@oalo-ai/cli 0.0.0-stage → 0.1.1

package/man/oalo.1

@@ -0,0 +1,1530 @@
+.TH OALO 1 "" "oalo 0.1.0" "OALO CLI"
+.SH NAME
+oalo \- wire a local app into your Oalo workspace
+.SH SYNOPSIS
+.B oalo
+.I command
+[\fIargs\fR] [\fIflags\fR]
+.SH DESCRIPTION
+The OALO command line: link a local app to an OALO workspace, deploy it, read and write its data, make tables searchable by bots, change bot settings, and run workflows. \fBoalo help <command>\fR prints the same detail as this page for one command; \fBoalo help \-\-json\fR prints all of it for a program or an agent to read.
+.SH COMMANDS
+.SS login
+Connect this machine to a workspace by approving it in the browser.
+.PP
+\fBoalo login <workspace> [\-\-name "<this machine>"] [\-\-no\-browser]\fR
+.br
+\fBoalo login \-\-server <url>\fR
+.br
+.TP
+\fB\-\-server <url>\fR
+Workspace URL, e.g. https://acme.oalo.ai. Defaults to OALO_URL or the linked project.
+.TP
+\fB\-\-name <name>\fR
+What the connection is called in the dashboard. Default: this machine's hostname.
+.TP
+\fB\-\-no\-browser\fR
+Print the approval URL without opening it (for a remote shell).
+.IP \(bu 2
+Opens the dashboard on Account \-> CLI & agents with a code. Approve it there (check the code matches) and the CLI saves a CLI token plus a read\-only data token.
+.IP \(bu 2
+Saved to ~/.oalo/credentials.json (mode 0600), by workspace URL, never in a project. Every command, oalo mcp included, finds them there.
+.IP \(bu 2
+The code lasts 10 minutes. Nothing is created until you approve.
+.PP
+Exit codes: 0 connected; 1 denied, expired or unreachable; 2 missing \-\-server.
+.SS logout
+Revoke this machine's connection and forget its saved tokens.
+.PP
+\fBoalo logout [\-\-server <url>]\fR
+.br
+.TP
+\fB\-\-server <url>\fR
+Workspace URL. Defaults to OALO_URL or the linked project.
+.IP \(bu 2
+Revokes the connection on the server when it was made by oalo login, then removes every saved token for that workspace.
+.PP
+Exit codes: 0 done; 2 missing \-\-server.
+.SS whoami
+Show the workspace, person and connection this machine uses, and check its tokens.
+.PP
+\fBoalo whoami [\-\-json]\fR
+.br
+.TP
+\fB\-\-json\fR
+Print everything as JSON.
+.IP \(bu 2
+Checks the CLI token by connecting and the data token by reading the manifest, so it tells you which one is the problem when a command is refused.
+.IP \(bu 2
+Also shows the workspace's API version and features, and says when this CLI is too old for it.
+.PP
+Exit codes: 0 connected and both checks passed; 1 a token failed, or the workspace is unreachable; 2 not connected.
+.SS link
+Point this project at a workspace and save credentials.
+.PP
+\fBoalo link \-\-server <url> [\-\-token <sync token>] [\-\-cli\-token <token>] [\-\-app <slug>] [\-\-env dev|prod] [\-\-no\-skill]\fR
+.br
+\fBoalo link \-\-status\fR
+.br
+.TP
+\fB\-\-server <url>\fR
+Workspace URL, e.g. https://acme.oalo.ai
+.TP
+\fB\-\-token <token>\fR
+Sync token (data plane). Not needed after oalo login, which saved one.
+.TP
+\fB\-\-cli\-token <token>\fR
+CLI token (control plane), for tail and mcp. Optional.
+.TP
+\fB\-\-app <slug>\fR
+The app that deploy, env, logs, secrets and dockerfile use when you don't pass \-\-app (\fBoalo apps\fR lists them). \fBoalo deploy \-\-new\fR sets it.
+.TP
+\fB\-\-env dev|prod\fR
+Which schema later commands touch. Default dev.
+.TP
+\fB\-\-status\fR
+Show the current link and re\-check reachability.
+.TP
+\fB\-\-no\-skill\fR
+Don't install or refresh the Oalo skill for coding agents (see \fBoalo skill\fR).
+.IP \(bu 2
+Every token is verified against the thing it is for BEFORE anything is saved, so a bad or mixed\-up token fails here rather than later.
+.IP \(bu 2
+Writes .oalo/config.json (safe to commit) and ~/.oalo/credentials.json (mode 0600, never in the project). OALO_HOME relocates the credential store.
+.IP \(bu 2
+Also installs the Oalo skill for coding agents (.claude/skills/oalo/SKILL.md), or refreshes it, from this CLI version; an AGENTS.md section from \fBoalo skill \-\-agents\fR is refreshed too.
+.PP
+Exit codes: 0 linked; 1 verification failed; 2 missing or invalid arguments.
+.SS typegen
+Generate TypeScript bindings from the workspace's own schema: its models, and the workflows apps can call.
+.PP
+\fBoalo typegen [\-\-out <file>] [\-\-check]\fR
+.br
+\fBoalo typegen \-\-dart [\-\-out <project dir>] [\-\-check]\fR
+.br
+.TP
+\fB\-\-out <file>\fR
+Output path. Default oalo.generated.ts. With \-\-dart, the Flutter project's root (default the current folder).
+.TP
+\fB\-\-dart\fR
+For a Flutter app from Oalo's template: write lib/sync/generated and lib/models (the Base's own Dart generator, the one the box uses), and .oalo/dart\-defines.json with the Base's address, the linked app's slug and the env, for \fBflutter run \-\-dart\-define\-from\-file=.oalo/dart\-defines.json\fR.
+.TP
+\fB\-\-check\fR
+Do not write; exit non\-zero if the file is stale or missing. For CI.
+.IP \(bu 2
+Commit the output. Document interfaces are OPEN: the manifest describes some fields and rows may carry more, so undeclared keys stay reachable.
+.IP \(bu 2
+A table\-scoped token generates only the tables it can read.
+.IP \(bu 2
+\-\-dart files are the same ones the box writes after a model changes; run it again after \fBoalo data models create\fR. Commit them.
+.IP \(bu 2
+The env is stamped in the header: dev and prod are separate schemas.
+.IP \(bu 2
+Workflows with an api trigger get <Name>Input and <Name>Output types and runWorkflow(name, input, {contact, wait}), which calls POST /api/workflows/v1/<name>/run from the app's server with OALO_URL and OALO_SYNC_TOKEN. A preview's token runs it as a test: dev data, outside actions simulated. \-\-check fails when a workflow's input or output changes too.
+.IP \(bu 2
+Every file also gets createChatSession(bot, user), for the chat widget signed in as your app's user: the endpoint in the widget's data\-user\-url answers with it (see \fBoalo docs chat\-widget\fR).
+.IP \(bu 2
+And verifyOaloToolCall(req), which an endpoint declared as a bot tool in .oalo/app.json uses to check a call came from Oalo and for which user (see \fBoalo docs app\-tools\fR).
+.IP \(bu 2
+And the workspace's products: PRODUCTS, the ProductId type and isProductId() (Dart: the Products class and allProductIds). Use them wherever code names a product. \-\-check fails when one is added or archived.
+.PP
+Exit codes: 0 written, or up to date under \-\-check; 1 stale, missing, or fetch failed; 2 not linked.
+.SS tail
+Watch loop runs, jobs, builds and activity as they happen.
+.PP
+\fBoalo tail [\-\-filter <text>] [\-\-json] [\-\-all]\fR
+.br
+.TP
+\fB\-\-filter <text>\fR
+Only events whose name or payload contains this text.
+.TP
+\fB\-\-json\fR
+One JSON object per line. Pipes into jq.
+.TP
+\fB\-\-all\fR
+Include high\-frequency streaming chunk events.
+.IP \(bu 2
+Answers 'I did a thing, did the expected thing happen?'. A flow that never fired shows as silence.
+.IP \(bu 2
+Does NOT show direct Sync REST writes (they do not broadcast); you see their consequences.
+.IP \(bu 2
+Events go to stdout, the banner to stderr, so grep and jq both behave. Runs until interrupted.
+.IP \(bu 2
+Needs a CLI token.
+.PP
+Exit codes: 0 stopped cleanly; 1 could not connect; 2 no CLI token.
+.SS call
+Call any build\-surface event directly. The escape hatch.
+.PP
+\fBoalo call <event> ['<json params>']\fR
+.br
+\fBoalo call \-\-list [text] [\-\-json]\fR
+.br
+.TP
+\fB\-\-list [text]\fR
+List the events you can call, from the workspace. With text, the matching events and the params each accepts.
+.TP
+\fB\-\-namespaces\fR
+The events you may call, counted per namespace (what \fB\-\-list\fR with no text shows).
+.TP
+\fB\-\-compact\fR
+Print the reply as one line of JSON.
+.IP \(bu 2
+The build surface has ~500 events. First\-class commands cover the common ones; this reaches the rest without a command per feature.
+.IP \(bu 2
+Params are a JSON object. Org and user identity come from your token, never the params, so a call cannot exceed what you can do.
+.IP \(bu 2
+\-\-list comes from the server's own handlers and is filtered to what you may call, so it never goes stale. On an older workspace it falls back to a list of namespaces.
+.IP \(bu 2
+An unknown event returns a clean error naming what you sent. An event that exists but gets the wrong params says which params it takes.
+.IP \(bu 2
+Example: oalo call loops:run_now '{"name":"Nurture"}'
+.IP \(bu 2
+Needs a CLI token.
+.PP
+Exit codes: 0 the call succeeded; 1 the call failed or was rejected; 2 bad arguments or no token.
+.SS run
+Fire a loop, or send a bot a test message, and watch what happens.
+.PP
+\fBoalo run loop <name> [\-\-env dev|prod] [\-\-watch]\fR
+.br
+\fBoalo run bot <id> "<message>"\fR
+.br
+.TP
+\fB\-\-watch\fR
+Stream events after firing. Default on for bots.
+.TP
+\fB\-\-timeout <s>\fR
+How long to watch. Default 30.
+.TP
+\fB\-\-env dev|prod\fR
+Which schema the loop runs against.
+.TP
+\fB\-\-app <slug>\fR
+Only for a loop pinned to one app: that app's slug (\fBoalo apps\fR) or id. Loops are org\-wide by default.
+.IP \(bu 2
+IMPORTANT: \fBrun loop\fR fires the loop DIRECTLY and does NOT exercise its trigger binding. Triggers come from the event bus (a real form submission, a real inbound message). So this proves the loop body works; to test that its trigger is wired, use \fBoalo emit\fR.
+.IP \(bu 2
+bot ids accept an integer, a numeric string, or a public bot_ id.
+.IP \(bu 2
+Needs a CLI token.
+.PP
+Exit codes: 0 ran, or watch window elapsed; 1 the run failed to start; 2 bad arguments or no token.
+.SS emit
+Fire a domain event (form.submitted, order.created, ...) to test a loop's trigger.
+.PP
+\fBoalo emit <event type> [\-\-payload '<json>'] [\-\-contact <id>] [\-\-dry\-run] [\-\-json]\fR
+.br
+\fBoalo emit \-\-list [\-\-json]\fR
+.br
+.TP
+\fB\-\-payload <json>\fR
+The event's payload, a JSON object. \fBoalo emit \-\-list\fR shows each event's fields.
+.TP
+\fB\-\-contact <id>\fR
+An existing contact the event is about. Never creates one.
+.TP
+\fB\-\-dry\-run\fR
+List the loops it would fire, and emit nothing.
+.TP
+\fB\-\-list\fR
+Every event a trigger can listen for, with its payload fields and the loops listening now.
+.TP
+\fB\-\-json\fR
+Print the reply as JSON.
+.IP \(bu 2
+\fBoalo run loop\fR fires a loop directly and skips its trigger. emit goes through the real event bus, so it tests the trigger and its payload filter too.
+.IP \(bu 2
+The loops it fires do real things: send email or WhatsApp, mark invoices paid. Run \-\-dry\-run first.
+.IP \(bu 2
+Admins and members with Developer access only (an admin turns it on under Team). Events are tagged as coming from the CLI and posted to the team feed.
+.IP \(bu 2
+The type must be one a trigger can listen for; a typo gets a suggestion instead of vanishing.
+.PP
+Exit codes: 0 emitted (or dry run done); 1 refused or failed; 2 bad arguments or no token.
+.SS data
+Models and rows in this workspace: list, read, push (bulk upsert), delete, watch, promote, and make tables searchable by bots.
+.PP
+\fBoalo data models [\-\-json]\fR
+.br
+\fBoalo data models create <name> \-\-field name:type [\-\-field ...] [\-\-owned\-by <field>]\fR
+.br
+\fBoalo data list <table> [\-\-since N] [\-\-limit N] [\-\-include\-deleted] [\-\-json]\fR
+.br
+\fBoalo data get <table> <id> [\-\-json]\fR
+.br
+\fBoalo data push <table> <file.csv|.json|.jsonl> [\-\-id\-field id] [\-\-format csv|json|jsonl] [\-\-types] [\-\-from N] [\-\-new\-ids] [\-\-dry\-run] [\-\-json]\fR
+.br
+\fBoalo data delete <table> <id>\fR
+.br
+\fBoalo data watch <table> [\-\-since N] [\-\-json]\fR
+.br
+\fBoalo data promote <table>\fR
+.br
+\fBoalo data routes [\-\-json]\fR
+.br
+\fBoalo data events <table> created [updated] | \-\-off\fR
+.br
+\fBoalo data vectorize <table> [\-\-fields a,b] [\-\-where '<field> in a,b'] [\-\-describe '<text>'] [\-\-id <column>] [\-\-json]\fR
+.br
+\fBoalo data vectorize <table> \-\-off\fR
+.br
+\fBoalo data keep\-from\-ai <table> [<field,...>] [\-\-off] [\-\-json]\fR
+.br
+.TP
+\fB\-\-env dev|prod\fR
+Which schema. Default: the project's link, else dev. Writing to prod needs \-\-env prod on the command line.
+.TP
+\fB\-\-since N\fR
+list, watch: only rows changed after this sequence number.
+.TP
+\fB\-\-limit N\fR
+list: how many rows (the server caps it).
+.TP
+\fB\-\-order seqnum|\-seqnum\fR
+list: oldest change first (the default), or newest first.
+.TP
+\fB\-\-include\-deleted\fR
+list: include deleted rows.
+.TP
+\fB\-\-format csv|json|jsonl\fR
+push: the file's format, when its extension doesn't say.
+.TP
+\fB\-\-field name:type\fR
+models create: a field. Repeat it, or comma\-separate. Types: string text integer float boolean datetime date json list references:<table>.
+.TP
+\fB\-\-owned\-by <field>\fR
+models create: rows belong to the app user in this field (each member sees only their own). Without it the model is shared.
+.TP
+\fB\-\-id\-field <name>\fR
+push: which field holds each record's id (default id). Re\-sending a record updates it.
+.TP
+\fB\-\-types\fR
+push, CSV only: turn plain numbers, true/false and empty cells into numbers, booleans and null. Off by default so ids like 007 stay text.
+.TP
+\fB\-\-from N\fR
+push: skip the first N records, to resume a push that stopped.
+.TP
+\fB\-\-new\-ids\fR
+push: let the server make ids for records without one. A re\-send then adds copies.
+.TP
+\fB\-\-dry\-run\fR
+push: parse, check the model exists, show the first row, write nothing.
+.TP
+\fB\-\-fields a,b\fR
+vectorize: the fields (a model's) or columns (a plain table's) whose text bots search. Turns it on, and embeds the existing rows.
+.TP
+\fB\-\-where <filter>\fR
+vectorize, models only: embed only matching rows. \fBstatus in active,draft\fR, \fBstatus not in archived\fR, \fBstatus = active\fR, \fBstatus != archived\fR, \fBcover present\fR, \fBcover absent\fR.
+.TP
+\fB\-\-describe <text>\fR
+vectorize: what the table holds. Bots see its first 120 characters when deciding what to search.
+.TP
+\fB\-\-id <column>\fR
+vectorize, plain tables: the unique column each row is keyed by (default id).
+.TP
+\fB\-\-off\fR
+events, vectorize: turn it off. keep\-from\-ai: take the named fields off the list, or all of them when none are named.
+.TP
+\fB\-\-json\fR
+Print the reply as JSON.
+.IP \(bu 2
+dev is a sandbox; live apps read prod. Push to dev, check it, then \fBoalo data promote <table>\fR copies dev rows to prod.
+.IP \(bu 2
+Reads use the saved data token (read\-only). Row writes use a write token limited to the tables written, made as you over the CLI token the first time you write a table and saved beside it (\fBoalo tokens list\fR shows it; it expires in 30 days).
+.IP \(bu 2
+models create and promote run as you over the CLI token, so they follow your dashboard access.
+.IP \(bu 2
+push sends up to 1,000 rows per request, waits out the rate limit (120 writes a minute), retries network errors, and lists rows the server rejected.
+.IP \(bu 2
+Every write syncs to apps on that schema at once. A delete marks the row deleted; it leaves synced apps.
+.IP \(bu 2
+The exact contract: \fBoalo data routes\fR, or the OpenAPI spec at <workspace>/api/docs.
+.IP \(bu 2
+vectorize works on an Oalo model (both schemas) or a table the app made (the \-\-env schema). With no flags it shows the status: fields, filter, rows embedded. New and edited rows are embedded within 15 minutes, whoever writes them. Then attach it to a bot with \fBoalo bots knowledge <bot> \-\-add <table>\fR.
+.IP \(bu 2
+vectorize sends the text of the chosen fields to the embedding provider (Voyage); a bot's answer sends the rows its search finds to its AI model. Leave out fields that shouldn't leave Oalo.
+.IP \(bu 2
+keep\-from\-ai names fields a bot's data tools (data_search, data_related, table_search, search) leave out of what they hand its AI model, and that can't be embedded. They're still stored, synced to your apps, and read by workflows. A field that's embedded now has to be vectorized away first. With no fields, the list.
+.PP
+Exit codes: 0 done; 1 failed, or some rows were rejected; 2 bad arguments or no token.
+.SS incidents
+A live app's outages and restart bursts, as Oalo's uptime check saw them, newest first.
+.PP
+\fBoalo incidents [\-\-app <slug>] [\-\-all] [\-\-json]\fR
+.br
+.TP
+\fB\-\-app <slug>\fR
+The app. Default: the one saved with \fBoalo link \-\-app\fR.
+.TP
+\fB\-\-all\fR
+Show the details of closed incidents too (open ones always show them).
+.TP
+\fB\-\-json\fR
+The reply as JSON.
+.IP \(bu 2
+Oalo checks each live server app every minute: its port answers (and .oalo/app.json's health path, when set), and how often Docker restarted its processes. An incident opens after 3 failed checks in a row, or 3 restarts in 10 minutes; it closes after 2 good checks.
+.IP \(bu 2
+Each one says what was seen: which process, how many restarts, a memory kill with the size and the fix, the exit code, and the last log lines. The workspace is told in the dashboard's bell and by email (each person can turn that off under Notifications).
+.PP
+Exit codes: 0 no open incident; 1 an incident is open, or the request failed; 2 bad arguments or no CLI token.
+.SS db
+All of an env's data as plain SQL (every app's own tables and the Oalo models), to keep a copy or take it anywhere.
+.PP
+\fBoalo db dump [\-\-env dev|prod] [\-\-out <file.sql>] [\-\-force]\fR
+.br
+.TP
+\fB\-\-env dev|prod\fR
+Which env's data. Default prod.
+.TP
+\fB\-\-out <file.sql>\fR
+Where to write it. Default <workspace>\-<env>\-<date>.sql here.
+.TP
+\fB\-\-force\fR
+Replace the file if it exists.
+.IP \(bu 2
+Workspace admins only: it holds every member's data. Restore it into any Postgres with psql \-f.
+.IP \(bu 2
+Your code is in git (oalo deploy \-\-pull); this is the data. Together they are everything you need to run your apps elsewhere.
+.PP
+Exit codes: 0 a whole dump was written; 1 refused, unreachable, or cut off (the partial file is removed); 2 bad arguments, the file exists, or no CLI token.
+.SS metrics
+A number from the workspace's data: count, sum or average over a model's rows, events or contacts, grouped or over time.
+.PP
+\fBoalo metrics <model | events | contacts> [\-\-sum|\-\-avg|\-\-min|\-\-max|\-\-distinct <field>] [\-\-by <field>] [\-\-every day|week|month] [\-\-days N] [\-\-where <filter>] [\-\-json]\fR
+.br
+.TP
+\fB\-\-sum <field>\fR
+The sum of a number field. Also \-\-avg, \-\-min, \-\-max, and \-\-distinct (how many different values). Default: count the rows.
+.TP
+\fB\-\-avg <field>\fR
+The average of a number field.
+.TP
+\fB\-\-min <field>\fR
+The lowest value of a number field.
+.TP
+\fB\-\-max <field>\fR
+The highest value of a number field.
+.TP
+\fB\-\-distinct <field>\fR
+How many different values a field has.
+.TP
+\fB\-\-by <field>\fR
+Group by a field, largest first. Contacts group by status, source or custom_fields.<name>.
+.TP
+\fB\-\-every <day|week|month>\fR
+Over time, one row per day, week or month.
+.TP
+\fB\-\-days N\fR
+The window, ending now. Default: all time.
+.TP
+\fB\-\-where <filter>\fR
+Only matching rows: "status = paid and total > 100". Also !=, >=, <, <=, ~ (contains), in a,b, present, absent.
+.TP
+\fB\-\-event <type>\fR
+events: one type, like order.created. Default: every type.
+.TP
+\fB\-\-time <created|changed|field>\fR
+A model row counts at when it was created (default), last changed, or one of its date fields.
+.TP
+\fB\-\-compare\fR
+Also the same over the window before (needs \-\-days).
+.TP
+\fB\-\-env dev|prod\fR
+A model's live (default) or dev data.
+.TP
+\fB\-\-json\fR
+The answer as JSON.
+.IP \(bu 2
+The same query the dashboards draw. Model rows count at when they were created, stamped by the server; rows from before the stamp are counted as untracked.
+.IP \(bu 2
+A model's fields are checked: \fBoalo data models\fR lists them. An app's server asks the same with queryMetric from \fBoalo typegen\fR (see \fBoalo docs dashboards\fR).
+.PP
+Exit codes: 0 done; 1 the query failed; 2 bad arguments or no CLI token.
+.SS dashboards
+The workspace's dashboards, and a chart put on one (made when no dashboard has that name).
+.PP
+\fBoalo dashboards [\-\-json]\fR
+.br
+\fBoalo dashboards add <dashboard> <model | events | contacts> \-\-title "<title>" \-\-kind number|line|bars|table [metrics flags] [\-\-app <slug>] [\-\-width 1|2|3]\fR
+.br
+\fBoalo dashboards add <dashboard> \-\-title "<title>" \-\-kind funnel \-\-steps a,b,c [\-\-days N]\fR
+.br
+.TP
+\fB\-\-title <title>\fR
+The chart's title. A chart with the same title on that dashboard is replaced.
+.TP
+\fB\-\-kind <kind>\fR
+number (a total; \-\-compare adds the window before), line (needs \-\-every), bars (needs \-\-by), table, funnel.
+.TP
+\fB\-\-steps a,b\fR
+funnel: event types, in order.
+.TP
+\fB\-\-width <1|2|3>\fR
+Columns of three.
+.TP
+\fB\-\-app <slug>\fR
+A dashboard made now shows on this app too (its Dashboard tab).
+.TP
+\fB\-\-json\fR
+The answer as JSON.
+.IP \(bu 2
+add runs the query first and refuses one that can't draw, then prints its numbers. It changes what everyone with access sees.
+.IP \(bu 2
+The flags after the model are the same as oalo metrics.
+.PP
+Exit codes: 0 done; 1 the request failed; 2 bad arguments or no CLI token.
+.SS products
+What the workspace sells (Oalo commerce on its own Stripe account): list, create, rename, change a price, archive, and see orders.
+.PP
+\fBoalo products [\-\-all] [\-\-json]\fR
+.br
+\fBoalo products create <id> \-\-name "<name>" \-\-price <amount> \-\-once|\-\-monthly|\-\-yearly [\-\-trial <days>] [\-\-currency <code>] [\-\-description <text>] [\-\-live] [\-\-yes]\fR
+.br
+\fBoalo products edit <id> [\-\-name "<name>"] [\-\-description <text>]\fR
+.br
+\fBoalo products price <id> <amount> [\-\-yes]\fR
+.br
+\fBoalo products archive <id> \-\-yes\fR
+.br
+\fBoalo products delete <id> \-\-yes\fR
+.br
+\fBoalo products orders [<id>] [\-\-limit N]\fR
+.br
+.TP
+\fB\-\-name <name>\fR
+create, edit: the name buyers see.
+.TP
+\fB\-\-price <amount>\fR
+create: the price, like 9.99.
+.TP
+\fB\-\-once\fR
+create: paid once.
+.TP
+\fB\-\-monthly\fR
+create: a subscription, billed every month.
+.TP
+\fB\-\-yearly\fR
+create: a subscription, billed every year.
+.TP
+\fB\-\-trial <days>\fR
+create: free days before a subscription's first charge.
+.TP
+\fB\-\-currency <code>\fR
+create: ISO code, like EUR. Default USD.
+.TP
+\fB\-\-description <text>\fR
+create, edit: shown on the checkout page.
+.TP
+\fB\-\-live\fR
+create: on your live Stripe key (real charges). Without it, the test key.
+.TP
+\fB\-\-yes\fR
+Go ahead: needed for archive and delete, for \-\-live, and for a price over 500.
+.TP
+\fB\-\-all\fR
+list: archived products too.
+.TP
+\fB\-\-limit N\fR
+orders: how many, newest first. Default 50.
+.TP
+\fB\-\-json\fR
+The reply as JSON.
+.IP \(bu 2
+The id (premium, pro_yearly) is what code uses: BuyButton productId, a row's product_id (with availability product), and a member's purchased_products. \fBoalo typegen\fR writes the ids as PRODUCTS and the ProductId type (Dart: the Products class), so a typo fails to compile.
+.IP \(bu 2
+Payments run on the workspace's own Stripe key (Payment settings). A product made with the test key is bought with test cards only.
+.IP \(bu 2
+price makes a new Stripe price and archives the old one: new buyers pay the new price, existing subscriptions keep theirs.
+.IP \(bu 2
+archive stops a product being sold; its orders stay and its buyers keep access. delete is for an archived product nobody bought, and frees its id.
+.IP \(bu 2
+PayPal, Apple and Google prices are set up from the dashboard's Storefront or by asking the builder.
+.PP
+Exit codes: 0 done; 1 the request failed; 2 bad arguments, a confirmation (\-\-yes) needed, or no CLI token.
+.SS channels
+Every channel the workspace has (WhatsApp, Instagram, email, web chat) and which bot answers each; change the bot, check or connect a number.
+.PP
+\fBoalo channels [\-\-json]\fR
+.br
+\fBoalo channels set whatsapp|instagram <number or @account> \-\-bot <bot>\fR
+.br
+\fBoalo channels check whatsapp <number>\fR
+.br
+\fBoalo channels connect whatsapp \-\-bot <bot>\fR
+.br
+\fBoalo channels connect instagram\fR
+.br
+\fBoalo channels disconnect whatsapp|instagram <number or @account> \-\-yes\fR
+.br
+.TP
+\fB\-\-bot <bot>\fR
+The bot's public id (\fBoalo bots\fR lists them).
+.TP
+\fB\-\-yes\fR
+Go ahead with disconnect. Without it, disconnect only says what it would do.
+.TP
+\fB\-\-json\fR
+The reply as JSON.
+.IP \(bu 2
+A WhatsApp number can be given as shown (+54 9 11 5555\-0100), as its digits, or by its id; an Instagram account as @username or its id.
+.IP \(bu 2
+WhatsApp numbers and Instagram accounts are kept by the platform, where Meta's messages arrive; your Base asks it. Email is the sending address (no bot answers it); the web chat is each published bot's own widget.
+.IP \(bu 2
+connect prints a link to open in a browser, because Meta's own sign\-in has to run there. The WhatsApp link is for you only and works for a few minutes.
+.IP \(bu 2
+Changes (set, connect, disconnect) are for workspace admins. Reading is for admins and members with Developer access. Disconnecting stops the bot answering at once; the conversations stay in the Inbox.
+.PP
+Exit codes: 0 done (check: Oalo can send on the number); 1 the request failed, or check found it can't send; 2 bad arguments or no CLI token.
+.SS setup
+The setup agent on your Base makes an app run that Oalo can't run on its own, on a branch you then accept or reject.
+.PP
+\fBoalo setup [\-\-app <slug>]\fR
+.br
+\fBoalo setup status [\-\-app <slug>] [\-\-json]\fR
+.br
+\fBoalo setup accept [\-\-app <slug>]\fR
+.br
+\fBoalo setup reject [\-\-app <slug>]\fR
+.br
+\fBoalo setup auto on|off [\-\-app <slug>]\fR
+.br
+.TP
+\fB\-\-app <slug>\fR
+The app. Default: the one saved with \fBoalo link \-\-app\fR.
+.TP
+\fB\-\-json\fR
+The reply as JSON.
+.IP \(bu 2
+The agent works in the app's folder on a branch, oalo/setup: it reads the repo and adds what's missing (a Procfile, a Dockerfile, .oalo/app.json, a fix for a hard\-coded port), the smallest change that makes it run. It never writes a secret; it names the variables to set.
+.IP \(bu 2
+Oalo checks each attempt itself: the app is detected and, for a server app, installed, its \fBrelease:\fR run, and its preview answering. Up to 6 attempts and a dollar budget (shown), then it stops and says why.
+.IP \(bu 2
+When it runs, the preview shows the branch. accept makes its commits the app's code (a fast\-forward); reject throws them away. Deploys wait until then.
+.IP \(bu 2
+status has the agent's report: what the app is, what it changed and why, variables to set, whether it can run as several copies, what it couldn't fix.
+.IP \(bu 2
+auto on: a dev deploy that finds nothing runnable, or a preview that doesn't run, starts one by itself. Off by default.
+.IP \(bu 2
+Admins and members with Developer access only.
+.PP
+Exit codes: 0 done; 1 refused, or (status) the last setup failed; 2 bad arguments or no CLI token.
+.SS sources
+Feeds that send Oalo rows from outside (another system, a webhook, an export), keeping only the fields you choose.
+.PP
+\fBoalo sources [list] [\-\-json]\fR
+.br
+\fBoalo sources create <name> \-\-from <sample.csv|.json|.jsonl> [\-\-table <new model>] [\-\-id\-field <field>] [\-\-mode upsert|snapshot] [\-\-auth bearer|hmac|url] [\-\-env dev|prod]\fR
+.br
+\fBoalo sources create <name> \-\-table <existing model or table> [\-\-fields a,b] [\-\-id\-field <field>] [\-\-auth bearer|hmac|url]\fR
+.br
+\fB  (either form) [\-\-keep\-from\-ai a,b] [\-\-retention <days>]\fR
+.br
+\fBoalo sources show <name> [\-\-json]\fR
+.br
+\fBoalo sources create <name> \-\-bot <bot> [\-\-auth bearer|hmac|url]\fR
+.br
+\fBoalo sources push <name> <file.csv|.json|.jsonl> [\-\-json]\fR
+.br
+\fBoalo sources push <name> <doc.pdf|.docx|.md|.html|.txt> [more...] [\-\-json]\fR
+.br
+\fBoalo sources remove <name> <document>\fR
+.br
+\fBoalo sources fetch <name> <https url> [\-\-every <minutes>] [\-\-header <"Name: value">] [\-\-records\-at <path>] [\-\-document <name>] [\-\-now]\fR
+.br
+\fBoalo sources fetch <name> <postgres url> \-\-relation <schema.view> [\-\-key <column>] [\-\-cursor <column>] [\-\-every <minutes>] [\-\-now]\fR
+.br
+\fBoalo sources fetch <name> \-\-now | \-\-off\fR
+.br
+\fBoalo sources fields <name> a,b\fR
+.br
+\fBoalo sources retention <name> <days|off>\fR
+.br
+\fBoalo sources rotate <name>\fR
+.br
+\fBoalo sources delete <name> [\-\-wipe]\fR
+.br
+.TP
+\fB\-\-from <file>\fR
+create: a sample of what the sender sends. Its fields and their types make the source's fields and a new model (\-\-table, default the source's name).
+.TP
+\fB\-\-bot <bot>\fR
+create: send documents into this bot's knowledge (its public id, from oalo bots) instead of rows into a table. Each upload is one document by name; the same name replaces it.
+.TP
+\fB\-\-table <model>\fR
+create: the model or plain table the rows go to (a table the app made with its own SQL, or an import kept as it is). An existing one keeps all its fields or columns, or the ones in \-\-fields. A plain table's \-\-id\-field must be a unique column.
+.TP
+\fB\-\-keep\-from\-ai a,b\fR
+create: fields stored and synced but never handed to a bot's AI model (see oalo data keep\-from\-ai).
+.TP
+\fB\-\-retention <days>\fR
+create, a new model only: drop rows the source hasn't sent in this many days (1 to 3650), each night. Rows added by hand stay.
+.TP
+\fB\-\-fields a,b\fR
+create, existing model: keep only these fields. Anything else a sender sends is dropped, never stored.
+.TP
+\fB\-\-id\-field <field>\fR
+create: the field that identifies a record (default id). A record sent again updates its row.
+.TP
+\fB\-\-mode snapshot\fR
+create: each upload is the whole set, and rows it leaves out are deleted. Only for a model the source makes. Default upsert.
+.TP
+\fB\-\-auth bearer|hmac|url\fR
+create: how a sender proves it's allowed. bearer (default): Authorization: Bearer <secret>. hmac: a signature header over the raw body (\-\-hmac\-header, default x\-signature; \-\-hmac\-format sha256=hex, hex or base64), for tools that sign their webhooks. url: the secret is the last part of the address, for tools that can only send to an address.
+.TP
+\fB\-\-env dev|prod\fR
+create: which copy of the model the rows go to. Default prod.
+.TP
+\fB\-\-every <minutes>\fR
+fetch: how often Oalo fetches the address, 5 to 10080 minutes. Default 60.
+.TP
+\fB\-\-header <value>\fR
+fetch: a request header, "Name: value" (an API key, say: \-\-header "Authorization: Bearer $KEY"). Repeat it for more, up to 10. Sealed on the server; show prints only the names. Left out, the ones set before stay; \-\-header "" clears them.
+.TP
+\fB\-\-records\-at <path>\fR
+fetch, a table's source: the records are the list at this key of the JSON answer (data.items).
+.TP
+\fB\-\-document <name>\fR
+fetch, a knowledge source: the document's name (default the address's last part).
+.TP
+\fB\-\-relation <name>\fR
+fetch, a postgres:// address: the view (or table) to read, like public.orders_for_oalo. Write a view of just the columns to share.
+.TP
+\fB\-\-key <column>\fR
+fetch, a postgres:// address: the view's column that identifies a row. Default the source's id field.
+.TP
+\fB\-\-cursor <column>\fR
+fetch, a postgres:// address: a column that grows as rows change (updated_at). Each run then reads only rows past the last one seen, up to 50,000. Without it, each run reads the whole view (up to 200,000 rows), so a snapshot source deletes what the view no longer has.
+.TP
+\fB\-\-now\fR
+fetch: fetch once now, and say what was stored.
+.TP
+\fB\-\-off\fR
+fetch: stop fetching.
+.TP
+\fB\-\-wipe\fR
+delete: also delete the rows, when the source made the model.
+.TP
+\fB\-\-json\fR
+The reply as JSON.
+.IP \(bu 2
+A sender posts JSON (an object or an array), NDJSON or CSV to the source's address. Keys and CSV headers are snake\-cased as the CSV import does it, so "Order ID" and order_id are one field.
+.IP \(bu 2
+The secret is shown when the source is made, and by rotate; it only writes. Each upload answers what it stored, rejected and dropped, is listed in show, and fires source.<name>.received for workflows.
+.IP \(bu 2
+Rows sync to your apps at once and fire the model's row events, as Sync API writes do. Up to 10,000 records a request, 120 requests a minute per source, 200,000 rows a day per workspace.
+.IP \(bu 2
+push sends a file from here, over your CLI token, in batches of 1,000; in snapshot mode the rows missing from the whole file are deleted after its last batch.
+.IP \(bu 2
+A \-\-bot source takes one document an upload: the file as the body named by ?name= (or an X\-Document\-Name header, or a form upload), or JSON {"name", "text"}. Its text is read on arrival, so a file without text (a scanned PDF) is refused then. Oalo keeps the text, not the file. DELETE to the address with ?name= removes a document. The bot answers from it once indexed, live at once (bots have no draft knowledge).
+.IP \(bu 2
+fetch from a postgres:// address reads a view in your own database: tested when set (connected, columns read), then on the schedule. Public addresses only, TLS required, a read\-only session with a 30 s statement timeout, opened per run. The address, password included, is sealed; show prints it without the password. Pass it from an environment variable ("$ORDERS_DB_URL") to keep it out of your shell history.
+.IP \(bu 2
+fetch is for a system that can't post: Oalo GETs the address on a schedule and stores the answer as a post would be (JSON, NDJSON or CSV by its Content\-Type; a knowledge source's document). Public https addresses only, up to 3 redirects, 10 MB. An answer that hasn't changed is skipped. show has the last run and its error.
+.IP \(bu 2
+Into a plain table, each record writes only the columns it has, cast by Postgres to the column's type; a value that doesn't fit rejects that record and says why. Snapshot, retention and delete \-\-wipe are for a model the source made.
+.PP
+Exit codes: 0 done; 1 refused, failed, or some records were rejected; 2 bad arguments or no CLI token.
+.SS bots
+The workspace's bots: the tables each can search, and every setting (knowledge, memory, model, replies, limits).
+.PP
+\fBoalo bots [\-\-json]\fR
+.br
+\fBoalo bots knowledge <bot> [\-\-json]\fR
+.br
+\fBoalo bots knowledge <bot> \-\-add <source> [\-\-add ...] [\-\-remove <source>] [\-\-json]\fR
+.br
+\fBoalo bots tools <bot> [\-\-add <tool>] [\-\-remove <tool>] [\-\-json]\fR
+.br
+\fBoalo bots settings <bot> [\-\-json]\fR
+.br
+\fBoalo bots settings <bot> set key=value [key=value ...] [\-\-yes] [\-\-dry\-run] [\-\-json]\fR
+.br
+\fBoalo bots settings \-\-explain [<key> | <group>] [\-\-json]\fR
+.br
+.TP
+\fBtools \-\-add <tool>\fR
+Let the bot call one of the workspace's tools, by name. Your server apps' own endpoints are listed once a deploy reads their .oalo/app.json (see \fBoalo docs app\-tools\fR). \-\-remove takes it away.
+.TP
+\fB\-\-add <source>\fR
+knowledge: attach a searchable table: its handle (model:products, table:prod.faq) or just its name when that's unique. Repeat it, or comma\-separate.
+.TP
+\fB\-\-remove <source>\fR
+Detach one. The table stays searchable for other bots.
+.TP
+\fBset key=value\fR
+settings: change one or more. A value starting with @ is read from that file (for the frame). none, default or an empty value clears a setting where its help says so.
+.TP
+\fB\-\-yes\fR
+settings set: apply to a published bot. Without it a published bot's change is shown and not saved.
+.TP
+\fB\-\-dry\-run\fR
+settings set: show what would change; save nothing.
+.TP
+\fB\-\-explain [key]\fR
+settings: what each setting does, its values and default. A key, a group (knowledge, memory, model, replies, limits, data) or all.
+.TP
+\fB\-\-json\fR
+The bots, or the bot's sources and what else could be attached, as JSON.
+.IP \(bu 2
+<bot> is the bot's public id (bot_...), as \fBoalo bots\fR prints it.
+.IP \(bu 2
+A source is a table made searchable with \fBoalo data vectorize <table> \-\-fields ...\fR. A bot always searches its own knowledge base (documents) too.
+.IP \(bu 2
+The same as ticking a table in the bot's Knowledge pane in the dashboard, with the same access as there.
+.IP \(bu 2
+settings go through the dashboard's own actions, with the same checks and access. A change sets only the settings it names: the model without the provider keeps the provider, one limit keeps the others, one context.* key keeps the rest of the context config.
+.IP \(bu 2
+Every setting is described in \fBman oalo\fR (BOT SETTINGS) and by \fBoalo bots settings \-\-explain\fR.
+.PP
+Exit codes: 0 done; 1 refused or failed; 2 bad arguments or no CLI token.
+.SS tokens
+List, create and revoke the workspace's sync tokens, for an app's own server.
+.PP
+\fBoalo tokens list [\-\-json]\fR
+.br
+\fBoalo tokens create \-\-name <name> \-\-scope write:<table> [\-\-scope ...] [\-\-days N] [\-\-json]\fR
+.br
+\fBoalo tokens revoke <id>\fR
+.br
+.TP
+\fB\-\-name <name>\fR
+What the token is for, shown in the dashboard.
+.TP
+\fB\-\-scope <scope>\fR
+read, write, read_manifest, read:<table>, write:<table>, events (send events to POST /api/events/v1), workflows (call workflows, POST /api/workflows/v1/<name>/run), chat (sign the chat widget in as your app's user, POST /api/chat/v1/sessions), or env:dev / env:prod (lock it to one env's data: env:dev makes events and workflow calls safe test runs, for running your app on your machine). Repeat it. Prefer the narrowest. An unknown scope is refused.
+.TP
+\fB\-\-days N\fR
+Expiry in days (default 90; 0 for none).
+.IP \(bu 2
+A sync token reads or writes every row of its tables, for every member. It belongs in a server's secrets, never in a mobile or web app.
+.IP \(bu 2
+The token is printed once. Copy it into the app server's secrets right away.
+.PP
+Exit codes: 0 done; 1 refused or failed; 2 bad arguments or no CLI token.
+.SS docs
+Read the Oalo platform docs from your workspace: list, search, or print a page as markdown.
+.PP
+\fBoalo docs [\-\-audience developer|trainer] [\-\-json]\fR
+.br
+\fBoalo docs <slug> [\-\-json]\fR
+.br
+\fBoalo docs \-\-search "<words>" [\-\-json]\fR
+.br
+.TP
+\fB\-\-search <words>\fR
+Pages ranked for the words, each with the line that matched.
+.TP
+\fB\-\-audience developer|trainer\fR
+Only pages for that reader (pages for both always show).
+.TP
+\fB\-\-json\fR
+Structured output: summaries for a list or search, the full page with markdown for a slug.
+.IP \(bu 2
+Served by your workspace's own server (its Base), so the pages match the version it runs.
+.IP \(bu 2
+Good starting pages for building on Oalo: bring\-your\-repo and connect\-your\-own\-frontend for your own code, app\-environment, tokens\-and\-credentials, data\-models, sync\-rest\-api, triggers\-and\-chaining.
+.IP \(bu 2
+A page goes to stdout as markdown, so \fBoalo docs data\-models > notes.md\fR saves it. Related pages are listed on stderr.
+.PP
+Exit codes: 0 done; 1 no such page, or the workspace failed; 2 no CLI token.
+.SS apps
+List the workspace's apps: type, state, preview and live addresses, and the live release.
+.PP
+\fBoalo apps [\-\-json]\fR
+.br
+.TP
+\fB\-\-json\fR
+Print the apps as JSON.
+.IP \(bu 2
+The first column is the slug, which \fBoalo deploy \-\-app\fR and \fBoalo link \-\-app\fR take.
+.PP
+Exit codes: 0 done; 1 the workspace failed; 2 no CLI token.
+.SS deploy
+Send this repo's commits to an app and run them: the preview (dev) by default, the live release with \-\-env prod.
+.PP
+\fBoalo deploy [\-\-app <slug>] [\-\-env dev|prod] [\-\-allow\-dirty] [\-\-json]\fR
+.br
+\fBoalo deploy \-\-new [<name>] [\-\-name "Display name"]\fR
+.br
+\fBoalo deploy \-\-new [<name>] \-\-from <https url> [\-\-branch <name>] [\-\-token\-env <VAR>]\fR
+.br
+\fBoalo deploy \-\-app <slug> \-\-pull\fR
+.br
+\fBoalo deploy \-\-app <slug> \-\-replace\fR
+.br
+\fBoalo deploy \-\-app <slug> \-\-history\fR
+.br
+\fBoalo deploy \-\-app <slug> \-\-rollback [\-\-to <sha>]\fR
+.br
+.TP
+\fB\-\-app <slug>\fR
+The app (\fBoalo apps\fR lists them). Default: the app saved with \fBoalo link \-\-app\fR.
+.TP
+\fB\-\-env dev|prod\fR
+dev updates the preview; prod builds and swaps the live release. prod must be on the command line.
+.TP
+\fB\-\-new [<name>]\fR
+Make a new app from this repo: its type found from the files at the repo's root (no Dockerfile needed), its commits kept as the app's history, its preview set up. The name (default: the repo's folder) becomes its slug, and this project is linked to it. When nothing at the root says what the app is (a monorepo, say), it is made as code only and the deploy says what to add: see \fBoalo docs bring\-your\-repo\fR.
+.TP
+\fB\-\-name <display name>\fR
+With \-\-new: the app's display name. Default: its slug.
+.TP
+\fB\-\-from <https url>\fR
+With \-\-new: make the app from a Git repository at this address instead of this folder (no local checkout needed). The Base clones one branch with its whole history (https to a public host only, up to 200 MB, 5 minutes), then makes the app as \-\-new does. The name defaults to the repository's. Nothing is linked here.
+.TP
+\fB\-\-branch <name>\fR
+With \-\-from: the branch to import. Default: the repository's default branch.
+.TP
+\fB\-\-token\-env <VAR>\fR
+With \-\-from: for a private repository, the environment variable holding an access token that can read it (a GitHub, GitLab, Bitbucket or Forgejo personal access token). Without it, at a terminal, you're asked for the token, hidden, when the host wants one. It is used for that one clone: never stored, logged or kept in the app's repo.
+.TP
+\fB\-\-pull\fR
+Fetch the app's code as Oalo has it into oalo/<slug>, to merge changes made there (by the builder agent or a teammate).
+.TP
+\fB\-\-replace\fR
+Make this branch the app's code even though the histories differ. The app's current code is tagged first so it can be recovered.
+.TP
+\fB\-\-allow\-dirty\fR
+Deploy the last commit even though there are uncommitted changes (which are not sent).
+.TP
+\fB\-\-history\fR
+The live releases the app has had, newest first.
+.TP
+\fB\-\-rollback\fR
+Make the release before the current one live again (or \-\-to <sha>). Again goes further back; it never returns to a release you rolled back from. It is built and checked like any live deploy; a failing one leaves the current release live.
+.TP
+\fB\-\-to <sha>\fR
+With \-\-rollback: the release to make live (\fB\-\-history\fR lists them).
+.IP \(bu 2
+What is sent is the current branch's commits, as a git bundle, signed in with your CLI token. No git remote or extra credential is needed. Uncommitted changes are never sent.
+.IP \(bu 2
+The app only moves forward. If it has commits your repo lacks, the deploy stops and lists them: run \-\-pull, merge, deploy again.
+.IP \(bu 2
+dev: dependencies are reinstalled when package.json, a lockfile, requirements.txt, mix.exs or pubspec.yaml changed, then the preview restarts.
+.IP \(bu 2
+prod: the app is built (install, then its build script), a Procfile \fBrelease:\fR line runs, and the live release swaps over once the new one answers on its port. A failed build or release command leaves the old release live; a release that crashes or never answers is removed, and the old one keeps serving (the error shows its last lines).
+.IP \(bu 2
+How a server app starts: its Procfile (\fBweb:\fR, workers, \fBrelease:\fR), else its package.json \fBstart\fR (\fBdev\fR in the preview), else the runtime's default (index.js, main.py, app.py, manage.py, mix).
+.IP \(bu 2
+\-\-from is what the dashboard's Add app, From Git does: the same app, the same type detection, secret scan and preview. A token is never a flag value, since that stays in your shell history.
+.IP \(bu 2
+Admins and members with Developer access only. Progress streams while it runs.
+.PP
+Exit codes: 0 deployed; 1 refused or failed; 2 bad arguments, no CLI token, or not in a git repo.
+.SS env
+An app's environment variables on Oalo (API keys, settings), per env: list, set, unset, rotate\-token.
+.PP
+\fBoalo env [\-\-app <slug>] [\-\-env dev|prod] [\-\-json]\fR
+.br
+\fBoalo env set NAME=value [NAME=value ...] [\-\-secret | \-\-public] [\-\-no\-restart]\fR
+.br
+\fBoalo env set NAME \-\-secret\fR
+.br
+\fBoalo env set \-\-file .env.production \-\-env prod\fR
+.br
+\fBoalo env unset NAME [NAME ...]\fR
+.br
+\fBoalo env rotate\-token [\-\-env dev|prod]\fR
+.br
+.TP
+\fB\-\-app <slug>\fR
+The app (\fBoalo apps\fR lists them). Default: the app saved with \fBoalo link \-\-app\fR.
+.TP
+\fB\-\-env dev|prod\fR
+dev is the preview, prod the live app. Each has its own variables. Changing prod needs \-\-env prod on the command line.
+.TP
+\fB\-\-secret\fR
+Store as secret: never shown again, and only server apps get it. A NAME with no =value asks for the value without echoing it (or reads stdin when piped).
+.TP
+\fB\-\-public\fR
+Store as public: shown by \fBoalo env\fR, and given to static apps too.
+.TP
+\fB\-\-file <path>\fR
+Set every NAME=value line of a .env file in one step (all or none).
+.TP
+\fB\-\-no\-restart\fR
+Don't restart the preview (dev) or relaunch the live app (prod) after this change.
+.IP \(bu 2
+A variable is secret unless its name starts with VITE_, EXPO_PUBLIC_, NEXT_PUBLIC_, PUBLIC_ or REACT_APP_, or it's set with \-\-public.
+.IP \(bu 2
+Server apps get every variable, in the preview and live. Static apps (React, Expo, Flutter) only get public ones, because whatever their build sees ends up in the browser.
+.IP \(bu 2
+Names Oalo sets itself can't be set: any starting with OALO_, PORT, DATABASE_URL, APP_SCHEMA, APP_SLUG, CONTAINER_HOST (and their VITE_/EXPO_PUBLIC_ forms), and the process basics (PATH, HOME, LANG, TZ, the Mix, Hex and Flutter homes). \fBoalo env set\fR refuses one by name.
+.IP \(bu 2
+A server app gets OALO_URL and OALO_SYNC_TOKEN: a Sync API token for its own env's data that can also send events, call workflows and start chat sessions, so it needs no token of its own. It also signs Oalo's calls to the app's endpoints (.oalo/app.json tools). The preview's token can't touch live data, and its events and workflow calls are test runs. \fBrotate\-token\fR replaces it at once and restarts the app on the new one.
+.IP \(bu 2
+A dev change restarts the preview. A prod change relaunches the live app at the commit it already runs (a build; no new code goes out). \-\-no\-restart skips that, to batch several changes: the last one without it relaunches.
+.IP \(bu 2
+Admins and members with Developer access only.
+.PP
+Exit codes: 0 done; 1 refused or failed; 2 bad arguments or no CLI token.
+.SS secrets
+Keys and tokens found committed to an app's code (on import, and in each push or deploy).
+.PP
+\fBoalo secrets [\-\-app <slug>] [\-\-all] [\-\-json]\fR
+.br
+\fBoalo secrets dismiss <fingerprint> [\-\-app <slug>]\fR
+.br
+.TP
+\fB\-\-app <slug>\fR
+The app (\fBoalo apps\fR lists them). Default: the app saved with \fBoalo link \-\-app\fR.
+.TP
+\fB\-\-all\fR
+Dismissed findings too.
+.TP
+\fB\-\-json\fR
+The findings as JSON.
+.IP \(bu 2
+Only where each one is and what it looks like: no value is ever kept.
+.IP \(bu 2
+For each: rotate it with its provider (it stays in the repo's history), set the new one with \fBoalo env set NAME \-\-secret\fR, and read it from the environment in the code.
+.IP \(bu 2
+Admins and members with Developer access only.
+.PP
+Exit codes: 0 done; 1 refused or failed; 2 bad arguments or no CLI token.
+.SS dockerfile
+How a server app's live image is built, and the Dockerfile it builds from.
+.PP
+\fBoalo dockerfile [\-\-app <slug>] [\-\-json]\fR
+.br
+\fBoalo dockerfile \-\-write [\-\-force] [\-\-app <slug>]\fR
+.br
+.TP
+\fB\-\-app <slug>\fR
+The app (\fBoalo apps\fR lists them). Default: the app saved with \fBoalo link \-\-app\fR.
+.TP
+\fB\-\-write\fR
+Save Oalo's Dockerfile as ./Dockerfile, to change. Once committed, the repo's copy is used.
+.TP
+\fB\-\-force\fR
+With \-\-write, replace an existing ./Dockerfile.
+.TP
+\fB\-\-json\fR
+method, source (repo or oalo), runtime and the Dockerfile's text.
+.IP \(bu 2
+The first that fits: the repo's own Dockerfile; Oalo's for the runtime, for the languages buildpacks can't build; buildpacks for the rest. \fBoalo docs live\-server\-apps\fR lists which language gets which.
+.IP \(bu 2
+Every image runs as uid 1000 with a read\-only filesystem (/tmp is writable) and must serve $PORT. A Procfile's lines still name the processes: web runs the image's own command when the Procfile has no web line.
+.PP
+Exit codes: 0 done; 1 refused or failed; 2 bad arguments or no CLI token.
+.SS logs
+What an app's own processes printed (server, workers, release command), per env.
+.PP
+\fBoalo logs [\-\-app <slug>] [\-\-env dev|prod] [\-\-process web|<worker>] [\-\-limit N] [\-\-follow] [\-\-json]\fR
+.br
+.TP
+\fB\-\-app <slug>\fR
+The app (\fBoalo apps\fR lists them). Default: the app saved with \fBoalo link \-\-app\fR.
+.TP
+\fB\-\-env dev|prod\fR
+dev is the preview, prod the live app. Default dev.
+.TP
+\fB\-\-process <name>\fR
+Only this process: web, a Procfile worker's name, release, build (a live build's output, with \-\-env prod), or oalo (Oalo's own notes).
+.TP
+\fB\-\-limit N\fR
+How many recent lines (default 200, at most 2000).
+.TP
+\fB\-\-follow\fR
+Keep printing new lines as they come, until Ctrl\-C.
+.TP
+\fB\-\-json\fR
+One JSON object per line: at, process, line.
+.IP \(bu 2
+The workspace keeps the last 2,000 lines per env in memory; restarting the workspace empties them.
+.IP \(bu 2
+Lines from \fBoalo\fR are Oalo's own: which command started, and when a process exited and with what status.
+.IP \(bu 2
+Admins and members with Developer access only: an app can print secrets or customers' details.
+.PP
+Exit codes: 0 done; 1 refused or failed; 2 bad arguments or no CLI token.
+.SS loops
+Test a loop (sends simulated), see its past runs, turn it on or off, or delete it, without pulling and pushing it.
+.PP
+\fBoalo loops test <name> [\-\-sample latest|example] [\-\-input <json|@file.json>] [\-\-json]\fR
+.br
+\fBoalo loops on <name>\fR
+.br
+\fBoalo loops off <name>\fR
+.br
+\fBoalo loops delete <name>\fR
+.br
+\fBoalo loops runs [<name>] [\-\-limit N] [\-\-json]\fR
+.br
+\fBoalo loops runs \-\-id <run> [\-\-json]\fR
+.br
+.TP
+\fB\-\-sample latest|example\fR
+Test with the loop's most recent real event, or one built from its trigger's fields.
+.TP
+\fB\-\-input <json|@file>\fR
+Test with this input instead: an event envelope {type, contact_id, payload}, or what a scheduled loop's first step reads.
+.TP
+\fB\-\-app <slug>\fR
+Only for a loop pinned to one app: that app's slug (\fBoalo apps\fR) or id. Works with test, runs, on, off and delete.
+.TP
+\fB\-\-id <run>\fR
+runs: one run step by step, with each step's output.
+.TP
+\fB\-\-limit N\fR
+runs: at most this many (default 20).
+.TP
+\fB\-\-json\fR
+Print the test result as JSON.
+.IP \(bu 2
+A test runs every step. Steps that send messages or change records are simulated, and their output says what they would have done. Custom tools and AI steps run for real. It works on a loop that is off.
+.IP \(bu 2
+A loop that is on runs for real whenever its triggers fire. Starting a run now, for real: \fBoalo run loop <name>\fR.
+.IP \(bu 2
+Deleting can't be undone; turning a loop off keeps it.
+.PP
+Exit codes: 0 done (a test passed); 1 refused, failed, or the test run failed; 2 bad arguments or no CLI token.
+.SS flows
+Turn a chat flow on or off, or delete it, by bot and flow name, without pulling and pushing it.
+.PP
+\fBoalo flows on <bot> <flow>\fR
+.br
+\fBoalo flows off <bot> <flow>\fR
+.br
+\fBoalo flows delete <bot> <flow>\fR
+.br
+.IP \(bu 2
+<bot> is the bot's public id (the folder under .oalo/flows/ after \fBoalo pull\fR, or the MCP tool oalo_list_bots), <flow> its name or id.
+.IP \(bu 2
+A flow that is on can start in real conversations. A call_other_flow step only runs a flow that is on.
+.IP \(bu 2
+Deleting can't be undone; turning a flow off keeps it.
+.PP
+Exit codes: 0 done; 1 refused or failed; 2 bad arguments or no CLI token.
+.SS pull
+Fetch chat flows, loops and code tools into .oalo/ as files you can edit.
+.PP
+\fBoalo pull [flows|loops|tools] [\-\-bot <id>] [\-\-name <name>] [\-\-force]\fR
+.br
+.TP
+\fB\-\-bot <id>\fR
+Only this bot's flows (numeric or public bot_ id).
+.TP
+\fB\-\-name <name>\fR
+Only the flow or loop with this name.
+.TP
+\fB\-\-force\fR
+Overwrite files you have edited since the last pull.
+.IP \(bu 2
+Writes .oalo/flows/<bot>/<flow>.json, .oalo/loops/<loop>.json (loops pinned to an app under loops/apps/<app>/), .oalo/tools/<tool>.js + .json for code tools, and the node contracts .oalo/catalog/flow.json and loop.json.
+.IP \(bu 2
+Only code (JavaScript) tools are pulled; webhooks, built\-ins and Elixir actions are configured in the dashboard. A tool's code is compiled when pushed, so code that doesn't build is refused.
+.IP \(bu 2
+A loop file also lists the loop's \fBtriggers\fR (what starts it). Add or delete entries and push: push adds the new ones and removes the ones you deleted, and keeps any a teammate added since your pull. Set a trigger's \fBenabled\fR to turn it on or off.
+.IP \(bu 2
+Each file holds the editable object (\fBflow\fR or \fBloop\fR) plus the CLI's bookkeeping: id, version (sent back as base_version on push) and base_hash (how the CLI knows you edited it). Edit the object; leave the bookkeeping alone.
+.IP \(bu 2
+A file you have edited is kept, not overwritten, unless you pass \-\-force.
+.IP \(bu 2
+To create a flow or loop, write a file in the same shape without id or version, then push it.
+.IP \(bu 2
+Needs a CLI token.
+.PP
+Exit codes: 0 pulled; 1 pull failed; 2 bad arguments or no token.
+.SS status
+Show which flow and loop files changed, locally or on the server.
+.PP
+\fBoalo status [<file>...] [\-\-json]\fR
+.br
+.TP
+\fB\-\-json\fR
+One JSON array of {path, state, note}.
+.IP \(bu 2
+States: new (never pushed), clean, modified (push it), behind (the server has a newer version: pull it), conflict (both changed: merge by hand), gone (deleted on the server), invalid (not a readable file), error (the server check failed; the note says why).
+.IP \(bu 2
+Needs a CLI token.
+.PP
+Exit codes: 0 nothing in conflict; 1 a conflict, an invalid file, or a failed check; 2 no token.
+.SS lint
+Check flow and loop files without saving anything.
+.PP
+\fBoalo lint [<file>...] [\-\-verbose] [\-\-json]\fR
+.br
+.TP
+\fB\-\-verbose\fR
+Also show info\-level findings.
+.TP
+\fB\-\-json\fR
+One JSON object per file: {path, findings}.
+.IP \(bu 2
+The same checks the server runs before a strict save: node types and keys against the catalog, required settings, edges and conditions, references between steps, and tools the flow or loop calls.
+.IP \(bu 2
+Each finding names the node, what is wrong and how to fix it.
+.IP \(bu 2
+Needs a CLI token.
+.PP
+Exit codes: 0 no errors (warnings allowed); 1 errors found; 2 no token.
+.SS push
+Lint and save edited flow, loop and tool files, guarded against concurrent edits.
+.PP
+\fBoalo push [<file>...] [\-\-dry\-run] [\-\-no\-strict] [\-\-force] [\-\-all] [\-\-verbose]\fR
+.br
+.TP
+\fB\-\-dry\-run\fR
+Lint only; save nothing.
+.TP
+\fB\-\-no\-strict\fR
+Save even with error\-level findings. Structural damage is still refused.
+.TP
+\fB\-\-force\fR
+Drop the version guard: overwrite whatever the server has.
+.TP
+\fB\-\-all\fR
+Push every file, not only the edited ones.
+.TP
+\fB\-\-verbose\fR
+Also show info\-level findings.
+.IP \(bu 2
+Without files, pushes every file edited since its pull (and new ones).
+.IP \(bu 2
+Each save sends the pulled version: if someone saved in between, the push is refused as a conflict and nothing is overwritten. Pull, merge, push again.
+.IP \(bu 2
+Saves are strict: error\-level lint findings block them. Fix the findings (each says how) or pass \-\-no\-strict.
+.IP \(bu 2
+After a save the file is rewritten from the server's copy with the new version.
+.IP \(bu 2
+Needs a CLI token.
+.PP
+Exit codes: 0 every file saved; 1 a file was refused, in conflict, or failed; 2 bad arguments or no token.
+.SS qa
+Run a scripted test conversation with a bot and print the transcript.
+.PP
+\fBoalo qa <bot> "<message>" ["<message>" ...] [\-\-channel web|whatsapp|instagram|sms] [\-\-flow <name>] [\-\-timeout <s>] [\-\-json]\fR
+.br
+\fBoalo qa <bot> \-\-script <file.json>\fR
+.br
+.TP
+\fB\-\-channel <name>\fR
+Act as this channel: web (default), whatsapp, instagram, sms, embed. Changes how the bot behaves (text mode vs pickers).
+.TP
+\fB\-\-flow <name>\fR
+Start this flow with the first message, even while it's off, so a new or changed flow is tested before it's turned on.
+.TP
+\fB\-\-script <file>\fR
+A JSON file: {"channel": "whatsapp", "flow": "<name>", "messages": ["...", "..."]}.
+.TP
+\fB\-\-timeout <s>\fR
+How long one turn may take to settle. Default 90, at most 300.
+.TP
+\fB\-\-label <text>\fR
+Tag stored on the test conversation.
+.TP
+\fB\-\-json\fR
+Print the whole run as JSON: turns (replies, flow state, ms, settled), flow_path, cost_usd.
+.IP \(bu 2
+The conversation is a preview with no phone number or external id: the inbox leaves it out and nothing is sent to WhatsApp, Instagram or SMS.
+.IP \(bu 2
+Everything else is real: the bot's tools and flows run, collected contact details are saved, handoffs happen. Use a test bot, or flows whose side effects you are fine repeating.
+.IP \(bu 2
+Each message waits until the bot settles (no new message and no running flow), then the next is sent. Any flow still active at the end is cancelled and the conversation is closed.
+.IP \(bu 2
+At most 20 messages per run. bot accepts a numeric id or a public bot_ id.
+.IP \(bu 2
+Needs a CLI token.
+.PP
+Exit codes: 0 every turn settled; 1 a turn timed out or the run failed; 2 bad arguments or no token.
+.SS rehearse
+Rehearse inbound WhatsApp conversations end to end: routing, triage and the bot's reply.
+.PP
+\fBoalo rehearse [\-\-number <phone_number_id>] [\-\-responder <bot_...>] [\-\-timeout <s>] [\-\-json]\fR
+.br
+\fBoalo rehearse \-\-script <file.json>\fR
+.br
+.TP
+\fB\-\-number <id>\fR
+The WhatsApp number (phone_number_id) the customer writes to. Default: the workspace's default number.
+.TP
+\fB\-\-responder <bot_...>\fR
+The bot that should end up answering, by its public id (\fBoalo bots\fR lists them). Default: the bot an enabled triage loop hands threads to, else the number's bot.
+.TP
+\fB\-\-script <file>\fR
+A JSON file: {"scenarios": [{"name", "messages", "known_contact", "opted_out", "open_thread": {"bot_id", "number", "hours_ago", "tags", "assigned", "deal"}, "expect": {"reply", "bot_id", "assigned"}}]}.
+.TP
+\fB\-\-timeout <s>\fR
+How long one message may take to settle. Default 120, at most 300.
+.TP
+\fB\-\-json\fR
+Print every scenario as JSON: turns (what was sent), threads, loop runs and their steps, checks, why_silent, cost_usd.
+.IP \(bu 2
+Without \-\-script it runs the standard scenarios: a new customer, a known contact whose thread is still open on another number, returning the same day, returning after 24 hours, writing again after their deal was won, writing again after opting out, handed to a teammate earlier today, and with a teammate but writing from another number.
+.IP \(bu 2
+Each message goes through the same code as a real WhatsApp message. The customer is a fictional 555\-01XX number: sends to it are recorded, never posted, its threads stay out of the Inbox, and assignment emails, team\-chat cards and workflow notices are skipped.
+.IP \(bu 2
+Real: LLM calls and their cost, loop runs in the run history. At the end its threads are closed and its contact removed.
+.IP \(bu 2
+A FAIL prints why the customer got no reply (opted out, a failed triage step, autopilot off, assigned to a teammate).
+.IP \(bu 2
+Needs a CLI token.
+.PP
+Exit codes: 0 every scenario passed; 1 a scenario failed or the run failed; 2 bad arguments or no token.
+.SS skill
+Teach this project's coding agent how to work on Oalo.
+.PP
+\fBoalo skill [\-\-agents]\fR
+.br
+\fBoalo skill \-\-print\fR
+.br
+.TP
+\fB\-\-agents\fR
+Also write the rules into AGENTS.md (between oalo markers), for agents other than Claude Code.
+.TP
+\fB\-\-print\fR
+Print the skill instead of installing it.
+.IP \(bu 2
+Installs .claude/skills/oalo/SKILL.md, which Claude Code loads on its own: the pull, lint, push, qa loop, and the rules (read the node catalog, never force past a conflict, test on the customer's channel, test conversations do real work).
+.IP \(bu 2
+The skill ships with this CLI version, and the installed copy says which. Re\-running replaces it, and the AGENTS.md section when there is one, nothing else. Commit both.
+.IP \(bu 2
+\fBoalo link\fR installs it too. After a CLI update, the first command in a project with an older copy says so, once; \fBoalo skill\fR updates it.
+.PP
+Exit codes: 0 installed or printed.
+.SS mcp
+Serve the workspace over MCP on stdio, for Claude Code or Cursor.
+.PP
+\fBoalo mcp\fR
+.br
+.IP \(bu 2
+stdout is the MCP protocol stream. Diagnostics go to stderr.
+.IP \(bu 2
+Exposes a curated tool set plus an oalo_call passthrough; the build surface has ~442 events and mapping them all would wreck tool selection.
+.IP \(bu 2
+Reads OALO_URL and OALO_CLI_TOKEN, or falls back to what \fBoalo link \-\-cli\-token\fR saved.
+.IP \(bu 2
+Needs a CLI token.
+.PP
+Exit codes: 0 stopped cleanly; 1 no workspace or CLI token.
+.SH BOT SETTINGS
+Read with \fBoalo bots settings <bot>\fR, changed with \fBoalo bots settings <bot> set key=value\fR, explained with \fBoalo bots settings \-\-explain <key>\fR. A change to a published bot needs \-\-yes.
+.SS knowledge
+.TP
+\fBretrieval_strategy\fR
+How the bot's knowledge reaches the AI each turn. preload packs the best matching passages into the prompt, with no search tools. adhoc gives the AI search tools only, and it searches when it decides to. hybrid does both. none uses no knowledge (the persona only).
+.br
+Values: hybrid | preload | adhoc | none. Default: hybrid.
+.TP
+\fBretrieval_mode\fR
+How documents are cut and searched. fast: small chunks, few hits, no reranking (FAQs). deep: big chunks, more hits, reranked (long or system\-level material).
+.br
+Values: fast | deep. Default: fast. Changing it re\-indexes the bot's knowledge.
+.TP
+\fBgraph_retrieval\fR
+How the knowledge graph adds to what's found. hierarchical always brings the matched passage's parent topics (its governing rules). similar_only adds related passages beside it. auto is hierarchical when the graph has real depth, else similar_only. off adds nothing.
+.br
+Values: auto | hierarchical | similar_only | off. Default: auto.
+.TP
+\fBancestor_preload_depth\fR
+How many levels of parent topics come with a match when graph_retrieval brings them, nearest first. Cheap to raise when the documents are small.
+.br
+Values: a number from 1 to 32. Default: 3.
+.TP
+\fBcontext.strategy\fR
+How each turn's context is put together. retrieval: the frame, the persona and what search finds. graph_resolver: everything the member's tier unlocks in the knowledge graph, whole (high recall, more tokens). graph_focused: the same unlocking, but only the unlocked topics' own text, plus a search over the graph for this turn (token\-bounded). The context.* settings below are read by the graph strategies.
+.br
+Values: retrieval | graph_resolver | graph_focused. Default: retrieval.
+.TP
+\fBcontext.frame_segments\fR
+Graph topics that load on top of the frame, each its own way. resident: the topic and everything under it, every turn (rules that must always bind). semantic: only the parts that match this turn, plus a list of all its titles. semantic_expand: semantic, with the question rephrased first for a better match. structural: only what the member's tier unlocks under it. Written \fBTHE RULES=resident; THE MAP=semantic\fR, or as JSON. Titles match exactly (case aside).
+.br
+Values: Title=mode; ... (modes: resident, semantic, semantic_expand, structural). Default: none.
+.TP
+\fBcontext.resident_subtrees\fR
+Graph topics loaded every turn whatever the member's tier, by title, comma\-separated.
+.br
+Values: list. Default: none.
+.TP
+\fBcontext.resident_subtree_depth\fR
+How much of each resident topic loads: full (it and everything under it) or shallow (its own text only). default: full for graph_resolver, shallow for graph_focused.
+.br
+Values: full | shallow, or default. Default: default.
+.TP
+\fBcontext.tier_field\fR
+The member field that holds their tier, which decides what the graph strategies unlock.
+.br
+Values: text. Default: band.
+.TP
+\fBcontext.tier_label\fR
+The word before the tier value in the title of each tier's topic: "Band 3" for tier 3.
+.br
+Values: text. Default: Band.
+.TP
+\fBcontext.grant_rel\fR
+The graph relation from a tier's topic to the topics it unlocks.
+.br
+Values: text. Default: grants.
+.TP
+\fBcontext.recurse_rel\fR
+The graph relation followed from an unlocked topic to the further topics it unlocks.
+.br
+Values: text. Default: recurses_into.
+.TP
+\fBcontext.child_rel\fR
+The graph relation from a topic to its parent: what "everything under it" follows.
+.br
+Values: text. Default: child_of.
+.TP
+\fBstate_fields\fR
+Fields of what the conversation has collected (or the member's own data) whose current values drive an extra search every turn, so the knowledge for the member's situation is there however they phrase the question. Comma\-separated; empty is off.
+.br
+Values: list. Default: none.
+.TP
+\fBframe\fR
+Rules that apply to every answer, always in the prompt (they can't depend on a search finding them). @file reads the text from a file; an empty value clears it.
+.br
+Values: text. Default: none.
+.TP
+\fBprotect_canon\fR
+After each reply, remove any passage copied word for word from the knowledge loaded that turn. For bots grounded in material that must not be quoted out.
+.br
+Values: true or false. Default: false.
+.TP
+\fBconversation_record\fR
+Whether the AI sees what the conversation has established. auto: shown when there are facts. extract: auto, plus reading every customer message for the facts the bot defines. off: never shown (it's still recorded).
+.br
+Values: auto | extract | off. Default: auto.
+.SS memory
+.TP
+\fBmember_learning.memory\fR
+Keep what members tell the bot across conversations. The master switch for the three below.
+.br
+Values: true or false. Default: true.
+.TP
+\fBmember_learning.interests\fR
+Track the topics each member asks about.
+.br
+Values: true or false. Default: false.
+.TP
+\fBmember_learning.trajectory\fR
+Note when a member's state_fields change between turns.
+.br
+Values: true or false. Default: false.
+.TP
+\fBmember_learning.query_priors\fR
+Lean searches toward the member's main interests.
+.br
+Values: true or false. Default: false.
+.SS model
+.TP
+\fBmodel\fR
+The AI model this bot answers with. default: the workspace's default model.
+.br
+Values: text, or default. Default: default.
+.TP
+\fBprovider\fR
+How the model is reached: anthropic directly, or opencode (for models from other providers). default: anthropic.
+.br
+Values: anthropic | opencode, or default. Default: default.
+.TP
+\fBprompt_cache_ttl\fR
+How long the provider keeps the bot's prompt cached. 1h costs more to write and pays off when a member's messages come 5 to 60 minutes apart. The AI sees the same text either way.
+.br
+Values: 5m | 1h. Default: 5m.
+.SS replies
+.TP
+\fBautopilot_default\fR
+Whether the bot answers new conversations. on: it answers. off: a human inbox, the bot never answers. handoff: it answers until it hands the conversation to a person.
+.br
+Values: on | off | handoff. Default: handoff.
+.TP
+\fBingestion_window_ms\fR
+How long to wait for more messages before answering, so a burst of short messages gets one reply. 0 answers at once. default: the channel's own.
+.br
+Values: a number from 0 to 600000, or default. Default: default.
+.TP
+\fBoffchannel_widget_fallback\fR
+On WhatsApp and Instagram, which can't show a form: text asks for the answers in the chat, link sends a link to the form on the web.
+.br
+Values: text | link. Default: text.
+.TP
+\fBoffchannel_handoff\fR
+On WhatsApp and Instagram: off answers there, link moves the customer to the web chat on the first reply (it costs nothing per message).
+.br
+Values: off | link. Default: off.
+.TP
+\fBoffchannel_close\fR
+When a sale is ready: handoff passes the lead to a salesperson, direct has the bot close it in the chat.
+.br
+Values: handoff | direct. Default: handoff.
+.TP
+\fBlead_watch.mode\fR
+Flag WhatsApp and Instagram leads about to be lost. tag: a tag and a note only. assign: also assign the conversation to the least busy teammate. off.
+.br
+Values: tag | assign | off. Default: tag.
+.TP
+\fBlead_watch.stalled_minutes\fR
+Minutes a customer can leave the bot waiting before the lead counts as stalled.
+.br
+Values: a number from 10 to 1440. Default: 30.
+.TP
+\fBlead_watch.window_hours\fR
+Hours after the customer's last WhatsApp message to flag the 24\-hour window as closing.
+.br
+Values: a number from 1 to 23. Default: 20.
+.TP
+\fBallow_ambient_uploads\fR
+Show an attach button in the web chat, so members can send files with their message.
+.br
+Values: true or false. Default: false.
+.SS limits
+.TP
+\fBapi_rate_limit_per_min\fR
+Conversations API requests a minute, per end user. none: the workspace default.
+.br
+Values: a number from 1 to 100000, or none. Default: none.
+.TP
+\fBdaily_message_cap_per_user\fR
+Messages a day per end user. none: no cap.
+.br
+Values: a number from 1 to 100000, or none. Default: none.
+.TP
+\fBsoft_daily_cap_cents\fR
+AI spend a day, in cents, past which the workspace is warned. none: no warning.
+.br
+Values: a number from 1 to 100000000, or none. Default: none.
+.TP
+\fBhard_daily_cap_cents\fR
+AI spend a day, in cents, past which the bot stops answering until tomorrow. none: no cap.
+.br
+Values: a number from 1 to 100000000, or none. Default: none.
+.SS data
+.TP
+\fBexpose_member_data\fR
+Let the workspace's dashboards read this bot's member memories and profiles over the Sync API. They are personal data; off unless you need them.
+.br
+Values: true or false. Default: false.
+.SH TOKENS
+.TP
+\fBsync\fR
+data (/api/sync/v1). From \fBoalo login\fR (read\-only), dashboard \-> Account \-> CLI & agents, or dashboard \-> Sync API for an app's own servers. Used by typegen, data.
+.br
+Server\-side only. Carries no end\-user identity, so it reads and writes EVERY member's rows. Never ship one inside a mobile or web app.
+.TP
+\fBcli\fR
+control (the build surface). From \fBoalo login\fR, or dashboard \-> Account \-> CLI & agents. Used by whoami, tail, call, run, emit, data, tokens, docs, apps, deploy, env, logs, secrets, loops, flows, pull, status, lint, push, qa, rehearse, bots, sources, mcp.
+.br
+Acts as you, with exactly your permissions. No read\-only mode. Treat it like a password.
+.SH ENVIRONMENT
+.TP
+\fBOALO_URL\fR
+Workspace URL; overrides the linked config.
+.TP
+\fBOALO_SYNC_TOKEN\fR
+Sync token; overrides the stored one.
+.TP
+\fBOALO_CLI_TOKEN\fR
+CLI token; overrides the stored one.
+.TP
+\fBOALO_HOME\fR
+Relocate the credential store (CI, containers, tests).
+.TP
+\fBOALO_DEBUG\fR
+Log channel transport activity to stderr.
+.TP
+\fBNO_COLOR\fR
+Disable colour in tail output.
+.SH SEE ALSO
+\fBoalo help\fR, \fBoalo docs\fR (the workspace's platform pages).