Command reference

Generated from the actual command tree. Every flag, one searchable surface.

Usage:
  wecom-channel-cli [flags]
  wecom-channel-cli [command]

Available Commands:
  auth        Explain credential ownership and verify through the broker
  broker      Run the isolated credential-holding broker
  channel     List channels during operator setup or through broker policy
  config      Manage local client contexts; authorization belongs to operator policy
  doctor      Check broker readiness and policy; use auth check to verify upstream credentials
  event       Read or watch channel observations and authenticated callback events
  member      Inspect member data through broker policy
  policy      Generate or validate the broker's operator-owned authorization policy offline
  post        Inspect post data through broker policy
  proposal    Inspect immutable proposals; operator-only actions approve, reject or reconcile them
  reaction    Inspect or propose native emoji reactions on posts and replies
  relay       Deliver changes and track local delivery and processing state
  reply       Inspect reply data through broker policy
  search      Inspect search data through broker policy
  skill       Inspect or install the embedded companion Skill
  version     Print build metadata

Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli [command] --help" for more information about a command.

Usage:
  wecom-channel-cli auth [flags]
  wecom-channel-cli auth [command]

Available Commands:
  check       Operator-only: verify authentication with a bounded channel-list request
  guide       Read offline authentication and official CLI compatibility guidance

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli auth [command] --help" for more information about a command.

Usage:
  wecom-channel-cli auth check [flags]

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli auth guide [flags]

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli broker [flags]
  wecom-channel-cli broker [command]

Available Commands:
  serve       Serve agent/operator Unix sockets and optional encrypted callbacks

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli broker [command] --help" for more information about a command.

Usage:
  wecom-channel-cli broker serve [flags]

Flags:
      --config string   Absolute operator-owned policy file
      --dry-run         Validate and preview without credentials, sockets or state writes

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli channel [flags]
  wecom-channel-cli channel [command]

Available Commands:
  list        List one page of channels; use --bot-id for initial operator setup

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli channel [command] --help" for more information about a command.

Usage:
  wecom-channel-cli channel list [flags]

Examples:
  wecom-channel-cli channel list --bot-id BOT_ID
  wecom-channel-cli channel list --bot-id BOT_ID --cursor NEXT_CURSOR
  wecom-channel-cli --use-context default channel list
  wecom-channel-cli --socket /run/wecom-channel-admin/admin.sock channel list

Flags:
      --bot-id string   Use operator credentials to list joined channels before broker setup; Secret comes from WECOM_CHANNEL_BOT_SECRET
      --cursor string   Continuation cursor from the previous channel list page
      --dry-run         Preview the channel request without credentials, network or local writes
      --limit int       Maximum channels in this page (1–50) (default 20)

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli config [flags]
  wecom-channel-cli config [command]

Available Commands:
  delete-context delete-context in the client configuration
  get-contexts   List named channel security contexts
  path           Show the client configuration path
  set-context    Prepare an offline channel context without credentials or changing broker policy
  use-context    use-context in the client configuration

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli config [command] --help" for more information about a command.

Usage:
  wecom-channel-cli config delete-context NAME [flags]

Flags:
      --dry-run   Preview without modifying client configuration
      --yes       Confirm deleting this saved connection only

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli config get-contexts [flags]

Aliases:
  get-contexts, contexts

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli config path [flags]

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli config set-context NAME [flags]

Flags:
      --activate         Make this context current
      --bot-id string    Expected broker bot ID
      --channel string   Expected data.topic_id returned by channel list
      --dry-run          Preview the exact context merge without writing
      --overwrite        Replace conflicting public context coordinates
      --socket string    Agent socket for this channel context

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli config use-context NAME [flags]

Flags:
      --dry-run   Preview without modifying client configuration

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli doctor [flags]

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli event [flags]
  wecom-channel-cli event [command]

Available Commands:
  context     Read the post and exact reply authorized by a fresh human mention
  get         Read one retained event's metadata by ID
  list        Read one page of retained events without starting a listener
  watch       Watch a whole channel or selected post threads as bounded NDJSON

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli event [command] --help" for more information about a command.

Usage:
  wecom-channel-cli event context [flags]

Flags:
      --id string   Event ID from event list

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli event get [flags]

Flags:
      --id string   Event ID from event list

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli event list [flags]

Flags:
      --after-sequence int   Read events admitted after this durable sequence; never orders by remote timestamps
      --cursor string        Cursor from event list
      --limit int            Maximum retained events in one page (1–100) (default 20)

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli event watch [flags]

Examples:
  wecom-channel-cli --use-context engineering event watch --whole-channel --duration 10m
  wecom-channel-cli --use-context engineering event watch --post POST_ID --checkpoint .watch/thread.json --duration 10m

Flags:
      --after-sequence int   Replay after this sequence instead of starting at the current head
      --allow-partial        Explicitly accept an inbox restricted to allowlisted human authors
      --checkpoint string    Optional private resume file in an existing agent-owned directory
      --dry-run              Inspect scope and coverage without streaming or saving a checkpoint
      --duration duration    Maximum total watch duration, up to 24h (default 5m0s)
      --interval duration    Minimum delay between scans, 1s–1m; broker polling policy may increase it (default 2s)
      --max-events int       Stop after this many matching emitted events (default 1000)
      --post stringArray     Watch this post and its replies; repeat for up to 32 post IDs
      --whole-channel        Watch post/reply changes throughout this channel context

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli member [flags]
  wecom-channel-cli member [command]

Available Commands:
  list        Read one bounded page of member data

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli member [command] --help" for more information about a command.

Usage:
  wecom-channel-cli member list [flags]

Flags:
      --channel string   Channel ID from channel list or an authenticated event
      --cursor string    Opaque continuation from the previous response
      --limit int        Maximum records in one page (1–50) (default 20)

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli policy [flags]
  wecom-channel-cli policy [command]

Available Commands:
  example     Print an operator policy template; discover channel IDs with channel list first
  validate    Strictly validate an operator policy file without credentials or I/O effects

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli policy [command] --help" for more information about a command.

Usage:
  wecom-channel-cli policy example [flags]

Flags:
      --bot-id string    Verified bot ID to insert into the template
      --channel string   Channel data.topic_id from channel list

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli policy validate [flags]

Flags:
      --file string   Operator policy file

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli post [flags]
  wecom-channel-cli post [command]

Available Commands:
  get         Read one post by its exact ID
  list        Read one bounded page of post data
  propose     Create an immutable proposal for operator review; does not send to WeCom

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli post [command] --help" for more information about a command.

Usage:
  wecom-channel-cli post get [flags]

Flags:
      --channel string   Channel ID from channel list or an authenticated event
      --post string      Post ID from post list, search get, or event get

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli post list [flags]

Flags:
      --channel string   Channel ID from channel list or an authenticated event
      --cursor string    Opaque continuation from the previous response
      --from string      Inclusive RFC 3339 lower bound
      --limit int        Maximum records in one page (1–50) (default 20)
      --since string     Relative time window, such as 24h (first page only)
      --to string        Exclusive RFC 3339 upper bound (defaults to now with --from)

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli post propose [flags]

Flags:
      --channel string   Exact channel ID
      --dry-run          Preview the exact proposal without storing or sending it
      --key string       Stable caller-chosen idempotency key; reuse it after a transport failure
      --stdin            Read the exact content from stdin; no file is opened by the broker
      --text string      Exact text to propose; use --stdin to avoid shell quoting and argv exposure

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli proposal [flags]
  wecom-channel-cli proposal [command]

Available Commands:
  approve     Operator-only: approve and execute one exact pending proposal
  get         Read a proposal, including an uncertain send outcome
  list        Operator-only: list retained proposals in all states
  reject      Operator-only: reject one pending proposal without sending
  resolve     Operator-only: record a verified uncertain outcome; never resend

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli proposal [command] --help" for more information about a command.

Usage:
  wecom-channel-cli proposal approve [flags]

Flags:
      --digest string   Exact digest from the reviewed immutable proposal
      --dry-run         Preview without a state change or remote write
      --id string       Exact proposal ID
      --yes             Confirm this exact operator action; never inferred from channel content

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli proposal get [flags]

Flags:
      --id string   Proposal ID from post/reply/reaction propose or proposal list

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli proposal list [flags]

Flags:
      --cursor string   Previous proposal-list cursor
      --limit int       Page size (1–100) (default 20)

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli proposal reject [flags]

Flags:
      --digest string   Exact digest from the reviewed immutable proposal
      --dry-run         Preview without a state change or remote write
      --id string       Exact proposal ID
      --yes             Confirm this exact operator action; never inferred from channel content

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli proposal resolve [flags]

Flags:
      --digest string      Exact digest from the reviewed immutable proposal
      --dry-run            Preview without a state change or remote write
      --id string          Exact proposal ID
      --outcome string     Independently verified outcome: sent or not_sent (never retries)
      --remote-id string   Verified post/reply ID for sent outcomes; omit for native reactions
      --yes                Confirm this exact operator action; never inferred from channel content

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli reaction [flags]
  wecom-channel-cli reaction [command]

Available Commands:
  list        Read native reactions and the bot's membership on one target
  propose     Propose adding or removing a native emoji; never sends immediately
  types       List the 115 documented native emoji types offline

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli reaction [command] --help" for more information about a command.

Usage:
  wecom-channel-cli reaction list [flags]

Flags:
      --channel string   Channel ID from channel list or an authenticated event
      --event string     Matching authenticated mention event for a mention-only read
      --post string      Exact post ID from post list, search get or event get
      --reply string     Optional reply ID; omit to inspect the post itself

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli reaction propose [flags]

Examples:
  wecom-channel-cli --use-context engineering reaction propose --post POST_ID --emoji-type 1 --action add --key reaction-1 --dry-run
  wecom-channel-cli --use-context engineering reaction propose --post POST_ID --reply REPLY_ID --emoji-type 3 --action remove --event EVENT_ID --key reaction-2 --dry-run

Flags:
      --action string    Required: add or remove this bot's native reaction
      --channel string   Exact channel ID
      --dry-run          Preview the exact native action without state changes or remote requests
      --emoji-type int   Native enum value from reaction types (not a Unicode emoji)
      --event string     Matching authenticated mention event; required by mentioned scope
      --key string       Stable idempotency key; use a new key for a separately reviewed action
      --post string      Exact post ID to react to or containing the target reply
      --reply string     Optional exact reply ID; omit to react to the post

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli reaction types [flags]

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli relay [flags]
  wecom-channel-cli relay [command]

Available Commands:
  claim       Atomically claim a webhook batch in worker-owned state before processing
  consume     Record a claimed batch as processed or failed; never send channel replies
  resolve     Reconcile an unknown HTTP acceptance using verified host evidence
  run         Collect changes and deliver nonempty batches without a model
  status      Read local delivery counts, timestamps and failure causes; this does not probe process liveness

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli relay [command] --help" for more information about a command.

Usage:
  wecom-channel-cli relay claim [flags]

Flags:
      --batch-file string       Original relay batch JSON; - reads stdin (required)
      --consumer-state string   Private worker-owned claim file, one per context (required)
      --dry-run                 Validate input and inspect state without claiming, locks or writes

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli relay consume [flags]

Flags:
      --batch-id string         Batch ID returned by relay claim (required)
      --claim-id string         Claim token returned only to the successful claimant (required)
      --consumer-state string   Private worker-owned claim file (required)
      --dry-run                 Validate completion without locks or writes
      --result string           processed or failed (required); neither permits automatic replay

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli relay resolve [flags]

Flags:
      --batch-id string   Exact unknown batch ID (required)
      --dry-run           Validate resolution without locks or writes
      --evidence string   Non-secret host run or operator reconciliation reference (required)
      --outcome string    accepted or not_accepted, verified from host history (required)
      --state string      Private sender-owned relay state (required)

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli relay run [flags]

Examples:
  wecom-channel-cli --use-context engineering relay run --whole-channel --config /etc/wecom-relay/relay.json --state /var/lib/wecom-relay/state.json --duration 24h
  wecom-channel-cli relay status --state /var/lib/wecom-relay/state.json

Flags:
      --after-sequence int   Replay after this sequence only when creating new relay state
      --allow-partial        Explicitly accept allowlisted-human callback coverage
      --config string        Private operator-provisioned JSON with fixed destination, filters and retry bounds
      --dry-run              Inspect binding and coverage without credentials, remote reads, locks or state writes
      --duration duration    Maximum session duration, up to 24h; only --state preserves queued work on exit (default 5m0s)
      --ephemeral            Keep delivery state only in bounded memory; interruption loses pending work, restart starts quietly now
      --interval duration    Minimum scan interval, 1s–1m; operator polling rates still apply (default 2s)
      --max-batches int      Stop after this many acknowledged or HTTP-accepted batches in this session (default 1000)
      --post stringArray     Observe this post and its replies; repeat for up to 32 IDs
      --retry-failed         Explicitly reset persisted retry budgets after repairing a failed receiver or scan
      --state string         Durable JSON queue in an existing private service-owned directory; mutually exclusive with --ephemeral
      --whole-channel        Observe the selected channel

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli relay status [flags]

Flags:
      --batch-id string         Inspect a specific retained delivery or worker claim
      --consumer-state string   Private worker-owned processing state; mutually exclusive with --state
      --state string            Private sender-owned relay state

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli reply [flags]
  wecom-channel-cli reply [command]

Available Commands:
  get         Read one reply by its exact ID
  list        Read one bounded page of reply data
  propose     Create an immutable proposal for operator review; does not send to WeCom

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli reply [command] --help" for more information about a command.

Usage:
  wecom-channel-cli reply get [flags]

Flags:
      --channel string   Channel ID from channel list or an authenticated event
      --post string      Post ID from post list, search get, or event get
      --reply string     Reply ID from reply list or event get

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli reply list [flags]

Flags:
      --channel string   Channel ID from channel list or an authenticated event
      --cursor string    Opaque continuation from the previous response
      --from string      Inclusive RFC 3339 lower bound
      --limit int        Maximum records in one page (1–50) (default 20)
      --post string      Post ID from post list, search get, or event get
      --since string     Relative time window, such as 24h (first page only)
      --to string        Exclusive RFC 3339 upper bound (defaults to now with --from)

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli reply propose [flags]

Flags:
      --channel string        Exact channel ID
      --dry-run               Preview the exact proposal without storing or sending it
      --event string          Authenticated mention event ID (required unless read_all is permitted)
      --key string            Stable caller-chosen idempotency key; reuse it after a transport failure
      --parent-reply string   Optional exact parent reply ID
      --post string           Exact post ID
      --stdin                 Read the exact content from stdin; no file is opened by the broker
      --text string           Exact text to propose; use --stdin to avoid shell quoting and argv exposure

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli search [flags]
  wecom-channel-cli search [command]

Available Commands:
  get         Read one page of results for a search job
  start       Start an asynchronous keyword search and return its job ID

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli search [command] --help" for more information about a command.

Usage:
  wecom-channel-cli search get [flags]

Flags:
      --channel string   Channel ID from channel list or an authenticated event
      --cursor string    Opaque continuation from the previous response
      --job string       Search job ID returned by search start
      --limit int        Maximum search results in one page (1–20) (default 20)

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli search start [flags]

Flags:
      --channel string   Channel ID from channel list or an authenticated event
      --cursor string    Opaque continuation from the previous response
      --from string      Inclusive RFC 3339 lower bound
      --keyword string   One content keyword, at most 32 UTF-8 bytes
      --limit int        Maximum records in one page (1–50) (default 20)
      --since string     Relative time window, such as 24h (first page only)
      --to string        Exclusive RFC 3339 upper bound (defaults to now with --from)

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli skill [flags]
  wecom-channel-cli skill [command]

Available Commands:
  install     install companion Skill for detected or selected agent hosts
  path        path companion Skill for detected or selected agent hosts
  show        Print the embedded Skill
  status      status companion Skill for detected or selected agent hosts

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Use "wecom-channel-cli skill [command] --help" for more information about a command.

Usage:
  wecom-channel-cli skill install [flags]

Flags:
      --agent string   Agent ID supported by agent-cli-kit (for example codex or claude)
      --dir string     Explicit parent skills directory
      --dry-run        Preview installation without writing
      --overwrite      Replace differing installed content after reviewing it
      --project        Use project rather than global agent paths

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli skill path [flags]

Flags:
      --agent string   Agent ID supported by agent-cli-kit (for example codex or claude)
      --dir string     Explicit parent skills directory
      --project        Use project rather than global agent paths

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli skill show [flags]

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli skill status [flags]

Flags:
      --agent string   Agent ID supported by agent-cli-kit (for example codex or claude)
      --dir string     Explicit parent skills directory
      --project        Use project rather than global agent paths

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)

Usage:
  wecom-channel-cli version [flags]

Global Flags:
      --allow-writes         Override only WECOM_CHANNEL_CLI_READ_ONLY; never broker policy or approval
      --config-dir string    Client context directory (or WECOM_CHANNEL_CONFIG)
      --format string        Output format: json or ndjson; trust metadata is always retained (default "json")
      --socket string        Unix socket path (or WECOM_CHANNEL_SOCKET)
      --timeout duration     Bound the entire local request (default 1m5s)
      --use-context string   Select a channel security context (or WECOM_CHANNEL_CONTEXT)