Command reference

CLI

Command reference

Where conifer --help says otherwise, --help wins.

Install

One line per platform — checksum-verified, installs to ~/.local/bin, and safe to re-run (a current install just updates in place).

macOS / Linux:

terminal

curl -fsSL https://www.conifer.build/install-cli.sh | sh

Windows (PowerShell):

powershell

irm https://www.conifer.build/install-cli.ps1 | iex

Windows from Command Prompt instead of PowerShell:

cmd

powershell -c "irm https://www.conifer.build/install-cli.ps1 | iex"

Commands read conifer <noun> <verb>. Two flags exist everywhere: --json (machine-readable output, stable schema) and -q (suppress the non-essential). Flags marked macOS exist only on builds with the embedded engine; thin builds don’t recognize them at all.

The commands

Command	What it does
`setup`	Interactive guided setup; spends nothing. The beta /setup install adds the full browser wizard on top.
`login / logout`	Paste the API key once; it's validated live and stored in the OS keychain. login --status answers offline (exit 77 when signed out).
`auth token`	Which credential a cloud call would use right now, and where it came from. --reveal prints the token; --json for scripts. Releases newer than v0.2.3.
`models pull / import / list / remove`	Get and manage local models. Details are on Get models.
`run`	One task against a local model, a daemon, or a registered endpoint.
`fuse`	Create, inspect, update, and remove saved multi-model fuse configs. Execute one with run --fuse.
`serve`	The API door on 127.0.0.1:8080.
`endpoints`	The registry of places models live: remote hosts, BYOK providers, the gateway.
`routing`	Saved pool-and-policy routes built from reach selectors and explicit endpoint/model candidates.
`privacy`	Telemetry opt-out, durable offline mode, the egress firewall, receipts.
`meter`	For processes that carry their own provider traffic: report a settled turn, ask the gate before the next. Machine surface; releases newer than v0.2.3.
`doctor`	Install health. --probe-cloud makes one minimal billable request to prove the account works.
`update`	Self-update: checksum-verified, atomic, rolled back if the new binary misbehaves. --check only reports.
`host`	The serving supervisor behind serve: status, logs, stop, listeners.
`init / agents / completions / man / version`	Scaffold config; manage the agent catalog; shell completions; man pages; version with build provenance.

conifer <command> --help documents every flag.

run

Flag
`--model <id>`	One exact physical model. Mutually exclusive with --route and --fuse.
`--route <preset-or-name>`	One complete saved route or reach preset. With no selector, run copies the built-in all/balanced route.
`--fuse <name>`	One saved explicit multi-model composition. Mutually exclusive with --model and --route.
`--timeout <s>`	Bound the task. Off by default.
`--events`	NDJSON event stream; the final record carries usage and cost.
`--allow-read / --allow-write`	File access, off by default.
`--dry-run`	Print the merged plan and exit.
`--ctx <n>`	Context-window override. macOS.
`--interactive / --repl`	Chat loop. macOS; implied by a bare run on a TTY.

fuse

Flag
`list / show / remove`	Inspect or delete saved fuse authoring templates.
`create / set <name>`	Create a fuse or atomically replace fields on one.
`--member <endpoint/model>`	One explicit physical member; repeat for every member.
`--strategy gated\|full\|anchored`	How the saved fuse composes its explicit members.
`--aggregator <endpoint/model>`	The member that composes the final answer.

fuse only authors templates. conifer run --fuse executes one; each member call is separately metered and receipted.

serve

Flag
`--port <n>`	Default 8080.
`--bind loopback\|lan`	loopback is the default; lan is refused without an auth token.
`--model / --route / --fuse`	Copy one complete admission default into the listener. It seeds model:default; it does not narrow the door.
`--ttl <s>`	Idle unload; 0 (default) keeps the model resident forever.
`--ctx <n>`	Context-window override for the served model. macOS.
`--prefix-cache`	Prompt-prefix reuse across requests; on by default.
`--detach`	Background the door; conifer host stop ends it.
`serve peers mint / revoke`	Per-peer access tokens for LAN serving, individually revocable.

endpoints & routing

terminal

conifer endpoints add remote mac-studio --url http://192.168.1.20:8080
conifer endpoints add byok openai --url https://api.openai.com/v1 --api-key-env OPENAI_API_KEY
conifer endpoints key set byok:openai   # secret read from stdin, stored in the keychain
conifer routing create work --reach device --reach hosts --policy balanced
conifer host listeners default listener:local --route work

Three endpoints are built in and can’t be removed: local:default (the embedded engine), host:local (your serve daemon), and cloud:managed-gateway. Secrets never ride argv: key set reads from stdin and stores in the OS keychain. A saved route contains a pool (live --reach selectors and optional exact --candidate endpoint/model entries) plus one--policy balanced|best|cost-effective|fast. The familiar presets on-device, local, cloud-only, and all compile to the same reach selectors; they are not another routing system. A receiving listener’s default is copied by value for stateless model: defaultrequests and newly created conversations; changing it does not rewrite existing conversations or impose a daemon resource ceiling.

privacy

terminal

conifer privacy opt-out          # usage telemetry off (it only ever carries metadata)
conifer privacy offline on       # durable, machine-wide: no egress at all
conifer privacy receipts         # what left the machine: hosts and byte counts, never content
conifer privacy firewall set --deny api.example.com

Where things live

Path	Holds
`~/Library/Application Support/build.Conifer.conifer/config.toml`	Settings: profiles, telemetry choices, and non-secret preferences. (Linux: ~/.config/conifer/; Windows: %APPDATA%\Conifer\conifer\config\)
`~/.conifer/`	Data: models, endpoint registry, saved route/fuse templates, listener state, receipts, and the owner-only credentials.json default secret store.
OS keychain	Optional credential backend when CONIFER_SECRETS_BACKEND=keychain is explicitly selected.

Environment variables

Variable
`CONIFER_API_KEY`	The one key name: tool configs reference it and the CLI reads it when set (releases newer than v0.2.3). Env beats keychain.
`CONIFER_ENTITLEMENT_TOKEN`	A short-lived bearer for CI. Outranks CONIFER_API_KEY when both are set.
`CONIFER_HOME`	Moves the ~/.conifer data directory.
`CONIFER_UPDATE_CHECK`	off silences the daily update notice.

Exit codes

Code	Class
0	Success
64	Usage: bad arguments, unknown name, unsupported file
65	Incomplete: the task didn't finish its work
69	Unavailable: the venue or model can't serve this
70	Internal error
74	I/O failure
75	External: provider fault, timeout, cancelled
77	Auth or policy: signed out, or the durable offline master refused egress
78	Config

Stable by contract: scripts may branch on them.

Install#

The commands#

run#

fuse#

serve#

endpoints & routing#

privacy#

Where things live#

Environment variables#

Exit codes#

Install

The commands

run

fuse

serve

endpoints & routing

privacy

Where things live

Environment variables

Exit codes