in to a Cyber Account for collaboration and other networked features

cyber login [OPTIONS]

Options:

  • --no-browser: Print the login URL and accept a pasted redirect; use device login if advertised.
  • --reauth: Require a new authentication for a recent-authentication approval.

cyber whoami

Show the current Cyber Account without exposing tokens

cyber whoami [OPTIONS]

Options:

  • --org <ORG>: Select an authorized organization by short name or immutable ID.

cyber logout

Remove Cyber Account credentials, keeping provider logins and local Sessions

cyber logout [OPTIONS]

Options:

  • --all: Remove every stored Cyber Account, not only the active account.

cyber import

Import Claude Code, Codex or OpenCode configuration: detect, preview or write

cyber import [OPTIONS] [TOOL]

Arguments:

  • [TOOL]: Values: claude, codex, opencode, auto.

Options:

  • --detect
  • --dry-run: Print the file diff and the mapping report; never write.
  • --yes: Write without asking for confirmation.
  • --include <INCLUDE>: Also import these items. Values: sessions.
  • --scope <SCOPE>: Values: project, global. Default: project.

cyber lsp

Inspect installed language servers for the current Location

cyber lsp [OPTIONS] <COMMAND>

Subcommands:

cyber lsp status

cyber lsp status [OPTIONS]

cyber fmt

Inspect detected formatters for the current Location

cyber fmt [OPTIONS] <COMMAND>

Subcommands:

cyber fmt status

cyber fmt status [OPTIONS]

cyber memory

Review and edit durable project/global memory

cyber memory [OPTIONS] <COMMAND>

Subcommands:

  • list: List note metadata and invalid-file diagnostics
  • show: Print a memory's content
  • edit: Edit a private draft with EDITOR (or VISUAL), then validate and commit it
  • delete: Delete a note and update its index through the recovery journal
  • recovery: Inspect an interrupted transaction and its proposed content without recovery
  • recover: Recover local files only if the reviewed fingerprint still matches
  • recovery-request: Inspect a retained server recovery request without repeating its effects
  • path: Print the memory directory without creating it

cyber memory list

List note metadata and invalid-file diagnostics

cyber memory list [OPTIONS]

cyber memory show

Print a memory's content

cyber memory show [OPTIONS] <NAME>

Arguments:

  • <NAME>

cyber memory edit

Edit a private draft with EDITOR (or VISUAL), then validate and commit it

cyber memory edit [OPTIONS] <NAME>

Arguments:

  • <NAME>

cyber memory delete

Delete a note and update its index through the recovery journal

cyber memory delete [OPTIONS] <NAME>

Arguments:

  • <NAME>

cyber memory recovery

Inspect an interrupted transaction and its proposed content without recovery

cyber memory recovery [OPTIONS]

cyber memory recover

Recover local files only if the reviewed fingerprint still matches

cyber memory recover [OPTIONS] --review <REVIEW>

Options:

  • --review <REVIEW>
  • --admission-review <ADMISSION_REVIEW>: Database fingerprint from recovery --server.
  • --key <KEY>: Retain this key for retries and durable receipt lookup.

cyber memory recovery-request

Inspect a retained server recovery request without repeating its effects

cyber memory recovery-request [OPTIONS] --server --key <KEY>

Options:

  • --key <KEY>

cyber memory path

Print the memory directory without creating it

cyber memory path [OPTIONS]

cyber sessions

List, show, rename and delete the Location's Sessions

cyber sessions [OPTIONS] <COMMAND>

Subcommands:

  • list: The Location's Sessions, most recently updated first
  • show: One Session: title, Location, model, status and usage
  • rename: Give a Session a title to find and resume it by later
  • delete: Delete a Session with its child Sessions
  • tree: The Session's user-message tree: * marks the active path
  • checkout: Make another branch active; the Session must be idle
  • rewind: Preview a rewind before a user message; apply only with its reviewed fingerprint
  • label: Set or remove a branch label
  • export: Write a Session as JSON (default), Markdown (--format md) or one self-contained HTML page (--format html): its info, messages, tool calls, goals and workflow runs
  • import: Import a JSON export (cyber sessions export) as a new Session in this Location, with fresh IDs and its attachments, which are verified before anything is written

cyber sessions list

The Location's Sessions, most recently updated first

cyber sessions list [OPTIONS]

Options:

  • --limit <LIMIT>: At most this many (1 to 200) Default: 50.

cyber sessions show

One Session: title, Location, model, status and usage

cyber sessions show [OPTIONS] <SESSION>

Arguments:

  • <SESSION>: ID, exact title or unique ID prefix.

cyber sessions rename

Give a Session a title to find and resume it by later

cyber sessions rename [OPTIONS] <SESSION> <TITLE>...

Arguments:

  • <SESSION>: ID, exact title or unique ID prefix.
  • <TITLE>...: The new title; words are joined with spaces.

cyber sessions delete

Delete a Session with its child Sessions

cyber sessions delete [OPTIONS] <SESSION>

Arguments:

  • <SESSION>: ID, exact title or unique ID prefix.

Options:

  • --yes: Confirm the deletion; it cannot be undone.

cyber sessions tree

The Session's user-message tree: * marks the active path

cyber sessions tree [OPTIONS] <SESSION>

Arguments:

  • <SESSION>: ID, exact title or unique ID prefix.

cyber sessions checkout

Make another branch active; the Session must be idle

cyber sessions checkout [OPTIONS] <SESSION> <MESSAGE>

Arguments:

  • <SESSION>: ID, exact title or unique ID prefix.
  • <MESSAGE>: A message ID, a branch label or a unique message ID prefix; the newest tip under it becomes active.

Options:

  • --code: Also restore files to the branch's last snapshot, keeping your own edits.
  • --exact: Make the message itself the tip; the next prompt branches there.

cyber sessions rewind

Preview a rewind before a user message; apply only with its reviewed fingerprint

cyber sessions rewind [OPTIONS] --to <TO> <SESSION>

Arguments:

  • <SESSION>: ID, exact title or unique ID prefix.

Options:

  • --to <TO>: Exact active user-message ID; the boundary itself is excluded on conversation rewind.
  • --target <TARGET>: Values: code, conversation, both. Default: both.
  • --confirm <CONFIRM>: Apply the exact previously reviewed preview; changed context requires a new preview.

cyber sessions label

Set or remove a branch label

cyber sessions label [OPTIONS] <SESSION> <NAME>

Arguments:

  • <SESSION>: ID, exact title or unique ID prefix.
  • <NAME>: The label: letters, digits, ., _ and -, at most 48.

Options:

  • --at <AT>: The message to label (ID, label or unique prefix); the active tip by default.
  • --delete: Remove the label instead.

cyber sessions export

Write a Session as JSON (default), Markdown (--format md) or one self-contained HTML page (--format html): its info, messages, tool calls, goals and workflow runs

cyber sessions export [OPTIONS] <SESSION>

Arguments:

  • <SESSION>: ID, exact title or unique ID prefix.

Options:

  • --sanitize: Replace prompts, answers, paths, URLs, tool inputs and outputs and metadata with [redacted::] markers, keeping structure, token counts and timings.
  • --include-children: Include child Sessions (subagents, workflow agents), recursively.
  • --all-branches: Include every branch; each message's parent_message_id links the tree.
  • -o, --output <FILE>: Write the export to this file, atomically, instead of stdout. A symlink is refused; an existing file keeps its permissions, a new one is private.

cyber sessions import

Import a JSON export (cyber sessions export) as a new Session in this Location, with fresh IDs and its attachments, which are verified before anything is written

cyber sessions import [OPTIONS] <FILE>

Arguments:

  • <FILE>: The export file.

cyber skills

Inspect skills: source, scope, permission effect and diagnostics

cyber skills [OPTIONS] <COMMAND>

Subcommands:

  • list: List skills with source, scope, permission effect and diagnostics
  • show: Show one skill, including skipped definitions of that name
  • trust: Approve a remote skill source (https:// entry) configured outside your user config for this checkout, bound to its URL and currently cached content

cyber skills list

List skills with source, scope, permission effect and diagnostics

cyber skills list [OPTIONS]

Options:

  • --agent <AGENT>: Evaluate permissions for this agent. Default: build.

cyber skills show

Show one skill, including skipped definitions of that name

cyber skills show [OPTIONS] <NAME>

Arguments:

  • <NAME>

Options:

  • --agent <AGENT>: Evaluate permissions for this agent. Default: build.

cyber skills trust

Approve a remote skill source (https:// entry) configured outside your user config for this checkout, bound to its URL and currently cached content

cyber skills trust [OPTIONS] <URL>

Arguments:

  • <URL>

cyber commands

Inspect slash commands and command discovery diagnostics

cyber commands [OPTIONS] <COMMAND>

Subcommands:

  • list: List slash commands and command discovery diagnostics
  • trust: Approve a project command or skill template that runs shell commands (!`cmd`) for this checkout. A changed template needs a new approval

cyber commands list

List slash commands and command discovery diagnostics

cyber commands list [OPTIONS]

cyber commands trust

Approve a project command or skill template that runs shell commands (!`cmd`) for this checkout. A changed template needs a new approval

cyber commands trust [OPTIONS] <NAME>

Arguments:

  • <NAME>

cyber mcp

Review MCP server definitions, individual server approvals and OAuth credentials

cyber mcp [OPTIONS] <COMMAND>

Subcommands:

  • list: List configured servers with their live status, transport and tool count
  • add: Add a server to the user, project or local config document, keeping its comments: --url <url> for a remote server, or -- <command> [args...] for a local one
  • remove: Remove a server from the config document that defines it
  • definitions: Review loaded server definitions, origins and digests without connecting
  • get: Display one loaded server and its resolved output options without connecting
  • trust: Approve an inspected, currently loaded project server definition
  • untrust: Revoke an individual server digest, including an obsolete definition
  • auth: Authorize a remote server with OAuth: prints the authorization URL to open in a browser, waits for the loopback callback and stores the token privately
  • serve: Serve Cyber Code Sessions to an MCP client: a stdio bridge to the shared server, or --transport http to print its endpoint. Reads only the global config and never opens the database
  • logout: Remove every stored OAuth credential of a server (at any URL, from any issuer) and ask a running server to reconnect without it. Tokens are not revoked remotely
  • browser: Install, check and clean up the optional browser verification server

cyber mcp list

List configured servers with their live status, transport and tool count

cyber mcp list [OPTIONS]

cyber mcp add

Add a server to the user, project or local config document, keeping its comments: --url <url> for a remote server, or -- <command> [args...] for a local one

cyber mcp add [OPTIONS] <NAME> [-- <COMMAND>...]

Arguments:

  • <NAME>: Server name (letters, digits, - and _)
  • [COMMAND]...: A local (stdio) server: the command and its arguments, after --.

Options:

  • --scope <SCOPE>: Values: user, project, local. Default: user.
  • --url <URL>: A remote (Streamable HTTP) server URL.
  • --header <K=V>: A request header for a remote server, as Name=value (repeatable)
  • --env <K=V>: An environment variable for a local server, as NAME=value (repeatable)

cyber mcp remove

Remove a server from the config document that defines it

cyber mcp remove [OPTIONS] <NAME>

Arguments:

  • <NAME>

Options:

  • --scope <SCOPE>: Values: user, project, local.

cyber mcp definitions

Review loaded server definitions, origins and digests without connecting

cyber mcp definitions [OPTIONS]

cyber mcp get

Display one loaded server and its resolved output options without connecting

cyber mcp get [OPTIONS] <NAME>

Arguments:

  • <NAME>

cyber mcp trust

Approve an inspected, currently loaded project server definition

cyber mcp trust [OPTIONS] --digest <DIGEST> <NAME>

Arguments:

  • <NAME>

Options:

  • --digest <DIGEST>

cyber mcp untrust

Revoke an individual server digest, including an obsolete definition

cyber mcp untrust [OPTIONS] --digest <DIGEST>

Options:

  • --digest <DIGEST>

cyber mcp auth

Authorize a remote server with OAuth: prints the authorization URL to open in a browser, waits for the loopback callback and stores the token privately

cyber mcp auth [OPTIONS] <NAME>

Arguments:

  • <NAME>

Options:

  • --port <PORT>: Loopback callback port (overrides oauth.redirect_port; default ephemeral)

cyber mcp serve

Serve Cyber Code Sessions to an MCP client: a stdio bridge to the shared server, or --transport http to print its endpoint. Reads only the global config and never opens the database

cyber mcp serve [OPTIONS]

Options:

  • --transport <TRANSPORT>: Values: stdio, http. Default: stdio.
  • --client <LABEL>: Attribution label sent as X-Cyber-MCP-Client (^[a-z0-9][a-z0-9_-]{0,47}$); defaults to the client's clientInfo.name.

cyber mcp logout

Remove every stored OAuth credential of a server (at any URL, from any issuer) and ask a running server to reconnect without it. Tokens are not revoked remotely

cyber mcp logout [OPTIONS] <NAME>

Arguments:

  • <NAME>

cyber mcp browser

Install, check and clean up the optional browser verification server

cyber mcp browser [OPTIONS] <COMMAND>

Subcommands:

  • install: Write the pinned browser MCP server and enable browser verification
  • health: Start the configured browser server once and check the tools it offers
  • cleanup: Remove per-Session browser profiles that no running process holds

cyber mcp browser install

Write the pinned browser MCP server and enable browser verification

cyber mcp browser install [OPTIONS]

Options:

  • --scope <SCOPE>: Values: user, project, local. Default: user.
  • --server <SERVER>: The MCP server name (letters, digits, - and _) Default: browser.

cyber mcp browser health

Start the configured browser server once and check the tools it offers

cyber mcp browser health [OPTIONS]

cyber mcp browser cleanup

Remove per-Session browser profiles that no running process holds

cyber mcp browser cleanup [OPTIONS]

cyber teams

Agent teams (feature teams): list, show, stop and resume teams; list definitions

cyber teams [OPTIONS] <COMMAND>

Subcommands:

  • list: The Location's teams, newest first
  • show: A team's members (status, current task, cost, last message) and its task board
  • stop: Stop a team: teammates finish their current Turn; queued input stays queued
  • resume: Resume a stopped team; after its lead was deleted, --lead names the new one
  • definitions: Team definitions from .cyber/teams/*.md (trusted checkouts) and ~/.config/cyber/teams/*.md; a project definition wins on a name clash

cyber teams list

The Location's teams, newest first

cyber teams list [OPTIONS]

Options:

  • --status <STATUS>: Only teams with this status. Values: active, stopping, stopped.

cyber teams show

A team's members (status, current task, cost, last message) and its task board

cyber teams show [OPTIONS] <TEAM>

Arguments:

  • <TEAM>: A team_ ID, or the name of a team of this Location (the newest one by that name)

cyber teams stop

Stop a team: teammates finish their current Turn; queued input stays queued

cyber teams stop [OPTIONS] <TEAM>

Arguments:

  • <TEAM>: A team_ ID, or the name of a team of this Location (the newest one by that name)

cyber teams resume

Resume a stopped team; after its lead was deleted, --lead names the new one

cyber teams resume [OPTIONS] <TEAM>

Arguments:

  • <TEAM>: A team_ ID, or the name of a team of this Location (the newest one by that name)

Options:

  • --lead <LEAD>: The new lead (ID, exact title or unique ID prefix) of a team whose lead was deleted.

cyber teams definitions

Team definitions from .cyber/teams/*.md (trusted checkouts) and ~/.config/cyber/teams/*.md; a project definition wins on a name clash

cyber teams definitions [OPTIONS]

cyber computer

Inspect, set up, arm and stop experimental native computer control

cyber computer [OPTIONS] <COMMAND>

Subcommands:

  • status: Inspect native OS consent and the running binary; optionally a Session's grant
  • setup: Request macOS Screen Recording and Accessibility consent for the running server
  • allow: Review and arm one application window or an explicitly selected display
  • stop: Immediately revoke native control; without a Session, revoke all host control

cyber computer status

Inspect native OS consent and the running binary; optionally a Session's grant

cyber computer status [OPTIONS] [SESSION]

Arguments:

  • [SESSION]

cyber computer setup

Request macOS Screen Recording and Accessibility consent for the running server

cyber computer setup [OPTIONS]

Options:

  • --yes: Explicitly allow the operating system permission prompts.

cyber computer allow

Review and arm one application window or an explicitly selected display

cyber computer allow [OPTIONS] <SESSION>

Arguments:

  • <SESSION>

Options:

  • --app <APP>: Bundle ID of the application (for example com.apple.TextEdit)
  • --display <DISPLAY>: Native display ID; 0 explicitly selects the main display.
  • --ttl <TTL>: Lifetime in seconds (1–900); default 300.
  • --yes: Confirm this native scope after reviewing its details printed below.
  • --acknowledge-unknown: Acknowledge the reviewed unresolved native operations before rearming.

cyber computer stop

Immediately revoke native control; without a Session, revoke all host control

cyber computer stop [OPTIONS] [SESSION]

Arguments:

  • [SESSION]

cyber features

List the feature registry; enable or disable a feature in config

cyber features [OPTIONS] <COMMAND>

Subcommands:

  • list: Every feature with its maturity, default, effective value and source
  • enable: Turn a feature on in the user or project configuration
  • disable: Turn a feature off in the user or project configuration

cyber features list

Every feature with its maturity, default, effective value and source

cyber features list [OPTIONS]

Options:

  • --json: Print JSON (same as --format json)

cyber features enable

Turn a feature on in the user or project configuration

cyber features enable [OPTIONS] <NAME>

Arguments:

  • <NAME>

Options:

  • --scope <SCOPE>: Values: user, project. Default: user.

cyber features disable

Turn a feature off in the user or project configuration

cyber features disable [OPTIONS] <NAME>

Arguments:

  • <NAME>

Options:

  • --scope <SCOPE>: Values: user, project. Default: user.

cyber workflows

List saved Workflows; run, inspect and control Workflow Runs

cyber workflows [OPTIONS] <COMMAND>

Subcommands:

  • integrations: Compose, verify and review complementary agent contributions in isolation
  • list: List the Workflow library (project overrides global, both override bundled) and modules that fail to load
  • eject: Copy a bundled Workflow's source into .cyber/workflows/ (or the global directory) to customize it; the copy then overrides the bundled one
  • run: Start a Workflow Run from a saved name or a script file
  • runs: List recent Workflow Runs of this Location: active runs first, then the newest
  • show: Show one Workflow Run and its agents (run_…), or a library Workflow's meta, args schema, default budget and origin (a Workflow name)
  • pause: Pause a Workflow Run: in-flight agents finish, no new agent starts
  • resume: Resume a paused, failed or stopped Workflow Run, or with --interrupted every run a server restart interrupted
  • stop: Stop a Workflow Run and cancel its in-flight agents
  • logs: Print a Workflow Run's log

cyber workflows integrations

Compose, verify and review complementary agent contributions in isolation

cyber workflows integrations [OPTIONS] <COMMAND>

Subcommands:

  • submit: Pin a JSON manifest from a file (or - for stdin); does not run checks yet
  • list
  • show
  • report
  • run: Start a fresh immutable attempt; --wait reports final host evidence
  • cancel
  • publish: Explicitly push the integration branch and create/reconcile its GitHub PR

cyber workflows integrations submit

Pin a JSON manifest from a file (or - for stdin); does not run checks yet

cyber workflows integrations submit [OPTIONS] <FILE>

Arguments:

  • <FILE>

Options:

  • --session <SESSION>
  • --budget <BUDGET>

cyber workflows integrations list

cyber workflows integrations list [OPTIONS]

cyber workflows integrations show

cyber workflows integrations show [OPTIONS] <ID>

Arguments:

  • <ID>

cyber workflows integrations report

cyber workflows integrations report [OPTIONS] <ID>

Arguments:

  • <ID>

cyber workflows integrations run

Start a fresh immutable attempt; --wait reports final host evidence

cyber workflows integrations run [OPTIONS] <ID>

Arguments:

  • <ID>

Options:

  • --wait
  • --expected-revision <EXPECTED_REVISION>

cyber workflows integrations cancel

cyber workflows integrations cancel [OPTIONS] <ID>

Arguments:

  • <ID>

Options:

  • --expected-revision <EXPECTED_REVISION>

cyber workflows integrations publish

Explicitly push the integration branch and create/reconcile its GitHub PR

cyber workflows integrations publish [OPTIONS] --repository <REPOSITORY> --title <TITLE> --body-file <BODY_FILE> <ID>

Arguments:

  • <ID>

Options:

  • --remote <REMOTE>: Default: origin.
  • --repository <REPOSITORY>
  • --title <TITLE>
  • --body-file <BODY_FILE>
  • --operation-id <OPERATION_ID>
  • --acknowledge-review-unavailable
  • --expected-revision <EXPECTED_REVISION>

cyber workflows list

List the Workflow library (project overrides global, both override bundled) and modules that fail to load

cyber workflows list [OPTIONS]

cyber workflows eject

Copy a bundled Workflow's source into .cyber/workflows/ (or the global directory) to customize it; the copy then overrides the bundled one

cyber workflows eject [OPTIONS] <NAME>

Arguments:

  • <NAME>: The bundled Workflow to copy.

Options:

  • --global: Write it to the global workflows/ directory instead of the project.
  • --force: Replace an existing file.

cyber workflows run

Start a Workflow Run from a saved name or a script file

cyber workflows run [OPTIONS] <TARGET>

Arguments:

  • <TARGET>: A saved Workflow's name, or the path of a .js module.

Options:

  • --args <JSON>: The script's args as a JSON object.
  • --max-cost <USD>: Stop starting agents once the run cost this much (USD)
  • --max-turns <N>
  • --max-tokens <N>
  • --timeout <DURATION>: Wall-clock limit of the run, e.g. 30m or 90s.
  • --max-agents <N>
  • --max-concurrent <N>: The run's share of the server's Workflow agent slots (at most N agents at once)
  • --runner <ID>: Run on a remote runner (not available yet)
  • --wait: Follow the run until it ends; the exit code reports how it ended.

cyber workflows runs

List recent Workflow Runs of this Location: active runs first, then the newest

cyber workflows runs [OPTIONS]

Options:

  • --all: Every Location's runs.
  • --status <S[,S...]>: Only runs of these statuses, e.g. running,queued.
  • --watch: Keep the list current until Ctrl-C, which changes no run.

cyber workflows show

Show one Workflow Run and its agents (run_…), or a library Workflow's meta, args schema, default budget and origin (a Workflow name)

cyber workflows show [OPTIONS] <TARGET>

Arguments:

  • <TARGET>: A run ID, or a Workflow name.

Options:

  • --source: With a Workflow name, also print the module source.

cyber workflows pause

Pause a Workflow Run: in-flight agents finish, no new agent starts

cyber workflows pause [OPTIONS] <RUN_ID>

Arguments:

  • <RUN_ID>

cyber workflows resume

Resume a paused, failed or stopped Workflow Run, or with --interrupted every run a server restart interrupted

cyber workflows resume [OPTIONS] [RUN_ID]

Arguments:

  • [RUN_ID]

Options:

  • --revision: Accept a changed script or configuration as a new revision.
  • --interrupted: Resume every run of this Location that a server restart interrupted; runs paused by a user stay paused.
  • --all: With --interrupted, every Location's interrupted runs.

cyber workflows stop

Stop a Workflow Run and cancel its in-flight agents

cyber workflows stop [OPTIONS] <RUN_ID>

Arguments:

  • <RUN_ID>

cyber workflows logs

Print a Workflow Run's log

cyber workflows logs [OPTIONS] <RUN_ID>

Arguments:

  • <RUN_ID>

cyber worktree

List, remove and prune managed Git worktrees of the current repository

cyber worktree [OPTIONS] <COMMAND>

Subcommands:

  • list: List owned worktrees, Git status and their Sessions
  • remove: Remove a managed worktree and its branch
  • prune: Remove clean managed worktrees older than a number of days

cyber worktree list

List owned worktrees, Git status and their Sessions

cyber worktree list [OPTIONS]

cyber worktree remove

Remove a managed worktree and its branch

cyber worktree remove [OPTIONS] <NAME>

Arguments:

  • <NAME>

Options:

  • --force: Remove even with uncommitted changes or commits beyond its base.

cyber worktree prune

Remove clean managed worktrees older than a number of days

cyber worktree prune [OPTIONS]

Options:

  • --older-than <DAYS>: Default: 14.

cyber debug

Inspect resolved paths, configuration and build information

cyber debug [OPTIONS] <COMMAND>

Subcommands:

  • memory: List memory metadata and invalid-file diagnostics
  • paths: Print resolved directories and the database location
  • config: Print the resolved configuration with secrets redacted
  • info: Print build, path, database, configuration and trust information

cyber debug memory

List memory metadata and invalid-file diagnostics

cyber debug memory [OPTIONS]

Options:

  • --global

cyber debug paths

Print resolved directories and the database location

cyber debug paths [OPTIONS]

cyber debug config

Print the resolved configuration with secrets redacted

cyber debug config [OPTIONS]

Options:

  • --sources: Include the source layer of every value.

cyber debug info

Print build, path, database, configuration and trust information

cyber debug info [OPTIONS]

cyber models

List models from the catalog, available first

cyber models [OPTIONS] [PROVIDER]

Arguments:

  • [PROVIDER]: Only this provider (list and refresh are accepted as verbs)

Options:

  • --verbose: Show limits, prices and variants.
  • --refresh: Refetch the catalog even when the cache is fresh.

cyber providers

Sign in to or out of a provider (today: chatgpt, a ChatGPT Plus/Pro subscription, and copilot, a GitHub Copilot plan)

cyber providers [OPTIONS] <COMMAND>

Subcommands:

  • login: Sign in to a provider. chatgpt signs in with a ChatGPT Plus/Pro subscription: open the printed URL in a browser to authorize. copilot signs in with a GitHub Copilot plan: open the printed URL and enter the printed code
  • logout: Forget a provider login. Tokens are not revoked remotely

cyber providers login

Sign in to a provider. chatgpt signs in with a ChatGPT Plus/Pro subscription: open the printed URL in a browser to authorize. copilot signs in with a GitHub Copilot plan: open the printed URL and enter the printed code

cyber providers login [OPTIONS] <PROVIDER>

Arguments:

  • <PROVIDER>

Options:

  • --method <METHOD>: browser waits for the redirect on localhost:1455; code reads the redirect URL pasted from the browser (for SSH and other headless machines). ChatGPT only. Values: browser, code. Default: browser.
  • --enterprise <HOST>: Sign in to a GitHub Enterprise host (a bare hostname such as example.ghe.com) instead of github.com. Copilot only.

cyber providers logout

Forget a provider login. Tokens are not revoked remotely

cyber providers logout [OPTIONS] <PROVIDER>

Arguments:

  • <PROVIDER>

cyber permissions

Dry-run permission rules; inspect or reset checkout-scoped auto-mode statistics

cyber permissions [OPTIONS] <COMMAND>

Subcommands:

  • auto: Show or reset recorded auto-mode decision statistics for this checkout
  • test: Evaluate a tool call or shell command as a Session would, without running it

cyber permissions auto

Show or reset recorded auto-mode decision statistics for this checkout

cyber permissions auto [OPTIONS] <COMMAND>

Subcommands:

cyber permissions auto show

cyber permissions auto show [OPTIONS]

cyber permissions auto reset

cyber permissions auto reset [OPTIONS]

cyber permissions test

Evaluate a tool call or shell command as a Session would, without running it

cyber permissions test [OPTIONS] [-- <COMMAND>...]

Arguments:

  • [COMMAND]...: A shell command, split into commands as bash splits it.

Options:

  • --agent <AGENT>
  • --tool <TOOL>
  • --resource <RESOURCE>

cyber db

Inspect the local database

cyber db [OPTIONS] <COMMAND>

Subcommands:

  • path: Print the database path
  • query: Run a read-only SQL query (TSV, or JSON with --format json)
  • backup: Copy the database while the server runs (online backup). With --artifacts, write a bundle directory with tool output, snapshots and a manifest of hashes
  • verify: Check a backup bundle against its manifest and the database's integrity
  • restore: Replace the database (and bundle artifacts) from a backup; the server must be stopped
  • vacuum: Rebuild the database to reclaim space; the server must be stopped

cyber db path

Print the database path

cyber db path [OPTIONS]

cyber db query

Run a read-only SQL query (TSV, or JSON with --format json)

cyber db query [OPTIONS] <SQL>

Arguments:

  • <SQL>

cyber db backup

Copy the database while the server runs (online backup). With --artifacts, write a bundle directory with tool output, snapshots and a manifest of hashes

cyber db backup [OPTIONS] <PATH>

Arguments:

  • <PATH>

Options:

  • --artifacts

cyber db verify

Check a backup bundle against its manifest and the database's integrity

cyber db verify [OPTIONS] <PATH>

Arguments:

  • <PATH>

cyber db restore

Replace the database (and bundle artifacts) from a backup; the server must be stopped

cyber db restore [OPTIONS] <PATH>

Arguments:

  • <PATH>

cyber db vacuum

Rebuild the database to reclaim space; the server must be stopped

cyber db vacuum [OPTIONS]

cyber plugins

Install, list, enable, disable, update and remove plugins

cyber plugins [OPTIONS] <COMMAND>

Subcommands:

  • install: Install a plugin from a git URL (git+<url>[#ref]) or a local directory
  • list: List plugins of every scope with their state; every plugin is unsigned
  • info: Show one plugin's state, source, digest and components
  • update: Fetch a plugin (or every plugin) again from its source and record the new digest
  • remove: Remove a plugin from a scope (default: every scope listing it) and revoke its trust
  • enable: Enable a listed plugin, installing it at its pinned commit and asking to trust it
  • disable: Disable a plugin in a scope (default: every scope listing it)
  • validate: Check a plugin directory's manifest and components without installing it
  • configure: Set a plugin's userConfig settings: --set key=value for ordinary values, or answer a prompt for each (secrets without echo, stored in the OS keyring)

cyber plugins install

Install a plugin from a git URL (git+<url>[#ref]) or a local directory

cyber plugins install [OPTIONS] <SPEC>

Arguments:

  • <SPEC>

Options:

  • --scope <SCOPE>: Values: user, project, local. Default: user.
  • --ref <REF>: The git branch, tag or commit.
  • --path <DIR>: The plugin's directory inside the git repository.
  • --force: Install even when engines.cyber excludes this version.

cyber plugins list

List plugins of every scope with their state; every plugin is unsigned

cyber plugins list [OPTIONS]

cyber plugins info

Show one plugin's state, source, digest and components

cyber plugins info [OPTIONS] <NAME>

Arguments:

  • <NAME>

cyber plugins update

Fetch a plugin (or every plugin) again from its source and record the new digest

cyber plugins update [OPTIONS] [NAME]

Arguments:

  • [NAME]

Options:

  • --scope <SCOPE>: Values: user, project, local.
  • --yes: Trust the new content without asking.
  • --force

cyber plugins remove

Remove a plugin from a scope (default: every scope listing it) and revoke its trust

cyber plugins remove [OPTIONS] <NAME>

Arguments:

  • <NAME>

Options:

  • --scope <SCOPE>: Values: user, project, local.

cyber plugins enable

Enable a listed plugin, installing it at its pinned commit and asking to trust it

cyber plugins enable [OPTIONS] <NAME>

Arguments:

  • <NAME>

Options:

  • --scope <SCOPE>: Values: user, project, local.
  • --yes: Trust the plugin without asking.
  • --force

cyber plugins disable

Disable a plugin in a scope (default: every scope listing it)

cyber plugins disable [OPTIONS] <NAME>

Arguments:

  • <NAME>

Options:

  • --scope <SCOPE>: Values: user, project, local.

cyber plugins validate

Check a plugin directory's manifest and components without installing it

cyber plugins validate [OPTIONS] <PATH>

Arguments:

  • <PATH>

cyber plugins configure

Set a plugin's userConfig settings: --set key=value for ordinary values, or answer a prompt for each (secrets without echo, stored in the OS keyring)

cyber plugins configure [OPTIONS] <NAME>

Arguments:

  • <NAME>

Options:

  • --set <KEY=VALUE>

cyber hooks

Review hook definitions and individual handler trust

cyber hooks [OPTIONS] <COMMAND>

Subcommands:

  • list: List resolved definitions, file origins, digests and individual trust state
  • test: Run matching hooks against a synthetic event without creating a Session
  • history: Inspect committed Session execution receipts without running hooks or recovery
  • trust: Approve a currently resolved project/local handler after inspecting its digest
  • untrust: Revoke a handler digest, including an obsolete definition

cyber hooks list

List resolved definitions, file origins, digests and individual trust state

cyber hooks list [OPTIONS]

cyber hooks test

Run matching hooks against a synthetic event without creating a Session

cyber hooks test [OPTIONS] <EVENT>

Arguments:

  • <EVENT>

Options:

  • --payload <FILE>: JSON object of event fields; trusted envelope fields cannot be supplied.

cyber hooks history

Inspect committed Session execution receipts without running hooks or recovery

cyber hooks history [OPTIONS] --session <SESSION>

Options:

  • --session <SESSION>
  • --limit <LIMIT>: Default: 50.
  • --cursor <CURSOR>

cyber hooks trust

Approve a currently resolved project/local handler after inspecting its digest

cyber hooks trust [OPTIONS] --digest <DIGEST>

Options:

  • --digest <DIGEST>

cyber hooks untrust

Revoke a handler digest, including an obsolete definition

cyber hooks untrust [OPTIONS] --digest <DIGEST>

Options:

  • --digest <DIGEST>

cyber sandbox

Test, explain or run a command under the effective OS sandbox policy

cyber sandbox [OPTIONS] <COMMAND>

Subcommands:

  • test: Run read, write and network probes under the effective policy
  • explain: Print the effective writable roots, network mode, domains and masked variables
  • run: Run one command under the effective policy

cyber sandbox test

Run read, write and network probes under the effective policy

cyber sandbox test [OPTIONS]

Options:

  • --policy <POLICY>: A policy: read-only, workspace-write or full-access.

cyber sandbox explain

Print the effective writable roots, network mode, domains and masked variables

cyber sandbox explain [OPTIONS]

Options:

  • --policy <POLICY>: A policy: read-only, workspace-write or full-access.

cyber sandbox run

Run one command under the effective policy

cyber sandbox run [OPTIONS] -- <COMMAND>...

Arguments:

  • <COMMAND>...: The command and its arguments, after --.

Options:

  • --policy <POLICY>: A policy: read-only, workspace-write or full-access.

cyber trust

Inspect and approve repository-controlled configuration for this checkout

cyber trust [OPTIONS] <COMMAND>

Subcommands:

  • inspect: Show the checkout, the digest of its security-sensitive definitions and their state
  • approve: Approve exactly the inspected definitions
  • revoke: Revoke this checkout's approval

cyber trust inspect

Show the checkout, the digest of its security-sensitive definitions and their state

cyber trust inspect [OPTIONS]

cyber trust approve

Approve exactly the inspected definitions

cyber trust approve [OPTIONS] --digest <DIGEST>

Options:

  • --digest <DIGEST>: Digest printed by cyber trust inspect.

cyber trust revoke

Revoke this checkout's approval

cyber trust revoke [OPTIONS]

cyber exec

Run one prompt non-interactively (alias: cyber -p)

cyber exec [OPTIONS] [PROMPT]...

Arguments:

  • [PROMPT]...: The prompt; stdin is appended when it is not a terminal.

Options:

  • --worktree [<NAME>]: Start a new Session in a managed worktree; omit NAME to generate one.
  • --continue: Reuse the most recent root Session of the Location.
  • --session <SESSION>: Reuse a Session by ID or name.
  • --fork: Fork the selected Session first (needs --continue or --session)
  • --name <NAME>: Name the new Session.
  • --ephemeral: Run in memory: nothing is written to the shared database or snapshots.
  • --embedded: Run a private in-process server instead of the background service.
  • --attach <ATTACH>: Target a remote server URL.
  • --password <PASSWORD>: Password for --attach (else CYBER_SERVER_PASSWORD)
  • --agent <AGENT>
  • --auto: Use auto mode.
  • --yolo: Use bypass mode: everything runs without approval. The server refuses it unless commands run in the OS sandbox or a container, or with --dangerously-bypass-permissions.
  • --dangerously-bypass-permissions: Allow bypass mode without a sandbox or a container (needs --embedded or --ephemeral: a shared server cannot take it for one run)
  • --dangerously-skip-permissions: Claude Code's name for running without prompts: bypass mode plus --dangerously-bypass-permissions, so every action runs without approval and, outside a sandbox or a container, without OS confinement. Needs --embedded or --ephemeral: a shared server cannot take the override for one run (there, use --mode bypass where its sandbox or a container already admits it). An organization policy that disables bypass still refuses it.
  • --non-interactive-rules: Add the never-ask rules to a reused Session too.
  • --accept-messages: Let other Sessions message the Session this run creates (by default it refuses them with non_interactive)
  • --command <COMMAND>: Run a skill or custom command with the prompt as its arguments.
  • --output-style <NAME>: Use this output style for the Session (a name from /output-style); it must be listed at the Location, or the run exits 2 before any Session exists.
  • --output-schema <FILE>: A JSON Schema file the final answer must satisfy: the model ends with a validated object, which becomes result (printed as JSON in text mode). Three invalid submissions exit 1 with StructuredOutputError.
  • --input-format <INPUT_FORMAT>: stream-json reads JSON lines from stdin for the life of the process: prompts, interrupt, permission and question replies, and end (needs --format stream-json; each prompt gets its own result line) Values: text, stream-json. Default: text.
  • --include-partial-messages: With --input-format stream-json: add text_delta and reasoning_delta lines.
  • --output-last-message <FILE>: With --input-format stream-json: write the last answer's text to this file, atomically, when the run ends.
  • --workflow <NAME|PATH>: Run a Workflow (a saved name or a .js module path) instead of a prompt; its return value is the result.
  • --args <JSON>: The Workflow's args as a JSON object.
  • --file <FILES>: Attach a file (repeatable): an image or PDF as an attachment, read by a local server under the read permission (sent inline with --attach); others as text.
  • --max-turns <MAX_TURNS>: With --goal: each Goal's max_turns budget; otherwise the Session's step ceiling.
  • --goal <CONDITION>: Work until this Goal is met (repeatable: a queue, in order). The exit code is 0 met, 3 impossible, 4 budget exceeded, 1 otherwise, for the first non-met Goal.
  • --goal-check <COMMAND>: A command that must pass for the --goal before it to count as met.
  • --max-tokens <MAX_TOKENS>
  • --max-cost <MAX_COST>: Stop after this cost in USD.
  • --timeout <TIMEOUT>: Stop after this long, e.g. 30m, 90s.
  • --verbose: Print tool progress on stderr (text format)
  • --quiet: No non-result output on stderr.
  • --thinking: Include reasoning events (stream-json)
  • --sandbox <SANDBOX>: Sandbox policy: read-only, workspace-write or full-access (embedded runs)
  • --fail-on-deny: Exit with code 5 when any action was denied.
  • --trust-project-hooks: Run the currently resolved project/local hooks for this run only, without approving them for later runs (needs --embedded or --ephemeral)

cyber attach

Open the TUI on a Session of a paired machine: cyber attach @

cyber attach [OPTIONS] <TARGET>

Arguments:

  • <TARGET>: <session>@<peer>: a Session (ID or name) of a paired machine.

cyber review

Review uncommitted changes, a range, a commit or a pull request

cyber review [OPTIONS] [TARGET]...

Arguments:

  • [TARGET]...: What to review: nothing for uncommitted changes, <base>..<head>, a commit, or pr <number>.

Options:

  • --worktree [<NAME>]: Start a new Session in a managed worktree; omit NAME to generate one.
  • --continue: Reuse the most recent root Session of the Location.
  • --session <SESSION>: Reuse a Session by ID or name.
  • --ephemeral: Run in memory: nothing is written to the shared database or snapshots.
  • --embedded: Run a private in-process server instead of the background service.
  • --attach <ATTACH>: Target a remote server URL.
  • --password <PASSWORD>: Password for --attach (else CYBER_SERVER_PASSWORD)
  • --max-tokens <MAX_TOKENS>
  • --max-cost <MAX_COST>: Stop after this cost in USD.
  • --timeout <TIMEOUT>: Stop after this long, e.g. 30m, 90s.
  • --fail-on-deny: Exit with code 5 when any action was denied.

cyber pr

Check out a pull request and resume the Session linked to it

cyber pr [OPTIONS] <NUMBER|URL>

Arguments:

  • <NUMBER|URL>: The pull request number or URL.

cyber git

Generate commit and pull request text with the small model

cyber git [OPTIONS] <COMMAND>

Subcommands:

  • commit-msg: Print a conventional commit message for the staged changes
  • pr-description: Print a pull request title and body for BASE..HEAD

cyber git commit-msg

Print a conventional commit message for the staged changes

cyber git commit-msg [OPTIONS]

cyber git pr-description

Print a pull request title and body for BASE..HEAD

cyber git pr-description [OPTIONS]

Options:

  • --base <BASE>: The base branch or commit (default: origin/HEAD, else main, else master)

cyber web

Open the local web dashboard and remote approval inbox

cyber web [OPTIONS]

Options:

  • --hostname <HOSTNAME>: Address to bind when starting a server (default 127.0.0.1). Off loopback requires HTTPS.
  • --port <PORT>: TCP port when starting a server (default 4747, falling back to a free port)
  • --no-open: Print the dashboard URL without opening a browser.

cyber serve

Run the server in the foreground

cyber serve [OPTIONS]

Options:

  • --hostname <HOSTNAME>: Address to bind (default 127.0.0.1). Off loopback requires global server.tls. Default: 127.0.0.1.
  • --port <PORT>: TCP port (default 4747, falling back to a free port)
  • --socket <SOCKET>: Unix socket path inside private state (default /cyber.sock)
  • --no-tcp: Do not listen on TCP.
  • --register: Register in server.json so clients find this server.
  • --sandbox <SANDBOX>: Sandbox policy for model-run commands: read-only, workspace-write or full-access.
  • --mdns: Publish the peer listener (peers.listen) over mDNS, as peers.mdns does. Only a listener off loopback is published; the main API never is.
  • --stdio: Speak JSON-RPC over stdin and stdout.
  • --dangerously-bypass-permissions: Allow bypass mode without a sandbox or a container. Everything the model runs executes without approval or OS confinement.

cyber service

Manage the background server

cyber service [OPTIONS] <COMMAND>

Subcommands:

  • start: Start the background server, or reuse a healthy one
  • stop: Stop the background server
  • restart: Stop, then start
  • status: Show the registered server and whether it is healthy
  • password: Print the local server password, or replace it (restarting the server)

cyber service start

Start the background server, or reuse a healthy one

cyber service start [OPTIONS]

cyber service stop

Stop the background server

cyber service stop [OPTIONS]

cyber service restart

Stop, then start

cyber service restart [OPTIONS]

cyber service status

Show the registered server and whether it is healthy

cyber service status [OPTIONS]

cyber service password

Print the local server password, or replace it (restarting the server)

cyber service password [OPTIONS] [VALUE]

Arguments:

  • [VALUE]

cyber api

Send one request to the server API

cyber api [OPTIONS] <TARGET>...

Arguments:

  • <TARGET>...: An operation ID (v1.session.list) or METHOD /path.

Options:

  • -d, --data <DATA>: Request body (JSON by default)
  • -H, --header <HEADERS>: Extra header as Name: value (repeatable, up to 100)
  • --param <PARAMS>: Path or query parameter as key=value (repeatable)

cyber collab

Work with people and their locally running agents through a project hub

cyber collab [OPTIONS] <COMMAND>

Subcommands:

  • status: Read local binding and publication status
  • serve: Run the independent project hub (TLS termination is required outside loopback)
  • project: Create a collaboration project
  • bind: Explicitly pin this checkout to one hub and project after comparing its Git remote
  • publish: Publish one local Session. Its context is permanently pinned to this project
  • unpublish: Revoke an agent publication, retaining its Session's project tombstone
  • invite: Create a single-use invitation (the secret is displayed only on issuance)
  • invitations
  • join: Apply to join. Invitation tokens are accepted only on stdin
  • applications
  • members
  • messages
  • tasks
  • leave

cyber collab status

Read local binding and publication status

cyber collab status [OPTIONS]

Options:

  • --session <SESSION>

cyber collab serve

Run the independent project hub (TLS termination is required outside loopback)

cyber collab serve [OPTIONS] --issuer <ISSUER> --audience <AUDIENCE> --bootstrap-sub <BOOTSTRAP_SUB>

Options:

  • --issuer <ISSUER>
  • --audience <AUDIENCE>
  • --bootstrap-sub <BOOTSTRAP_SUB>
  • --listen <LISTEN>: Default: 127.0.0.1:4749.
  • --database <DATABASE>
  • --introspection-token-env <INTROSPECTION_TOKEN_ENV>
  • --introspection-client-id <INTROSPECTION_CLIENT_ID>
  • --introspection-client-secret-env <INTROSPECTION_CLIENT_SECRET_ENV>
  • --introspection-scope <INTROSPECTION_SCOPE>
  • --tls-cert <TLS_CERT>
  • --tls-key <TLS_KEY>
  • --trusted-proxy <TRUSTED_PROXY>
  • --allow-loopback-http
  • --allow-guests
  • --require-mfa <REQUIRE_MFA>: Values: true, false. Default: true.

cyber collab project

Create a collaboration project

cyber collab project [OPTIONS] <COMMAND>

Subcommands:

  • list: List projects the current account is authorized to read on this hub
  • show: Read one authorized project descriptor before explicitly binding a checkout
  • policy: Change explicit enrollment/guest policy with optimistic concurrency
  • create

cyber collab project list

List projects the current account is authorized to read on this hub

cyber collab project list [OPTIONS] --hub <HUB>

Options:

  • --hub <HUB>

cyber collab project show

Read one authorized project descriptor before explicitly binding a checkout

cyber collab project show [OPTIONS] --hub <HUB> <PROJECT>

Arguments:

  • <PROJECT>

Options:

  • --hub <HUB>

cyber collab project policy

Change explicit enrollment/guest policy with optimistic concurrency

cyber collab project policy [OPTIONS] --project <PROJECT> --expected-revision <EXPECTED_REVISION>

Options:

  • --project <PROJECT>
  • --expected-revision <EXPECTED_REVISION>
  • --enrollment <ENROLLMENT>: Values: invite-only, organization-members. Default: invite-only.
  • --role <ROLE>: Values: owner, member, viewer. Default: viewer.
  • --allow-guests <ALLOW_GUESTS>: Values: true, false. Default: false.

cyber collab project create

cyber collab project create [OPTIONS] --hub <HUB> --repo <REPO> --name <NAME>

Options:

  • --hub <HUB>
  • --repo <REPO>
  • --name <NAME>
  • --organization <ORGANIZATION>
  • --friends

cyber collab bind

Explicitly pin this checkout to one hub and project after comparing its Git remote

cyber collab bind [OPTIONS] --hub <HUB> --project <PROJECT>

Options:

  • --hub <HUB>
  • --project <PROJECT>
  • --remote <REMOTE>: Default: origin.
  • --confirm

cyber collab publish

Publish one local Session. Its context is permanently pinned to this project

cyber collab publish [OPTIONS] --project <PROJECT> --session <SESSION> --name <NAME>

Options:

  • --project <PROJECT>
  • --session <SESSION>
  • --name <NAME>
  • --subscribe-project-messages

cyber collab unpublish

Revoke an agent publication, retaining its Session's project tombstone

cyber collab unpublish [OPTIONS] <AGENT>

Arguments:

  • <AGENT>

cyber collab invite

Create a single-use invitation (the secret is displayed only on issuance)

cyber collab invite [OPTIONS] --project <PROJECT>

Options:

  • --project <PROJECT>
  • --role <ROLE>: Values: owner, member, viewer.
  • --subject <SUBJECT>
  • --guest

cyber collab invitations

cyber collab invitations [OPTIONS] <COMMAND>

Subcommands:

cyber collab invitations list

cyber collab invitations list [OPTIONS] --project <PROJECT>

Options:

  • --project <PROJECT>

cyber collab invitations revoke

cyber collab invitations revoke [OPTIONS] --project <PROJECT> <INVITATION>

Arguments:

  • <INVITATION>

Options:

  • --project <PROJECT>

cyber collab join

Apply to join. Invitation tokens are accepted only on stdin

cyber collab join [OPTIONS] --hub <HUB>

Options:

  • --hub <HUB>
  • --project <PROJECT>
  • --invite-stdin
  • --name <NAME>

cyber collab applications

cyber collab applications [OPTIONS] <COMMAND>

Subcommands:

  • status: Read your own pending application and refresh identity for owner approval
  • list
  • approve
  • reject
  • redeem: Confirm the displayed repository and optionally redeem a join code from stdin

cyber collab applications status

Read your own pending application and refresh identity for owner approval

cyber collab applications status [OPTIONS] --hub <HUB> <APPLICATION>

Arguments:

  • <APPLICATION>

Options:

  • --hub <HUB>

cyber collab applications list

cyber collab applications list [OPTIONS] --project <PROJECT>

Options:

  • --project <PROJECT>

cyber collab applications approve

cyber collab applications approve [OPTIONS] --project <PROJECT> <APPLICATION>

Arguments:

  • <APPLICATION>

Options:

  • --project <PROJECT>

cyber collab applications reject

cyber collab applications reject [OPTIONS] --project <PROJECT> <APPLICATION>

Arguments:

  • <APPLICATION>

Options:

  • --project <PROJECT>

cyber collab applications redeem

Confirm the displayed repository and optionally redeem a join code from stdin

cyber collab applications redeem [OPTIONS] --hub <HUB> --repo <REPO> <APPLICATION>

Arguments:

  • <APPLICATION>

Options:

  • --hub <HUB>
  • --repo <REPO>
  • --code-stdin

cyber collab members

cyber collab members [OPTIONS] <COMMAND>

Subcommands:

cyber collab members list

cyber collab members list [OPTIONS] --project <PROJECT>

Options:

  • --project <PROJECT>

cyber collab members set-role

cyber collab members set-role [OPTIONS] --project <PROJECT> --role <ROLE> <MEMBER>

Arguments:

  • <MEMBER>

Options:

  • --project <PROJECT>
  • --role <ROLE>: Values: owner, member, viewer.

cyber collab members remove

cyber collab members remove [OPTIONS] --project <PROJECT> <MEMBER>

Arguments:

  • <MEMBER>

Options:

  • --project <PROJECT>

cyber collab messages

cyber collab messages [OPTIONS] <COMMAND>

Subcommands:

cyber collab messages list

cyber collab messages list [OPTIONS] --project <PROJECT>

Options:

  • --project <PROJECT>

cyber collab messages send

cyber collab messages send [OPTIONS] --project <PROJECT> <TEXT>

Arguments:

  • <TEXT>

Options:

  • --project <PROJECT>
  • --member <MEMBER>
  • --agent <AGENT>
  • --reply-to <REPLY_TO>

cyber collab tasks

cyber collab tasks [OPTIONS] <COMMAND>

Subcommands:

cyber collab tasks list

cyber collab tasks list [OPTIONS] --project <PROJECT>

Options:

  • --project <PROJECT>

cyber collab tasks create

cyber collab tasks create [OPTIONS] --project <PROJECT> <TITLE>

Arguments:

  • <TITLE>

Options:

  • --project <PROJECT>
  • --description <DESCRIPTION>: Default: ``.
  • --dependency <DEPENDENCY>

cyber collab tasks claim

cyber collab tasks claim [OPTIONS] --project <PROJECT> --expected-revision <EXPECTED_REVISION> <TASK>

Arguments:

  • <TASK>

Options:

  • --project <PROJECT>
  • --expected-revision <EXPECTED_REVISION>

cyber collab tasks update

cyber collab tasks update [OPTIONS] --project <PROJECT> --expected-revision <EXPECTED_REVISION> --claim-generation <CLAIM_GENERATION> <TASK>

Arguments:

  • <TASK>

Options:

  • --project <PROJECT>
  • --expected-revision <EXPECTED_REVISION>
  • --claim-generation <CLAIM_GENERATION>
  • --status <STATUS>
  • --title <TITLE>
  • --description <DESCRIPTION>
  • --report <REPORT>

cyber collab tasks reconcile

cyber collab tasks reconcile [OPTIONS] --project <PROJECT> --expected-revision <EXPECTED_REVISION> --claim-generation <CLAIM_GENERATION> --reason <REASON> <TASK>

Arguments:

  • <TASK>

Options:

  • --project <PROJECT>
  • --expected-revision <EXPECTED_REVISION>
  • --claim-generation <CLAIM_GENERATION>
  • --acknowledge-unknown-work
  • --reason <REASON>
  • --member <MEMBER>
  • --agent <AGENT>

cyber collab leave

cyber collab leave [OPTIONS] --project <PROJECT>

Options:

  • --project <PROJECT>

cyber peers

Pair with other machines' cyber servers to message their Sessions

cyber peers [OPTIONS] <COMMAND>

Subcommands:

  • invite: Let another machine send to this one: create a grant and print its pairing code once. Needs peers.listen in user config
  • add: Pair with another machine from the code its cyber peers invite printed: test it, store the token in the OS keyring and add the remote to user config
  • rm: Remove a remote and its stored token
  • list: Remotes (state and latency) and grants of this machine
  • test: Call a remote's hello: machine, version, scopes and latency; exit 1 with the error tag on failure
  • revoke: End a grant: the peer's next request is refused
  • discover: Peer listeners published on this network over mDNS: machine, address, fingerprint and whether each is a remote already. It only lists: pairing still needs a code

cyber peers invite

Let another machine send to this one: create a grant and print its pairing code once. Needs peers.listen in user config

cyber peers invite [OPTIONS] <NAME>

Arguments:

  • <NAME>: The other machine's name here: its senders appear as <session>@<name>.

Options:

  • --scope <SCOPES>: What the grant allows (repeatable); default message. Values: message, attach.
  • --expires <EXPIRES>: End the grant after this long: 90d, 12h or 30m.
  • --rotate-key: Make a new listener key first; every existing pairing must be redone.
  • --host <HOST>: The host the code names (default: the bound IP, or this host's LAN name)

cyber peers add

Pair with another machine from the code its cyber peers invite printed: test it, store the token in the OS keyring and add the remote to user config

cyber peers add [OPTIONS] <NAME> <CODE>

Arguments:

  • <NAME>: The name to send to it by (<session>@<name>)
  • <CODE>: The pairing code cyber peers invite printed on the other machine.

Options:

  • --token-env <NAME>: Keep the token out of the keyring: config gets {env:NAME}, and NAME must hold the code's token wherever the server runs (headless machines)

cyber peers rm

Remove a remote and its stored token

cyber peers rm [OPTIONS] <NAME>

Arguments:

  • <NAME>

cyber peers list

Remotes (state and latency) and grants of this machine

cyber peers list [OPTIONS]

Options:

  • --json: Print JSON.

cyber peers test

Call a remote's hello: machine, version, scopes and latency; exit 1 with the error tag on failure

cyber peers test [OPTIONS] <NAME>

Arguments:

  • <NAME>

cyber peers revoke

End a grant: the peer's next request is refused

cyber peers revoke [OPTIONS] <NAME>

Arguments:

  • <NAME>

cyber peers discover

Peer listeners published on this network over mDNS: machine, address, fingerprint and whether each is a remote already. It only lists: pairing still needs a code

cyber peers discover [OPTIONS]

Options:

  • --timeout <TIMEOUT>: How long to listen: 3s, 500ms or 1m. Default: 3s.
  • --json: Print JSON.

cyber messages

Send messages between Sessions and read their message history

cyber messages [OPTIONS] <COMMAND>

Subcommands:

  • send: Send a message to a Session by ID or name. Exits 0 when delivered or held, 1 when refused (the reason on stderr) or when a peer cannot be reached, 2 for an ambiguous or unknown address, an unconfigured peer or a text over 16 KiB, and 6 for an address that needs a Cyber Account
  • list: The message history of a Session (default: the Location's most recent one), or with --reachable the Sessions a message can be sent to

cyber messages send

Send a message to a Session by ID or name. Exits 0 when delivered or held, 1 when refused (the reason on stderr) or when a peer cannot be reached, 2 for an ambiguous or unknown address, an unconfigured peer or a text over 16 KiB, and 6 for an address that needs a Cyber Account

cyber messages send [OPTIONS] <TO> [TEXT]

Arguments:

  • <TO>: The target: a ses_ ID, a subagent name, a Session name, or <session>@<peer> for a Session of a paired machine (which needs --from)
  • [TEXT]: The message text; - (or nothing, with a pipe) reads it from stdin.

Options:

  • --from <FROM>: Send as this Session (ID, exact title or unique ID prefix) instead of as the client:cli client; a message to a peer Session (<session>@<peer>) needs it.
  • --notify-when-idle: Also notify the --from Session once when the target next goes idle.

cyber messages list

The message history of a Session (default: the Location's most recent one), or with --reachable the Sessions a message can be sent to

cyber messages list [OPTIONS]

Options:

  • --session <SESSION>: The Session whose history to show (ID, exact title or unique ID prefix)
  • --direction <DIRECTION>: Only received (in) or sent (out) messages. Values: in, out.
  • --limit <LIMIT>: At most this many records, newest first (1 to 200) Default: 50.
  • --reachable: List the Sessions a message can be sent to instead of a history.
  • --from <FROM>: With --reachable: list as this Session (ID, exact title or unique ID prefix) instead of as the client:cli client.

cyber doctor

Check configuration, skills, commands, credentials, catalog, database, sandbox, tools and server

cyber doctor [OPTIONS]

cyber stats

Usage statistics: activity, streaks, tokens, cost and per-model totals

cyber stats [OPTIONS]

Options:

  • --days <DAYS>: Only the last N local days, today included (1 to 371)
  • --project <DIR>: Only Sessions of the project containing this directory.
  • --models: One row per model.
  • --tools: Tool calls by name.
  • --by <GROUP>: One row per usage origin (user, session, client, job, mcp, ...) Values: origin.

cyber telemetry

The server's OpenTelemetry export status: settings, sources and counters

cyber telemetry [OPTIONS] <COMMAND>

Subcommands:

  • show: Export settings per signal with their sources, counters, ignored project values and whether a restart is required. Exits 0 whether or not export is on

cyber telemetry show

Export settings per signal with their sources, counters, ignored project values and whether a restart is required. Exits 0 whether or not export is on

cyber telemetry show [OPTIONS]

cyber upgrade

Upgrade cyber to the channel's latest version or to VERSION

cyber upgrade [OPTIONS] [VERSION]

Arguments:

  • [VERSION]: Version to install (1.4.0 or v1.4.0); defaults to the channel's latest.

Options:

  • --method <METHOD>: Install method instead of the detected one: script, brew, npm, pnpm, bun, cargo, scoop, winget, aur, nix, docker or unknown.
  • --channel <CHANNEL>: Channel to read the latest version from; defaults to the build's (dev reads stable) Values: stable, beta, nightly.
  • --dry-run: Print what would be done (target version, method, action) and change nothing.

cyber uninstall

Remove cyber: its binary (script installs), PATH lines and directories

cyber uninstall [OPTIONS]

Options:

  • --keep-config: Keep the configuration directory.
  • --keep-data: Keep the data directory (sessions, memory, stored logins) and the keyring entries.
  • --dry-run: List what would be removed, with sizes, and change nothing.
  • --force: Remove without asking, and go on when the background server cannot be stopped.

cyber eval

Run evaluation manifests and write reports

cyber eval [OPTIONS] <COMMAND>

Subcommands:

  • run: Run a coding manifest and write a report
  • prepare: Download verified pinned source trees into a new isolated evaluation root

cyber eval run

Run a coding manifest and write a report

cyber eval run [OPTIONS] --output <OUTPUT> <MANIFEST>

Arguments:

  • <MANIFEST>: Manifest path, e.g. eval/manifests/suite-coding-v1.json.

Options:

  • --strategy <STRATEGY>: Evaluate one Session or the separately graded bundled solve workflow. Values: single, solve. Default: single.
  • --output <OUTPUT>: Directory for report.json, report.md and per-trial logs.
  • -m, --model <MODEL>: Model as provider/model[#variant]; required for suites, overrides live manifests.
  • --trials <TRIALS>: Trials per task (the release baseline uses 3) Default: 3.
  • --trial-start <TRIAL_START>: First trial identity, for predetermined interleaving across strategies. Default: 1.
  • --task <TASKS>: Only these task IDs (repeatable)
  • --jobs <JOBS>: Trials run at the same time. Default: 4.
  • --keep-workspaces: Keep trial workspaces under /workspaces for inspection.

cyber eval prepare

Download verified pinned source trees into a new isolated evaluation root

cyber eval prepare [OPTIONS] --output <OUTPUT> <CATALOG>

Arguments:

  • <CATALOG>

Options:

  • --output <OUTPUT>: New directory; existing destinations are refused.