Add ez-assistant and kerberos service folders

docker-compose/ez-assistant/docs/cli/acp.md

@@ -0,0 +1,166 @@
+---
+summary: "Run the ACP bridge for IDE integrations"
+read_when:
+  - Setting up ACP-based IDE integrations
+  - Debugging ACP session routing to the Gateway
+---
+
+# acp
+
+Run the ACP (Agent Client Protocol) bridge that talks to a Moltbot Gateway.
+
+This command speaks ACP over stdio for IDEs and forwards prompts to the Gateway
+over WebSocket. It keeps ACP sessions mapped to Gateway session keys.
+
+## Usage
+
+```bash
+moltbot acp
+
+# Remote Gateway
+moltbot acp --url wss://gateway-host:18789 --token <token>
+
+# Attach to an existing session key
+moltbot acp --session agent:main:main
+
+# Attach by label (must already exist)
+moltbot acp --session-label "support inbox"
+
+# Reset the session key before the first prompt
+moltbot acp --session agent:main:main --reset-session
+```
+
+## ACP client (debug)
+
+Use the built-in ACP client to sanity-check the bridge without an IDE.
+It spawns the ACP bridge and lets you type prompts interactively.
+
+```bash
+moltbot acp client
+
+# Point the spawned bridge at a remote Gateway
+moltbot acp client --server-args --url wss://gateway-host:18789 --token <token>
+
+# Override the server command (default: moltbot)
+moltbot acp client --server "node" --server-args dist/entry.js acp --url ws://127.0.0.1:19001
+```
+
+## How to use this
+
+Use ACP when an IDE (or other client) speaks Agent Client Protocol and you want
+it to drive a Moltbot Gateway session.
+
+1. Ensure the Gateway is running (local or remote).
+2. Configure the Gateway target (config or flags).
+3. Point your IDE to run `moltbot acp` over stdio.
+
+Example config (persisted):
+
+```bash
+moltbot config set gateway.remote.url wss://gateway-host:18789
+moltbot config set gateway.remote.token <token>
+```
+
+Example direct run (no config write):
+
+```bash
+moltbot acp --url wss://gateway-host:18789 --token <token>
+```
+
+## Selecting agents
+
+ACP does not pick agents directly. It routes by the Gateway session key.
+
+Use agent-scoped session keys to target a specific agent:
+
+```bash
+moltbot acp --session agent:main:main
+moltbot acp --session agent:design:main
+moltbot acp --session agent:qa:bug-123
+```
+
+Each ACP session maps to a single Gateway session key. One agent can have many
+sessions; ACP defaults to an isolated `acp:<uuid>` session unless you override
+the key or label.
+
+## Zed editor setup
+
+Add a custom ACP agent in `~/.config/zed/settings.json` (or use Zed’s Settings UI):
+
+```json
+{
+  "agent_servers": {
+    "Moltbot ACP": {
+      "type": "custom",
+      "command": "moltbot",
+      "args": ["acp"],
+      "env": {}
+    }
+  }
+}
+```
+
+To target a specific Gateway or agent:
+
+```json
+{
+  "agent_servers": {
+    "Moltbot ACP": {
+      "type": "custom",
+      "command": "moltbot",
+      "args": [
+        "acp",
+        "--url", "wss://gateway-host:18789",
+        "--token", "<token>",
+        "--session", "agent:design:main"
+      ],
+      "env": {}
+    }
+  }
+}
+```
+
+In Zed, open the Agent panel and select “Moltbot ACP” to start a thread.
+
+## Session mapping
+
+By default, ACP sessions get an isolated Gateway session key with an `acp:` prefix.
+To reuse a known session, pass a session key or label:
+
+- `--session <key>`: use a specific Gateway session key.
+- `--session-label <label>`: resolve an existing session by label.
+- `--reset-session`: mint a fresh session id for that key (same key, new transcript).
+
+If your ACP client supports metadata, you can override per session:
+
+```json
+{
+  "_meta": {
+    "sessionKey": "agent:main:main",
+    "sessionLabel": "support inbox",
+    "resetSession": true
+  }
+}
+```
+
+Learn more about session keys at [/concepts/session](/concepts/session).
+
+## Options
+
+- `--url <url>`: Gateway WebSocket URL (defaults to gateway.remote.url when configured).
+- `--token <token>`: Gateway auth token.
+- `--password <password>`: Gateway auth password.
+- `--session <key>`: default session key.
+- `--session-label <label>`: default session label to resolve.
+- `--require-existing`: fail if the session key/label does not exist.
+- `--reset-session`: reset the session key before first use.
+- `--no-prefix-cwd`: do not prefix prompts with the working directory.
+- `--verbose, -v`: verbose logging to stderr.
+
+### `acp client` options
+
+- `--cwd <dir>`: working directory for the ACP session.
+- `--server <command>`: ACP server command (default: `moltbot`).
+- `--server-args <args...>`: extra arguments passed to the ACP server.
+- `--server-verbose`: enable verbose logging on the ACP server.
+- `--verbose, -v`: verbose client logging.

docker-compose/ez-assistant/docs/cli/agent.md

@@ -0,0 +1,22 @@
+---
+summary: "CLI reference for `moltbot agent` (send one agent turn via the Gateway)"
+read_when:
+  - You want to run one agent turn from scripts (optionally deliver reply)
+---
+
+# `moltbot agent`
+
+Run an agent turn via the Gateway (use `--local` for embedded).
+Use `--agent <id>` to target a configured agent directly.
+
+Related:
+- Agent send tool: [Agent send](/tools/agent-send)
+
+## Examples
+
+```bash
+moltbot agent --to +15555550123 --message "status update" --deliver
+moltbot agent --agent ops --message "Summarize logs"
+moltbot agent --session-id 1234 --message "Summarize inbox" --thinking medium
+moltbot agent --agent ops --message "Generate report" --deliver --reply-channel slack --reply-to "#reports"
+```

docker-compose/ez-assistant/docs/cli/agents.md

@@ -0,0 +1,71 @@
+---
+summary: "CLI reference for `moltbot agents` (list/add/delete/set identity)"
+read_when:
+  - You want multiple isolated agents (workspaces + routing + auth)
+---
+
+# `moltbot agents`
+
+Manage isolated agents (workspaces + auth + routing).
+
+Related:
+- Multi-agent routing: [Multi-Agent Routing](/concepts/multi-agent)
+- Agent workspace: [Agent workspace](/concepts/agent-workspace)
+
+## Examples
+
+```bash
+moltbot agents list
+moltbot agents add work --workspace ~/clawd-work
+moltbot agents set-identity --workspace ~/clawd --from-identity
+moltbot agents set-identity --agent main --avatar avatars/clawd.png
+moltbot agents delete work
+```
+
+## Identity files
+
+Each agent workspace can include an `IDENTITY.md` at the workspace root:
+- Example path: `~/clawd/IDENTITY.md`
+- `set-identity --from-identity` reads from the workspace root (or an explicit `--identity-file`)
+
+Avatar paths resolve relative to the workspace root.
+
+## Set identity
+
+`set-identity` writes fields into `agents.list[].identity`:
+- `name`
+- `theme`
+- `emoji`
+- `avatar` (workspace-relative path, http(s) URL, or data URI)
+
+Load from `IDENTITY.md`:
+
+```bash
+moltbot agents set-identity --workspace ~/clawd --from-identity
+```
+
+Override fields explicitly:
+
+```bash
+moltbot agents set-identity --agent main --name "Clawd" --emoji "🦞" --avatar avatars/clawd.png
+```
+
+Config sample:
+
+```json5
+{
+  agents: {
+    list: [
+      {
+        id: "main",
+        identity: {
+          name: "Clawd",
+          theme: "space lobster",
+          emoji: "🦞",
+          avatar: "avatars/clawd.png"
+        }
+      }
+    ]
+  }
+}
+```

docker-compose/ez-assistant/docs/cli/approvals.md

@@ -0,0 +1,48 @@
+---
+summary: "CLI reference for `moltbot approvals` (exec approvals for gateway or node hosts)"
+read_when:
+  - You want to edit exec approvals from the CLI
+  - You need to manage allowlists on gateway or node hosts
+---
+
+# `moltbot approvals`
+
+Manage exec approvals for the **local host**, **gateway host**, or a **node host**.
+By default, commands target the local approvals file on disk. Use `--gateway` to target the gateway, or `--node` to target a specific node.
+
+Related:
+- Exec approvals: [Exec approvals](/tools/exec-approvals)
+- Nodes: [Nodes](/nodes)
+
+## Common commands
+
+```bash
+moltbot approvals get
+moltbot approvals get --node <id|name|ip>
+moltbot approvals get --gateway
+```
+
+## Replace approvals from a file
+
+```bash
+moltbot approvals set --file ./exec-approvals.json
+moltbot approvals set --node <id|name|ip> --file ./exec-approvals.json
+moltbot approvals set --gateway --file ./exec-approvals.json
+```
+
+## Allowlist helpers
+
+```bash
+moltbot approvals allowlist add "~/Projects/**/bin/rg"
+moltbot approvals allowlist add --agent main --node <id|name|ip> "/usr/bin/uptime"
+moltbot approvals allowlist add --agent "*" "/usr/bin/uname"
+
+moltbot approvals allowlist remove "~/Projects/**/bin/rg"
+```
+
+## Notes
+
+- `--node` uses the same resolver as `moltbot nodes` (id, name, ip, or id prefix).
+- `--agent` defaults to `"*"`, which applies to all agents.
+- The node host must advertise `system.execApprovals.get/set` (macOS app or headless node host).
+- Approvals files are stored per host at `~/.clawdbot/exec-approvals.json`.

docker-compose/ez-assistant/docs/cli/browser.md

@@ -0,0 +1,104 @@
+---
+summary: "CLI reference for `moltbot browser` (profiles, tabs, actions, extension relay)"
+read_when:
+  - You use `moltbot browser` and want examples for common tasks
+  - You want to control a browser running on another machine via a node host
+  - You want to use the Chrome extension relay (attach/detach via toolbar button)
+---
+
+# `moltbot browser`
+
+Manage Moltbot’s browser control server and run browser actions (tabs, snapshots, screenshots, navigation, clicks, typing).
+
+Related:
+- Browser tool + API: [Browser tool](/tools/browser)
+- Chrome extension relay: [Chrome extension](/tools/chrome-extension)
+
+## Common flags
+
+- `--url <gatewayWsUrl>`: Gateway WebSocket URL (defaults to config).
+- `--token <token>`: Gateway token (if required).
+- `--timeout <ms>`: request timeout (ms).
+- `--browser-profile <name>`: choose a browser profile (default from config).
+- `--json`: machine-readable output (where supported).
+
+## Quick start (local)
+
+```bash
+moltbot browser --browser-profile chrome tabs
+moltbot browser --browser-profile clawd start
+moltbot browser --browser-profile clawd open https://example.com
+moltbot browser --browser-profile clawd snapshot
+```
+
+## Profiles
+
+Profiles are named browser routing configs. In practice:
+- `clawd`: launches/attaches to a dedicated Moltbot-managed Chrome instance (isolated user data dir).
+- `chrome`: controls your existing Chrome tab(s) via the Chrome extension relay.
+
+```bash
+moltbot browser profiles
+moltbot browser create-profile --name work --color "#FF5A36"
+moltbot browser delete-profile --name work
+```
+
+Use a specific profile:
+
+```bash
+moltbot browser --browser-profile work tabs
+```
+
+## Tabs
+
+```bash
+moltbot browser tabs
+moltbot browser open https://docs.molt.bot
+moltbot browser focus <targetId>
+moltbot browser close <targetId>
+```
+
+## Snapshot / screenshot / actions
+
+Snapshot:
+
+```bash
+moltbot browser snapshot
+```
+
+Screenshot:
+
+```bash
+moltbot browser screenshot
+```
+
+Navigate/click/type (ref-based UI automation):
+
+```bash
+moltbot browser navigate https://example.com
+moltbot browser click <ref>
+moltbot browser type <ref> "hello"
+```
+
+## Chrome extension relay (attach via toolbar button)
+
+This mode lets the agent control an existing Chrome tab that you attach manually (it does not auto-attach).
+
+Install the unpacked extension to a stable path:
+
+```bash
+moltbot browser extension install
+moltbot browser extension path
+```
+
+Then Chrome → `chrome://extensions` → enable “Developer mode” → “Load unpacked” → select the printed folder.
+
+Full guide: [Chrome extension](/tools/chrome-extension)
+
+## Remote browser control (node host proxy)
+
+If the Gateway runs on a different machine than the browser, run a **node host** on the machine that has Chrome/Brave/Edge/Chromium. The Gateway will proxy browser actions to that node (no separate browser control server required).
+
+Use `gateway.nodes.browser.mode` to control auto-routing and `gateway.nodes.browser.node` to pin a specific node if multiple are connected.
+
+Security + remote setup: [Browser tool](/tools/browser), [Remote access](/gateway/remote), [Tailscale](/gateway/tailscale), [Security](/gateway/security)

docker-compose/ez-assistant/docs/cli/channels.md

@@ -0,0 +1,75 @@
+---
+summary: "CLI reference for `moltbot channels` (accounts, status, login/logout, logs)"
+read_when:
+  - You want to add/remove channel accounts (WhatsApp/Telegram/Discord/Google Chat/Slack/Mattermost (plugin)/Signal/iMessage)
+  - You want to check channel status or tail channel logs
+---
+
+# `moltbot channels`
+
+Manage chat channel accounts and their runtime status on the Gateway.
+
+Related docs:
+- Channel guides: [Channels](/channels/index)
+- Gateway configuration: [Configuration](/gateway/configuration)
+
+## Common commands
+
+```bash
+moltbot channels list
+moltbot channels status
+moltbot channels capabilities
+moltbot channels capabilities --channel discord --target channel:123
+moltbot channels resolve --channel slack "#general" "@jane"
+moltbot channels logs --channel all
+```
+
+## Add / remove accounts
+
+```bash
+moltbot channels add --channel telegram --token <bot-token>
+moltbot channels remove --channel telegram --delete
+```
+
+Tip: `moltbot channels add --help` shows per-channel flags (token, app token, signal-cli paths, etc).
+
+## Login / logout (interactive)
+
+```bash
+moltbot channels login --channel whatsapp
+moltbot channels logout --channel whatsapp
+```
+
+## Troubleshooting
+
+- Run `moltbot status --deep` for a broad probe.
+- Use `moltbot doctor` for guided fixes.
+- `moltbot channels list` prints `Claude: HTTP 403 ... user:profile` → usage snapshot needs the `user:profile` scope. Use `--no-usage`, or provide a claude.ai session key (`CLAUDE_WEB_SESSION_KEY` / `CLAUDE_WEB_COOKIE`), or re-auth via Claude Code CLI.
+
+## Capabilities probe
+
+Fetch provider capability hints (intents/scopes where available) plus static feature support:
+
+```bash
+moltbot channels capabilities
+moltbot channels capabilities --channel discord --target channel:123
+```
+
+Notes:
+- `--channel` is optional; omit it to list every channel (including extensions).
+- `--target` accepts `channel:<id>` or a raw numeric channel id and only applies to Discord.
+- Probes are provider-specific: Discord intents + optional channel permissions; Slack bot + user scopes; Telegram bot flags + webhook; Signal daemon version; MS Teams app token + Graph roles/scopes (annotated where known). Channels without probes report `Probe: unavailable`.
+
+## Resolve names to IDs
+
+Resolve channel/user names to IDs using the provider directory:
+
+```bash
+moltbot channels resolve --channel slack "#general" "@jane"
+moltbot channels resolve --channel discord "My Server/#support" "@someone"
+moltbot channels resolve --channel matrix "Project Room"
+```
+
+Notes:
+- Use `--kind user|group|auto` to force the target type.
+- Resolution prefers active matches when multiple entries share the same name.

docker-compose/ez-assistant/docs/cli/config.md

@@ -0,0 +1,49 @@
+---
+summary: "CLI reference for `moltbot config` (get/set/unset config values)"
+read_when:
+  - You want to read or edit config non-interactively
+---
+
+# `moltbot config`
+
+Config helpers: get/set/unset values by path. Run without a subcommand to open
+the configure wizard (same as `moltbot configure`).
+
+## Examples
+
+```bash
+moltbot config get browser.executablePath
+moltbot config set browser.executablePath "/usr/bin/google-chrome"
+moltbot config set agents.defaults.heartbeat.every "2h"
+moltbot config set agents.list[0].tools.exec.node "node-id-or-name"
+moltbot config unset tools.web.search.apiKey
+```
+
+## Paths
+
+Paths use dot or bracket notation:
+
+```bash
+moltbot config get agents.defaults.workspace
+moltbot config get agents.list[0].id
+```
+
+Use the agent list index to target a specific agent:
+
+```bash
+moltbot config get agents.list
+moltbot config set agents.list[1].tools.exec.node "node-id-or-name"
+```
+
+## Values
+
+Values are parsed as JSON5 when possible; otherwise they are treated as strings.
+Use `--json` to require JSON5 parsing.
+
+```bash
+moltbot config set agents.defaults.heartbeat.every "0m"
+moltbot config set gateway.port 19001 --json
+moltbot config set channels.whatsapp.groups '["*"]' --json
+```
+
+Restart the gateway after edits.

docker-compose/ez-assistant/docs/cli/configure.md

@@ -0,0 +1,30 @@
+---
+summary: "CLI reference for `moltbot configure` (interactive configuration prompts)"
+read_when:
+  - You want to tweak credentials, devices, or agent defaults interactively
+---
+
+# `moltbot configure`
+
+Interactive prompt to set up credentials, devices, and agent defaults.
+
+Note: The **Model** section now includes a multi-select for the
+`agents.defaults.models` allowlist (what shows up in `/model` and the model picker).
+
+Tip: `moltbot config` without a subcommand opens the same wizard. Use
+`moltbot config get|set|unset` for non-interactive edits.
+
+Related:
+- Gateway configuration reference: [Configuration](/gateway/configuration)
+- Config CLI: [Config](/cli/config)
+
+Notes:
+- Choosing where the Gateway runs always updates `gateway.mode`. You can select "Continue" without other sections if that is all you need.
+- Channel-oriented services (Slack/Discord/Matrix/Microsoft Teams) prompt for channel/room allowlists during setup. You can enter names or IDs; the wizard resolves names to IDs when possible.
+
+## Examples
+
+```bash
+moltbot configure
+moltbot configure --section models --section channels
+```

docker-compose/ez-assistant/docs/cli/cron.md

@@ -0,0 +1,29 @@
+---
+summary: "CLI reference for `moltbot cron` (schedule and run background jobs)"
+read_when:
+  - You want scheduled jobs and wakeups
+  - You’re debugging cron execution and logs
+---
+
+# `moltbot cron`
+
+Manage cron jobs for the Gateway scheduler.
+
+Related:
+- Cron jobs: [Cron jobs](/automation/cron-jobs)
+
+Tip: run `moltbot cron --help` for the full command surface.
+
+## Common edits
+
+Update delivery settings without changing the message:
+
+```bash
+moltbot cron edit <job-id> --deliver --channel telegram --to "123456789"
+```
+
+Disable delivery for an isolated job:
+
+```bash
+moltbot cron edit <job-id> --no-deliver
+```

docker-compose/ez-assistant/docs/cli/dashboard.md

@@ -0,0 +1,16 @@
+---
+summary: "CLI reference for `moltbot dashboard` (open the Control UI)"
+read_when:
+  - You want to open the Control UI with your current token
+  - You want to print the URL without launching a browser
+---
+
+# `moltbot dashboard`
+
+Open the Control UI using your current auth.
+
+```bash
+moltbot dashboard
+moltbot dashboard --no-open
+```
+

docker-compose/ez-assistant/docs/cli/devices.md

@@ -0,0 +1,66 @@
+---
+summary: "CLI reference for `moltbot devices` (device pairing + token rotation/revocation)"
+read_when:
+  - You are approving device pairing requests
+  - You need to rotate or revoke device tokens
+---
+
+# `moltbot devices`
+
+Manage device pairing requests and device-scoped tokens.
+
+## Commands
+
+### `moltbot devices list`
+
+List pending pairing requests and paired devices.
+
+```
+moltbot devices list
+moltbot devices list --json
+```
+
+### `moltbot devices approve <requestId>`
+
+Approve a pending device pairing request.
+
+```
+moltbot devices approve <requestId>
+```
+
+### `moltbot devices reject <requestId>`
+
+Reject a pending device pairing request.
+
+```
+moltbot devices reject <requestId>
+```
+
+### `moltbot devices rotate --device <id> --role <role> [--scope <scope...>]`
+
+Rotate a device token for a specific role (optionally updating scopes).
+
+```
+moltbot devices rotate --device <deviceId> --role operator --scope operator.read --scope operator.write
+```
+
+### `moltbot devices revoke --device <id> --role <role>`
+
+Revoke a device token for a specific role.
+
+```
+moltbot devices revoke --device <deviceId> --role node
+```
+
+## Common options
+
+- `--url <url>`: Gateway WebSocket URL (defaults to `gateway.remote.url` when configured).
+- `--token <token>`: Gateway token (if required).
+- `--password <password>`: Gateway password (password auth).
+- `--timeout <ms>`: RPC timeout.
+- `--json`: JSON output (recommended for scripting).
+
+## Notes
+
+- Token rotation returns a new token (sensitive). Treat it like a secret.
+- These commands require `operator.pairing` (or `operator.admin`) scope.

docker-compose/ez-assistant/docs/cli/directory.md

@@ -0,0 +1,60 @@
+---
+summary: "CLI reference for `moltbot directory` (self, peers, groups)"
+read_when:
+  - You want to look up contacts/groups/self ids for a channel
+  - You are developing a channel directory adapter
+---
+
+# `moltbot directory`
+
+Directory lookups for channels that support it (contacts/peers, groups, and “me”).
+
+## Common flags
+- `--channel <name>`: channel id/alias (required when multiple channels are configured; auto when only one is configured)
+- `--account <id>`: account id (default: channel default)
+- `--json`: output JSON
+
+## Notes
+- `directory` is meant to help you find IDs you can paste into other commands (especially `moltbot message send --target ...`).
+- For many channels, results are config-backed (allowlists / configured groups) rather than a live provider directory.
+- Default output is `id` (and sometimes `name`) separated by a tab; use `--json` for scripting.
+
+## Using results with `message send`
+
+```bash
+moltbot directory peers list --channel slack --query "U0"
+moltbot message send --channel slack --target user:U012ABCDEF --message "hello"
+```
+
+## ID formats (by channel)
+
+- WhatsApp: `+15551234567` (DM), `1234567890-1234567890@g.us` (group)
+- Telegram: `@username` or numeric chat id; groups are numeric ids
+- Slack: `user:U…` and `channel:C…`
+- Discord: `user:<id>` and `channel:<id>`
+- Matrix (plugin): `user:@user:server`, `room:!roomId:server`, or `#alias:server`
+- Microsoft Teams (plugin): `user:<id>` and `conversation:<id>`
+- Zalo (plugin): user id (Bot API)
+- Zalo Personal / `zalouser` (plugin): thread id (DM/group) from `zca` (`me`, `friend list`, `group list`)
+
+## Self (“me”)
+
+```bash
+moltbot directory self --channel zalouser
+```
+
+## Peers (contacts/users)
+
+```bash
+moltbot directory peers list --channel zalouser
+moltbot directory peers list --channel zalouser --query "name"
+moltbot directory peers list --channel zalouser --limit 50
+```
+
+## Groups
+
+```bash
+moltbot directory groups list --channel zalouser
+moltbot directory groups list --channel zalouser --query "work"
+moltbot directory groups members --channel zalouser --group-id <id>
+```

docker-compose/ez-assistant/docs/cli/dns.md

@@ -0,0 +1,22 @@
+---
+summary: "CLI reference for `moltbot dns` (wide-area discovery helpers)"
+read_when:
+  - You want wide-area discovery (DNS-SD) via Tailscale + CoreDNS
+  - You’re setting up split DNS for moltbot.internal
+---
+
+# `moltbot dns`
+
+DNS helpers for wide-area discovery (Tailscale + CoreDNS). Currently focused on macOS + Homebrew CoreDNS.
+
+Related:
+- Gateway discovery: [Discovery](/gateway/discovery)
+- Wide-area discovery config: [Configuration](/gateway/configuration)
+
+## Setup
+
+```bash
+moltbot dns setup
+moltbot dns setup --apply
+```
+

docker-compose/ez-assistant/docs/cli/docs.md

@@ -0,0 +1,15 @@
+---
+summary: "CLI reference for `moltbot docs` (search the live docs index)"
+read_when:
+  - You want to search the live Moltbot docs from the terminal
+---
+
+# `moltbot docs`
+
+Search the live docs index.
+
+```bash
+moltbot docs browser extension
+moltbot docs sandbox allowHostControl
+```
+

docker-compose/ez-assistant/docs/cli/doctor.md

@@ -0,0 +1,38 @@
+---
+summary: "CLI reference for `moltbot doctor` (health checks + guided repairs)"
+read_when:
+  - You have connectivity/auth issues and want guided fixes
+  - You updated and want a sanity check
+---
+
+# `moltbot doctor`
+
+Health checks + quick fixes for the gateway and channels.
+
+Related:
+- Troubleshooting: [Troubleshooting](/gateway/troubleshooting)
+- Security audit: [Security](/gateway/security)
+
+## Examples
+
+```bash
+moltbot doctor
+moltbot doctor --repair
+moltbot doctor --deep
+```
+
+Notes:
+- Interactive prompts (like keychain/OAuth fixes) only run when stdin is a TTY and `--non-interactive` is **not** set. Headless runs (cron, Telegram, no terminal) will skip prompts.
+- `--fix` (alias for `--repair`) writes a backup to `~/.clawdbot/moltbot.json.bak` and drops unknown config keys, listing each removal.
+
+## macOS: `launchctl` env overrides
+
+If you previously ran `launchctl setenv CLAWDBOT_GATEWAY_TOKEN ...` (or `...PASSWORD`), that value overrides your config file and can cause persistent “unauthorized” errors.
+
+```bash
+launchctl getenv CLAWDBOT_GATEWAY_TOKEN
+launchctl getenv CLAWDBOT_GATEWAY_PASSWORD
+
+launchctl unsetenv CLAWDBOT_GATEWAY_TOKEN
+launchctl unsetenv CLAWDBOT_GATEWAY_PASSWORD
+```

docker-compose/ez-assistant/docs/cli/gateway.md

@@ -0,0 +1,187 @@
+---
+summary: "Moltbot Gateway CLI (`moltbot gateway`) — run, query, and discover gateways"
+read_when:
+  - Running the Gateway from the CLI (dev or servers)
+  - Debugging Gateway auth, bind modes, and connectivity
+  - Discovering gateways via Bonjour (LAN + tailnet)
+---
+
+# Gateway CLI
+
+The Gateway is Moltbot’s WebSocket server (channels, nodes, sessions, hooks).
+
+Subcommands in this page live under `moltbot gateway …`.
+
+Related docs:
+- [/gateway/bonjour](/gateway/bonjour)
+- [/gateway/discovery](/gateway/discovery)
+- [/gateway/configuration](/gateway/configuration)
+
+## Run the Gateway
+
+Run a local Gateway process:
+
+```bash
+moltbot gateway
+```
+
+Foreground alias:
+
+```bash
+moltbot gateway run
+```
+
+Notes:
+- By default, the Gateway refuses to start unless `gateway.mode=local` is set in `~/.clawdbot/moltbot.json`. Use `--allow-unconfigured` for ad-hoc/dev runs.
+- Binding beyond loopback without auth is blocked (safety guardrail).
+- `SIGUSR1` triggers an in-process restart when authorized (enable `commands.restart` or use the gateway tool/config apply/update).
+- `SIGINT`/`SIGTERM` handlers stop the gateway process, but they don’t restore any custom terminal state. If you wrap the CLI with a TUI or raw-mode input, restore the terminal before exit.
+
+### Options
+
+- `--port <port>`: WebSocket port (default comes from config/env; usually `18789`).
+- `--bind <loopback|lan|tailnet|auto|custom>`: listener bind mode.
+- `--auth <token|password>`: auth mode override.
+- `--token <token>`: token override (also sets `CLAWDBOT_GATEWAY_TOKEN` for the process).
+- `--password <password>`: password override (also sets `CLAWDBOT_GATEWAY_PASSWORD` for the process).
+- `--tailscale <off|serve|funnel>`: expose the Gateway via Tailscale.
+- `--tailscale-reset-on-exit`: reset Tailscale serve/funnel config on shutdown.
+- `--allow-unconfigured`: allow gateway start without `gateway.mode=local` in config.
+- `--dev`: create a dev config + workspace if missing (skips BOOTSTRAP.md).
+- `--reset`: reset dev config + credentials + sessions + workspace (requires `--dev`).
+- `--force`: kill any existing listener on the selected port before starting.
+- `--verbose`: verbose logs.
+- `--claude-cli-logs`: only show claude-cli logs in the console (and enable its stdout/stderr).
+- `--ws-log <auto|full|compact>`: websocket log style (default `auto`).
+- `--compact`: alias for `--ws-log compact`.
+- `--raw-stream`: log raw model stream events to jsonl.
+- `--raw-stream-path <path>`: raw stream jsonl path.
+
+## Query a running Gateway
+
+All query commands use WebSocket RPC.
+
+Output modes:
+- Default: human-readable (colored in TTY).
+- `--json`: machine-readable JSON (no styling/spinner).
+- `--no-color` (or `NO_COLOR=1`): disable ANSI while keeping human layout.
+
+Shared options (where supported):
+- `--url <url>`: Gateway WebSocket URL.
+- `--token <token>`: Gateway token.
+- `--password <password>`: Gateway password.
+- `--timeout <ms>`: timeout/budget (varies per command).
+- `--expect-final`: wait for a “final” response (agent calls).
+
+### `gateway health`
+
+```bash
+moltbot gateway health --url ws://127.0.0.1:18789
+```
+
+### `gateway status`
+
+`gateway status` shows the Gateway service (launchd/systemd/schtasks) plus an optional RPC probe.
+
+```bash
+moltbot gateway status
+moltbot gateway status --json
+```
+
+Options:
+- `--url <url>`: override the probe URL.
+- `--token <token>`: token auth for the probe.
+- `--password <password>`: password auth for the probe.
+- `--timeout <ms>`: probe timeout (default `10000`).
+- `--no-probe`: skip the RPC probe (service-only view).
+- `--deep`: scan system-level services too.
+
+### `gateway probe`
+
+`gateway probe` is the “debug everything” command. It always probes:
+- your configured remote gateway (if set), and
+- localhost (loopback) **even if remote is configured**.
+
+If multiple gateways are reachable, it prints all of them. Multiple gateways are supported when you use isolated profiles/ports (e.g., a rescue bot), but most installs still run a single gateway.
+
+```bash
+moltbot gateway probe
+moltbot gateway probe --json
+```
+
+#### Remote over SSH (Mac app parity)
+
+The macOS app “Remote over SSH” mode uses a local port-forward so the remote gateway (which may be bound to loopback only) becomes reachable at `ws://127.0.0.1:<port>`.
+
+CLI equivalent:
+
+```bash
+moltbot gateway probe --ssh user@gateway-host
+```
+
+Options:
+- `--ssh <target>`: `user@host` or `user@host:port` (port defaults to `22`).
+- `--ssh-identity <path>`: identity file.
+- `--ssh-auto`: pick the first discovered gateway host as SSH target (LAN/WAB only).
+
+Config (optional, used as defaults):
+- `gateway.remote.sshTarget`
+- `gateway.remote.sshIdentity`
+
+### `gateway call <method>`
+
+Low-level RPC helper.
+
+```bash
+moltbot gateway call status
+moltbot gateway call logs.tail --params '{"sinceMs": 60000}'
+```
+
+## Manage the Gateway service
+
+```bash
+moltbot gateway install
+moltbot gateway start
+moltbot gateway stop
+moltbot gateway restart
+moltbot gateway uninstall
+```
+
+Notes:
+- `gateway install` supports `--port`, `--runtime`, `--token`, `--force`, `--json`.
+- Lifecycle commands accept `--json` for scripting.
+
+## Discover gateways (Bonjour)
+
+`gateway discover` scans for Gateway beacons (`_moltbot-gw._tcp`).
+
+- Multicast DNS-SD: `local.`
+- Unicast DNS-SD (Wide-Area Bonjour): `moltbot.internal.` (requires split DNS + DNS server; see [/gateway/bonjour](/gateway/bonjour))
+
+Only gateways with Bonjour discovery enabled (default) advertise the beacon.
+
+Wide-Area discovery records include (TXT):
+- `role` (gateway role hint)
+- `transport` (transport hint, e.g. `gateway`)
+- `gatewayPort` (WebSocket port, usually `18789`)
+- `sshPort` (SSH port; defaults to `22` if not present)
+- `tailnetDns` (MagicDNS hostname, when available)
+- `gatewayTls` / `gatewayTlsSha256` (TLS enabled + cert fingerprint)
+- `cliPath` (optional hint for remote installs)
+
+### `gateway discover`
+
+```bash
+moltbot gateway discover
+```
+
+Options:
+- `--timeout <ms>`: per-command timeout (browse/resolve); default `2000`.
+- `--json`: machine-readable output (also disables styling/spinner).
+
+Examples:
+
+```bash
+moltbot gateway discover --timeout 4000
+moltbot gateway discover --json | jq '.beacons[].wsUrl'
+```

docker-compose/ez-assistant/docs/cli/health.md

@@ -0,0 +1,19 @@
+---
+summary: "CLI reference for `moltbot health` (gateway health endpoint via RPC)"
+read_when:
+  - You want to quickly check the running Gateway’s health
+---
+
+# `moltbot health`
+
+Fetch health from the running Gateway.
+
+```bash
+moltbot health
+moltbot health --json
+moltbot health --verbose
+```
+
+Notes:
+- `--verbose` runs live probes and prints per-account timings when multiple accounts are configured.
+- Output includes per-agent session stores when multiple agents are configured.

docker-compose/ez-assistant/docs/cli/hooks.md

@@ -0,0 +1,290 @@
+---
+summary: "CLI reference for `moltbot hooks` (agent hooks)"
+read_when:
+  - You want to manage agent hooks
+  - You want to install or update hooks
+---
+
+# `moltbot hooks`
+
+Manage agent hooks (event-driven automations for commands like `/new`, `/reset`, and gateway startup).
+
+Related:
+- Hooks: [Hooks](/hooks)
+- Plugin hooks: [Plugins](/plugin#plugin-hooks)
+
+## List All Hooks
+
+```bash
+moltbot hooks list
+```
+
+List all discovered hooks from workspace, managed, and bundled directories.
+
+**Options:**
+- `--eligible`: Show only eligible hooks (requirements met)
+- `--json`: Output as JSON
+- `-v, --verbose`: Show detailed information including missing requirements
+
+**Example output:**
+
+```
+Hooks (4/4 ready)
+
+Ready:
+  🚀 boot-md ✓ - Run BOOT.md on gateway startup
+  📝 command-logger ✓ - Log all command events to a centralized audit file
+  💾 session-memory ✓ - Save session context to memory when /new command is issued
+  😈 soul-evil ✓ - Swap injected SOUL content during a purge window or by random chance
+```
+
+**Example (verbose):**
+
+```bash
+moltbot hooks list --verbose
+```
+
+Shows missing requirements for ineligible hooks.
+
+**Example (JSON):**
+
+```bash
+moltbot hooks list --json
+```
+
+Returns structured JSON for programmatic use.
+
+## Get Hook Information
+
+```bash
+moltbot hooks info <name>
+```
+
+Show detailed information about a specific hook.
+
+**Arguments:**
+- `<name>`: Hook name (e.g., `session-memory`)
+
+**Options:**
+- `--json`: Output as JSON
+
+**Example:**
+
+```bash
+moltbot hooks info session-memory
+```
+
+**Output:**
+
+```
+💾 session-memory ✓ Ready
+
+Save session context to memory when /new command is issued
+
+Details:
+  Source: moltbot-bundled
+  Path: /path/to/moltbot/hooks/bundled/session-memory/HOOK.md
+  Handler: /path/to/moltbot/hooks/bundled/session-memory/handler.ts
+  Homepage: https://docs.molt.bot/hooks#session-memory
+  Events: command:new
+
+Requirements:
+  Config: ✓ workspace.dir
+```
+
+## Check Hooks Eligibility
+
+```bash
+moltbot hooks check
+```
+
+Show summary of hook eligibility status (how many are ready vs. not ready).
+
+**Options:**
+- `--json`: Output as JSON
+
+**Example output:**
+
+```
+Hooks Status
+
+Total hooks: 4
+Ready: 4
+Not ready: 0
+```
+
+## Enable a Hook
+
+```bash
+moltbot hooks enable <name>
+```
+
+Enable a specific hook by adding it to your config (`~/.clawdbot/config.json`).
+
+**Note:** Hooks managed by plugins show `plugin:<id>` in `moltbot hooks list` and
+can’t be enabled/disabled here. Enable/disable the plugin instead.
+
+**Arguments:**
+- `<name>`: Hook name (e.g., `session-memory`)
+
+**Example:**
+
+```bash
+moltbot hooks enable session-memory
+```
+
+**Output:**
+
+```
+✓ Enabled hook: 💾 session-memory
+```
+
+**What it does:**
+- Checks if hook exists and is eligible
+- Updates `hooks.internal.entries.<name>.enabled = true` in your config
+- Saves config to disk
+
+**After enabling:**
+- Restart the gateway so hooks reload (menu bar app restart on macOS, or restart your gateway process in dev).
+
+## Disable a Hook
+
+```bash
+moltbot hooks disable <name>
+```
+
+Disable a specific hook by updating your config.
+
+**Arguments:**
+- `<name>`: Hook name (e.g., `command-logger`)
+
+**Example:**
+
+```bash
+moltbot hooks disable command-logger
+```
+
+**Output:**
+
+```
+⏸ Disabled hook: 📝 command-logger
+```
+
+**After disabling:**
+- Restart the gateway so hooks reload
+
+## Install Hooks
+
+```bash
+moltbot hooks install <path-or-spec>
+```
+
+Install a hook pack from a local folder/archive or npm.
+
+**What it does:**
+- Copies the hook pack into `~/.clawdbot/hooks/<id>`
+- Enables the installed hooks in `hooks.internal.entries.*`
+- Records the install under `hooks.internal.installs`
+
+**Options:**
+- `-l, --link`: Link a local directory instead of copying (adds it to `hooks.internal.load.extraDirs`)
+
+**Supported archives:** `.zip`, `.tgz`, `.tar.gz`, `.tar`
+
+**Examples:**
+
+```bash
+# Local directory
+moltbot hooks install ./my-hook-pack
+
+# Local archive
+moltbot hooks install ./my-hook-pack.zip
+
+# NPM package
+moltbot hooks install @moltbot/my-hook-pack
+
+# Link a local directory without copying
+moltbot hooks install -l ./my-hook-pack
+```
+
+## Update Hooks
+
+```bash
+moltbot hooks update <id>
+moltbot hooks update --all
+```
+
+Update installed hook packs (npm installs only).
+
+**Options:**
+- `--all`: Update all tracked hook packs
+- `--dry-run`: Show what would change without writing
+
+## Bundled Hooks
+
+### session-memory
+
+Saves session context to memory when you issue `/new`.
+
+**Enable:**
+
+```bash
+moltbot hooks enable session-memory
+```
+
+**Output:** `~/clawd/memory/YYYY-MM-DD-slug.md`
+
+**See:** [session-memory documentation](/hooks#session-memory)
+
+### command-logger
+
+Logs all command events to a centralized audit file.
+
+**Enable:**
+
+```bash
+moltbot hooks enable command-logger
+```
+
+**Output:** `~/.clawdbot/logs/commands.log`
+
+**View logs:**
+
+```bash
+# Recent commands
+tail -n 20 ~/.clawdbot/logs/commands.log
+
+# Pretty-print
+cat ~/.clawdbot/logs/commands.log | jq .
+
+# Filter by action
+grep '"action":"new"' ~/.clawdbot/logs/commands.log | jq .
+```
+
+**See:** [command-logger documentation](/hooks#command-logger)
+
+### soul-evil
+
+Swaps injected `SOUL.md` content with `SOUL_EVIL.md` during a purge window or by random chance.
+
+**Enable:**
+
+```bash
+moltbot hooks enable soul-evil
+```
+
+**See:** [SOUL Evil Hook](/hooks/soul-evil)
+
+### boot-md
+
+Runs `BOOT.md` when the gateway starts (after channels start).
+
+**Events**: `gateway:startup`
+
+**Enable**:
+
+```bash
+moltbot hooks enable boot-md
+```
+
+**See:** [boot-md documentation](/hooks#boot-md)

docker-compose/ez-assistant/docs/cli/index.md

@@ -0,0 +1,918 @@
+---
+summary: "Moltbot CLI reference for `moltbot` commands, subcommands, and options"
+read_when:
+  - Adding or modifying CLI commands or options
+  - Documenting new command surfaces
+---
+
+# CLI reference
+
+This page describes the current CLI behavior. If commands change, update this doc.
+
+## Command pages
+
+- [`setup`](/cli/setup)
+- [`onboard`](/cli/onboard)
+- [`configure`](/cli/configure)
+- [`config`](/cli/config)
+- [`doctor`](/cli/doctor)
+- [`dashboard`](/cli/dashboard)
+- [`reset`](/cli/reset)
+- [`uninstall`](/cli/uninstall)
+- [`update`](/cli/update)
+- [`message`](/cli/message)
+- [`agent`](/cli/agent)
+- [`agents`](/cli/agents)
+- [`acp`](/cli/acp)
+- [`status`](/cli/status)
+- [`health`](/cli/health)
+- [`sessions`](/cli/sessions)
+- [`gateway`](/cli/gateway)
+- [`logs`](/cli/logs)
+- [`system`](/cli/system)
+- [`models`](/cli/models)
+- [`memory`](/cli/memory)
+- [`nodes`](/cli/nodes)
+- [`devices`](/cli/devices)
+- [`node`](/cli/node)
+- [`approvals`](/cli/approvals)
+- [`sandbox`](/cli/sandbox)
+- [`tui`](/cli/tui)
+- [`browser`](/cli/browser)
+- [`cron`](/cli/cron)
+- [`dns`](/cli/dns)
+- [`docs`](/cli/docs)
+- [`hooks`](/cli/hooks)
+- [`webhooks`](/cli/webhooks)
+- [`pairing`](/cli/pairing)
+- [`plugins`](/cli/plugins) (plugin commands)
+- [`channels`](/cli/channels)
+- [`security`](/cli/security)
+- [`skills`](/cli/skills)
+- [`voicecall`](/cli/voicecall) (plugin; if installed)
+
+## Global flags
+
+- `--dev`: isolate state under `~/.clawdbot-dev` and shift default ports.
+- `--profile <name>`: isolate state under `~/.clawdbot-<name>`.
+- `--no-color`: disable ANSI colors.
+- `--update`: shorthand for `moltbot update` (source installs only).
+- `-V`, `--version`, `-v`: print version and exit.
+
+## Output styling
+
+- ANSI colors and progress indicators only render in TTY sessions.
+- OSC-8 hyperlinks render as clickable links in supported terminals; otherwise we fall back to plain URLs.
+- `--json` (and `--plain` where supported) disables styling for clean output.
+- `--no-color` disables ANSI styling; `NO_COLOR=1` is also respected.
+- Long-running commands show a progress indicator (OSC 9;4 when supported).
+
+## Color palette
+
+Moltbot uses a lobster palette for CLI output.
+
+- `accent` (#FF5A2D): headings, labels, primary highlights.
+- `accentBright` (#FF7A3D): command names, emphasis.
+- `accentDim` (#D14A22): secondary highlight text.
+- `info` (#FF8A5B): informational values.
+- `success` (#2FBF71): success states.
+- `warn` (#FFB020): warnings, fallbacks, attention.
+- `error` (#E23D2D): errors, failures.
+- `muted` (#8B7F77): de-emphasis, metadata.
+
+Palette source of truth: `src/terminal/palette.ts` (aka “lobster seam”).
+
+## Command tree
+
+```
+moltbot [--dev] [--profile <name>] <command>
+  setup
+  onboard
+  configure
+  config
+    get
+    set
+    unset
+  doctor
+  security
+    audit
+  reset
+  uninstall
+  update
+  channels
+    list
+    status
+    logs
+    add
+    remove
+    login
+    logout
+  skills
+    list
+    info
+    check
+  plugins
+    list
+    info
+    install
+    enable
+    disable
+    doctor
+  memory
+    status
+    index
+    search
+  message
+  agent
+  agents
+    list
+    add
+    delete
+  acp
+  status
+  health
+  sessions
+  gateway
+    call
+    health
+    status
+    probe
+    discover
+    install
+    uninstall
+    start
+    stop
+    restart
+    run
+  logs
+  system
+    event
+    heartbeat last|enable|disable
+    presence
+  models
+    list
+    status
+    set
+    set-image
+    aliases list|add|remove
+    fallbacks list|add|remove|clear
+    image-fallbacks list|add|remove|clear
+    scan
+    auth add|setup-token|paste-token
+    auth order get|set|clear
+  sandbox
+    list
+    recreate
+    explain
+  cron
+    status
+    list
+    add
+    edit
+    rm
+    enable
+    disable
+    runs
+    run
+  nodes
+  devices
+  node
+    run
+    status
+    install
+    uninstall
+    start
+    stop
+    restart
+  approvals
+    get
+    set
+    allowlist add|remove
+  browser
+    status
+    start
+    stop
+    reset-profile
+    tabs
+    open
+    focus
+    close
+    profiles
+    create-profile
+    delete-profile
+    screenshot
+    snapshot
+    navigate
+    resize
+    click
+    type
+    press
+    hover
+    drag
+    select
+    upload
+    fill
+    dialog
+    wait
+    evaluate
+    console
+    pdf
+  hooks
+    list
+    info
+    check
+    enable
+    disable
+    install
+    update
+  webhooks
+    gmail setup|run
+  pairing
+    list
+    approve
+  docs
+  dns
+    setup
+  tui
+```
+
+Note: plugins can add additional top-level commands (for example `moltbot voicecall`).
+
+## Security
+
+- `moltbot security audit` — audit config + local state for common security foot-guns.
+- `moltbot security audit --deep` — best-effort live Gateway probe.
+- `moltbot security audit --fix` — tighten safe defaults and chmod state/config.
+
+## Plugins
+
+Manage extensions and their config:
+
+- `moltbot plugins list` — discover plugins (use `--json` for machine output).
+- `moltbot plugins info <id>` — show details for a plugin.
+- `moltbot plugins install <path|.tgz|npm-spec>` — install a plugin (or add a plugin path to `plugins.load.paths`).
+- `moltbot plugins enable <id>` / `disable <id>` — toggle `plugins.entries.<id>.enabled`.
+- `moltbot plugins doctor` — report plugin load errors.
+
+Most plugin changes require a gateway restart. See [/plugin](/plugin).
+
+## Memory
+
+Vector search over `MEMORY.md` + `memory/*.md`:
+
+- `moltbot memory status` — show index stats.
+- `moltbot memory index` — reindex memory files.
+- `moltbot memory search "<query>"` — semantic search over memory.
+
+## Chat slash commands
+
+Chat messages support `/...` commands (text and native). See [/tools/slash-commands](/tools/slash-commands).
+
+Highlights:
+- `/status` for quick diagnostics.
+- `/config` for persisted config changes.
+- `/debug` for runtime-only config overrides (memory, not disk; requires `commands.debug: true`).
+
+## Setup + onboarding
+
+### `setup`
+Initialize config + workspace.
+
+Options:
+- `--workspace <dir>`: agent workspace path (default `~/clawd`).
+- `--wizard`: run the onboarding wizard.
+- `--non-interactive`: run wizard without prompts.
+- `--mode <local|remote>`: wizard mode.
+- `--remote-url <url>`: remote Gateway URL.
+- `--remote-token <token>`: remote Gateway token.
+
+Wizard auto-runs when any wizard flags are present (`--non-interactive`, `--mode`, `--remote-url`, `--remote-token`).
+
+### `onboard`
+Interactive wizard to set up gateway, workspace, and skills.
+
+Options:
+- `--workspace <dir>`
+- `--reset` (reset config + credentials + sessions + workspace before wizard)
+- `--non-interactive`
+- `--mode <local|remote>`
+- `--flow <quickstart|advanced|manual>` (manual is an alias for advanced)
+- `--auth-choice <setup-token|token|chutes|openai-codex|openai-api-key|openrouter-api-key|ai-gateway-api-key|moonshot-api-key|kimi-code-api-key|synthetic-api-key|venice-api-key|gemini-api-key|zai-api-key|apiKey|minimax-api|minimax-api-lightning|opencode-zen|skip>`
+- `--token-provider <id>` (non-interactive; used with `--auth-choice token`)
+- `--token <token>` (non-interactive; used with `--auth-choice token`)
+- `--token-profile-id <id>` (non-interactive; default: `<provider>:manual`)
+- `--token-expires-in <duration>` (non-interactive; e.g. `365d`, `12h`)
+- `--anthropic-api-key <key>`
+- `--openai-api-key <key>`
+- `--openrouter-api-key <key>`
+- `--ai-gateway-api-key <key>`
+- `--moonshot-api-key <key>`
+- `--kimi-code-api-key <key>`
+- `--gemini-api-key <key>`
+- `--zai-api-key <key>`
+- `--minimax-api-key <key>`
+- `--opencode-zen-api-key <key>`
+- `--gateway-port <port>`
+- `--gateway-bind <loopback|lan|tailnet|auto|custom>`
+- `--gateway-auth <token|password>`
+- `--gateway-token <token>`
+- `--gateway-password <password>`
+- `--remote-url <url>`
+- `--remote-token <token>`
+- `--tailscale <off|serve|funnel>`
+- `--tailscale-reset-on-exit`
+- `--install-daemon`
+- `--no-install-daemon` (alias: `--skip-daemon`)
+- `--daemon-runtime <node|bun>`
+- `--skip-channels`
+- `--skip-skills`
+- `--skip-health`
+- `--skip-ui`
+- `--node-manager <npm|pnpm|bun>` (pnpm recommended; bun not recommended for Gateway runtime)
+- `--json`
+
+### `configure`
+Interactive configuration wizard (models, channels, skills, gateway).
+
+### `config`
+Non-interactive config helpers (get/set/unset). Running `moltbot config` with no
+subcommand launches the wizard.
+
+Subcommands:
+- `config get <path>`: print a config value (dot/bracket path).
+- `config set <path> <value>`: set a value (JSON5 or raw string).
+- `config unset <path>`: remove a value.
+
+### `doctor`
+Health checks + quick fixes (config + gateway + legacy services).
+
+Options:
+- `--no-workspace-suggestions`: disable workspace memory hints.
+- `--yes`: accept defaults without prompting (headless).
+- `--non-interactive`: skip prompts; apply safe migrations only.
+- `--deep`: scan system services for extra gateway installs.
+
+## Channel helpers
+
+### `channels`
+Manage chat channel accounts (WhatsApp/Telegram/Discord/Google Chat/Slack/Mattermost (plugin)/Signal/iMessage/MS Teams).
+
+Subcommands:
+- `channels list`: show configured channels and auth profiles.
+- `channels status`: check gateway reachability and channel health (`--probe` runs extra checks; use `moltbot health` or `moltbot status --deep` for gateway health probes).
+- Tip: `channels status` prints warnings with suggested fixes when it can detect common misconfigurations (then points you to `moltbot doctor`).
+- `channels logs`: show recent channel logs from the gateway log file.
+- `channels add`: wizard-style setup when no flags are passed; flags switch to non-interactive mode.
+- `channels remove`: disable by default; pass `--delete` to remove config entries without prompts.
+- `channels login`: interactive channel login (WhatsApp Web only).
+- `channels logout`: log out of a channel session (if supported).
+
+Common options:
+- `--channel <name>`: `whatsapp|telegram|discord|googlechat|slack|mattermost|signal|imessage|msteams`
+- `--account <id>`: channel account id (default `default`)
+- `--name <label>`: display name for the account
+
+`channels login` options:
+- `--channel <channel>` (default `whatsapp`; supports `whatsapp`/`web`)
+- `--account <id>`
+- `--verbose`
+
+`channels logout` options:
+- `--channel <channel>` (default `whatsapp`)
+- `--account <id>`
+
+`channels list` options:
+- `--no-usage`: skip model provider usage/quota snapshots (OAuth/API-backed only).
+- `--json`: output JSON (includes usage unless `--no-usage` is set).
+
+`channels logs` options:
+- `--channel <name|all>` (default `all`)
+- `--lines <n>` (default `200`)
+- `--json`
+
+More detail: [/concepts/oauth](/concepts/oauth)
+
+Examples:
+```bash
+moltbot channels add --channel telegram --account alerts --name "Alerts Bot" --token $TELEGRAM_BOT_TOKEN
+moltbot channels add --channel discord --account work --name "Work Bot" --token $DISCORD_BOT_TOKEN
+moltbot channels remove --channel discord --account work --delete
+moltbot channels status --probe
+moltbot status --deep
+```
+
+### `skills`
+List and inspect available skills plus readiness info.
+
+Subcommands:
+- `skills list`: list skills (default when no subcommand).
+- `skills info <name>`: show details for one skill.
+- `skills check`: summary of ready vs missing requirements.
+
+Options:
+- `--eligible`: show only ready skills.
+- `--json`: output JSON (no styling).
+- `-v`, `--verbose`: include missing requirements detail.
+
+Tip: use `npx clawdhub` to search, install, and sync skills.
+
+### `pairing`
+Approve DM pairing requests across channels.
+
+Subcommands:
+- `pairing list <channel> [--json]`
+- `pairing approve <channel> <code> [--notify]`
+
+### `webhooks gmail`
+Gmail Pub/Sub hook setup + runner. See [/automation/gmail-pubsub](/automation/gmail-pubsub).
+
+Subcommands:
+- `webhooks gmail setup` (requires `--account <email>`; supports `--project`, `--topic`, `--subscription`, `--label`, `--hook-url`, `--hook-token`, `--push-token`, `--bind`, `--port`, `--path`, `--include-body`, `--max-bytes`, `--renew-minutes`, `--tailscale`, `--tailscale-path`, `--tailscale-target`, `--push-endpoint`, `--json`)
+- `webhooks gmail run` (runtime overrides for the same flags)
+
+### `dns setup`
+Wide-area discovery DNS helper (CoreDNS + Tailscale). See [/gateway/discovery](/gateway/discovery).
+
+Options:
+- `--apply`: install/update CoreDNS config (requires sudo; macOS only).
+
+## Messaging + agent
+
+### `message`
+Unified outbound messaging + channel actions.
+
+See: [/cli/message](/cli/message)
+
+Subcommands:
+- `message send|poll|react|reactions|read|edit|delete|pin|unpin|pins|permissions|search|timeout|kick|ban`
+- `message thread <create|list|reply>`
+- `message emoji <list|upload>`
+- `message sticker <send|upload>`
+- `message role <info|add|remove>`
+- `message channel <info|list>`
+- `message member info`
+- `message voice status`
+- `message event <list|create>`
+
+Examples:
+- `moltbot message send --target +15555550123 --message "Hi"`
+- `moltbot message poll --channel discord --target channel:123 --poll-question "Snack?" --poll-option Pizza --poll-option Sushi`
+
+### `agent`
+Run one agent turn via the Gateway (or `--local` embedded).
+
+Required:
+- `--message <text>`
+
+Options:
+- `--to <dest>` (for session key and optional delivery)
+- `--session-id <id>`
+- `--thinking <off|minimal|low|medium|high|xhigh>` (GPT-5.2 + Codex models only)
+- `--verbose <on|full|off>`
+- `--channel <whatsapp|telegram|discord|slack|mattermost|signal|imessage|msteams>`
+- `--local`
+- `--deliver`
+- `--json`
+- `--timeout <seconds>`
+
+### `agents`
+Manage isolated agents (workspaces + auth + routing).
+
+#### `agents list`
+List configured agents.
+
+Options:
+- `--json`
+- `--bindings`
+
+#### `agents add [name]`
+Add a new isolated agent. Runs the guided wizard unless flags (or `--non-interactive`) are passed; `--workspace` is required in non-interactive mode.
+
+Options:
+- `--workspace <dir>`
+- `--model <id>`
+- `--agent-dir <dir>`
+- `--bind <channel[:accountId]>` (repeatable)
+- `--non-interactive`
+- `--json`
+
+Binding specs use `channel[:accountId]`. When `accountId` is omitted for WhatsApp, the default account id is used.
+
+#### `agents delete <id>`
+Delete an agent and prune its workspace + state.
+
+Options:
+- `--force`
+- `--json`
+
+### `acp`
+Run the ACP bridge that connects IDEs to the Gateway.
+
+See [`acp`](/cli/acp) for full options and examples.
+
+### `status`
+Show linked session health and recent recipients.
+
+Options:
+- `--json`
+- `--all` (full diagnosis; read-only, pasteable)
+- `--deep` (probe channels)
+- `--usage` (show model provider usage/quota)
+- `--timeout <ms>`
+- `--verbose`
+- `--debug` (alias for `--verbose`)
+
+Notes:
+- Overview includes Gateway + node host service status when available.
+
+### Usage tracking
+Moltbot can surface provider usage/quota when OAuth/API creds are available.
+
+Surfaces:
+- `/status` (adds a short provider usage line when available)
+- `moltbot status --usage` (prints full provider breakdown)
+- macOS menu bar (Usage section under Context)
+
+Notes:
+- Data comes directly from provider usage endpoints (no estimates).
+- Providers: Anthropic, GitHub Copilot, OpenAI Codex OAuth, plus Gemini CLI/Antigravity when those provider plugins are enabled.
+- If no matching credentials exist, usage is hidden.
+- Details: see [Usage tracking](/concepts/usage-tracking).
+
+### `health`
+Fetch health from the running Gateway.
+
+Options:
+- `--json`
+- `--timeout <ms>`
+- `--verbose`
+
+### `sessions`
+List stored conversation sessions.
+
+Options:
+- `--json`
+- `--verbose`
+- `--store <path>`
+- `--active <minutes>`
+
+## Reset / Uninstall
+
+### `reset`
+Reset local config/state (keeps the CLI installed).
+
+Options:
+- `--scope <config|config+creds+sessions|full>`
+- `--yes`
+- `--non-interactive`
+- `--dry-run`
+
+Notes:
+- `--non-interactive` requires `--scope` and `--yes`.
+
+### `uninstall`
+Uninstall the gateway service + local data (CLI remains).
+
+Options:
+- `--service`
+- `--state`
+- `--workspace`
+- `--app`
+- `--all`
+- `--yes`
+- `--non-interactive`
+- `--dry-run`
+
+Notes:
+- `--non-interactive` requires `--yes` and explicit scopes (or `--all`).
+
+## Gateway
+
+### `gateway`
+Run the WebSocket Gateway.
+
+Options:
+- `--port <port>`
+- `--bind <loopback|tailnet|lan|auto|custom>`
+- `--token <token>`
+- `--auth <token|password>`
+- `--password <password>`
+- `--tailscale <off|serve|funnel>`
+- `--tailscale-reset-on-exit`
+- `--allow-unconfigured`
+- `--dev`
+- `--reset` (reset dev config + credentials + sessions + workspace)
+- `--force` (kill existing listener on port)
+- `--verbose`
+- `--claude-cli-logs`
+- `--ws-log <auto|full|compact>`
+- `--compact` (alias for `--ws-log compact`)
+- `--raw-stream`
+- `--raw-stream-path <path>`
+
+### `gateway service`
+Manage the Gateway service (launchd/systemd/schtasks).
+
+Subcommands:
+- `gateway status` (probes the Gateway RPC by default)
+- `gateway install` (service install)
+- `gateway uninstall`
+- `gateway start`
+- `gateway stop`
+- `gateway restart`
+
+Notes:
+- `gateway status` probes the Gateway RPC by default using the service’s resolved port/config (override with `--url/--token/--password`).
+- `gateway status` supports `--no-probe`, `--deep`, and `--json` for scripting.
+- `gateway status` also surfaces legacy or extra gateway services when it can detect them (`--deep` adds system-level scans). Profile-named Moltbot services are treated as first-class and aren't flagged as "extra".
+- `gateway status` prints which config path the CLI uses vs which config the service likely uses (service env), plus the resolved probe target URL.
+- `gateway install|uninstall|start|stop|restart` support `--json` for scripting (default output stays human-friendly).
+- `gateway install` defaults to Node runtime; bun is **not recommended** (WhatsApp/Telegram bugs).
+- `gateway install` options: `--port`, `--runtime`, `--token`, `--force`, `--json`.
+
+### `logs`
+Tail Gateway file logs via RPC.
+
+Notes:
+- TTY sessions render a colorized, structured view; non-TTY falls back to plain text.
+- `--json` emits line-delimited JSON (one log event per line).
+
+Examples:
+```bash
+moltbot logs --follow
+moltbot logs --limit 200
+moltbot logs --plain
+moltbot logs --json
+moltbot logs --no-color
+```
+
+### `gateway <subcommand>`
+Gateway CLI helpers (use `--url`, `--token`, `--password`, `--timeout`, `--expect-final` for RPC subcommands).
+
+Subcommands:
+- `gateway call <method> [--params <json>]`
+- `gateway health`
+- `gateway status`
+- `gateway probe`
+- `gateway discover`
+- `gateway install|uninstall|start|stop|restart`
+- `gateway run`
+
+Common RPCs:
+- `config.apply` (validate + write config + restart + wake)
+- `config.patch` (merge a partial update + restart + wake)
+- `update.run` (run update + restart + wake)
+
+Tip: when calling `config.set`/`config.apply`/`config.patch` directly, pass `baseHash` from
+`config.get` if a config already exists.
+
+## Models
+
+See [/concepts/models](/concepts/models) for fallback behavior and scanning strategy.
+
+Preferred Anthropic auth (setup-token):
+
+```bash
+claude setup-token
+moltbot models auth setup-token --provider anthropic
+moltbot models status
+```
+
+### `models` (root)
+`moltbot models` is an alias for `models status`.
+
+Root options:
+- `--status-json` (alias for `models status --json`)
+- `--status-plain` (alias for `models status --plain`)
+
+### `models list`
+Options:
+- `--all`
+- `--local`
+- `--provider <name>`
+- `--json`
+- `--plain`
+
+### `models status`
+Options:
+- `--json`
+- `--plain`
+- `--check` (exit 1=expired/missing, 2=expiring)
+- `--probe` (live probe of configured auth profiles)
+- `--probe-provider <name>`
+- `--probe-profile <id>` (repeat or comma-separated)
+- `--probe-timeout <ms>`
+- `--probe-concurrency <n>`
+- `--probe-max-tokens <n>`
+
+Always includes the auth overview and OAuth expiry status for profiles in the auth store.
+`--probe` runs live requests (may consume tokens and trigger rate limits).
+
+### `models set <model>`
+Set `agents.defaults.model.primary`.
+
+### `models set-image <model>`
+Set `agents.defaults.imageModel.primary`.
+
+### `models aliases list|add|remove`
+Options:
+- `list`: `--json`, `--plain`
+- `add <alias> <model>`
+- `remove <alias>`
+
+### `models fallbacks list|add|remove|clear`
+Options:
+- `list`: `--json`, `--plain`
+- `add <model>`
+- `remove <model>`
+- `clear`
+
+### `models image-fallbacks list|add|remove|clear`
+Options:
+- `list`: `--json`, `--plain`
+- `add <model>`
+- `remove <model>`
+- `clear`
+
+### `models scan`
+Options:
+- `--min-params <b>`
+- `--max-age-days <days>`
+- `--provider <name>`
+- `--max-candidates <n>`
+- `--timeout <ms>`
+- `--concurrency <n>`
+- `--no-probe`
+- `--yes`
+- `--no-input`
+- `--set-default`
+- `--set-image`
+- `--json`
+
+### `models auth add|setup-token|paste-token`
+Options:
+- `add`: interactive auth helper
+- `setup-token`: `--provider <name>` (default `anthropic`), `--yes`
+- `paste-token`: `--provider <name>`, `--profile-id <id>`, `--expires-in <duration>`
+
+### `models auth order get|set|clear`
+Options:
+- `get`: `--provider <name>`, `--agent <id>`, `--json`
+- `set`: `--provider <name>`, `--agent <id>`, `<profileIds...>`
+- `clear`: `--provider <name>`, `--agent <id>`
+
+## System
+
+### `system event`
+Enqueue a system event and optionally trigger a heartbeat (Gateway RPC).
+
+Required:
+- `--text <text>`
+
+Options:
+- `--mode <now|next-heartbeat>`
+- `--json`
+- `--url`, `--token`, `--timeout`, `--expect-final`
+
+### `system heartbeat last|enable|disable`
+Heartbeat controls (Gateway RPC).
+
+Options:
+- `--json`
+- `--url`, `--token`, `--timeout`, `--expect-final`
+
+### `system presence`
+List system presence entries (Gateway RPC).
+
+Options:
+- `--json`
+- `--url`, `--token`, `--timeout`, `--expect-final`
+
+## Cron
+Manage scheduled jobs (Gateway RPC). See [/automation/cron-jobs](/automation/cron-jobs).
+
+Subcommands:
+- `cron status [--json]`
+- `cron list [--all] [--json]` (table output by default; use `--json` for raw)
+- `cron add` (alias: `create`; requires `--name` and exactly one of `--at` | `--every` | `--cron`, and exactly one payload of `--system-event` | `--message`)
+- `cron edit <id>` (patch fields)
+- `cron rm <id>` (aliases: `remove`, `delete`)
+- `cron enable <id>`
+- `cron disable <id>`
+- `cron runs --id <id> [--limit <n>]`
+- `cron run <id> [--force]`
+
+All `cron` commands accept `--url`, `--token`, `--timeout`, `--expect-final`.
+
+## Node host
+
+`node` runs a **headless node host** or manages it as a background service. See
+[`moltbot node`](/cli/node).
+
+Subcommands:
+- `node run --host <gateway-host> --port 18789`
+- `node status`
+- `node install [--host <gateway-host>] [--port <port>] [--tls] [--tls-fingerprint <sha256>] [--node-id <id>] [--display-name <name>] [--runtime <node|bun>] [--force]`
+- `node uninstall`
+- `node stop`
+- `node restart`
+
+## Nodes
+
+`nodes` talks to the Gateway and targets paired nodes. See [/nodes](/nodes).
+
+Common options:
+- `--url`, `--token`, `--timeout`, `--json`
+
+Subcommands:
+- `nodes status [--connected] [--last-connected <duration>]`
+- `nodes describe --node <id|name|ip>`
+- `nodes list [--connected] [--last-connected <duration>]`
+- `nodes pending`
+- `nodes approve <requestId>`
+- `nodes reject <requestId>`
+- `nodes rename --node <id|name|ip> --name <displayName>`
+- `nodes invoke --node <id|name|ip> --command <command> [--params <json>] [--invoke-timeout <ms>] [--idempotency-key <key>]`
+- `nodes run --node <id|name|ip> [--cwd <path>] [--env KEY=VAL] [--command-timeout <ms>] [--needs-screen-recording] [--invoke-timeout <ms>] <command...>` (mac node or headless node host)
+- `nodes notify --node <id|name|ip> [--title <text>] [--body <text>] [--sound <name>] [--priority <passive|active|timeSensitive>] [--delivery <system|overlay|auto>] [--invoke-timeout <ms>]` (mac only)
+
+Camera:
+- `nodes camera list --node <id|name|ip>`
+- `nodes camera snap --node <id|name|ip> [--facing front|back|both] [--device-id <id>] [--max-width <px>] [--quality <0-1>] [--delay-ms <ms>] [--invoke-timeout <ms>]`
+- `nodes camera clip --node <id|name|ip> [--facing front|back] [--device-id <id>] [--duration <ms|10s|1m>] [--no-audio] [--invoke-timeout <ms>]`
+
+Canvas + screen:
+- `nodes canvas snapshot --node <id|name|ip> [--format png|jpg|jpeg] [--max-width <px>] [--quality <0-1>] [--invoke-timeout <ms>]`
+- `nodes canvas present --node <id|name|ip> [--target <urlOrPath>] [--x <px>] [--y <px>] [--width <px>] [--height <px>] [--invoke-timeout <ms>]`
+- `nodes canvas hide --node <id|name|ip> [--invoke-timeout <ms>]`
+- `nodes canvas navigate <url> --node <id|name|ip> [--invoke-timeout <ms>]`
+- `nodes canvas eval [<js>] --node <id|name|ip> [--js <code>] [--invoke-timeout <ms>]`
+- `nodes canvas a2ui push --node <id|name|ip> (--jsonl <path> | --text <text>) [--invoke-timeout <ms>]`
+- `nodes canvas a2ui reset --node <id|name|ip> [--invoke-timeout <ms>]`
+- `nodes screen record --node <id|name|ip> [--screen <index>] [--duration <ms|10s>] [--fps <n>] [--no-audio] [--out <path>] [--invoke-timeout <ms>]`
+
+Location:
+- `nodes location get --node <id|name|ip> [--max-age <ms>] [--accuracy <coarse|balanced|precise>] [--location-timeout <ms>] [--invoke-timeout <ms>]`
+
+## Browser
+
+Browser control CLI (dedicated Chrome/Brave/Edge/Chromium). See [`moltbot browser`](/cli/browser) and the [Browser tool](/tools/browser).
+
+Common options:
+- `--url`, `--token`, `--timeout`, `--json`
+- `--browser-profile <name>`
+
+Manage:
+- `browser status`
+- `browser start`
+- `browser stop`
+- `browser reset-profile`
+- `browser tabs`
+- `browser open <url>`
+- `browser focus <targetId>`
+- `browser close [targetId]`
+- `browser profiles`
+- `browser create-profile --name <name> [--color <hex>] [--cdp-url <url>]`
+- `browser delete-profile --name <name>`
+
+Inspect:
+- `browser screenshot [targetId] [--full-page] [--ref <ref>] [--element <selector>] [--type png|jpeg]`
+- `browser snapshot [--format aria|ai] [--target-id <id>] [--limit <n>] [--interactive] [--compact] [--depth <n>] [--selector <sel>] [--out <path>]`
+
+Actions:
+- `browser navigate <url> [--target-id <id>]`
+- `browser resize <width> <height> [--target-id <id>]`
+- `browser click <ref> [--double] [--button <left|right|middle>] [--modifiers <csv>] [--target-id <id>]`
+- `browser type <ref> <text> [--submit] [--slowly] [--target-id <id>]`
+- `browser press <key> [--target-id <id>]`
+- `browser hover <ref> [--target-id <id>]`
+- `browser drag <startRef> <endRef> [--target-id <id>]`
+- `browser select <ref> <values...> [--target-id <id>]`
+- `browser upload <paths...> [--ref <ref>] [--input-ref <ref>] [--element <selector>] [--target-id <id>] [--timeout-ms <ms>]`
+- `browser fill [--fields <json>] [--fields-file <path>] [--target-id <id>]`
+- `browser dialog --accept|--dismiss [--prompt <text>] [--target-id <id>] [--timeout-ms <ms>]`
+- `browser wait [--time <ms>] [--text <value>] [--text-gone <value>] [--target-id <id>]`
+- `browser evaluate --fn <code> [--ref <ref>] [--target-id <id>]`
+- `browser console [--level <error|warn|info>] [--target-id <id>]`
+- `browser pdf [--target-id <id>]`
+
+## Docs search
+
+### `docs [query...]`
+Search the live docs index.
+
+## TUI
+
+### `tui`
+Open the terminal UI connected to the Gateway.
+
+Options:
+- `--url <url>`
+- `--token <token>`
+- `--password <password>`
+- `--session <key>`
+- `--deliver`
+- `--thinking <level>`
+- `--message <text>`
+- `--timeout-ms <ms>` (defaults to `agents.defaults.timeoutSeconds`)
+- `--history-limit <n>`

docker-compose/ez-assistant/docs/cli/logs.md

@@ -0,0 +1,23 @@
+---
+summary: "CLI reference for `moltbot logs` (tail gateway logs via RPC)"
+read_when:
+  - You need to tail Gateway logs remotely (without SSH)
+  - You want JSON log lines for tooling
+---
+
+# `moltbot logs`
+
+Tail Gateway file logs over RPC (works in remote mode).
+
+Related:
+- Logging overview: [Logging](/logging)
+
+## Examples
+
+```bash
+moltbot logs
+moltbot logs --follow
+moltbot logs --json
+moltbot logs --limit 500
+```
+

docker-compose/ez-assistant/docs/cli/memory.md

@@ -0,0 +1,41 @@
+---
+summary: "CLI reference for `moltbot memory` (status/index/search)"
+read_when:
+  - You want to index or search semantic memory
+  - You’re debugging memory availability or indexing
+---
+
+# `moltbot memory`
+
+Manage semantic memory indexing and search.
+Provided by the active memory plugin (default: `memory-core`; set `plugins.slots.memory = "none"` to disable).
+
+Related:
+- Memory concept: [Memory](/concepts/memory)
+ - Plugins: [Plugins](/plugins)
+
+## Examples
+
+```bash
+moltbot memory status
+moltbot memory status --deep
+moltbot memory status --deep --index
+moltbot memory status --deep --index --verbose
+moltbot memory index
+moltbot memory index --verbose
+moltbot memory search "release checklist"
+moltbot memory status --agent main
+moltbot memory index --agent main --verbose
+```
+
+## Options
+
+Common:
+
+- `--agent <id>`: scope to a single agent (default: all configured agents).
+- `--verbose`: emit detailed logs during probes and indexing.
+
+Notes:
+- `memory status --deep` probes vector + embedding availability.
+- `memory status --deep --index` runs a reindex if the store is dirty.
+- `memory index --verbose` prints per-phase details (provider, model, sources, batch activity).

docker-compose/ez-assistant/docs/cli/message.md

@@ -0,0 +1,228 @@
+---
+summary: "CLI reference for `moltbot message` (send + channel actions)"
+read_when:
+  - Adding or modifying message CLI actions
+  - Changing outbound channel behavior
+---
+
+# `moltbot message`
+
+Single outbound command for sending messages and channel actions
+(Discord/Google Chat/Slack/Mattermost (plugin)/Telegram/WhatsApp/Signal/iMessage/MS Teams).
+
+## Usage
+
+```
+moltbot message <subcommand> [flags]
+```
+
+Channel selection:
+- `--channel` required if more than one channel is configured.
+- If exactly one channel is configured, it becomes the default.
+- Values: `whatsapp|telegram|discord|googlechat|slack|mattermost|signal|imessage|msteams` (Mattermost requires plugin)
+
+Target formats (`--target`):
+- WhatsApp: E.164 or group JID
+- Telegram: chat id or `@username`
+- Discord: `channel:<id>` or `user:<id>` (or `<@id>` mention; raw numeric ids are treated as channels)
+- Google Chat: `spaces/<spaceId>` or `users/<userId>`
+- Slack: `channel:<id>` or `user:<id>` (raw channel id is accepted)
+- Mattermost (plugin): `channel:<id>`, `user:<id>`, or `@username` (bare ids are treated as channels)
+- Signal: `+E.164`, `group:<id>`, `signal:+E.164`, `signal:group:<id>`, or `username:<name>`/`u:<name>`
+- iMessage: handle, `chat_id:<id>`, `chat_guid:<guid>`, or `chat_identifier:<id>`
+- MS Teams: conversation id (`19:...@thread.tacv2`) or `conversation:<id>` or `user:<aad-object-id>`
+
+Name lookup:
+- For supported providers (Discord/Slack/etc), channel names like `Help` or `#help` are resolved via the directory cache.
+- On cache miss, Moltbot will attempt a live directory lookup when the provider supports it.
+
+## Common flags
+
+- `--channel <name>`
+- `--account <id>`
+- `--target <dest>` (target channel or user for send/poll/read/etc)
+- `--targets <name>` (repeat; broadcast only)
+- `--json`
+- `--dry-run`
+- `--verbose`
+
+## Actions
+
+### Core
+
+- `send`
+  - Channels: WhatsApp/Telegram/Discord/Google Chat/Slack/Mattermost (plugin)/Signal/iMessage/MS Teams
+  - Required: `--target`, plus `--message` or `--media`
+  - Optional: `--media`, `--reply-to`, `--thread-id`, `--gif-playback`
+  - Telegram only: `--buttons` (requires `channels.telegram.capabilities.inlineButtons` to allow it)
+  - Telegram only: `--thread-id` (forum topic id)
+  - Slack only: `--thread-id` (thread timestamp; `--reply-to` uses the same field)
+  - WhatsApp only: `--gif-playback`
+
+- `poll`
+  - Channels: WhatsApp/Discord/MS Teams
+  - Required: `--target`, `--poll-question`, `--poll-option` (repeat)
+  - Optional: `--poll-multi`
+  - Discord only: `--poll-duration-hours`, `--message`
+
+- `react`
+  - Channels: Discord/Google Chat/Slack/Telegram/WhatsApp/Signal
+  - Required: `--message-id`, `--target`
+  - Optional: `--emoji`, `--remove`, `--participant`, `--from-me`, `--target-author`, `--target-author-uuid`
+  - Note: `--remove` requires `--emoji` (omit `--emoji` to clear own reactions where supported; see /tools/reactions)
+  - WhatsApp only: `--participant`, `--from-me`
+  - Signal group reactions: `--target-author` or `--target-author-uuid` required
+
+- `reactions`
+  - Channels: Discord/Google Chat/Slack
+  - Required: `--message-id`, `--target`
+  - Optional: `--limit`
+
+- `read`
+  - Channels: Discord/Slack
+  - Required: `--target`
+  - Optional: `--limit`, `--before`, `--after`
+  - Discord only: `--around`
+
+- `edit`
+  - Channels: Discord/Slack
+  - Required: `--message-id`, `--message`, `--target`
+
+- `delete`
+  - Channels: Discord/Slack/Telegram
+  - Required: `--message-id`, `--target`
+
+- `pin` / `unpin`
+  - Channels: Discord/Slack
+  - Required: `--message-id`, `--target`
+
+- `pins` (list)
+  - Channels: Discord/Slack
+  - Required: `--target`
+
+- `permissions`
+  - Channels: Discord
+  - Required: `--target`
+
+- `search`
+  - Channels: Discord
+  - Required: `--guild-id`, `--query`
+  - Optional: `--channel-id`, `--channel-ids` (repeat), `--author-id`, `--author-ids` (repeat), `--limit`
+
+### Threads
+
+- `thread create`
+  - Channels: Discord
+  - Required: `--thread-name`, `--target` (channel id)
+  - Optional: `--message-id`, `--auto-archive-min`
+
+- `thread list`
+  - Channels: Discord
+  - Required: `--guild-id`
+  - Optional: `--channel-id`, `--include-archived`, `--before`, `--limit`
+
+- `thread reply`
+  - Channels: Discord
+  - Required: `--target` (thread id), `--message`
+  - Optional: `--media`, `--reply-to`
+
+### Emojis
+
+- `emoji list`
+  - Discord: `--guild-id`
+  - Slack: no extra flags
+
+- `emoji upload`
+  - Channels: Discord
+  - Required: `--guild-id`, `--emoji-name`, `--media`
+  - Optional: `--role-ids` (repeat)
+
+### Stickers
+
+- `sticker send`
+  - Channels: Discord
+  - Required: `--target`, `--sticker-id` (repeat)
+  - Optional: `--message`
+
+- `sticker upload`
+  - Channels: Discord
+  - Required: `--guild-id`, `--sticker-name`, `--sticker-desc`, `--sticker-tags`, `--media`
+
+### Roles / Channels / Members / Voice
+
+- `role info` (Discord): `--guild-id`
+- `role add` / `role remove` (Discord): `--guild-id`, `--user-id`, `--role-id`
+- `channel info` (Discord): `--target`
+- `channel list` (Discord): `--guild-id`
+- `member info` (Discord/Slack): `--user-id` (+ `--guild-id` for Discord)
+- `voice status` (Discord): `--guild-id`, `--user-id`
+
+### Events
+
+- `event list` (Discord): `--guild-id`
+- `event create` (Discord): `--guild-id`, `--event-name`, `--start-time`
+  - Optional: `--end-time`, `--desc`, `--channel-id`, `--location`, `--event-type`
+
+### Moderation (Discord)
+
+- `timeout`: `--guild-id`, `--user-id` (optional `--duration-min` or `--until`; omit both to clear timeout)
+- `kick`: `--guild-id`, `--user-id` (+ `--reason`)
+- `ban`: `--guild-id`, `--user-id` (+ `--delete-days`, `--reason`)
+  - `timeout` also supports `--reason`
+
+### Broadcast
+
+- `broadcast`
+  - Channels: any configured channel; use `--channel all` to target all providers
+  - Required: `--targets` (repeat)
+  - Optional: `--message`, `--media`, `--dry-run`
+
+## Examples
+
+Send a Discord reply:
+```
+moltbot message send --channel discord \
+  --target channel:123 --message "hi" --reply-to 456
+```
+
+Create a Discord poll:
+```
+moltbot message poll --channel discord \
+  --target channel:123 \
+  --poll-question "Snack?" \
+  --poll-option Pizza --poll-option Sushi \
+  --poll-multi --poll-duration-hours 48
+```
+
+Send a Teams proactive message:
+```
+moltbot message send --channel msteams \
+  --target conversation:19:abc@thread.tacv2 --message "hi"
+```
+
+Create a Teams poll:
+```
+moltbot message poll --channel msteams \
+  --target conversation:19:abc@thread.tacv2 \
+  --poll-question "Lunch?" \
+  --poll-option Pizza --poll-option Sushi
+```
+
+React in Slack:
+```
+moltbot message react --channel slack \
+  --target C123 --message-id 456 --emoji "✅"
+```
+
+React in a Signal group:
+```
+moltbot message react --channel signal \
+  --target signal:group:abc123 --message-id 1737630212345 \
+  --emoji "✅" --target-author-uuid 123e4567-e89b-12d3-a456-426614174000
+```
+
+Send Telegram inline buttons:
+```
+moltbot message send --channel telegram --target @mychat --message "Choose:" \
+  --buttons '[ [{"text":"Yes","callback_data":"cmd:yes"}], [{"text":"No","callback_data":"cmd:no"}] ]'
+```

docker-compose/ez-assistant/docs/cli/models.md

@@ -0,0 +1,68 @@
+---
+summary: "CLI reference for `moltbot models` (status/list/set/scan, aliases, fallbacks, auth)"
+read_when:
+  - You want to change default models or view provider auth status
+  - You want to scan available models/providers and debug auth profiles
+---
+
+# `moltbot models`
+
+Model discovery, scanning, and configuration (default model, fallbacks, auth profiles).
+
+Related:
+- Providers + models: [Models](/providers/models)
+- Provider auth setup: [Getting started](/start/getting-started)
+
+## Common commands
+
+```bash
+moltbot models status
+moltbot models list
+moltbot models set <model-or-alias>
+moltbot models scan
+```
+
+`moltbot models status` shows the resolved default/fallbacks plus an auth overview.
+When provider usage snapshots are available, the OAuth/token status section includes
+provider usage headers.
+Add `--probe` to run live auth probes against each configured provider profile.
+Probes are real requests (may consume tokens and trigger rate limits).
+
+Notes:
+- `models set <model-or-alias>` accepts `provider/model` or an alias.
+- Model refs are parsed by splitting on the **first** `/`. If the model ID includes `/` (OpenRouter-style), include the provider prefix (example: `openrouter/moonshotai/kimi-k2`).
+- If you omit the provider, Moltbot treats the input as an alias or a model for the **default provider** (only works when there is no `/` in the model ID).
+
+### `models status`
+Options:
+- `--json`
+- `--plain`
+- `--check` (exit 1=expired/missing, 2=expiring)
+- `--probe` (live probe of configured auth profiles)
+- `--probe-provider <name>` (probe one provider)
+- `--probe-profile <id>` (repeat or comma-separated profile ids)
+- `--probe-timeout <ms>`
+- `--probe-concurrency <n>`
+- `--probe-max-tokens <n>`
+
+## Aliases + fallbacks
+
+```bash
+moltbot models aliases list
+moltbot models fallbacks list
+```
+
+## Auth profiles
+
+```bash
+moltbot models auth add
+moltbot models auth login --provider <id>
+moltbot models auth setup-token
+moltbot models auth paste-token
+```
+`models auth login` runs a provider plugin’s auth flow (OAuth/API key). Use
+`moltbot plugins list` to see which providers are installed.
+
+Notes:
+- `setup-token` prompts for a setup-token value (generate it with `claude setup-token` on any machine).
+- `paste-token` accepts a token string generated elsewhere or from automation.

docker-compose/ez-assistant/docs/cli/node.md

@@ -0,0 +1,108 @@
+---
+summary: "CLI reference for `moltbot node` (headless node host)"
+read_when:
+  - Running the headless node host
+  - Pairing a non-macOS node for system.run
+---
+
+# `moltbot node`
+
+Run a **headless node host** that connects to the Gateway WebSocket and exposes
+`system.run` / `system.which` on this machine.
+
+## Why use a node host?
+
+Use a node host when you want agents to **run commands on other machines** in your
+network without installing a full macOS companion app there.
+
+Common use cases:
+- Run commands on remote Linux/Windows boxes (build servers, lab machines, NAS).
+- Keep exec **sandboxed** on the gateway, but delegate approved runs to other hosts.
+- Provide a lightweight, headless execution target for automation or CI nodes.
+
+Execution is still guarded by **exec approvals** and per‑agent allowlists on the
+node host, so you can keep command access scoped and explicit.
+
+## Browser proxy (zero-config)
+
+Node hosts automatically advertise a browser proxy if `browser.enabled` is not
+disabled on the node. This lets the agent use browser automation on that node
+without extra configuration.
+
+Disable it on the node if needed:
+
+```json5
+{
+  nodeHost: {
+    browserProxy: {
+      enabled: false
+    }
+  }
+}
+```
+
+## Run (foreground)
+
+```bash
+moltbot node run --host <gateway-host> --port 18789
+```
+
+Options:
+- `--host <host>`: Gateway WebSocket host (default: `127.0.0.1`)
+- `--port <port>`: Gateway WebSocket port (default: `18789`)
+- `--tls`: Use TLS for the gateway connection
+- `--tls-fingerprint <sha256>`: Expected TLS certificate fingerprint (sha256)
+- `--node-id <id>`: Override node id (clears pairing token)
+- `--display-name <name>`: Override the node display name
+
+## Service (background)
+
+Install a headless node host as a user service.
+
+```bash
+moltbot node install --host <gateway-host> --port 18789
+```
+
+Options:
+- `--host <host>`: Gateway WebSocket host (default: `127.0.0.1`)
+- `--port <port>`: Gateway WebSocket port (default: `18789`)
+- `--tls`: Use TLS for the gateway connection
+- `--tls-fingerprint <sha256>`: Expected TLS certificate fingerprint (sha256)
+- `--node-id <id>`: Override node id (clears pairing token)
+- `--display-name <name>`: Override the node display name
+- `--runtime <runtime>`: Service runtime (`node` or `bun`)
+- `--force`: Reinstall/overwrite if already installed
+
+Manage the service:
+
+```bash
+moltbot node status
+moltbot node stop
+moltbot node restart
+moltbot node uninstall
+```
+
+Use `moltbot node run` for a foreground node host (no service).
+
+Service commands accept `--json` for machine-readable output.
+
+## Pairing
+
+The first connection creates a pending node pair request on the Gateway.
+Approve it via:
+
+```bash
+moltbot nodes pending
+moltbot nodes approve <requestId>
+```
+
+The node host stores its node id, token, display name, and gateway connection info in
+`~/.clawdbot/node.json`.
+
+## Exec approvals
+
+`system.run` is gated by local exec approvals:
+
+- `~/.clawdbot/exec-approvals.json`
+- [Exec approvals](/tools/exec-approvals)
+- `moltbot approvals --node <id|name|ip>` (edit from the Gateway)

docker-compose/ez-assistant/docs/cli/nodes.md

@@ -0,0 +1,68 @@
+---
+summary: "CLI reference for `moltbot nodes` (list/status/approve/invoke, camera/canvas/screen)"
+read_when:
+  - You’re managing paired nodes (cameras, screen, canvas)
+  - You need to approve requests or invoke node commands
+---
+
+# `moltbot nodes`
+
+Manage paired nodes (devices) and invoke node capabilities.
+
+Related:
+- Nodes overview: [Nodes](/nodes)
+- Camera: [Camera nodes](/nodes/camera)
+- Images: [Image nodes](/nodes/images)
+
+Common options:
+- `--url`, `--token`, `--timeout`, `--json`
+
+## Common commands
+
+```bash
+moltbot nodes list
+moltbot nodes list --connected
+moltbot nodes list --last-connected 24h
+moltbot nodes pending
+moltbot nodes approve <requestId>
+moltbot nodes status
+moltbot nodes status --connected
+moltbot nodes status --last-connected 24h
+```
+
+`nodes list` prints pending/paired tables. Paired rows include the most recent connect age (Last Connect).
+Use `--connected` to only show currently-connected nodes. Use `--last-connected <duration>` to
+filter to nodes that connected within a duration (e.g. `24h`, `7d`).
+
+## Invoke / run
+
+```bash
+moltbot nodes invoke --node <id|name|ip> --command <command> --params <json>
+moltbot nodes run --node <id|name|ip> <command...>
+moltbot nodes run --raw "git status"
+moltbot nodes run --agent main --node <id|name|ip> --raw "git status"
+```
+
+Invoke flags:
+- `--params <json>`: JSON object string (default `{}`).
+- `--invoke-timeout <ms>`: node invoke timeout (default `15000`).
+- `--idempotency-key <key>`: optional idempotency key.
+
+### Exec-style defaults
+
+`nodes run` mirrors the model’s exec behavior (defaults + approvals):
+
+- Reads `tools.exec.*` (plus `agents.list[].tools.exec.*` overrides).
+- Uses exec approvals (`exec.approval.request`) before invoking `system.run`.
+- `--node` can be omitted when `tools.exec.node` is set.
+- Requires a node that advertises `system.run` (macOS companion app or headless node host).
+
+Flags:
+- `--cwd <path>`: working directory.
+- `--env <key=val>`: env override (repeatable).
+- `--command-timeout <ms>`: command timeout.
+- `--invoke-timeout <ms>`: node invoke timeout (default `30000`).
+- `--needs-screen-recording`: require screen recording permission.
+- `--raw <command>`: run a shell string (`/bin/sh -lc` or `cmd.exe /c`).
+- `--agent <id>`: agent-scoped approvals/allowlists (defaults to configured agent).
+- `--ask <off|on-miss|always>`, `--security <deny|allowlist|full>`: overrides.

docker-compose/ez-assistant/docs/cli/onboard.md

@@ -0,0 +1,26 @@
+---
+summary: "CLI reference for `moltbot onboard` (interactive onboarding wizard)"
+read_when:
+  - You want guided setup for gateway, workspace, auth, channels, and skills
+---
+
+# `moltbot onboard`
+
+Interactive onboarding wizard (local or remote Gateway setup).
+
+Related:
+- Wizard guide: [Onboarding](/start/onboarding)
+
+## Examples
+
+```bash
+moltbot onboard
+moltbot onboard --flow quickstart
+moltbot onboard --flow manual
+moltbot onboard --mode remote --remote-url ws://gateway-host:18789
+```
+
+Flow notes:
+- `quickstart`: minimal prompts, auto-generates a gateway token.
+- `manual`: full prompts for port/bind/auth (alias of `advanced`).
+- Fastest first chat: `moltbot dashboard` (Control UI, no channel setup).

docker-compose/ez-assistant/docs/cli/pairing.md

@@ -0,0 +1,20 @@
+---
+summary: "CLI reference for `moltbot pairing` (approve/list pairing requests)"
+read_when:
+  - You’re using pairing-mode DMs and need to approve senders
+---
+
+# `moltbot pairing`
+
+Approve or inspect DM pairing requests (for channels that support pairing).
+
+Related:
+- Pairing flow: [Pairing](/start/pairing)
+
+## Commands
+
+```bash
+moltbot pairing list whatsapp
+moltbot pairing approve whatsapp <code> --notify
+```
+

docker-compose/ez-assistant/docs/cli/plugins.md

@@ -0,0 +1,60 @@
+---
+summary: "CLI reference for `moltbot plugins` (list, install, enable/disable, doctor)"
+read_when:
+  - You want to install or manage in-process Gateway plugins
+  - You want to debug plugin load failures
+---
+
+# `moltbot plugins`
+
+Manage Gateway plugins/extensions (loaded in-process).
+
+Related:
+- Plugin system: [Plugins](/plugin)
+- Plugin manifest + schema: [Plugin manifest](/plugins/manifest)
+- Security hardening: [Security](/gateway/security)
+
+## Commands
+
+```bash
+moltbot plugins list
+moltbot plugins info <id>
+moltbot plugins enable <id>
+moltbot plugins disable <id>
+moltbot plugins doctor
+moltbot plugins update <id>
+moltbot plugins update --all
+```
+
+Bundled plugins ship with Moltbot but start disabled. Use `plugins enable` to
+activate them.
+
+All plugins must ship a `moltbot.plugin.json` file with an inline JSON Schema
+(`configSchema`, even if empty). Missing/invalid manifests or schemas prevent
+the plugin from loading and fail config validation.
+
+### Install
+
+```bash
+moltbot plugins install <path-or-spec>
+```
+
+Security note: treat plugin installs like running code. Prefer pinned versions.
+
+Supported archives: `.zip`, `.tgz`, `.tar.gz`, `.tar`.
+
+Use `--link` to avoid copying a local directory (adds to `plugins.load.paths`):
+
+```bash
+moltbot plugins install -l ./my-plugin
+```
+
+### Update
+
+```bash
+moltbot plugins update <id>
+moltbot plugins update --all
+moltbot plugins update <id> --dry-run
+```
+
+Updates only apply to plugins installed from npm (tracked in `plugins.installs`).

docker-compose/ez-assistant/docs/cli/reset.md

@@ -0,0 +1,17 @@
+---
+summary: "CLI reference for `moltbot reset` (reset local state/config)"
+read_when:
+  - You want to wipe local state while keeping the CLI installed
+  - You want a dry-run of what would be removed
+---
+
+# `moltbot reset`
+
+Reset local config/state (keeps the CLI installed).
+
+```bash
+moltbot reset
+moltbot reset --dry-run
+moltbot reset --scope config+creds+sessions --yes --non-interactive
+```
+

docker-compose/ez-assistant/docs/cli/sandbox.md

@@ -0,0 +1,150 @@
+---
+title: Sandbox CLI
+summary: "Manage sandbox containers and inspect effective sandbox policy"
+read_when: "You are managing sandbox containers or debugging sandbox/tool-policy behavior."
+status: active
+---
+
+# Sandbox CLI
+
+Manage Docker-based sandbox containers for isolated agent execution.
+
+## Overview
+
+Moltbot can run agents in isolated Docker containers for security. The `sandbox` commands help you manage these containers, especially after updates or configuration changes.
+
+## Commands
+
+### `moltbot sandbox explain`
+
+Inspect the **effective** sandbox mode/scope/workspace access, sandbox tool policy, and elevated gates (with fix-it config key paths).
+
+```bash
+moltbot sandbox explain
+moltbot sandbox explain --session agent:main:main
+moltbot sandbox explain --agent work
+moltbot sandbox explain --json
+```
+
+### `moltbot sandbox list`
+
+List all sandbox containers with their status and configuration.
+
+```bash
+moltbot sandbox list
+moltbot sandbox list --browser  # List only browser containers
+moltbot sandbox list --json     # JSON output
+```
+
+**Output includes:**
+- Container name and status (running/stopped)
+- Docker image and whether it matches config
+- Age (time since creation)
+- Idle time (time since last use)
+- Associated session/agent
+
+### `moltbot sandbox recreate`
+
+Remove sandbox containers to force recreation with updated images/config.
+
+```bash
+moltbot sandbox recreate --all                # Recreate all containers
+moltbot sandbox recreate --session main       # Specific session
+moltbot sandbox recreate --agent mybot        # Specific agent
+moltbot sandbox recreate --browser            # Only browser containers
+moltbot sandbox recreate --all --force        # Skip confirmation
+```
+
+**Options:**
+- `--all`: Recreate all sandbox containers
+- `--session <key>`: Recreate container for specific session
+- `--agent <id>`: Recreate containers for specific agent
+- `--browser`: Only recreate browser containers
+- `--force`: Skip confirmation prompt
+
+**Important:** Containers are automatically recreated when the agent is next used.
+
+## Use Cases
+
+### After updating Docker images
+
+```bash
+# Pull new image
+docker pull moltbot-sandbox:latest
+docker tag moltbot-sandbox:latest moltbot-sandbox:bookworm-slim
+
+# Update config to use new image
+# Edit config: agents.defaults.sandbox.docker.image (or agents.list[].sandbox.docker.image)
+
+# Recreate containers
+moltbot sandbox recreate --all
+```
+
+### After changing sandbox configuration
+
+```bash
+# Edit config: agents.defaults.sandbox.* (or agents.list[].sandbox.*)
+
+# Recreate to apply new config
+moltbot sandbox recreate --all
+```
+
+### After changing setupCommand
+
+```bash
+moltbot sandbox recreate --all
+# or just one agent:
+moltbot sandbox recreate --agent family
+```
+
+
+### For a specific agent only
+
+```bash
+# Update only one agent's containers
+moltbot sandbox recreate --agent alfred
+```
+
+## Why is this needed?
+
+**Problem:** When you update sandbox Docker images or configuration:
+- Existing containers continue running with old settings
+- Containers are only pruned after 24h of inactivity
+- Regularly-used agents keep old containers running indefinitely
+
+**Solution:** Use `moltbot sandbox recreate` to force removal of old containers. They'll be recreated automatically with current settings when next needed.
+
+Tip: prefer `moltbot sandbox recreate` over manual `docker rm`. It uses the
+Gateway’s container naming and avoids mismatches when scope/session keys change.
+
+## Configuration
+
+Sandbox settings live in `~/.clawdbot/moltbot.json` under `agents.defaults.sandbox` (per-agent overrides go in `agents.list[].sandbox`):
+
+```jsonc
+{
+  "agents": {
+    "defaults": {
+      "sandbox": {
+        "mode": "all",                    // off, non-main, all
+        "scope": "agent",                 // session, agent, shared
+        "docker": {
+          "image": "moltbot-sandbox:bookworm-slim",
+          "containerPrefix": "moltbot-sbx-"
+          // ... more Docker options
+        },
+        "prune": {
+          "idleHours": 24,               // Auto-prune after 24h idle
+          "maxAgeDays": 7                // Auto-prune after 7 days
+        }
+      }
+    }
+  }
+}
+```
+
+## See Also
+
+- [Sandbox Documentation](/gateway/sandboxing)
+- [Agent Configuration](/concepts/agent-workspace)
+- [Doctor Command](/gateway/doctor) - Check sandbox setup

docker-compose/ez-assistant/docs/cli/security.md

@@ -0,0 +1,24 @@
+---
+summary: "CLI reference for `moltbot security` (audit and fix common security footguns)"
+read_when:
+  - You want to run a quick security audit on config/state
+  - You want to apply safe “fix” suggestions (chmod, tighten defaults)
+---
+
+# `moltbot security`
+
+Security tools (audit + optional fixes).
+
+Related:
+- Security guide: [Security](/gateway/security)
+
+## Audit
+
+```bash
+moltbot security audit
+moltbot security audit --deep
+moltbot security audit --fix
+```
+
+The audit warns when multiple DM senders share the main session and recommends `session.dmScope="per-channel-peer"` for shared inboxes.
+It also warns when small models (`<=300B`) are used without sandboxing and with web/browser tools enabled.

docker-compose/ez-assistant/docs/cli/sessions.md

@@ -0,0 +1,16 @@
+---
+summary: "CLI reference for `moltbot sessions` (list stored sessions + usage)"
+read_when:
+  - You want to list stored sessions and see recent activity
+---
+
+# `moltbot sessions`
+
+List stored conversation sessions.
+
+```bash
+moltbot sessions
+moltbot sessions --active 120
+moltbot sessions --json
+```
+

docker-compose/ez-assistant/docs/cli/setup.md

@@ -0,0 +1,28 @@
+---
+summary: "CLI reference for `moltbot setup` (initialize config + workspace)"
+read_when:
+  - You’re doing first-run setup without the full onboarding wizard
+  - You want to set the default workspace path
+---
+
+# `moltbot setup`
+
+Initialize `~/.clawdbot/moltbot.json` and the agent workspace.
+
+Related:
+- Getting started: [Getting started](/start/getting-started)
+- Wizard: [Onboarding](/start/onboarding)
+
+## Examples
+
+```bash
+moltbot setup
+moltbot setup --workspace ~/clawd
+```
+
+To run the wizard via setup:
+
+```bash
+moltbot setup --wizard
+```
+

docker-compose/ez-assistant/docs/cli/skills.md

@@ -0,0 +1,25 @@
+---
+summary: "CLI reference for `moltbot skills` (list/info/check) and skill eligibility"
+read_when:
+  - You want to see which skills are available and ready to run
+  - You want to debug missing binaries/env/config for skills
+---
+
+# `moltbot skills`
+
+Inspect skills (bundled + workspace + managed overrides) and see what’s eligible vs missing requirements.
+
+Related:
+- Skills system: [Skills](/tools/skills)
+- Skills config: [Skills config](/tools/skills-config)
+- ClawdHub installs: [ClawdHub](/tools/clawdhub)
+
+## Commands
+
+```bash
+moltbot skills list
+moltbot skills list --eligible
+moltbot skills info <name>
+moltbot skills check
+```
+

docker-compose/ez-assistant/docs/cli/status.md

@@ -0,0 +1,24 @@
+---
+summary: "CLI reference for `moltbot status` (diagnostics, probes, usage snapshots)"
+read_when:
+  - You want a quick diagnosis of channel health + recent session recipients
+  - You want a pasteable “all” status for debugging
+---
+
+# `moltbot status`
+
+Diagnostics for channels + sessions.
+
+```bash
+moltbot status
+moltbot status --all
+moltbot status --deep
+moltbot status --usage
+```
+
+Notes:
+- `--deep` runs live probes (WhatsApp Web + Telegram + Discord + Google Chat + Slack + Signal).
+- Output includes per-agent session stores when multiple agents are configured.
+- Overview includes Gateway + node host service install/runtime status when available.
+- Overview includes update channel + git SHA (for source checkouts).
+- Update info surfaces in the Overview; if an update is available, status prints a hint to run `moltbot update` (see [Updating](/install/updating)).

docker-compose/ez-assistant/docs/cli/system.md

@@ -0,0 +1,55 @@
+---
+summary: "CLI reference for `moltbot system` (system events, heartbeat, presence)"
+read_when:
+  - You want to enqueue a system event without creating a cron job
+  - You need to enable or disable heartbeats
+  - You want to inspect system presence entries
+---
+
+# `moltbot system`
+
+System-level helpers for the Gateway: enqueue system events, control heartbeats,
+and view presence.
+
+## Common commands
+
+```bash
+moltbot system event --text "Check for urgent follow-ups" --mode now
+moltbot system heartbeat enable
+moltbot system heartbeat last
+moltbot system presence
+```
+
+## `system event`
+
+Enqueue a system event on the **main** session. The next heartbeat will inject
+it as a `System:` line in the prompt. Use `--mode now` to trigger the heartbeat
+immediately; `next-heartbeat` waits for the next scheduled tick.
+
+Flags:
+- `--text <text>`: required system event text.
+- `--mode <mode>`: `now` or `next-heartbeat` (default).
+- `--json`: machine-readable output.
+
+## `system heartbeat last|enable|disable`
+
+Heartbeat controls:
+- `last`: show the last heartbeat event.
+- `enable`: turn heartbeats back on (use this if they were disabled).
+- `disable`: pause heartbeats.
+
+Flags:
+- `--json`: machine-readable output.
+
+## `system presence`
+
+List the current system presence entries the Gateway knows about (nodes,
+instances, and similar status lines).
+
+Flags:
+- `--json`: machine-readable output.
+
+## Notes
+
+- Requires a running Gateway reachable by your current config (local or remote).
+- System events are ephemeral and not persisted across restarts.

docker-compose/ez-assistant/docs/cli/tui.md

@@ -0,0 +1,22 @@
+---
+summary: "CLI reference for `moltbot tui` (terminal UI connected to the Gateway)"
+read_when:
+  - You want a terminal UI for the Gateway (remote-friendly)
+  - You want to pass url/token/session from scripts
+---
+
+# `moltbot tui`
+
+Open the terminal UI connected to the Gateway.
+
+Related:
+- TUI guide: [TUI](/tui)
+
+## Examples
+
+```bash
+moltbot tui
+moltbot tui --url ws://127.0.0.1:18789 --token <token>
+moltbot tui --session main --deliver
+```
+

docker-compose/ez-assistant/docs/cli/uninstall.md

@@ -0,0 +1,17 @@
+---
+summary: "CLI reference for `moltbot uninstall` (remove gateway service + local data)"
+read_when:
+  - You want to remove the gateway service and/or local state
+  - You want a dry-run first
+---
+
+# `moltbot uninstall`
+
+Uninstall the gateway service + local data (CLI remains).
+
+```bash
+moltbot uninstall
+moltbot uninstall --all --yes
+moltbot uninstall --dry-run
+```
+

docker-compose/ez-assistant/docs/cli/update.md

@@ -0,0 +1,96 @@
+---
+summary: "CLI reference for `moltbot update` (safe-ish source update + gateway auto-restart)"
+read_when:
+  - You want to update a source checkout safely
+  - You need to understand `--update` shorthand behavior
+---
+
+# `moltbot update`
+
+Safely update Moltbot and switch between stable/beta/dev channels.
+
+If you installed via **npm/pnpm** (global install, no git metadata), updates happen via the package manager flow in [Updating](/install/updating).
+
+## Usage
+
+```bash
+moltbot update
+moltbot update status
+moltbot update wizard
+moltbot update --channel beta
+moltbot update --channel dev
+moltbot update --tag beta
+moltbot update --no-restart
+moltbot update --json
+moltbot --update
+```
+
+## Options
+
+- `--no-restart`: skip restarting the Gateway service after a successful update.
+- `--channel <stable|beta|dev>`: set the update channel (git + npm; persisted in config).
+- `--tag <dist-tag|version>`: override the npm dist-tag or version for this update only.
+- `--json`: print machine-readable `UpdateRunResult` JSON.
+- `--timeout <seconds>`: per-step timeout (default is 1200s).
+
+Note: downgrades require confirmation because older versions can break configuration.
+
+## `update status`
+
+Show the active update channel + git tag/branch/SHA (for source checkouts), plus update availability.
+
+```bash
+moltbot update status
+moltbot update status --json
+moltbot update status --timeout 10
+```
+
+Options:
+- `--json`: print machine-readable status JSON.
+- `--timeout <seconds>`: timeout for checks (default is 3s).
+
+## `update wizard`
+
+Interactive flow to pick an update channel and confirm whether to restart the Gateway
+after updating (default is to restart). If you select `dev` without a git checkout, it
+offers to create one.
+
+## What it does
+
+When you switch channels explicitly (`--channel ...`), Moltbot also keeps the
+install method aligned:
+
+- `dev` → ensures a git checkout (default: `~/moltbot`, override with `CLAWDBOT_GIT_DIR`),
+  updates it, and installs the global CLI from that checkout.
+- `stable`/`beta` → installs from npm using the matching dist-tag.
+
+## Git checkout flow
+
+Channels:
+
+- `stable`: checkout the latest non-beta tag, then build + doctor.
+- `beta`: checkout the latest `-beta` tag, then build + doctor.
+- `dev`: checkout `main`, then fetch + rebase.
+
+High-level:
+
+1. Requires a clean worktree (no uncommitted changes).
+2. Switches to the selected channel (tag or branch).
+3. Fetches upstream (dev only).
+4. Dev only: preflight lint + TypeScript build in a temp worktree; if the tip fails, walks back up to 10 commits to find the newest clean build.
+5. Rebases onto the selected commit (dev only).
+6. Installs deps (pnpm preferred; npm fallback).
+7. Builds + builds the Control UI.
+8. Runs `moltbot doctor` as the final “safe update” check.
+9. Syncs plugins to the active channel (dev uses bundled extensions; stable/beta uses npm) and updates npm-installed plugins.
+
+## `--update` shorthand
+
+`moltbot --update` rewrites to `moltbot update` (useful for shells and launcher scripts).
+
+## See also
+
+- `moltbot doctor` (offers to run update first on git checkouts)
+- [Development channels](/install/development-channels)
+- [Updating](/install/updating)
+- [CLI reference](/cli)

docker-compose/ez-assistant/docs/cli/voicecall.md

@@ -0,0 +1,33 @@
+---
+summary: "CLI reference for `moltbot voicecall` (voice-call plugin command surface)"
+read_when:
+  - You use the voice-call plugin and want the CLI entry points
+  - You want quick examples for `voicecall call|continue|status|tail|expose`
+---
+
+# `moltbot voicecall`
+
+`voicecall` is a plugin-provided command. It only appears if the voice-call plugin is installed and enabled.
+
+Primary doc:
+- Voice-call plugin: [Voice Call](/plugins/voice-call)
+
+## Common commands
+
+```bash
+moltbot voicecall status --call-id <id>
+moltbot voicecall call --to "+15555550123" --message "Hello" --mode notify
+moltbot voicecall continue --call-id <id> --message "Any questions?"
+moltbot voicecall end --call-id <id>
+```
+
+## Exposing webhooks (Tailscale)
+
+```bash
+moltbot voicecall expose --mode serve
+moltbot voicecall expose --mode funnel
+moltbot voicecall unexpose
+```
+
+Security note: only expose the webhook endpoint to networks you trust. Prefer Tailscale Serve over Funnel when possible.
+

docker-compose/ez-assistant/docs/cli/webhooks.md

@@ -0,0 +1,23 @@
+---
+summary: "CLI reference for `moltbot webhooks` (webhook helpers + Gmail Pub/Sub)"
+read_when:
+  - You want to wire Gmail Pub/Sub events into Moltbot
+  - You want webhook helper commands
+---
+
+# `moltbot webhooks`
+
+Webhook helpers and integrations (Gmail Pub/Sub, webhook helpers).
+
+Related:
+- Webhooks: [Webhook](/automation/webhook)
+- Gmail Pub/Sub: [Gmail Pub/Sub](/automation/gmail-pubsub)
+
+## Gmail
+
+```bash
+moltbot webhooks gmail setup --account you@example.com
+moltbot webhooks gmail run
+```
+
+See [Gmail Pub/Sub documentation](/automation/gmail-pubsub) for details.