CLI reference

Every command below is checked against the shipping binary by the build. If a command is renamed and this page is not, the build fails.

icloser is the Executor. It creates workspaces, holds permissions, drives the Runtime and reports what happened.

The same binary also answers to icli. On Windows, if something else on your PATH already answers to icloser, the installer says so and names what you would get — use icli there.

Getting connected

Command	What it does
`icloser pair`	Create a workspace, ask for permissions once, and print a QR code. Run it once, in your project directory.
`icloser qr`	Draw the current workspace's code again. Does not create anything. Use this when the code scrolled away or a second device needs to join — not `pair`, which would make a new empty workspace.
`icloser run`	Poll for tasks and execute them. Keep it running.
`icloser console`	What state this machine is in, where the console is, what to do next. Works without a workspace.
`icloser open`	Open the local console in a browser; prints the address in a non-interactive shell.

Permissions

`icloser perms`	What this device is currently allowed to do.
`icloser grant read`	Add a tier on this machine. Grants only ever add — the six tiers are `read`, `write`, `exec`, `web`, `push`, `danger`, and a grant never carries across to another device.
`icloser grant write`
`icloser grant exec`
`icloser approval list`	What is waiting for you.

Workspaces and devices

`icloser workspaces`	Every workspace on this machine; the arrow marks the current one.
`icloser workspace list`	The same view through the workspace subcommand.
`icloser status`	Workspace identity, and the agent view recovered from it.
`icloser agents`	Who is running and which workspace each is bound to. Reach for this first when switching workspaces appears to do nothing.
`icloser device list`	Machines that have come for work.

Runtime and environment

`icloser runtimes`	Which coding agents are installed here and what each can hold. Runs only `--version` on each — it spends none of your model quota.
`icloser runtimes --json`	The same, machine-readable.
`icloser runtime list`	The Runtimes in this workspace.
`icloser run --runtime-kind claude`	Pin the adapter kind instead of identifying it from the executable name.
`icloser env probe`	Probe the developer toolchain on this machine.
`icloser env bootstrap`	Install what registered employees are missing.

Tasks and AI Employees

`icloser task list`	Tasks in this workspace.
`icloser task result`	What a task produced.
`icloser task diff`	What a task changed.
`icloser employee list`	Registered roles.
`icloser skill list`	The global skill catalogue.

Keeping it running

`icloser daemon install`	Keep the Executor resident. It starts at login; on macOS and Linux it is also restarted if it dies. On Windows it is a scheduled task and needs no password — prefer it to `service install`, which takes your Windows password on the command line.
`icloser daemon status`	Whether it is resident, and what it thinks it is doing.
`icloser service status`	The platform service view (Windows service, launchd, systemd).
`icloser logs -n 50`	The last 50 lines from the resident agent.

Diagnostics

`icloser version`	Which build this is. Say this first in any report. It takes no flags.
`icloser doctor`	One answer to “can this machine work right now”.

Configuration

Command line beats environment variable beats ~/.kernelhub/config.json.

Flag	Variable	What
`--api`	`KERNELHUB_API`	Gateway address.
`--ws`	`KERNELHUB_WS`	Workspace uuid.
`--token`	`KERNELHUB_TOKEN`	Workspace access token — handed out once, when the workspace is created.
`--device`	`KERNELHUB_DEVICE`	This device's id; defaults to the hostname.
`--path`	`KERNELHUB_PATH`	The working directory on this machine.
`--runtime`	`KERNELHUB_RUNTIME`	Which Runtime command to drive. Left empty, the resolver picks the best available.

The Runtime uses your own login. KernelHub does not hold, and does not need, any model API key.

Next: Version & diagnostics — what to run, and what to send us.