Command reference

Generated from the actual command tree. Every flag, one searchable surface.

Usage:
  wecom-chat-cli [flags]
  wecom-chat-cli [command]

Available Commands:
  auth        Read credential provisioning guidance
  broker      Run the credential-holding operator service
  config      Inspect operator policy
  event       Operator-only event discovery and monitoring
  memory      Manage scoped sender risk records
  relay       Deliver pending references and track acceptance separately from processing
  reply       Propose immutable replies and independently review sends
  session     Operator-controlled conversation fences
  status      Inspect broker connectivity and scope
  task        Issue or consume single-event worker grants
  version     Show the local CLI version

Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Use "wecom-chat-cli [command] --help" for more information about a command.

Usage:
  wecom-chat-cli auth [flags]
  wecom-chat-cli auth [command]

Available Commands:
  guide       Explain broker-only smart-bot credentials

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Use "wecom-chat-cli auth [command] --help" for more information about a command.

Usage:
  wecom-chat-cli auth guide [flags]

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli broker [flags]
  wecom-chat-cli broker [command]

Available Commands:
  serve       Maintain the smart-bot connection and scoped worker/operator sockets

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Use "wecom-chat-cli broker [command] --help" for more information about a command.

Usage:
  wecom-chat-cli broker serve [flags]

Flags:
      --policy string   Absolute policy JSON path

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli config [flags]
  wecom-chat-cli config [command]

Available Commands:
  example     Print a deny-by-default operator policy
  validate    Validate a protected operator policy offline

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Use "wecom-chat-cli config [command] --help" for more information about a command.

Usage:
  wecom-chat-cli config example [flags]

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli config validate [flags]

Flags:
      --policy string   Absolute policy JSON path

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli event [flags]
  wecom-chat-cli event [command]

Available Commands:
  get         Inspect one event and its durable reply outcome
  list        Read one bounded page; reuse its cursor
  watch       Stream new pending event references; explicit replay or cursor resumes history

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Use "wecom-chat-cli event [command] --help" for more information about a command.

Usage:
  wecom-chat-cli event get [flags]

Flags:
      --event string   Event ID from list/watch or a reply result

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli event list [flags]

Flags:
      --cursor string        Cursor from a prior page or event
      --include-suppressed   Include redacted quarantined/suppressed events for operator inspection
      --limit int            Maximum events, 1..100 (default 50)

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli event watch [flags]

Flags:
      --cursor string       Watch cursor saved after durable host enqueue; not a model-completion checkpoint
      --duration duration   Total observation deadline, at most 1h (default 1m0s)
      --max-events int      Maximum emitted event references (default 100)
      --replay              Explicitly replay retained live, unassigned events instead of starting now

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli memory [flags]
  wecom-chat-cli memory [command]

Available Commands:
  list        List active risk records through the operator socket
  report      Worker: report a fixed risk reason without changing user permissions
  set         Operator-only block, quarantine, watch or clear for an allowlisted user

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Use "wecom-chat-cli memory [command] --help" for more information about a command.

Usage:
  wecom-chat-cli memory list [flags]

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli memory report [flags]

Flags:
      --reason string   prompt_injection, secret_request, destructive_request, abuse, other

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli memory set [flags]

Flags:
      --reason string   Fixed reason code (default "other")
      --status string   blocked, quarantined, watch or clear
      --user string     Stable user ID from an event or reviewed operator policy
      --yes             Confirm the selected user's policy change

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli relay [flags]
  wecom-chat-cli relay [command]

Available Commands:
  claim       Atomically claim a webhook batch in supervisor-owned state before processing
  consume     Record a claimed batch as processed or failed; never send chat replies
  resolve     Reconcile an unknown HTTP acceptance using verified host evidence
  run         Trusted service: deliver nonempty metadata batches without a model
  status      Read local delivery counts and timestamps; this does not probe process liveness

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Use "wecom-chat-cli relay [command] --help" for more information about a command.

Usage:
  wecom-chat-cli relay claim [flags]

Flags:
      --batch-file string       Original relay batch JSON; - reads stdin (required)
      --consumer-state string   Private supervisor-owned claim file, one per bot/deployment/ledger (required)

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli relay consume [flags]

Flags:
      --batch-id string         Batch ID returned by relay claim (required)
      --claim-id string         Claim token returned only to the successful claimant (required)
      --consumer-state string   Private supervisor-owned claim file (required)
      --result string           processed or failed (required); neither permits automatic replay

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli relay resolve [flags]

Flags:
      --batch-id string   Exact unknown batch ID (required)
      --evidence string   Non-secret host run or operator reconciliation reference (required)
      --outcome string    accepted or not_accepted, verified from host history (required)
      --state string      Private sender-owned relay state (required)

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli relay run [flags]

Flags:
      --config string       Private fixed-destination relay JSON (required)
      --duration duration   Maximum service session duration, up to 24h; resume the same state (default 5m0s)
      --interval duration   Minimum local broker scan interval, 1s..1m (default 1s)
      --max-batches int     Maximum acknowledged or HTTP-accepted batches in this session (default 1000)
      --replay              Replay retained pending work only when creating new state; default starts quietly now
      --retry-failed        Explicitly reset retry budgets after repair; never replays an unknown outcome
      --state string        Durable JSON queue in an existing private service-owned directory (required)

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli relay status [flags]

Flags:
      --batch-id string         Inspect a specific retained delivery or supervisor claim
      --consumer-state string   Private supervisor-owned processing state; mutually exclusive with --state
      --state string            Private sender-owned relay state

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli reply [flags]
  wecom-chat-cli reply [command]

Available Commands:
  approve     Operator: approve the exact immutable proposal digest
  get         Operator: inspect the exact draft, target, digest and outcome
  propose     Worker: submit stdin text for review, or select an approved literal template
  reject      Operator: reject the exact immutable proposal digest

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Use "wecom-chat-cli reply [command] --help" for more information about a command.

Usage:
  wecom-chat-cli reply approve [flags]

Flags:
      --digest string   Exact digest returned by reply get
      --event string    Reviewed event ID
      --yes             Confirm the reviewed proposal action

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli reply get [flags]

Flags:
      --event string   Event ID with a proposal

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli reply propose [flags]

Flags:
      --template string   Policy-approved literal template ID; only in template mode

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli reply reject [flags]

Flags:
      --digest string   Exact digest returned by reply get
      --event string    Reviewed event ID
      --yes             Confirm the reviewed proposal action

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli session [flags]
  wecom-chat-cli session [command]

Available Commands:
  reset       Advance the session epoch and invalidate all previous tasks

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Use "wecom-chat-cli session [command] --help" for more information about a command.

Usage:
  wecom-chat-cli session reset [flags]

Flags:
      --event string         An event identifying the session
      --expected-epoch int   Current session epoch from an event record
      --yes                  Confirm the conversation reset

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli status [flags]

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli task [flags]
  wecom-chat-cli task [command]

Available Commands:
  get         Worker: read only the task bound to WECOM_CHAT_TASK_TOKEN
  issue       Operator: issue a short-lived grant; stdout contains a secret token
  revoke      Operator: revoke a task grant and prevent pending sends

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Use "wecom-chat-cli task [command] --help" for more information about a command.

Usage:
  wecom-chat-cli task get [flags]

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli task issue [flags]

Flags:
      --event string   Admitted event ID from event list/watch

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli task revoke [flags]

Flags:
      --event string   Event whose task must be revoked
      --yes            Confirm revocation

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path

Usage:
  wecom-chat-cli version [flags]

Global Flags:
      --allow-writes        Permit this invocation's mutation; grants no server authority
      --bot-id string       Expected bot ID from the operator
      --deployment string   Expected deployment name from the operator
      --dry-run             Validate a write without state changes or remote sends
      --format string       Output: json or ndjson (trust fields cannot be removed) (default "json")
      --socket string       Absolute worker or trusted operator Unix socket path