CLI reference

Dieter — control local or enrolled Dieter daemon machines

Usage:
  dieter [global options] <command> [options]

Global options:
  --store PATH             DIETER_HOME (default ~/.dieter)
  --gateway URL            Require this enrolled gateway origin
  --machine ID|NAME        Target an enrolled daemon; omit for the local daemon
  --timeout DURATION       Unary command and connection timeout (default 15s)
  --harness-config PATH    Local daemon harness registry YAML
  --help, -h               Show this help
  --version                Print the version

Commands:
  machine      List, route, rename, revoke, inspect, control, or privately lock machines
  status       Show target daemon health, runtime, route, and state counts
  harness      List target daemon harnesses, models, and options
  quota        Show, summarize, refresh, and reset provider-account quotas
  project      Create, browse, map hostnames, relocate, archive, and restore projects
  board        Manage boards, retirement/restore, hostnames, workflows, and labels
  card         Create, edit, read, present files, merge, and manage board conversations
  chat         Manage standalone conversations and present files or URLs
  workspace    Inspect changes and run durable Git/SCM operations
  file         Browse, edit, copy and sync project/workspace files
  terminal     Create, attach, control, and close daemon-host PTYs
  remote       Run resumable commands and native shells on a daemon host
  screen       Share screens/clipboard, configure virtual displays, inspect latency
  schedule     Create, preview, dispatch, pause, and inspect schedules
  kv           Shared portable JSON, ordering, and live account subscriptions
  channel      Agent channels (experimental): messages, claims and decisions between agents
  mail         Send Markdown reports to Dieter Mail; read, flag, file and delete them
  vault        End-to-end encrypted passwords and TOTP shared by your machines
  device       Pair, approve, revoke, and inspect the account's trusted devices
  peer         Inspect and edit account peer settings (leaderless sync)
  settings     Inspect and update prompt and daemon settings
  prompt       Inspect, update, scope, and preview prompt templates
  watch        Stream this machine's change frames as JSON Lines
  storage      Print the target daemon's central storage path
  doctor       Check local Linux/macOS runtime and service prerequisites
  setup        Authorize, enroll, and install the daemon and macOS privacy helper
  daemon       Start, enroll, recover, inspect, or manage this local daemon service
  serve        Alias for "dieter daemon start"
  version      Print the version

Without --machine, operational commands use the running local daemon API. With
--machine, the CLI uses the local daemon's enrollment to authenticate to the
gateway, prefers direct TLS, then tries WebRTC (direct or TURN), and falls back
to the bounded gateway relay.
Status reports the selected route. It never reads a remote machine's storage.
Read watches renew credentials and resume after transient failures, with five
retries between delivered frames. Revocation stops recovery; mutations and
process starts are never replayed by watch recovery.

Run "dieter help <command> [action]" or append --help at any command depth.

Usage: dieter machine <action>

Actions:
  list [--format table|json|jsonl|ids]      List enrolled machines
  gateway                                   Show the connected gateway build
  watch [--count N]                         Stream gateway presence as JSON Lines
  show [MACHINE]                            Show gateway presence and route
  route [MACHINE]                           Inspect direct routes and relay channel health
  info [MACHINE]                            Show live host telemetry
  rename --name NAME [MACHINE]              Rename an enrolled machine
  revoke --confirm MACHINE_ID [MACHINE]     Revoke an enrolled machine
  restart --confirm RESTART [MACHINE]       Restart the machine
  shutdown --confirm "SHUT DOWN" [MACHINE]  Shut the machine down
  update --confirm UPDATE [MACHINE]         Update a managed daemon service
  rtc [MACHINE]                             Get signed WebRTC configuration
  connection <start|show|close>             Manage data-only WebRTC signaling
  privacy <status|setup|on|off> [--key ID]  Control macOS local display/input privacy

Pass MACHINE or global --machine to select a remote daemon. Info, restart,
shutdown and update target the local daemon when MACHINE is omitted. Update is
non-interactive and available to Homebrew-managed macOS services and
Dieter-managed Linux systemd user services.

Usage: dieter machine list [--format table|json|jsonl|ids]

Usage: dieter machine gateway

Usage: dieter machine watch [--count N]

Usage: dieter machine show [MACHINE]

Show the machine's gateway presence and route as JSON.

Usage: dieter machine route [MACHINE]

Show the machine's direct routes and relay channel health as JSON.

Usage: dieter machine info [MACHINE]

Show live host telemetry; the local daemon when MACHINE is omitted.

Usage: dieter machine rename --name NAME [MACHINE]

Usage: dieter machine revoke --confirm MACHINE_ID [MACHINE]

--confirm must equal the machine's exact ID.

Usage: dieter machine restart --confirm RESTART [MACHINE]

Usage: dieter machine shutdown --confirm "SHUT DOWN" [MACHINE]

Usage: dieter machine update --confirm UPDATE [MACHINE]

Update a Homebrew-managed macOS or Dieter-managed Linux daemon service.

Usage: dieter machine rtc [MACHINE]

Print a signed WebRTC (ICE) configuration for the machine as JSON.

Usage: dieter machine connection <start|show|close> [options]

Inspect or manage data-only WebRTC signaling on the selected daemon.
Use --machine ID|NAME for a remote daemon. Normal commands select WebRTC automatically.
start requires protobuf JSON containing rtcConfiguration and offerSdp.

Usage: dieter machine connection start --request FILE

Start data-only WebRTC signaling from protobuf JSON with rtcConfiguration and
offerSdp (a signed RTC configuration and the gathered SDP offer).

Usage: dieter machine connection show SESSION

Show the session's selected ICE mode (direct or turn).

Usage: dieter machine connection close SESSION

Close only this data-only transport.

Usage: dieter [--machine ID|NAME] machine privacy <status|setup|on|off> [--key ID]

Black out local displays and block physical input while agents and remote control continue.
Setup registers the privileged input helper; approve it and grant Input Monitoring on the target Mac.
Requires macOS Accessibility permission. Stays on across disconnects and daemon restarts;
unlock explicitly or reboot to clear. This is session privacy, not an authentication lock.

Usage: dieter [--machine ID|NAME] machine privacy status

Show the privacy state (off, on or degraded) and whether its input helper needs setup, as JSON.

Usage: dieter [--machine ID|NAME] machine privacy setup [--key ID]

Register the privileged input helper; approve it and grant Input Monitoring on the target Mac.
--key is an idempotency key: reuse it only to retry this operation on this daemon.

Usage: dieter [--machine ID|NAME] machine privacy on [--key ID]

Black out local displays and block physical input; agents and remote control continue.
It stays on across disconnects and daemon restarts until off or a reboot.
--key is an idempotency key: reuse it only to retry this operation on this daemon.

Usage: dieter [--machine ID|NAME] machine privacy off [--key ID]

Restore local displays and physical input.
--key is an idempotency key: reuse it only to retry this operation on this daemon.

Usage: dieter status [--format table|json]

Usage: dieter harness list [--format table|json|jsonl|ids]

Usage: dieter harness list [--format table|json|jsonl|ids]

Usage: dieter quota <action>

Actions:
  list [PROVIDER] [--format table|json|jsonl]  List account quotas and provider summaries
  watch [PROVIDER] [--count N]                Stream quota updates as JSON Lines
  refresh [PROVIDER] [--account KEY]          Request a bounded refresh and show the result
  include PROVIDER --account KEY              Include an account in its header summary
  exclude PROVIDER --account KEY              Exclude an account from its header summary
  reset openai --account KEY --confirm RESET  Consume one available reset credit

PROVIDER is openai, codex, or claude. Quotas are gateway-account scoped and
combine accounts discovered by all online enrolled machines. Summary values
show the lowest remaining window; separate account quotas are never summed.

Usage: dieter quota list [PROVIDER] [--format table|json|jsonl]

Usage: dieter quota watch [PROVIDER] [--count N]

Usage: dieter quota refresh [PROVIDER] [--account KEY] [--format table|json]

Claude refresh respects its five-minute polling interval and ten-minute failure cooldown.

Usage: dieter quota include PROVIDER --account KEY

Usage: dieter quota exclude PROVIDER --account KEY

Usage: dieter quota reset openai --account KEY --confirm RESET

Usage: dieter project <action>

Actions:
  list                            List active projects; --removed lists archived ones
  show PROJECT                    Show project metadata
  create PATH                     Create and register a Git working tree on the target daemon
  open PATH                       Register an existing Git working tree on the target daemon
  directories [PATH]              Browse daemon-host directories and Git repositories
  update PROJECT                  Update path, name, summary, instructions or browser hostnames
  workspace PROJECT               Update the Git base and validation commands
  remove PROJECT                  Archive a project
  restore PROJECT                 Restore an archived project
  checkouts PROJECT               List the project's checkouts across machines
  attach PROJECT PATH             Attach this machine's checkout to an existing shared project
  detach CHECKOUT                 Detach a local checkout
  consolidate SOURCE DESTINATION  Merge SOURCE into DESTINATION, keeping all boards and owners

Usage: dieter project create [options] PATH

Options:
  --operation-id ID           Reuse for a safe retry of project creation
  --name NAME                 Project display name
  --summary TEXT              Project summary
  --prompt TEXT               Project instructions
  --prompt-file FILE          Read project instructions from FILE or -
  --board-name NAME           Initial board name (default Main)
  --workflow direct|review    Initial board workflow
  --base-remote REMOTE        Git base remote
  --base-branch BRANCH        Git base branch
  --validation-file FILE      Validation command JSON
  --format json|id            Output format

Usage: dieter project open [options] PATH

Options:
  --operation-id ID           Reuse for a safe retry of project creation
  --name NAME                 Project display name
  --summary TEXT              Project summary
  --prompt TEXT               Project instructions
  --prompt-file FILE          Read project instructions from FILE or -
  --board-name NAME           Initial board name (default Main)
  --workflow direct|review    Initial board workflow
  --base-remote REMOTE        Git base remote
  --base-branch BRANCH        Git base branch
  --validation-file FILE      Validation command JSON
  --format json|id            Output format

Usage: dieter project directories [PATH]

Usage: dieter project list [--removed] [--format table|json|jsonl|ids]

Usage: dieter project show PROJECT

Usage: dieter project update [--path PATH] [--name NAME] [--summary TEXT] [--prompt TEXT|--prompt-file FILE] [--hostname HOST[:PORT] ...|--clear-hostnames] PROJECT

Repeat --hostname to replace the complete list of exact browser hosts or host:port mappings.
Ports are 1-65535; use brackets for IPv6 ports, for example '[::1]:4018'. No URL, path, or wildcard.
Capture tries board mappings before project mappings. Within each scope, an exact port wins,
then a bare host is the fallback; HTTP and HTTPS default to ports 80 and 443.
Use --clear-hostnames to remove all mappings; omit both flags to preserve them.

Usage: dieter project workspace [--base-remote REMOTE] [--base-branch BRANCH] [--validation-file FILE --checkout ID] PROJECT

Usage: dieter project remove PROJECT

Usage: dieter project restore PROJECT

Usage: dieter project consolidate SOURCE DESTINATION

Keep destination project defaults and retain every source board, label, checkout, and conversation with its existing ID and machine owner. Source references become durable redirects.

Usage: dieter project attach [--name NAME] PROJECT PATH

Attach an existing Git working tree on the selected machine to a shared project.

Usage: dieter project detach CHECKOUT

Detach a checkout on the selected machine without deleting project or conversation data.

Usage: dieter project checkouts PROJECT

List the project's checkouts on every machine; paths are shown only for the selected machine.

Usage: dieter board <action>

Actions:
  list                 List boards
  show BOARD           Show one board, its lanes and labels
  create               Create a direct or review workflow board
  rename BOARD         Rename a board
  retention BOARD      Configure automatic Done-card archiving
  git BOARD            Configure the default remote and publishing mode
  hostnames BOARD      Replace, append or clear exact browser hosts
  retire BOARD         Retire an empty board without deleting its records
  restore BOARD        Restore a retired board by exact ID
  label list           List board labels
  label add            Create a board label
  label update LABEL   Update label name, color or instructions
  label remove LABEL   Delete a board label

Usage: dieter board retire --revision REV --operation ID BOARD

Use an exact board ID and its retirementRevision from board show. Retirement refuses active, archived, pending card or schedule references. Records and labels are retained; restore is reversible. A late peer reference makes retirement blocked and the board visible.
The operation ID is a durable local replay receipt: retry identical input only on the same daemon. Success means local durability, not acknowledgement by every replica.

Usage: dieter board restore --revision REV --operation ID BOARD

Use an exact board ID and its retirementRevision from board show. Retirement refuses active, archived, pending card or schedule references. Records and labels are retained; restore is reversible. A late peer reference makes retirement blocked and the board visible.
The operation ID is a durable local replay receipt: retry identical input only on the same daemon. Success means local durability, not acknowledgement by every replica.

Usage: dieter board hostnames [--hostname HOST[:PORT] ...] [--append|--clear] BOARD

Accepts exact hosts or host:port mappings. Replaces the complete list by default.
--append adds without replacing; --clear removes all.
Ports are 1-65535; use brackets for IPv6 ports, for example '[::1]:4018'. No URL, path, or wildcard.
Capture tries board mappings before project mappings. Within each scope, an exact port wins,
then a bare host is the fallback; HTTP and HTTPS default to ports 80 and 443.

Usage: dieter board create --project PROJECT --name NAME [--workflow direct|review] [--description TEXT] [--archive-done POLICY] [--base-remote REMOTE] [--remote-publish manual|pull_request|push_base]

Usage: dieter board list [--project PROJECT] [--retired] [--page-size N --after ID --snapshot REV] [--format table|json|jsonl|ids]

Active boards are the default. --retired returns a bounded page; JSON includes nextId and snapshotRevision for continuation.

Usage: dieter board show BOARD

Usage: dieter board rename --name NAME BOARD

Usage: dieter board retention --archive-done POLICY BOARD

POLICY: never, immediately, after_1_day, after_7_days, after_30_days, or after_90_days.

Usage: dieter board git [--base-remote REMOTE] [--remote-publish manual|pull_request|push_base] BOARD

manual preserves explicit Git actions, pull_request requires PR publishing, and push_base pushes validated local integrations to the configured base branch.

Usage: dieter board label <action> [options]

Actions:
  add --board BOARD --name NAME [--color COLOR] [--instructions TEXT]
  list --board BOARD
  update --board BOARD [--name NAME] [--color COLOR] [--instructions TEXT] LABEL
  remove --board BOARD LABEL

COLOR is a hex color such as #6558df (the default for new labels). LABEL is an
exact label ID or a unique name. Agents see a label's instructions on its cards.

Usage: dieter board label <action> [options]

Actions:
  add --board BOARD --name NAME [--color COLOR] [--instructions TEXT]
  list --board BOARD
  update --board BOARD [--name NAME] [--color COLOR] [--instructions TEXT] LABEL
  remove --board BOARD LABEL

COLOR is a hex color such as #6558df (the default for new labels). LABEL is an
exact label ID or a unique name. Agents see a label's instructions on its cards.

Usage: dieter board label <action> [options]

Actions:
  add --board BOARD --name NAME [--color COLOR] [--instructions TEXT]
  list --board BOARD
  update --board BOARD [--name NAME] [--color COLOR] [--instructions TEXT] LABEL
  remove --board BOARD LABEL

COLOR is a hex color such as #6558df (the default for new labels). LABEL is an
exact label ID or a unique name. Agents see a label's instructions on its cards.

Usage: dieter board label <action> [options]

Actions:
  add --board BOARD --name NAME [--color COLOR] [--instructions TEXT]
  list --board BOARD
  update --board BOARD [--name NAME] [--color COLOR] [--instructions TEXT] LABEL
  remove --board BOARD LABEL

COLOR is a hex color such as #6558df (the default for new labels). LABEL is an
exact label ID or a unique name. Agents see a label's instructions on its cards.

Usage: dieter board label <action> [options]

Actions:
  add --board BOARD --name NAME [--color COLOR] [--instructions TEXT]
  list --board BOARD
  update --board BOARD [--name NAME] [--color COLOR] [--instructions TEXT] LABEL
  remove --board BOARD LABEL

COLOR is a hex color such as #6558df (the default for new labels). LABEL is an
exact label ID or a unique name. Agents see a label's instructions on its cards.

Usage: dieter card <action>

Actions:
  list         Search board cards
  show         Show a card's metadata as JSON
  context      Print a card's task brief, project instructions, board and lane
  transcript   Read a card's conversation
  poll         Fetch one bounded conversation update
  watch        Stream conversation updates as JSON Lines
  tool-output  Fetch a full tool input/output payload
  create       Create a card (Todo draft or running)
  start        Start a Todo draft
  send         Send a message to a card; it queues behind a running turn
  queue        Manage messages waiting behind the running turn
  cancel       Cancel the running turn
  move         Move a card to another lane
  labels       Replace a card's board labels
  present      Show a file or URL in the conversation's workspace pane
  read         Mark a displayed model response as seen
  rename       Rename a card
  update       Update the title, or a draft's task brief and agent settings
  fork         Fork a finished conversation into a standalone chat
  merge        Queue an idle card's request in a started card and mark it Done
  archive      Archive a card
  unarchive    Restore an archived card
  workspace    Use the project directory or an isolated worktree

Messages sent with "card send" appear as the human's. Agents message each
other with "dieter channel post" when agent channels are on.

Usage: dieter card present (--path PATH [--line N] | --url URL) [--title TITLE] CARD

Request presentation in the exact conversation's native workspace pane.
Paths belong to its owning daemon/worktree (relative paths are recommended).
URLs must be HTTP(S). File size is limited to 5 MiB. This does not resume the
agent or guarantee that a connected client has displayed the request.
Returns the durable presentation ID and normalized target as JSON.
Global --machine selects the owning daemon through authenticated direct/relay routes.

Usage: dieter card create --project PROJECT --board BOARD (--title TITLE | --auto-title) --workspace project|worktree [options]

Options:
  --checkout CHECKOUT       Checkout on the target machine; required if it has several
  --lane todo|running       Todo creates a draft; Running starts immediately
  --auto-title              Save immediately; GPT Spark improves the title in the background
  --prompt TEXT             Initial task brief
  --prompt-file FILE        Read the task brief from FILE or -
  --attach FILE             Attach a file; repeat up to four times
  --provider HARNESS        Harness provider
  --model MODEL             Model for the first turn
  --effort EFFORT           Reasoning or thinking effort
  --provider-option K=V     Provider option; repeat as needed
  --labels LABELS           Comma-separated label IDs
  --workspace MODE          project or worktree
  --branch BRANCH           Optional worktree branch
  --base-branch BRANCH      Optional worktree base branch
  --base-remote REMOTE      Optional board/project remote override
  --remote-publish MODE     manual, pull_request, or push_base
  --vault                   Let this conversation's agent turns use the account
                            vault (fixed at creation; see dieter vault --help)
  --mail                    Let this conversation's agent turns send you mail
                            (fixed at creation; see dieter mail --help)
  --format json|id          Output format

Destination defaults to the running local daemon. Pass global --machine ID|NAME
before the command to create on another enrolled machine.

Usage: dieter card list [--project PROJECT] [--board BOARD] [--lane LANE] [--label LABEL] [--status STATUS] [--query TEXT] [--archived] [--limit N] [--format table|json|jsonl|ids]

Usage: dieter card show CARD

Show the conversation with its project and board as JSON, including cumulative
provider-reported tokenUsage.

Usage: dieter card context CARD

Print the title, task brief, lane, project instructions, board and workflow, and
cumulative provider-reported tokenUsage as compact JSON.

Usage: dieter card transcript [--last N] [--before INDEX] CARD

Usage: dieter card poll [--last N] [--after-seq N] CARD

Usage: dieter card watch [--last N] [--after-seq N] [--count N] CARD

An up-to-date --after-seq receives a current metadata acknowledgment without
resending unchanged messages; this initial frame counts toward --count.

Read subscriptions renew credentials and resume from their last delivered checkpoint
after transient failures (up to five retries between frames). Revocation stops
recovery. Mutations, process starts, and stdin writes are never replayed.

Usage: dieter card tool-output --message MESSAGE --tool-call TOOL [--revision REVISION] CARD

Usage: dieter card fork [--at MESSAGE_ID] [--title TITLE] [--format json|id] CARD

Usage: dieter card send [--message TEXT|--file FILE] [--attach FILE ...] [--provider P] [--model M] [--effort E] [--provider-option K=V] CARD

Send a message as the human. It starts a turn, or queues behind the running turn
with its model selection. Model, effort and mutable provider options apply to this
message where supported; the provider stays fixed after the first message. Use
--effort default to reset reasoning.

Usage: dieter card queue <action>

Actions:
  remove   Remove a message that has not started yet

Usage: dieter card queue remove --message MESSAGE_ID CARD

Removes a queued message and prints its complete content as JSON.

Usage: dieter card read --response-seq SEQ CARD

Mark the displayed model response as seen. Use responseSeq from show; a stale
receipt cannot clear a newer reply.

Usage: dieter card merge --into TARGET CARD

Queue CARD's initial request and attachments in a started target on the same board. The source must be idle with an empty queue. Move it to Done and link it to TARGET. Retries are idempotent; conversations and workspaces are preserved.

Usage: dieter card move --lane todo|running|review|done [--after CARD] [--before CARD] [--revision REV] CARD

Usage: dieter card start CARD

Usage: dieter card labels --set LABELS CARD

LABELS is a comma-separated list of board label IDs; empty clears labels.

Usage: dieter card cancel CARD

Requests cancellation and returns once the active turn has been signaled.
Queued messages start after that turn finishes cleanup.

Usage: dieter card rename --title TITLE CARD

Usage: dieter card update [--title TITLE] [--prompt TEXT|--prompt-file FILE] [--provider P] [--model M] [--effort E] [--provider-option K=V] CARD

The task brief and agent settings are editable only before the first turn.

Usage: dieter card archive CARD

Usage: dieter card unarchive CARD

Usage: dieter card workspace --mode project|worktree [--branch BRANCH] [--base-branch BRANCH] [--base-remote REMOTE] [--remote-publish manual|pull_request|push_base] CARD

Usage: dieter chat <action>

Actions:
  create, list, show, context, transcript, poll, watch, tool-output, send,
  queue, cancel, present, read, rename, update, fork, archive, unarchive,
  workspace, pin, unpin

A standalone chat is a conversation without a board: it has no lanes or labels
and starts when created. Actions take the same options as their card versions
(see dieter chat ACTION --help).

Usage: dieter chat present (--path PATH [--line N] | --url URL) [--title TITLE] CHAT

Request presentation in the exact conversation's native workspace pane.
Paths belong to its owning daemon/worktree (relative paths are recommended).
URLs must be HTTP(S). File size is limited to 5 MiB. This does not resume the
agent or guarantee that a connected client has displayed the request.
Returns the durable presentation ID and normalized target as JSON.
Global --machine selects the owning daemon through authenticated direct/relay routes.

Usage: dieter chat create --project PROJECT (--title TITLE | --auto-title) --workspace project|worktree [options]

Options:
  --checkout CHECKOUT       Checkout on the target machine; required if it has several
  --auto-title              Save immediately; GPT Spark improves the title in the background
  --prompt TEXT             Initial task brief
  --prompt-file FILE        Read the task brief from FILE or -
  --attach FILE             Attach a file; repeat up to four times
  --provider HARNESS        Harness provider
  --model MODEL             Model for the first turn
  --effort EFFORT           Reasoning or thinking effort
  --provider-option K=V     Provider option; repeat as needed
  --workspace MODE          project or worktree
  --branch BRANCH           Optional worktree branch
  --base-branch BRANCH      Optional worktree base branch
  --base-remote REMOTE      Optional board/project remote override
  --remote-publish MODE     manual, pull_request, or push_base
  --vault                   Let this conversation's agent turns use the account
                            vault (fixed at creation; see dieter vault --help)
  --mail                    Let this conversation's agent turns send you mail
                            (fixed at creation; see dieter mail --help)
  --format json|id          Output format

Destination defaults to the running local daemon. Pass global --machine ID|NAME
before the command to create on another enrolled machine.

Usage: dieter chat list [--project PROJECT] [--archived] [--format table|json|jsonl|ids]

Usage: dieter chat show CHAT

Show the conversation with its project and board as JSON, including cumulative
provider-reported tokenUsage.

Usage: dieter chat context CHAT

Print the title, task brief, lane, project instructions, board and workflow, and
cumulative provider-reported tokenUsage as compact JSON.

Usage: dieter chat transcript [--last N] [--before INDEX] CHAT

Usage: dieter chat poll [--last N] [--after-seq N] CHAT

Usage: dieter chat watch [--last N] [--after-seq N] [--count N] CHAT

An up-to-date --after-seq receives a current metadata acknowledgment without
resending unchanged messages; this initial frame counts toward --count.

Read subscriptions renew credentials and resume from their last delivered checkpoint
after transient failures (up to five retries between frames). Revocation stops
recovery. Mutations, process starts, and stdin writes are never replayed.

Usage: dieter chat tool-output --message MESSAGE --tool-call TOOL [--revision REVISION] CHAT

Usage: dieter chat fork [--at MESSAGE_ID] [--title TITLE] [--format json|id] CHAT

Usage: dieter chat send [--message TEXT|--file FILE] [--attach FILE ...] [--provider P] [--model M] [--effort E] [--provider-option K=V] CHAT

Send a message as the human. It starts a turn, or queues behind the running turn
with its model selection. Model, effort and mutable provider options apply to this
message where supported; the provider stays fixed after the first message. Use
--effort default to reset reasoning.

Usage: dieter chat queue <action>

Actions:
  remove   Remove a message that has not started yet

Usage: dieter chat queue remove --message MESSAGE_ID CHAT

Removes a queued message and prints its complete content as JSON.

Usage: dieter chat read --response-seq SEQ CHAT

Mark the displayed model response as seen. Use responseSeq from show; a stale
receipt cannot clear a newer reply.

Usage: dieter chat cancel CHAT

Requests cancellation and returns once the active turn has been signaled.
Queued messages start after that turn finishes cleanup.

Usage: dieter chat rename --title TITLE CHAT

Usage: dieter chat update [--title TITLE] [--prompt TEXT|--prompt-file FILE] [--provider P] [--model M] [--effort E] [--provider-option K=V] CHAT

The task brief and agent settings are editable only before the first turn.

Usage: dieter chat archive CHAT

Usage: dieter chat unarchive CHAT

Usage: dieter chat workspace --mode project|worktree [--branch BRANCH] [--base-branch BRANCH] [--base-remote REMOTE] [--remote-publish manual|pull_request|push_base] CHAT

Usage: dieter chat pin CHAT

Usage: dieter chat unpin CHAT

Usage: dieter workspace <action>

Actions:
  show CARD                 Provision and show a conversation workspace
  list --project PROJECT    List durable project workspaces
  changes [target]          Show local changes for a worktree card or project
  diff [target]             Read a staged, unstaged, or combined file diff
  comments CARD             List changeset review comments
  comment [options] CARD    Add a changeset review comment
  scm CARD                  Show daemon-host source-control capabilities
  operation OPERATION       Show a durable Git operation
  watch OPERATION           Stream operation and log frames as JSON Lines
  run --kind KIND [target]  Start a serialized durable Git operation
  cancel OPERATION          Request cancellation of an operation

A target is --project PROJECT or a CARD. Run kinds for a project: stage,
unstage, discard_changes, commit, update, validate and push. A worktree card
also supports continue_conflict, abort_conflict, merge_local, cleanup, discard,
adopt, create_pr, refresh_pr and merge_pr. Commit uses the staged index; pass
--param stage_all=true only when explicitly committing every local change.
Repeat --param KEY=VALUE for kind-specific parameters.

Usage: dieter workspace show CARD

Usage: dieter workspace list --project PROJECT

Usage: dieter workspace changes [--project PROJECT] [CARD]

Usage: dieter workspace diff --path PATH [--project PROJECT] [--section combined|staged|unstaged] [--revision REVISION] [--commit SHA] [--offset N] [--limit N] [CARD]

Usage: dieter workspace comments [--revision REVISION] CARD

Usage: dieter workspace comment --path PATH --revision REVISION --message TEXT [--side new|old] [--line N] [--author NAME] [--commit SHA] CARD

Usage: dieter workspace scm CARD

Usage: dieter workspace operation OPERATION

Usage: dieter workspace watch [--after SEQUENCE] [--count N] OPERATION

Read subscriptions renew credentials and resume from their last delivered checkpoint
after transient failures (up to five retries between frames). Revocation stops
recovery. Mutations, process starts, and stdin writes are never replayed.

Usage: dieter workspace run --kind KIND [--project PROJECT] [--revision REVISION] [--param KEY=VALUE ...] [--wait] [CARD]

Usage: dieter workspace cancel OPERATION

Usage: dieter file <action>

Every action accepts either --project PROJECT or --card CARD. A card scope uses
that conversation's selected project directory or isolated worktree.

Actions:
  cp SOURCE DESTINATION       Copy binary files; remote: selects the daemon scope
  sync SOURCE DESTINATION     One-way directory sync with optional --delete
  stat PATH                   Transfer metadata and optional checksum
  scan PATH                   Bounded transfer directory page
  upload ACTION               Inspect, resume protocol, or abort an upload
  list [PATH]                 List a directory
  read PATH                   Read text or binary file content
  save PATH                   Revision-checked update of an existing text file
  create PATH                 Create a file or directory
  move SOURCE DESTINATION     Move or rename a file or directory
  delete PATH                 Delete a file; directories require --recursive

Usage: dieter file list (--project PROJECT|--card CARD) [--checkout ID] [--hidden] [--format table|json|jsonl] [PATH]

Usage: dieter file read (--project PROJECT|--card CARD) [--checkout ID] [--output FILE|-] [--format content|json] PATH

Usage: dieter file save (--project PROJECT|--card CARD) [--checkout ID] (--content TEXT|--file FILE|--file -) [--revision REVISION|--revision auto] PATH

Usage: dieter file create (--project PROJECT|--card CARD) [--checkout ID] [--kind file|directory] [--content TEXT|--file FILE] PATH

Usage: dieter file move (--project PROJECT|--card CARD) [--checkout ID] SOURCE DESTINATION

Usage: dieter file delete (--project PROJECT|--card CARD) [--checkout ID] [--recursive] PATH

Usage: dieter file cp (--project PROJECT|--card CARD) [--checkout ID] [OPTIONS] SOURCE DESTINATION

Exactly one endpoint must start with remote:; other paths are on this CLI machine.
Remote paths are relative to the selected workspace. Directories copy their contents.
Options: --recursive (cp), --dryrun, --delete (sync only), --checksum, --size-only,
  --no-clobber, ordered --exclude GLOB / --include GLOB, --concurrency N (1..8),
  --bandwidth-limit BYTES_PER_SECOND, --no-progress, --format text|jsonl.
Sync compares size and modification time; --checksum compares SHA-256 instead.
Hidden files are included; .git and transfer partials are protected. Symlinks and
special files are unsupported. Empty directories are not copied. Delete runs only
after a complete successful scan and copy phase; excluded files are protected.
Rerun an interrupted command to resume. Uploads expire after 24 hours.

Usage: dieter file sync (--project PROJECT|--card CARD) [--checkout ID] [OPTIONS] SOURCE DESTINATION

Exactly one endpoint must start with remote:; other paths are on this CLI machine.
Remote paths are relative to the selected workspace. Directories copy their contents.
Options: --recursive (cp), --dryrun, --delete (sync only), --checksum, --size-only,
  --no-clobber, ordered --exclude GLOB / --include GLOB, --concurrency N (1..8),
  --bandwidth-limit BYTES_PER_SECOND, --no-progress, --format text|jsonl.
Sync compares size and modification time; --checksum compares SHA-256 instead.
Hidden files are included; .git and transfer partials are protected. Symlinks and
special files are unsupported. Empty directories are not copied. Delete runs only
after a complete successful scan and copy phase; excluded files are protected.
Rerun an interrupted command to resume. Uploads expire after 24 hours.

Usage: dieter file stat (--project PROJECT|--card CARD) [--checkout ID] [--checksum] PATH
       dieter file scan (--project PROJECT|--card CARD) [--checkout ID] [--after NAME] [--revision REV] [--page-size N] PATH
       dieter file upload <begin|chunk|show|commit|abort> [OPTIONS]

stat and scan emit protobuf JSON. scan returns a bounded directory page; carry
its revision and next name into the following request. Restart on conflict.

Upload protocol commands (JSON output):
  begin (--project PROJECT|--card CARD) [--checkout ID] --operation ID
        --revision REV|missing --size BYTES --sha256 HASH --modified-nanos NS
        [--mode 420] PATH
  chunk --offset BYTES --file FILE UPLOAD_ID
  show UPLOAD_ID
  commit UPLOAD_ID
  abort UPLOAD_ID

Chunks are at most 1 MiB; offsets must be aligned except at the end of a file.
Replay uses identical input and operation ID. Commit is idempotent. Sessions
expire after 24 hours. Use cp/sync for automatic chunking, checksums and resume.

Usage: dieter file stat (--project PROJECT|--card CARD) [--checkout ID] [--checksum] PATH
       dieter file scan (--project PROJECT|--card CARD) [--checkout ID] [--after NAME] [--revision REV] [--page-size N] PATH
       dieter file upload <begin|chunk|show|commit|abort> [OPTIONS]

stat and scan emit protobuf JSON. scan returns a bounded directory page; carry
its revision and next name into the following request. Restart on conflict.

Upload protocol commands (JSON output):
  begin (--project PROJECT|--card CARD) [--checkout ID] --operation ID
        --revision REV|missing --size BYTES --sha256 HASH --modified-nanos NS
        [--mode 420] PATH
  chunk --offset BYTES --file FILE UPLOAD_ID
  show UPLOAD_ID
  commit UPLOAD_ID
  abort UPLOAD_ID

Chunks are at most 1 MiB; offsets must be aligned except at the end of a file.
Replay uses identical input and operation ID. Commit is idempotent. Sessions
expire after 24 hours. Use cp/sync for automatic chunking, checksums and resume.

Usage: dieter file stat (--project PROJECT|--card CARD) [--checkout ID] [--checksum] PATH
       dieter file scan (--project PROJECT|--card CARD) [--checkout ID] [--after NAME] [--revision REV] [--page-size N] PATH
       dieter file upload <begin|chunk|show|commit|abort> [OPTIONS]

stat and scan emit protobuf JSON. scan returns a bounded directory page; carry
its revision and next name into the following request. Restart on conflict.

Upload protocol commands (JSON output):
  begin (--project PROJECT|--card CARD) [--checkout ID] --operation ID
        --revision REV|missing --size BYTES --sha256 HASH --modified-nanos NS
        [--mode 420] PATH
  chunk --offset BYTES --file FILE UPLOAD_ID
  show UPLOAD_ID
  commit UPLOAD_ID
  abort UPLOAD_ID

Chunks are at most 1 MiB; offsets must be aligned except at the end of a file.
Replay uses identical input and operation ID. Commit is idempotent. Sessions
expire after 24 hours. Use cp/sync for automatic chunking, checksums and resume.

Usage: dieter terminal <action>

Actions:
  list [scope]                 List daemon-owned terminal sessions
  create [scope]               Create a PTY on the target daemon
  attach TERMINAL              Stream output and forward stdin until exit
  watch TERMINAL               Stream terminal frames as content or JSON Lines
  write --data TEXT TERMINAL   Write bytes to a running PTY
  resize --columns N --rows N TERMINAL
  rename --name NAME TERMINAL
  close TERMINAL               Stop and remove a terminal session

Create scope is exactly one of --project PROJECT, --card CARD, or --home.
--home starts in the target daemon user's home and works without a project.

Usage: dieter terminal list [--project PROJECT|--card CARD] [--format table|json|jsonl|ids]

Usage: dieter terminal create (--project PROJECT|--card CARD|--home) [--name NAME] [--shell PATH] [--directory PATH] [--columns N] [--rows N] [--format json|id]

Usage: dieter terminal attach [--after SEQUENCE] [--no-input] TERMINAL

Usage: dieter terminal watch [--after SEQUENCE] [--format content|jsonl] [--count N] TERMINAL

Read subscriptions renew credentials and resume from their last delivered checkpoint
after transient failures (up to five retries between frames). Revocation stops
recovery. Mutations, process starts, and stdin writes are never replayed.

Usage: dieter terminal write (--data TEXT|--file FILE|--file -) TERMINAL

Usage: dieter terminal resize --columns N --rows N TERMINAL

Usage: dieter terminal rename --name NAME TERMINAL

Usage: dieter terminal close TERMINAL

Usage: dieter remote <action>

Agent-oriented remote execution uses exact argv values, explicit exit status,
separate stdout/stderr, bounded resumable output, and optional PTY input. Every
action honors global --machine and uses verified direct TLS before relay.

Actions:
  exec SCOPE -- COMMAND [ARG...]     Run exact argv and wait for its exit
  shell SCOPE                        Open and attach a native remote PTY shell
  list [SCOPE]                       List retained executions
  show EXECUTION                     Show execution state
  watch EXECUTION                    Resume output from a sequence
  wait EXECUTION                     Wait for exit and propagate its exit code
  attach EXECUTION                   Watch output and forward stdin
  input EXECUTION                    Write bounded stdin bytes or EOF
  signal EXECUTION                   Send interrupt, terminate, kill, or hangup
  resize EXECUTION                   Resize a PTY execution
  cancel EXECUTION                   Gracefully terminate an execution
  close EXECUTION                    Stop and remove an execution

SCOPE is exactly one of --project PROJECT or --card CARD. Use IDs rather than
names in automation. A disconnected watch never cancels the remote process.
Output subscriptions renew credentials and resume after transient failures, with
five retries between delivered frames. Recovery never repeats process starts or
stdin writes; revoked credentials stop recovery.
Use exec --card CARD --detach to register a background process in that
conversation's native Processes workspace tab. Its output remains available
after the agent turn or tab closes; only explicit stop/timeout/daemon shutdown
ends it. The harness start_background_process tool uses the same execution API.

Usage: dieter remote exec (--project PROJECT|--card CARD) [--checkout ID] [options] -- COMMAND [ARG...]

Options: --name NAME --directory PATH --env KEY=VALUE --input TEXT --input-file FILE|- --stdin --keep-input --timeout DURATION --idempotency-key KEY --pty --columns N --rows N --max-output BYTES --detach --format content|jsonl|json|id

Usage: dieter remote shell (--project PROJECT|--card CARD) [--checkout ID] [--name NAME] [--shell PATH] [--directory PATH] [--env KEY=VALUE] [--columns N] [--rows N] [--timeout DURATION] [--idempotency-key KEY] [--detach] [--format content|jsonl|json|id]

Usage: dieter remote list [--project PROJECT|--card CARD] [--status STATUS] [--format table|json|jsonl|ids]

Usage: dieter remote show EXECUTION

Usage: dieter remote watch [--after SEQUENCE] [--format content|jsonl] [--count N] EXECUTION

Read subscriptions renew credentials and resume from their last delivered checkpoint
after transient failures (up to five retries between frames). Revocation stops
recovery. Mutations, process starts, and stdin writes are never replayed.

Usage: dieter remote wait [--after SEQUENCE] [--format content|jsonl] EXECUTION

Read subscriptions renew credentials and resume from their last delivered checkpoint
after transient failures (up to five retries between frames). Revocation stops
recovery. Mutations, process starts, and stdin writes are never replayed.

Usage: dieter remote attach [--after SEQUENCE] [--format content|jsonl] EXECUTION

Read subscriptions renew credentials and resume from their last delivered checkpoint
after transient failures (up to five retries between frames). Revocation stops
recovery. Mutations, process starts, and stdin writes are never replayed.

Usage: dieter remote input [--data TEXT|--file FILE|-] [--eof] EXECUTION

Usage: dieter remote signal --signal interrupt|terminate|kill|hangup EXECUTION

Usage: dieter remote resize --columns N --rows N EXECUTION

Usage: dieter remote cancel EXECUTION

Usage: dieter remote close EXECUTION

Usage: dieter screen <action>

Actions:
  capabilities                 Inspect displays, codecs, permissions, and readiness
  permissions [--request-control] Probe capture and input permission through the daemon
  start --request FILE         Start WebRTC signaling; stream daemon signals as JSON Lines
  signal --file FILE           Send one trickle ICE/heartbeat signal to a session
  sessions                     List viewers, controller, and capture resources
  control take|release SESSION  Transfer or release control
  status SESSION               Show current stream configuration and performance
  configure SESSION [options]  Change display, quality and stream ceilings live
  virtual ACTION SESSION       Experimental virtual desktop: status, set, presented, restore
  resolution ACTION SESSION    Experimental physical desktop modes: modes, set, restore
  refresh SESSION              Request a fresh keyframe, including an idle screen
  clipboard ACTION SESSION     Read, write, copy, paste, or toggle clipboard sharing
  close SESSION                Close a remote-desktop session

Hosting is automatically available when the required OS permissions are granted.
Use "dieter daemon permissions" on the host for guided setup; capabilities reports
ready, permission required, or unsupported. There is no enable/disable setting.

"start" accepts protobuf JSON from FILE or stdin (-). It can also consume
additional RemoteDesktopSignal JSON Lines from --signal-input FILE while the
daemon response stream remains open. Use "dieter machine rtc" to obtain signed
ICE configuration for remote sessions. Media and encrypted control travel over
the negotiated WebRTC connection, never through the CLI RPC transport.
Configure supports 1–120 fps; above 60 fps geometry is capped at 1920x1080.
Check capabilities.maxFps for older hosts. Motion trades pixels before cadence;
auto/detail preserve their cadence-first policy. All limits are adaptive.

Usage: dieter screen virtual <status|set|presented|restore> SESSION [options]

Experimental macOS virtual desktop, owned by the controlling session.
Enable DIETER_SCREEN_VIRTUAL_DISPLAY=1 on the host before starting its daemon.
set requires --width PIXELS --height PIXELS [--scale 1|2] [--disable-physical].
Dimensions must fit H.264 3840x2160 or HEVC 1920x1080, with even logical pixels.
The actual host desktop changes. Only one controlling session can own it.
presented requires --display ID --generation N: send ONLY after rendering a frame
from that exact display/media generation. An unseen desktop restores after 15s.
Physical disabling additionally requires DIETER_SCREEN_VIRTUAL_DISABLE=1 and
hardware qualification; the physical main is disabled only after presentation.
restore re-enables physical output before removing the virtual display. Control
handoff, disconnect, helper failure, and local display changes also restore it.
Supports local, verified direct TLS, and gateway relay with --machine ID|NAME.

Usage: dieter screen virtual <status|set|presented|restore> SESSION [options]

Experimental macOS virtual desktop, owned by the controlling session.
Enable DIETER_SCREEN_VIRTUAL_DISPLAY=1 on the host before starting its daemon.
set requires --width PIXELS --height PIXELS [--scale 1|2] [--disable-physical].
Dimensions must fit H.264 3840x2160 or HEVC 1920x1080, with even logical pixels.
The actual host desktop changes. Only one controlling session can own it.
presented requires --display ID --generation N: send ONLY after rendering a frame
from that exact display/media generation. An unseen desktop restores after 15s.
Physical disabling additionally requires DIETER_SCREEN_VIRTUAL_DISABLE=1 and
hardware qualification; the physical main is disabled only after presentation.
restore re-enables physical output before removing the virtual display. Control
handoff, disconnect, helper failure, and local display changes also restore it.
Supports local, verified direct TLS, and gateway relay with --machine ID|NAME.

Usage: dieter screen virtual <status|set|presented|restore> SESSION [options]

Experimental macOS virtual desktop, owned by the controlling session.
Enable DIETER_SCREEN_VIRTUAL_DISPLAY=1 on the host before starting its daemon.
set requires --width PIXELS --height PIXELS [--scale 1|2] [--disable-physical].
Dimensions must fit H.264 3840x2160 or HEVC 1920x1080, with even logical pixels.
The actual host desktop changes. Only one controlling session can own it.
presented requires --display ID --generation N: send ONLY after rendering a frame
from that exact display/media generation. An unseen desktop restores after 15s.
Physical disabling additionally requires DIETER_SCREEN_VIRTUAL_DISABLE=1 and
hardware qualification; the physical main is disabled only after presentation.
restore re-enables physical output before removing the virtual display. Control
handoff, disconnect, helper failure, and local display changes also restore it.
Supports local, verified direct TLS, and gateway relay with --machine ID|NAME.

Usage: dieter screen virtual <status|set|presented|restore> SESSION [options]

Experimental macOS virtual desktop, owned by the controlling session.
Enable DIETER_SCREEN_VIRTUAL_DISPLAY=1 on the host before starting its daemon.
set requires --width PIXELS --height PIXELS [--scale 1|2] [--disable-physical].
Dimensions must fit H.264 3840x2160 or HEVC 1920x1080, with even logical pixels.
The actual host desktop changes. Only one controlling session can own it.
presented requires --display ID --generation N: send ONLY after rendering a frame
from that exact display/media generation. An unseen desktop restores after 15s.
Physical disabling additionally requires DIETER_SCREEN_VIRTUAL_DISABLE=1 and
hardware qualification; the physical main is disabled only after presentation.
restore re-enables physical output before removing the virtual display. Control
handoff, disconnect, helper failure, and local display changes also restore it.
Supports local, verified direct TLS, and gateway relay with --machine ID|NAME.

Usage: dieter screen virtual <status|set|presented|restore> SESSION [options]

Experimental macOS virtual desktop, owned by the controlling session.
Enable DIETER_SCREEN_VIRTUAL_DISPLAY=1 on the host before starting its daemon.
set requires --width PIXELS --height PIXELS [--scale 1|2] [--disable-physical].
Dimensions must fit H.264 3840x2160 or HEVC 1920x1080, with even logical pixels.
The actual host desktop changes. Only one controlling session can own it.
presented requires --display ID --generation N: send ONLY after rendering a frame
from that exact display/media generation. An unseen desktop restores after 15s.
Physical disabling additionally requires DIETER_SCREEN_VIRTUAL_DISABLE=1 and
hardware qualification; the physical main is disabled only after presentation.
restore re-enables physical output before removing the virtual display. Control
handoff, disconnect, helper failure, and local display changes also restore it.
Supports local, verified direct TLS, and gateway relay with --machine ID|NAME.

Usage: dieter screen resolution <modes|set|restore> SESSION [options]

Experimental physical desktop resolution, independent of video stream ceilings.
"modes" lists the selected display's supported modes and current mode ID.
"set" requires --display ID --mode ID --expected-current ID from a fresh modes
response. It requires the controlling session and temporarily changes the actual
remote monitor for everyone using it. "restore" restores the leased original mode.
Control handoff, display selection, session closure, and helper exit also restore
the mode. A later local display change takes precedence. Supports --machine ID|NAME.

Usage: dieter screen resolution modes SESSION

List the selected display's supported modes and its current mode ID.

Usage: dieter screen resolution set SESSION --display ID --mode ID --expected-current ID

Change the physical monitor's mode for everyone using it; IDs come from a fresh
modes response. Requires the controlling session.

Usage: dieter screen resolution restore SESSION

Restore the leased original mode.

Usage: dieter screen clipboard read|write|paste|copy|cut|enable|disable SESSION [options]

Share text, images and regular files with an existing controlling screen session.
write updates the host clipboard; paste also invokes the native paste shortcut
once. copy/cut invoke the host shortcut and return the copied content. read returns
protobuf JSON (binary data is base64). enable/disable controls session sharing.

write/paste require exactly one format:
  --file FILE|-      UTF-8 text, at most 1 MiB (use - for stdin)
  --image FILE       PNG, JPEG, TIFF or WebP, at most 8 MiB
  --attach FILE      Regular file; repeat for up to 64 files, 8 MiB combined
read/copy/cut optionally accept:
  --output-dir DIR   Save binary items under a new private directory; never overwrite

Folders, links and duplicate filenames are rejected. Temporary native clipboard
files use DIETER_HOME/clipboard; the next transfer prunes old (24h) batches
and retains at most eight batches.
Mutations are never automatically retried. Supports global --machine ID|NAME
with direct TLS and relay fallback. Binary sharing requires an updated daemon.

Usage: dieter screen clipboard read|write|paste|copy|cut|enable|disable SESSION [options]

Share text, images and regular files with an existing controlling screen session.
write updates the host clipboard; paste also invokes the native paste shortcut
once. copy/cut invoke the host shortcut and return the copied content. read returns
protobuf JSON (binary data is base64). enable/disable controls session sharing.

write/paste require exactly one format:
  --file FILE|-      UTF-8 text, at most 1 MiB (use - for stdin)
  --image FILE       PNG, JPEG, TIFF or WebP, at most 8 MiB
  --attach FILE      Regular file; repeat for up to 64 files, 8 MiB combined
read/copy/cut optionally accept:
  --output-dir DIR   Save binary items under a new private directory; never overwrite

Folders, links and duplicate filenames are rejected. Temporary native clipboard
files use DIETER_HOME/clipboard; the next transfer prunes old (24h) batches
and retains at most eight batches.
Mutations are never automatically retried. Supports global --machine ID|NAME
with direct TLS and relay fallback. Binary sharing requires an updated daemon.

Usage: dieter screen clipboard read|write|paste|copy|cut|enable|disable SESSION [options]

Share text, images and regular files with an existing controlling screen session.
write updates the host clipboard; paste also invokes the native paste shortcut
once. copy/cut invoke the host shortcut and return the copied content. read returns
protobuf JSON (binary data is base64). enable/disable controls session sharing.

write/paste require exactly one format:
  --file FILE|-      UTF-8 text, at most 1 MiB (use - for stdin)
  --image FILE       PNG, JPEG, TIFF or WebP, at most 8 MiB
  --attach FILE      Regular file; repeat for up to 64 files, 8 MiB combined
read/copy/cut optionally accept:
  --output-dir DIR   Save binary items under a new private directory; never overwrite

Folders, links and duplicate filenames are rejected. Temporary native clipboard
files use DIETER_HOME/clipboard; the next transfer prunes old (24h) batches
and retains at most eight batches.
Mutations are never automatically retried. Supports global --machine ID|NAME
with direct TLS and relay fallback. Binary sharing requires an updated daemon.

Usage: dieter screen clipboard read|write|paste|copy|cut|enable|disable SESSION [options]

Share text, images and regular files with an existing controlling screen session.
write updates the host clipboard; paste also invokes the native paste shortcut
once. copy/cut invoke the host shortcut and return the copied content. read returns
protobuf JSON (binary data is base64). enable/disable controls session sharing.

write/paste require exactly one format:
  --file FILE|-      UTF-8 text, at most 1 MiB (use - for stdin)
  --image FILE       PNG, JPEG, TIFF or WebP, at most 8 MiB
  --attach FILE      Regular file; repeat for up to 64 files, 8 MiB combined
read/copy/cut optionally accept:
  --output-dir DIR   Save binary items under a new private directory; never overwrite

Folders, links and duplicate filenames are rejected. Temporary native clipboard
files use DIETER_HOME/clipboard; the next transfer prunes old (24h) batches
and retains at most eight batches.
Mutations are never automatically retried. Supports global --machine ID|NAME
with direct TLS and relay fallback. Binary sharing requires an updated daemon.

Usage: dieter screen clipboard read|write|paste|copy|cut|enable|disable SESSION [options]

Share text, images and regular files with an existing controlling screen session.
write updates the host clipboard; paste also invokes the native paste shortcut
once. copy/cut invoke the host shortcut and return the copied content. read returns
protobuf JSON (binary data is base64). enable/disable controls session sharing.

write/paste require exactly one format:
  --file FILE|-      UTF-8 text, at most 1 MiB (use - for stdin)
  --image FILE       PNG, JPEG, TIFF or WebP, at most 8 MiB
  --attach FILE      Regular file; repeat for up to 64 files, 8 MiB combined
read/copy/cut optionally accept:
  --output-dir DIR   Save binary items under a new private directory; never overwrite

Folders, links and duplicate filenames are rejected. Temporary native clipboard
files use DIETER_HOME/clipboard; the next transfer prunes old (24h) batches
and retains at most eight batches.
Mutations are never automatically retried. Supports global --machine ID|NAME
with direct TLS and relay fallback. Binary sharing requires an updated daemon.

Usage: dieter screen clipboard read|write|paste|copy|cut|enable|disable SESSION [options]

Share text, images and regular files with an existing controlling screen session.
write updates the host clipboard; paste also invokes the native paste shortcut
once. copy/cut invoke the host shortcut and return the copied content. read returns
protobuf JSON (binary data is base64). enable/disable controls session sharing.

write/paste require exactly one format:
  --file FILE|-      UTF-8 text, at most 1 MiB (use - for stdin)
  --image FILE       PNG, JPEG, TIFF or WebP, at most 8 MiB
  --attach FILE      Regular file; repeat for up to 64 files, 8 MiB combined
read/copy/cut optionally accept:
  --output-dir DIR   Save binary items under a new private directory; never overwrite

Folders, links and duplicate filenames are rejected. Temporary native clipboard
files use DIETER_HOME/clipboard; the next transfer prunes old (24h) batches
and retains at most eight batches.
Mutations are never automatically retried. Supports global --machine ID|NAME
with direct TLS and relay fallback. Binary sharing requires an updated daemon.

Usage: dieter screen clipboard read|write|paste|copy|cut|enable|disable SESSION [options]

Share text, images and regular files with an existing controlling screen session.
write updates the host clipboard; paste also invokes the native paste shortcut
once. copy/cut invoke the host shortcut and return the copied content. read returns
protobuf JSON (binary data is base64). enable/disable controls session sharing.

write/paste require exactly one format:
  --file FILE|-      UTF-8 text, at most 1 MiB (use - for stdin)
  --image FILE       PNG, JPEG, TIFF or WebP, at most 8 MiB
  --attach FILE      Regular file; repeat for up to 64 files, 8 MiB combined
read/copy/cut optionally accept:
  --output-dir DIR   Save binary items under a new private directory; never overwrite

Folders, links and duplicate filenames are rejected. Temporary native clipboard
files use DIETER_HOME/clipboard; the next transfer prunes old (24h) batches
and retains at most eight batches.
Mutations are never automatically retried. Supports global --machine ID|NAME
with direct TLS and relay fallback. Binary sharing requires an updated daemon.

Usage: dieter screen clipboard read|write|paste|copy|cut|enable|disable SESSION [options]

Share text, images and regular files with an existing controlling screen session.
write updates the host clipboard; paste also invokes the native paste shortcut
once. copy/cut invoke the host shortcut and return the copied content. read returns
protobuf JSON (binary data is base64). enable/disable controls session sharing.

write/paste require exactly one format:
  --file FILE|-      UTF-8 text, at most 1 MiB (use - for stdin)
  --image FILE       PNG, JPEG, TIFF or WebP, at most 8 MiB
  --attach FILE      Regular file; repeat for up to 64 files, 8 MiB combined
read/copy/cut optionally accept:
  --output-dir DIR   Save binary items under a new private directory; never overwrite

Folders, links and duplicate filenames are rejected. Temporary native clipboard
files use DIETER_HOME/clipboard; the next transfer prunes old (24h) batches
and retains at most eight batches.
Mutations are never automatically retried. Supports global --machine ID|NAME
with direct TLS and relay fallback. Binary sharing requires an updated daemon.

Usage: dieter screen sessions

List the connected viewers, active controller, four-client limit, shared capture
streams, and hardware encoders as JSON. Supports --machine ID|NAME.

Usage: dieter screen control take|release SESSION

Give a connected control-capable client exclusive keyboard/mouse control, or
release its current grant. Taking control first releases the previous client's
held input. Viewers keep streaming. Control handoff uses revocable grants.
Prints session state as JSON. Supports --machine ID|NAME.

Usage: dieter screen control take|release SESSION

Give a connected control-capable client exclusive keyboard/mouse control, or
release its current grant. Taking control first releases the previous client's
held input. Viewers keep streaming. Control handoff uses revocable grants.
Prints session state as JSON. Supports --machine ID|NAME.

Usage: dieter screen control take|release SESSION

Give a connected control-capable client exclusive keyboard/mouse control, or
release its current grant. Taking control first releases the previous client's
held input. Viewers keep streaming. Control handoff uses revocable grants.
Prints session state as JSON. Supports --machine ID|NAME.

Usage: dieter screen capabilities

Usage: dieter screen permissions [--request-control]

Ask the running daemon to discard one captured frame and check event-posting
permission. Prints the daemon/helper paths and both results as JSON. Does not
inject input or change settings. --request-control explicitly allows a macOS
Accessibility prompt or verifies the Linux XTest/RemoteDesktop portal path on
the daemon host. A Linux portal prompt can remain open for up to two minutes.
Supports --machine ID|NAME.

Usage: dieter screen start --request FILE|- [--signal-input FILE|-] [--count N] [--codec auto|h264|hevc] [--reference-recovery]
HEVC requires a compatible signed H265 offer and hardware at up to 1080p60; codec changes require a new session.
Reference recovery requires the generic RTP frame descriptor and acknowledgements after decoder completion. Omitted flags preserve request JSON.

Usage: dieter screen signal --file FILE|-

Usage: dieter screen close SESSION

Usage: dieter screen status SESSION
JSON includes paced sendMs, approximate captureToSendMs, receiver jitterBufferMs and renderMs; queueMs measures socket work only. Stages overlap and are not a glass-to-glass total.
renderMeasurement distinguishes Metal presentation from Android EGL submission. Optional decoder/encoder diagnostics report accepted configuration, not measured latency gains. mediaRtpBytes, repairRtpBytes, probeRtpBytes and fecRtpBytes exclude transport overhead. recoveryDiagnostics reports bounded packet history and repair decisions.

Usage: dieter screen configure SESSION [--display ID] [--quality auto|detail|motion] [--width N] [--height N] [--fps N] [--bitrate N] [--embedded-cursor=true|false]
Ceilings are adaptive; unspecified values retain the current session configuration.

Usage: dieter screen refresh SESSION

Usage: dieter schedule <action>

Actions:
  create                 Create a recurring project schedule
  list                   List one bounded page of schedules
  show SCHEDULE          Show a schedule and recent occurrences
  preview                Preview cron occurrence times
  update SCHEDULE        Replace a schedule definition
  run SCHEDULE           Dispatch one manual occurrence
  pause SCHEDULE         Disable automatic occurrences
  resume SCHEDULE        Enable automatic occurrences
  runs SCHEDULE          List one bounded page of occurrence history
  delete SCHEDULE        Delete the definition; cards and history remain

Usage: dieter schedule create --project PROJECT --board BOARD --name NAME --cron EXPRESSION --title TITLE --prompt TEXT [options]

Options:
  --timezone AREA/LOCATION           IANA timezone (default UTC)
  --action draft|run                 Create a draft or immediately run it
  --workspace project|worktree       Conversation workspace selection
  --labels ID,ID                     Board-label IDs
  --provider HARNESS --model MODEL --effort EFFORT
  --provider-option KEY=VALUE        Repeatable harness option
  --enabled=true|false
  --open-card skip_if_open|always
  --vault=true|false                 Cards it creates may use the account vault
  --mail=true|false                  Cards it creates may send you mail (dieter mail --help)

Usage: dieter schedule list [--project PROJECT] [--page-size N] [--page-token TOKEN] [--format table|json|jsonl|ids]

Usage: dieter schedule show [--runs N] SCHEDULE

Usage: dieter schedule preview --cron EXPRESSION [--timezone AREA/LOCATION] [--count N]

Usage: dieter schedule update --project PROJECT --board BOARD --name NAME --cron EXPRESSION --title TITLE --prompt TEXT [options] SCHEDULE

Options:
  --timezone AREA/LOCATION           IANA timezone (default UTC)
  --action draft|run                 Create a draft or immediately run it
  --workspace project|worktree       Conversation workspace selection
  --labels ID,ID                     Board-label IDs
  --provider HARNESS --model MODEL --effort EFFORT
  --provider-option KEY=VALUE        Repeatable harness option
  --enabled=true|false
  --open-card skip_if_open|always
  --vault=true|false                 Cards it creates may use the account vault
  --mail=true|false                  Cards it creates may send you mail (dieter mail --help)

Usage: dieter schedule run SCHEDULE

Usage: dieter schedule pause SCHEDULE

Usage: dieter schedule resume SCHEDULE

Usage: dieter schedule runs [--page-size N] [--page-token TOKEN] SCHEDULE

Usage: dieter schedule delete SCHEDULE

Usage: dieter kv <get|list|put|delete|move|watch> [options]

Account-scoped portable JSON state replicated between daemons. Writes acknowledge
local durability, not a quorum. Revisions are local compare-and-set checks.
Use global --machine ID|NAME for verified TLS, WebRTC, or relay targeting.

  get      Read a key, its deterministic value and all causal siblings
  list     Read a bounded snapshot page including tombstones
  put      Write JSON with an observed revision (empty means create only)
  delete   Persist a causal tombstone
  move     Position one ordered key using stable neighboring keys
  watch    Stream bounded changes; apply reset before replacement snapshots

Usage: dieter kv get --namespace NS --key KEY [--account ID]

Read the selected value and all causal siblings.

Usage: dieter kv list [--namespace NS] [--prefix PREFIX] [--after KEY --epoch EPOCH --sequence N]

Read up to 64 entries. Pass nextKey and cursor for subsequent pages.

Usage: dieter kv put --namespace NS --key KEY --file FILE [--revision REV] [--operation ID]

Write JSON (maximum 32 KiB). Read all siblings before resolving conflicts.
Pass --account ID --daemon ID to pin an uncertain retry, and retry identical
input and --operation only on that same daemon.

Usage: dieter kv delete --namespace NS --key KEY --revision REV [--operation ID]

Retain a tombstone; deleting does not remove causal history.
Pass --account ID --daemon ID to pin an uncertain retry, and retry identical
input and --operation only on that same daemon.

Usage: dieter kv move --namespace NS --key KEY [--parent ID] [--after KEY] [--before KEY] [--revision REV] [--operation ID]

Write an atomic parent/rank position. Empty neighbors append to this list.
Pass --account ID --daemon ID to pin an uncertain retry, and retry identical
input and --operation only on that same daemon.

Usage: dieter kv watch [--namespace NS] [--prefix PREFIX] [--epoch EPOCH --sequence N] [--count N]

Watch until canceled or count frames. Reset replaces the cache; publish at caughtUp.

Usage: dieter channel <list|messages|post|inbox|check|claims|release|pin|read|settings|watch|hook> [options]

Agent channels (experimental): one message channel per project, shared by
every machine of the account, with direct messages to cards, threads, pinned
decisions and file claims that keep agents sharing a checkout from overwriting
each other. A channel post interrupts nobody: agents read it when their next
turn starts. A direct message (--to) reaches a running agent in its turn, and
a person's --here reaches every running agent. Inside an agent turn
(DIETER_TURN_TOKEN) the caller is that card's agent; otherwise you act as a
person. Channels are off until switched on with "channel settings".

  list      List project channels with unread counts and members on every machine
  messages  Page a project channel or one thread
  post      Post to the project channel, a thread, or directly to cards
  inbox     Read a card's undelivered messages (an agent's own by default)
  check     Show who else is changing files, pinned decisions and recent notes
  claims    List live file claims
  release   Release a card's file claims
  pin       Pin a message as a decision, or remove the pin with --off
  read      Mark a project channel read for humans
  settings  Show or change the experimental switch (global, project, board)
  watch     Stream a project channel as JSON Lines
  hook      Harness hook adapter: reads hook JSON on stdin, prints the decision

Usage: dieter channel list [--format table|json]
List project channels: enabled state, unread count, live claims and members on every machine.

Usage: dieter channel messages --project PROJECT [--thread ID] [--after SEQ] [--before SEQ] [--limit N] [--format table|json]
Page a project channel in sequence order (default: the newest 50 messages).

Usage: dieter channel post [--project PROJECT] [--to CARD]... [--here] [--thread ID] [--kind note|request|done|decision] [--file PATH]... [--wake] [--operation ID] [--stdin] TEXT...
Post at most 4096 bytes to the project channel. Agents post to their own project. A post without
--to interrupts nobody; agents read it when their next turn starts. --to sends a direct message
that reaches a running recipient in its turn, and --wake also starts idle direct recipients
within their wake budget. --here (people only) reaches every running agent of the project.
A decision is pinned.

Usage: dieter channel inbox [--card CARD] [--peek] [--format text|json]
Print a card's undelivered messages (direct messages, and channel posts from the last 24 hours)
and mark them delivered (--peek keeps them). Agents read their own inbox; humans name --card.
Only the card's machine marks them; elsewhere, add --peek or --machine.

Usage: dieter channel check [--card CARD] [--intent TEXT] [--format text|json] FILE...
Show live claims by other cards on FILEs (relative to the card's workspace), pinned decisions
and recent notes that mention them. An agent whose files are held is woken when they are free.
Claims in other machines' checkouts are listed as advisory: coordinate before you push.

Usage: dieter channel claims [--project PROJECT] [--format table|json]
List live file claims: path, holder card, since when, waiting cards and the machine.
Claims on other machines are advisory; they never block a write here.

Usage: dieter channel release [--card CARD] [PATH...]
Release a card's claims (all without PATHs). Agents release their own; humans name --card.

Usage: dieter channel pin --project PROJECT [--off] MESSAGE_ID
Pin a message as a decision that check returns for the files it mentions, or unpin it.

Usage: dieter channel read --project PROJECT [--seq N]
Mark the project channel read for humans up to N (default: the newest message).

Usage: dieter channel settings [--global on|off | --project PROJECT --set on|off|inherit | --board BOARD --set on|off|inherit]
Show or change the replicated experimental switch. A board overrides its project, a project
overrides the global switch. Agents cannot change settings.

Usage: dieter channel watch --project PROJECT [--after SEQ] [--count N]
Stream the project channel as JSON Lines: a reset frame with the newest page, then new and
changed messages, claims and the summary.
Read subscriptions renew credentials and resume from their last delivered checkpoint
after transient failures (up to five retries between frames). Revocation stops
recovery. Mutations, process starts, and stdin writes are never replayed.

Usage: dieter channel hook
Harness hook adapter for agent channel file claims. Reads one hook JSON object (Claude Code or
Codex PreToolUse format, at most 1 MiB) on stdin, prints the hook decision and exits 0.
Prints nothing (no opinion) outside an agent turn or when the daemon is unavailable.

Usage: dieter mail <send|list|show|mark|delete> [options]

Dieter Mail: one-way Markdown reports for you. Messages stay on the machine
that received them, with their read, flag and folder state (Inbox, Archive,
Trash; the Trash empties after 30 days), and every client shows them in Mail.
There is no reply: mail never reaches an agent.

Inside an agent turn (DIETER_TURN_TOKEN) the caller is that conversation's
agent. It may only send, and only when its card, chat or schedule was created
with --mail. Anyone else is the operator: scripts and jobs send with an
optional --from label, and people read and organize the mailbox.

  send    Send a Markdown report
  list    List messages, newest first
  show    Print one message with its Markdown body
  mark    Mark messages read or unread, flag them, or move them to a folder
  delete  Delete messages for good, or empty the Trash

Usage: dieter mail send --subject TEXT (--body TEXT | --body-file PATH|-) [options]

Send a Markdown report to Dieter Mail on the target machine.

Options:
  --subject TEXT          One line, at most 200 characters
  --body TEXT             The Markdown body
  --body-file PATH|-      Read the body from PATH or stdin
  --important             Mark a failure or finding that needs action
  --operation-id ID       Retry key (at most 128 characters): a repeated send
                          returns the original message instead of a duplicate
  --from LABEL            Operators only: who is sending, e.g. backup.sh
                          (at most 64 characters)
  --format text|json|id   Output format (default text)

The body is GitHub-flavored Markdown of at most 128 KiB and 4,000 lines (each
at most 8 KiB): headings, emphasis, inline code, links, lists, task lists,
quotes, rules, fenced code and tables. macOS, Android and iOS render mermaid,
vega-lite (or vegalite) and vega fences offline. Charts require inline JSON data;
external datasets and resource loads are blocked. Invalid or unsupported blocks
keep readable source. Raw HTML shows as text and images as links, never loaded.
Agent turns may send only when their conversation has mail access, at
most 10 messages per turn and 50 per conversation in any 24 hours.

Usage: dieter mail list [--folder inbox|archive|trash|all] [--unread] [--flagged] [--limit N] [--before ID] [--format table|json]

List the target machine's mail, newest first: the Inbox unless --folder names
another folder or all of them, at most --limit messages (default 50, at most
500). --before continues after a message ID. MARK shows ● unread, ⚑ flagged
and ! important.

Usage: dieter mail show [--raw] [--format text|json] ID

Print one message: its header, then its Markdown body. --raw prints only the
body. Showing a message does not mark it read; run dieter mail mark ID --read.

Usage: dieter mail mark [--read|--unread] [--flag|--unflag] [--folder inbox|archive|trash] [--format table|json] ID...

Change the state of up to 500 messages: read or unread, flagged or not, and
the folder. Combine the changes as needed; at least one is required. Move a
message to the Trash with --folder trash, and back with --folder inbox.

Usage: dieter mail delete (ID... | --empty-trash) [--format text|json]

Delete up to 500 messages for good, or every message in the Trash. To keep a
way back, move messages to the Trash instead: dieter mail mark ID --folder
trash. The Trash empties itself after 30 days.

Usage: dieter vault <action> [options]

An account-wide password and TOTP vault shared by your machines. Items
replicate end-to-end encrypted, and every route to a machine is TLS between
your devices, so the gateway relays only ciphertext. Each machine joins once.

Setup and machines:
  status         Show vault state, members and this caller's access
  init           Create the vault on the first machine; prints a recovery key
  join           Join from another machine (approval code or recovery key)
  approve        Approve a joining machine after comparing its code
  remove-member  Revoke a machine and rotate to a new key
  rotate         Rotate the vault key; --recovery-key replaces the recovery key

Items:
  list           List items (no secrets)
  show           Show one item's metadata
  add            Add an item with name, URLs, username, password, TOTP, notes
  edit           Change fields of an item
  remove         Delete an item
  get            Print one field; secret fields require --reveal
  totp           Print the current TOTP code
  exec           Run a command with item fields in its environment
  audit          Show this machine's vault access log

ITEM is an exact vi_ ID or a unique case-insensitive name. Secrets are never
accepted as command-line arguments: use --password-file -, --prompt or
--generate. Agent turns may use the vault only when their card, chat or
schedule was created with --vault; agents cannot change membership or keys.
Prefer exec over get so secrets do not enter transcripts.

Usage: dieter vault status [--format table|json]
Show vault state, machine members, pending join codes and this caller's access.

Usage: dieter vault status [--format table|json]
Show vault state, machine members, pending join codes and this caller's access.

Usage: dieter vault init [--name NAME] [--format text|json]

Create the account vault with this machine as its first member. The printed
recovery key is shown once and never stored: keep it offline. It unlocks the
vault on any machine with dieter vault join --recovery-key-stdin.

Usage: dieter vault join [--name NAME] [--recovery-key-stdin] [--format text|json]

Without a recovery key, publish this machine's vault key and print a join code.
On an existing member, compare that code and run:
  dieter vault approve MEMBER --code CODE
The code is derived from both machines' views, so a relay that substitutes keys
produces a different code. With --recovery-key-stdin, read the recovery key
from stdin and unlock immediately.

Usage: dieter vault approve MEMBER --code CODE
Approve a pending machine. Compare CODE with the code its dieter vault join printed;
dieter vault status lists pending members with the code this machine expects.

Usage: dieter vault remove-member MEMBER
Revoke a machine and rotate to a key it never receives. It keeps anything it
already decrypted: change those passwords. Unenroll a lost machine too.

Usage: dieter vault rotate [--recovery-key]
Create a new vault key, reseal it to every member and re-encrypt all items.
--recovery-key also replaces the recovery key and prints the new one once.

Usage: dieter vault list [--query TEXT] [--url URL] [--format table|json|jsonl|ids]
List item metadata. --url matches items for that host and its subdomains.

Usage: dieter vault show ITEM
Print item metadata as JSON. Secret values are never included.

Usage: dieter vault add --name NAME [--url URL]... [--username USER] [options]

Add an item. Secrets are read from files, stdin or a no-echo prompt.

Options:
  --name NAME                Unique item name
  --url URL                  Login URL; repeat for several
  --username USER            Account user name or email
  --password-file FILE|-     Read the password from FILE or stdin
  --generate                 Generate the password on the daemon; it is not printed
  --length N                 Generated length (default 24)
  --no-symbols               Generate letters and digits only
  --totp-file FILE|-         Read an otpauth://totp URI or base32 TOTP secret
  --notes-file FILE|-        Read notes
  --prompt                   Prompt for password and TOTP without echo (terminal)
  --format json|id           Output format

Example:
  printf '%s' "$PASSWORD" | dieter vault add --name GitHub --url https://github.com/login --username me --password-file -

Usage: dieter vault edit ITEM [options]

Change item fields. Unspecified fields keep their value. Editing an item with
a conflict keeps the shown version and resolves the conflict.

Options:
  --name NAME                Rename
  --url URL                  Add a URL; repeat for several
  --replace-urls             Replace all URLs with the given --url values
  --username USER            Set the user name
  --clear-totp               Remove the TOTP secret
  --clear-notes              Remove notes
  --password-file FILE|-     Read the password from FILE or stdin
  --generate                 Generate the password on the daemon; it is not printed
  --length N                 Generated length (default 24)
  --no-symbols               Generate letters and digits only
  --totp-file FILE|-         Read an otpauth://totp URI or base32 TOTP secret
  --notes-file FILE|-        Read notes
  --prompt                   Prompt for password and TOTP without echo (terminal)

Usage: dieter vault remove ITEM
Delete an item on every member machine.

Usage: dieter vault get ITEM [--field FIELD]... [--reveal] [--format value|json]

Print item fields: password (default), username, url, name, totp or notes.
password, totp and notes require --reveal. One field prints its raw value;
several print JSON. Prefer dieter vault exec so secrets stay out of output.

Usage: dieter vault totp ITEM [--no-wait] [--format value|json]
Print the current TOTP code. With fewer than 5 seconds left, wait for the next
code unless --no-wait is set.

Usage: dieter vault exec ITEM --env NAME=FIELD... -- COMMAND [ARG...]

Run COMMAND locally with item fields in its environment. FIELD is password,
username, url, name, totp or notes. Arguments run without a shell; wrap in
sh -c only when needed. stdin, stdout and stderr pass through and the exit
status is preserved. Secrets are not printed.

Example:
  dieter vault exec GitHub --env GH_USER=username --env GH_PASS=password -- ./login.sh

Usage: dieter vault audit [--item ITEM] [--card CARD] [--limit N] [--format table|jsonl]
Show this machine's vault access log, newest first. It never contains secret values.

Usage: dieter device <action> [options]

The account's devices: a signed, append-only roster of device keys that every
machine and app verifies itself. Remote calls run mutually authenticated TLS
between roster devices, so the gateway relays bytes but can neither read them,
impersonate a device, nor add one. A new device shows a one-time code; type
that code on a trusted device to approve it. Never share a code you did not
just see on your own new device.

Actions:
  status    Show trust state, roster head, pairing code and devices
  roster    List the verified roster entries
  sync      Refresh the roster from the gateway; offer ours with --machine
  init      Start the account's roster on this machine; prints a recovery key
  requests  List devices waiting for approval (names only, never codes)
  approve   Approve the device that shows CODE
  revoke    Remove a device from the roster
  recover   Rejoin this machine with the recovery key

status, roster, sync, requests, approve and revoke accept --machine ID|NAME.
init and recover run only on the machine itself. Agent turns cannot change
device trust.

Usage: dieter device status [--format text|json]

Show the target machine's device trust: its state (NO_ROSTER, PENDING,
TRUSTED, REVOKED or CONFLICT), the pinned roster's root and head, the
devices of the account, and, while PENDING, the one-time code to type on a
trusted device.

Usage: dieter device roster [--from SEQUENCE] [--format text|json]

List the entries of the target machine's verified device roster from
SEQUENCE: who added or removed which device, signed by which member.

Usage: dieter device sync [--format text|json]

Refresh the target machine's roster from the gateway. With --machine, also
offer this machine's pinned roster to the target, so it learns entries the
gateway withholds; it adopts only entries that extend its own pinned chain.

Usage: dieter device init [--replace] [--format text|json]

Start the account's device roster with this machine as its first device and
print a one-time recovery key. Run it once, on the first machine. If other
devices already use Dieter, do not run it: pair this machine instead. Without
--replace it refuses an account that already has a roster; --replace starts a
new roster that every previously paired device rejects: apps reset and pair
again, other machines run `dieter daemon unenroll` and enroll again.

Usage: dieter device requests [--format text|json]

List the devices waiting to join the account, by name. Their codes are never
listed: approve a device only with the code its own screen shows you.

Usage: dieter device approve [--format text|json] CODE

Approve the new device that shows CODE (16 characters, e.g. ABCD-EFGH-JKMN-PQRS;
case, spaces and hyphens do not matter). The code proves which key the new
device posted, so approving signs exactly that device into the roster. Only
type a code you see on your own new device.

Usage: dieter device revoke [--format text|json] DEVICE_ID

Remove DEVICE_ID (dv_…, see dieter device status) from the roster. Machines
and apps stop accepting it as soon as they see the signed revocation; the last
device that can connect cannot be removed. Revoking this machine is allowed.

Usage: dieter device recover --recovery-key KEY|- [--format text|json]

Add this machine to the roster with the recovery key printed by
dieter device init, when no trusted device can approve it. "-" reads the key
from stdin, which keeps it out of shell history. The key commits to the
roster it was made for and never signs into another one.

Usage: dieter peer <status|show|changes|list|put|delete|merge> [options]

Leaderless account settings replicated by enrolled daemons, including while clients
are closed. Local commits work offline after first account discovery. Concurrent
values and deletions are preserved; read all versions and put with their revision
to resolve. Shared project and board operations use these records directly.
Use global --machine ID|NAME to address another daemon over authenticated routes.

  show     Read one shared record and all conflicting values
  changes  Read an incremental change page using a durable sequence cursor
  status   Account, actor, conflicts, and bounded per-peer sync progress/blockers
  list     One bounded snapshot page, including conflicts and tombstones
  put      Resolve a typed shared field from a JSON file
  delete   Write a causal deletion using the current record revision
  merge    Import a bounded protobuf JSON MergePeerRecordsRequest (recovery/sync)

Usage: dieter peer show --kind KIND --id ID

Read one shared record and all conflicting values.

Usage: dieter peer changes [--account HASH] [--epoch EPOCH] [--sequence N]

Read a bounded incremental change page.

Usage: dieter peer status

Show the enrolled account, conflicts, and bounded per-peer attempts, successes,
directions, checkpoints and sanitized record blockers. Catchup means durable page
progress with more work pending. A successful exchange is not acknowledgement by
every machine.

Usage: dieter peer list [--account HASH] [--after KEY --snapshot REVISION]

Return up to 64 records. Pass nextKey and snapshotRevision for the next page.

Usage: dieter peer put --kind KIND --id ENTITY.FIELD --file FILE [--revision HASH]

FILE contains the JSON value for the typed shared field. Prefer project and board
commands for normal edits; the daemon rejects unknown kinds and fields. Omit
--revision only for a new record; resolve conflicts with the current revision.

Usage: dieter peer delete --kind KIND --id ID --revision HASH

Persist a tombstone; concurrent unseen writes remain visible as conflicts.

Usage: dieter peer merge --file FILE

Import at most 64 records (2 MiB total) from protobuf JSON with account and
records fields. This joins causal versions; it never replaces the store or runs
an agent.

Usage: dieter settings <action>

Actions:
  show                         Show global prompt settings
  options                      List valid projects, boards, and harnesses
  update [options]             Update global prompt settings

Update requires --file FILE containing the Settings JSON object emitted by "show".

Usage: dieter settings show

Usage: dieter settings options

Usage: dieter settings update --file FILE

Usage: dieter prompt <action>

Actions:
  show                         Show global prompt and skill templates
  update [options]             Update global templates
  project [options] PROJECT    Set or inherit a project prompt template
  board [options] BOARD        Set or inherit a board prompt template
  preview [options]            Render the effective prompt for a scope

Usage: dieter prompt show

Usage: dieter prompt update [--template TEXT|--template-file FILE] [--board-skill TEXT|--board-skill-file FILE] [--chat-skill TEXT|--chat-skill-file FILE] [--reset template|board-skill|chat-skill]...

The template opens every turn's instructions; the board skill follows it for
cards and the chat skill for standalone chats. dieter prompt show lists their
variables and dieter prompt preview renders them. --reset restores a template
to this release's default, which then follows later releases.

Usage: dieter prompt project [--inherit|--template TEXT|--template-file FILE] PROJECT

Usage: dieter prompt board [--inherit|--template TEXT|--template-file FILE] BOARD

Usage: dieter prompt preview [--project PROJECT] [--board BOARD] [--card CARD] [--labels ID,ID] [--scope board|chat]

Usage: dieter watch changes [--count N]

Stream this machine's change frames as JSON Lines until interrupted, the same
stream native clients hold for every online machine. Frames name the
machine's peer identity and account and carry its replica of the account's
shared records (projects, boards, labels, cards, checkouts and KV, with every
causal sibling and its rank), then what only it knows: owner-only details of
the cards it runs and of its checkouts (paths, validation commands), the live
activity of its conversations and its peer replication issues.
resetRecords or resetLocal replaces what was received for that half. A frame
with caughtUp has delivered everything the machine held; heartbeats repeat the
cursor. Use --machine to watch another machine.

Read subscriptions renew credentials and resume from their last delivered checkpoint
after transient failures (up to five retries between frames). Revocation stops
recovery. Mutations, process starts, and stdin writes are never replayed.

Usage: dieter watch changes [--count N]

Stream this machine's change frames as JSON Lines until interrupted, the same
stream native clients hold for every online machine. Frames name the
machine's peer identity and account and carry its replica of the account's
shared records (projects, boards, labels, cards, checkouts and KV, with every
causal sibling and its rank), then what only it knows: owner-only details of
the cards it runs and of its checkouts (paths, validation commands), the live
activity of its conversations and its peer replication issues.
resetRecords or resetLocal replaces what was received for that half. A frame
with caughtUp has delivered everything the machine held; heartbeats repeat the
cursor. Use --machine to watch another machine.

Read subscriptions renew credentials and resume from their last delivered checkpoint
after transient failures (up to five retries between frames). Revocation stops
recovery. Mutations, process starts, and stdin writes are never replayed.

Usage: dieter storage

Usage: dieter doctor [--format table|json]

Check the local daemon's runtime, storage, service-manager, shell, and optional
durability dependencies. Doctor is read-only and does not initialize storage.

Usage: dieter setup [--gateway URL] [--name NAME] [--no-open] [--no-start]

Authorize this machine with GitHub and start the platform-managed daemon service.
On macOS, setup also registers the signed background privacy helper and guides
Screen Recording, Accessibility, Login Items approval and Input Monitoring.
Privacy stays off until explicitly enabled. --no-open and --no-start skip privacy
helper registration; use "dieter machine privacy setup" later on this Mac.
Project registration is separate; use
"dieter project open PATH" explicitly after setup.
The default gateway is https://gateway.getdieter.com; use --gateway for self-hosting.
Retrying incomplete enrollment updates the gateway while preserving the machine key.

Usage: dieter daemon <action>

Actions:
  start        Run the local data plane and persistent gateway tunnel
  service      Install and manage the platform daemon service
  enroll       Enroll this machine with the Dieter gateway
  recover      Restore a revoked local daemon ID with this replacement key
  unenroll     Revoke this machine and remove its local gateway credential
  status       Show service, local API, enrollment, and gateway health
  logs         Show or follow the daemon service log
  permissions  Verify screen/input permissions through the running daemon

Usage: dieter daemon service <action>

Install and manage Dieter's per-user daemon service. Service commands never
delete DIETER_HOME or project data.

Actions:
  install    Install or refresh the service definition and enable it
  start      Start the installed service
  restart    Gracefully restart the installed service
  stop       Stop the installed service
  status     Show the native service-manager status
  uninstall  Disable and remove the service definition, preserving all data

Usage: dieter daemon service install

Usage: dieter daemon service start

Usage: dieter daemon service restart

Usage: dieter daemon service stop

Usage: dieter daemon service status

Usage: dieter daemon service uninstall

Usage: dieter daemon enroll [--gateway URL] [--name NAME] [--no-open]

Enroll this machine with the GitHub account configured by the Dieter gateway.
Retry incomplete enrollment with --gateway to correct the origin without changing
the machine key. Completed enrollments retain their identity.
Gateway URLs require HTTPS; HTTP is allowed only on literal loopback addresses.

Usage: dieter daemon unenroll

Revoke this machine at its Dieter gateway, remove it from the account's
trusted devices, and delete its enrollment key and credential. A later
enrollment creates a new key that a trusted device approves again. Projects,
conversations, schedules, and harness settings remain.

Usage: dieter daemon recover --old-id ID --confirm RECOVER

Restore a revoked daemon ID using this enrolled replacement's matching key.
This changes the saved local credential only after the gateway accepts and the
returned certificate is verified. Restart the daemon service manually afterward;
verify the restored daemon before revoking the replacement ID.

Usage: dieter daemon status [--format table|json]

Usage: dieter daemon logs [--lines N] [--follow]

Usage: dieter daemon permissions [--check] [--no-open]

Verify capture and input permission through the running daemon, including with
--machine ID|NAME. --check discards one encoded frame and checks event-posting
permission without injecting input or changing settings. No local fallback is
used when the daemon is unavailable. Screen sharing is always available when
the required permissions are granted. Onboarding never restarts the daemon.

Usage: dieter daemon start [--addr ADDRESS] [--direct-addr ADDRESS --direct-host HOST [--direct-network lan|tailscale|public|loopback]] [--env-file PATH] [--service [--runtime PATH]] [--verbose]

Run the machine-local Dieter data plane and, when enrolled, its persistent
outbound gateway tunnel. The local API is always loopback-only. An enrolled
daemon automatically advertises an authenticated loopback route; direct flags
add an optional LAN (the default --direct-network), Tailscale, or public route.
A package manager may supply --runtime with a fixed executable directory.
Service startup activates a staged verified release there before workers begin.
An enrolled daemon also verifies any gateway-signed endpoint relocation at startup,
preserving its enrolled identity and shared account. Discovery failure retains
its current address. Status reports the selected network endpoint.