durar-ai 2026.4.4

package/docs/cli/onboard.md

@@ -0,0 +1,171 @@
+---
+summary: "CLI reference for `Durar onboard` (interactive onboarding)"
+read_when:
+  - You want guided setup for gateway, workspace, auth, channels, and skills
+title: "onboard"
+---
+
+# `Durar onboard`
+
+Interactive onboarding for local or remote Gateway setup.
+
+## Related guides
+
+- CLI onboarding hub: [Onboarding (CLI)](/start/wizard)
+- Onboarding overview: [Onboarding Overview](/start/onboarding-overview)
+- CLI onboarding reference: [CLI Setup Reference](/start/wizard-cli-reference)
+- CLI automation: [CLI Automation](/start/wizard-cli-automation)
+- macOS onboarding: [Onboarding (macOS App)](/start/onboarding)
+
+## Examples
+
+```bash
+Durar onboard
+Durar onboard --flow quickstart
+Durar onboard --flow manual
+Durar onboard --mode remote --remote-url wss://gateway-host:18789
+```
+
+For plaintext private-network `ws://` targets (trusted networks only), set
+`Durar_ALLOW_INSECURE_PRIVATE_WS=1` in the onboarding process environment.
+
+Non-interactive custom provider:
+
+```bash
+Durar onboard --non-interactive \
+  --auth-choice custom-api-key \
+  --custom-base-url "https://llm.example.com/v1" \
+  --custom-model-id "foo-large" \
+  --custom-api-key "$CUSTOM_API_KEY" \
+  --secret-input-mode plaintext \
+  --custom-compatibility openai
+```
+
+`--custom-api-key` is optional in non-interactive mode. If omitted, onboarding checks `CUSTOM_API_KEY`.
+
+Non-interactive Ollama:
+
+```bash
+Durar onboard --non-interactive \
+  --auth-choice ollama \
+  --custom-base-url "http://ollama-host:11434" \
+  --custom-model-id "qwen3.5:27b" \
+  --accept-risk
+```
+
+`--custom-base-url` defaults to `http://127.0.0.1:11434`. `--custom-model-id` is optional; if omitted, onboarding uses Ollama's suggested defaults. Cloud model IDs such as `kimi-k2.5:cloud` also work here.
+
+Store provider keys as refs instead of plaintext:
+
+```bash
+Durar onboard --non-interactive \
+  --auth-choice openai-api-key \
+  --secret-input-mode ref \
+  --accept-risk
+```
+
+With `--secret-input-mode ref`, onboarding writes env-backed refs instead of plaintext key values.
+For auth-profile backed providers this writes `keyRef` entries; for custom providers this writes `models.providers.<id>.apiKey` as an env ref (for example `{ source: "env", provider: "default", id: "CUSTOM_API_KEY" }`).
+
+Non-interactive `ref` mode contract:
+
+- Set the provider env var in the onboarding process environment (for example `OPENAI_API_KEY`).
+- Do not pass inline key flags (for example `--openai-api-key`) unless that env var is also set.
+- If an inline key flag is passed without the required env var, onboarding fails fast with guidance.
+
+Gateway token options in non-interactive mode:
+
+- `--gateway-auth token --gateway-token <token>` stores a plaintext token.
+- `--gateway-auth token --gateway-token-ref-env <name>` stores `gateway.auth.token` as an env SecretRef.
+- `--gateway-token` and `--gateway-token-ref-env` are mutually exclusive.
+- `--gateway-token-ref-env` requires a non-empty env var in the onboarding process environment.
+- With `--install-daemon`, when token auth requires a token, SecretRef-managed gateway tokens are validated but not persisted as resolved plaintext in supervisor service environment metadata.
+- With `--install-daemon`, if token mode requires a token and the configured token SecretRef is unresolved, onboarding fails closed with remediation guidance.
+- With `--install-daemon`, if both `gateway.auth.token` and `gateway.auth.password` are configured and `gateway.auth.mode` is unset, onboarding blocks install until mode is set explicitly.
+- Local onboarding writes `gateway.mode="local"` into the config. If a later config file is missing `gateway.mode`, treat that as config damage or an incomplete manual edit, not as a valid local-mode shortcut.
+- `--allow-unconfigured` is a separate gateway runtime escape hatch. It does not mean onboarding may omit `gateway.mode`.
+
+Example:
+
+```bash
+export Durar_GATEWAY_TOKEN="your-token"
+Durar onboard --non-interactive \
+  --mode local \
+  --auth-choice skip \
+  --gateway-auth token \
+  --gateway-token-ref-env Durar_GATEWAY_TOKEN \
+  --accept-risk
+```
+
+Non-interactive local gateway health:
+
+- Unless you pass `--skip-health`, onboarding waits for a reachable local gateway before it exits successfully.
+- `--install-daemon` starts the managed gateway install path first. Without it, you must already have a local gateway running, for example `Durar gateway run`.
+- If you only want config/workspace/bootstrap writes in automation, use `--skip-health`.
+- On native Windows, `--install-daemon` tries Scheduled Tasks first and falls back to a per-user Startup-folder login item if task creation is denied.
+
+Interactive onboarding behavior with reference mode:
+
+- Choose **Use secret reference** when prompted.
+- Then choose either:
+  - Environment variable
+  - Configured secret provider (`file` or `exec`)
+- Onboarding performs a fast preflight validation before saving the ref.
+  - If validation fails, onboarding shows the error and lets you retry.
+
+Non-interactive Z.AI endpoint choices:
+
+Note: `--auth-choice zai-api-key` now auto-detects the best Z.AI endpoint for your key (prefers the general API with `zai/glm-5`).
+If you specifically want the GLM Coding Plan endpoints, pick `zai-coding-global` or `zai-coding-cn`.
+
+```bash
+# Promptless endpoint selection
+Durar onboard --non-interactive \
+  --auth-choice zai-coding-global \
+  --zai-api-key "$ZAI_API_KEY"
+
+# Other Z.AI endpoint choices:
+# --auth-choice zai-coding-cn
+# --auth-choice zai-global
+# --auth-choice zai-cn
+```
+
+Non-interactive Mistral example:
+
+```bash
+Durar onboard --non-interactive \
+  --auth-choice mistral-api-key \
+  --mistral-api-key "$MISTRAL_API_KEY"
+```
+
+Flow notes:
+
+- `quickstart`: minimal prompts, auto-generates a gateway token.
+- `manual`: full prompts for port/bind/auth (alias of `advanced`).
+- When an auth choice implies a preferred provider, onboarding prefilters the
+  default-model and allowlist pickers to that provider. For Volcengine and
+  BytePlus, this also matches the coding-plan variants
+  (`volcengine-plan/*`, `byteplus-plan/*`).
+- If the preferred-provider filter yields no loaded models yet, onboarding
+  falls back to the unfiltered catalog instead of leaving the picker empty.
+- In the web-search step, some providers can trigger provider-specific
+  follow-up prompts:
+  - **Grok** can offer optional `x_search` setup with the same `XAI_API_KEY`
+    and an `x_search` model choice.
+  - **Kimi** can ask for the Moonshot API region (`api.moonshot.ai` vs
+    `api.moonshot.cn`) and the default Kimi web-search model.
+- Local onboarding DM scope behavior: [CLI Setup Reference](/start/wizard-cli-reference#outputs-and-internals).
+- Fastest first chat: `Durar dashboard` (Control UI, no channel setup).
+- Custom Provider: connect any OpenAI or Anthropic compatible endpoint,
+  including hosted providers not listed. Use Unknown to auto-detect.
+
+## Common follow-up commands
+
+```bash
+Durar configure
+Durar agents add <name>
+```
+
+<Note>
+`--json` does not imply non-interactive mode. Use `--non-interactive` for scripts.
+</Note>

package/docs/cli/pairing.md

@@ -0,0 +1,65 @@
+---
+summary: "CLI reference for `Durar pairing` (approve/list pairing requests)"
+read_when:
+  - You’re using pairing-mode DMs and need to approve senders
+title: "pairing"
+---
+
+# `Durar pairing`
+
+Approve or inspect DM pairing requests (for channels that support pairing).
+
+Related:
+
+- Pairing flow: [Pairing](/channels/pairing)
+
+## Commands
+
+```bash
+Durar pairing list telegram
+Durar pairing list --channel telegram --account work
+Durar pairing list telegram --json
+
+Durar pairing approve <code>
+Durar pairing approve telegram <code>
+Durar pairing approve --channel telegram --account work <code> --notify
+```
+
+## `pairing list`
+
+List pending pairing requests for one channel.
+
+Options:
+
+- `[channel]`: positional channel id
+- `--channel <channel>`: explicit channel id
+- `--account <accountId>`: account id for multi-account channels
+- `--json`: machine-readable output
+
+Notes:
+
+- If multiple pairing-capable channels are configured, you must provide a channel either positionally or with `--channel`.
+- Extension channels are allowed as long as the channel id is valid.
+
+## `pairing approve`
+
+Approve a pending pairing code and allow that sender.
+
+Usage:
+
+- `Durar pairing approve <channel> <code>`
+- `Durar pairing approve --channel <channel> <code>`
+- `Durar pairing approve <code>` when exactly one pairing-capable channel is configured
+
+Options:
+
+- `--channel <channel>`: explicit channel id
+- `--account <accountId>`: account id for multi-account channels
+- `--notify`: send a confirmation back to the requester on the same channel
+
+## Notes
+
+- Channel input: pass it positionally (`pairing list telegram`) or with `--channel <channel>`.
+- `pairing list` supports `--account <accountId>` for multi-account channels.
+- `pairing approve` supports `--account <accountId>` and `--notify`.
+- If only one pairing-capable channel is configured, `pairing approve <code>` is allowed.

package/docs/cli/plugins.md

@@ -0,0 +1,305 @@
+---
+summary: "CLI reference for `Durar plugins` (list, install, marketplace, uninstall, enable/disable, doctor)"
+read_when:
+  - You want to install or manage Gateway plugins or compatible bundles
+  - You want to debug plugin load failures
+title: "plugins"
+---
+
+# `Durar plugins`
+
+Manage Gateway plugins/extensions, hook packs, and compatible bundles.
+
+Related:
+
+- Plugin system: [Plugins](/tools/plugin)
+- Bundle compatibility: [Plugin bundles](/plugins/bundles)
+- Plugin manifest + schema: [Plugin manifest](/plugins/manifest)
+- Security hardening: [Security](/gateway/security)
+
+## Commands
+
+```bash
+Durar plugins list
+Durar plugins list --enabled
+Durar plugins list --verbose
+Durar plugins list --json
+Durar plugins install <path-or-spec>
+Durar plugins inspect <id>
+Durar plugins inspect <id> --json
+Durar plugins inspect --all
+Durar plugins info <id>
+Durar plugins enable <id>
+Durar plugins disable <id>
+Durar plugins uninstall <id>
+Durar plugins doctor
+Durar plugins update <id>
+Durar plugins update --all
+Durar plugins marketplace list <marketplace>
+Durar plugins marketplace list <marketplace> --json
+```
+
+Bundled plugins ship with Durar. Some are enabled by default (for example
+bundled model providers, bundled speech providers, and the bundled browser
+plugin); others require `plugins enable`.
+
+Native Durar plugins must ship `Durar.plugin.json` with an inline JSON
+Schema (`configSchema`, even if empty). Compatible bundles use their own bundle
+manifests instead.
+
+`plugins list` shows `Format: Durar` or `Format: bundle`. Verbose list/info
+output also shows the bundle subtype (`codex`, `claude`, or `cursor`) plus detected bundle
+capabilities.
+
+### Install
+
+```bash
+Durar plugins install <package>                      # Durar Gateway first, then npm
+Durar plugins install Durar Gateway:<package>              # Durar Gateway only
+Durar plugins install <package> --force              # overwrite existing install
+Durar plugins install <package> --pin                # pin version
+Durar plugins install <package> --dangerously-force-unsafe-install
+Durar plugins install <path>                         # local path
+Durar plugins install <plugin>@<marketplace>         # marketplace
+Durar plugins install <plugin> --marketplace <name>  # marketplace (explicit)
+Durar plugins install <plugin> --marketplace https://github.com/<owner>/<repo>
+```
+
+Bare package names are checked against Durar Gateway first, then npm. Security note:
+treat plugin installs like running code. Prefer pinned versions.
+
+If config is invalid, `plugins install` normally fails closed and tells you to
+run `Durar doctor --fix` first. The only documented exception is a narrow
+bundled-plugin recovery path for plugins that explicitly opt into
+`Durar.install.allowInvalidConfigRecovery`.
+
+`--force` reuses the existing install target and overwrites an already-installed
+plugin or hook pack in place. Use it when you are intentionally reinstalling
+the same id from a new local path, archive, Durar Gateway package, or npm artifact.
+
+`--pin` applies to npm installs only. It is not supported with `--marketplace`,
+because marketplace installs persist marketplace source metadata instead of an
+npm spec.
+
+`--dangerously-force-unsafe-install` is a break-glass option for false positives
+in the built-in dangerous-code scanner. It allows the install to continue even
+when the built-in scanner reports `critical` findings, but it does **not**
+bypass plugin `before_install` hook policy blocks and does **not** bypass scan
+failures.
+
+This CLI flag applies to plugin install/update flows. Gateway-backed skill
+dependency installs use the matching `dangerouslyForceUnsafeInstall` request
+override, while `Durar skills install` remains a separate Durar Gateway skill
+download/install flow.
+
+`plugins install` is also the install surface for hook packs that expose
+`Durar.hooks` in `package.json`. Use `Durar hooks` for filtered hook
+visibility and per-hook enablement, not package installation.
+
+Npm specs are **registry-only** (package name + optional **exact version** or
+**dist-tag**). Git/URL/file specs and semver ranges are rejected. Dependency
+installs run with `--ignore-scripts` for safety.
+
+Bare specs and `@latest` stay on the stable track. If npm resolves either of
+those to a prerelease, Durar stops and asks you to opt in explicitly with a
+prerelease tag such as `@beta`/`@rc` or an exact prerelease version such as
+`@1.2.3-beta.4`.
+
+If a bare install spec matches a bundled plugin id (for example `diffs`), Durar
+installs the bundled plugin directly. To install an npm package with the same
+name, use an explicit scoped spec (for example `@scope/diffs`).
+
+Supported archives: `.zip`, `.tgz`, `.tar.gz`, `.tar`.
+
+Claude marketplace installs are also supported.
+
+Durar Gateway installs use an explicit `Durar Gateway:<package>` locator:
+
+```bash
+Durar plugins install Durar Gateway:Durar-codex-app-server
+Durar plugins install Durar Gateway:Durar-codex-app-server@1.2.3
+```
+
+Durar now also prefers Durar Gateway for bare npm-safe plugin specs. It only falls
+back to npm if Durar Gateway does not have that package or version:
+
+```bash
+Durar plugins install Durar-codex-app-server
+```
+
+Durar downloads the package archive from Durar Gateway, checks the advertised
+plugin API / minimum gateway compatibility, then installs it through the normal
+archive path. Recorded installs keep their Durar Gateway source metadata for later
+updates.
+
+Use `plugin@marketplace` shorthand when the marketplace name exists in Claude's
+local registry cache at `~/.claude/plugins/known_marketplaces.json`:
+
+```bash
+Durar plugins marketplace list <marketplace-name>
+Durar plugins install <plugin-name>@<marketplace-name>
+```
+
+Use `--marketplace` when you want to pass the marketplace source explicitly:
+
+```bash
+Durar plugins install <plugin-name> --marketplace <marketplace-name>
+Durar plugins install <plugin-name> --marketplace <owner/repo>
+Durar plugins install <plugin-name> --marketplace https://github.com/<owner>/<repo>
+Durar plugins install <plugin-name> --marketplace ./my-marketplace
+```
+
+Marketplace sources can be:
+
+- a Claude known-marketplace name from `~/.claude/plugins/known_marketplaces.json`
+- a local marketplace root or `marketplace.json` path
+- a GitHub repo shorthand such as `owner/repo`
+- a GitHub repo URL such as `https://github.com/owner/repo`
+- a git URL
+
+For remote marketplaces loaded from GitHub or git, plugin entries must stay
+inside the cloned marketplace repo. Durar accepts relative path sources from
+that repo and rejects HTTP(S), absolute-path, git, GitHub, and other non-path
+plugin sources from remote manifests.
+
+For local paths and archives, Durar auto-detects:
+
+- native Durar plugins (`Durar.plugin.json`)
+- Codex-compatible bundles (`.codex-plugin/plugin.json`)
+- Claude-compatible bundles (`.claude-plugin/plugin.json` or the default Claude
+  component layout)
+- Cursor-compatible bundles (`.cursor-plugin/plugin.json`)
+
+Compatible bundles install into the normal extensions root and participate in
+the same list/info/enable/disable flow. Today, bundle skills, Claude
+command-skills, Claude `settings.json` defaults, Claude `.lsp.json` /
+manifest-declared `lspServers` defaults, Cursor command-skills, and compatible
+Codex hook directories are supported; other detected bundle capabilities are
+shown in diagnostics/info but are not yet wired into runtime execution.
+
+### List
+
+```bash
+Durar plugins list
+Durar plugins list --enabled
+Durar plugins list --verbose
+Durar plugins list --json
+```
+
+Use `--enabled` to show only loaded plugins. Use `--verbose` to switch from the
+table view to per-plugin detail lines with source/origin/version/activation
+metadata. Use `--json` for machine-readable inventory plus registry
+diagnostics.
+
+Use `--link` to avoid copying a local directory (adds to `plugins.load.paths`):
+
+```bash
+Durar plugins install -l ./my-plugin
+```
+
+`--force` is not supported with `--link` because linked installs reuse the
+source path instead of copying over a managed install target.
+
+Use `--pin` on npm installs to save the resolved exact spec (`name@version`) in
+`plugins.installs` while keeping the default behavior unpinned.
+
+### Uninstall
+
+```bash
+Durar plugins uninstall <id>
+Durar plugins uninstall <id> --dry-run
+Durar plugins uninstall <id> --keep-files
+```
+
+`uninstall` removes plugin records from `plugins.entries`, `plugins.installs`,
+the plugin allowlist, and linked `plugins.load.paths` entries when applicable.
+For active memory plugins, the memory slot resets to `memory-core`.
+
+By default, uninstall also removes the plugin install directory under the active
+state-dir plugin root. Use
+`--keep-files` to keep files on disk.
+
+`--keep-config` is supported as a deprecated alias for `--keep-files`.
+
+### Update
+
+```bash
+Durar plugins update <id-or-npm-spec>
+Durar plugins update --all
+Durar plugins update <id-or-npm-spec> --dry-run
+Durar plugins update @Durar/voice-call@beta
+Durar plugins update Durar-codex-app-server --dangerously-force-unsafe-install
+```
+
+Updates apply to tracked installs in `plugins.installs` and tracked hook-pack
+installs in `hooks.internal.installs`.
+
+When you pass a plugin id, Durar reuses the recorded install spec for that
+plugin. That means previously stored dist-tags such as `@beta` and exact pinned
+versions continue to be used on later `update <id>` runs.
+
+For npm installs, you can also pass an explicit npm package spec with a dist-tag
+or exact version. Durar resolves that package name back to the tracked plugin
+record, updates that installed plugin, and records the new npm spec for future
+id-based updates.
+
+When a stored integrity hash exists and the fetched artifact hash changes,
+Durar prints a warning and asks for confirmation before proceeding. Use
+global `--yes` to bypass prompts in CI/non-interactive runs.
+
+`--dangerously-force-unsafe-install` is also available on `plugins update` as a
+break-glass override for built-in dangerous-code scan false positives during
+plugin updates. It still does not bypass plugin `before_install` policy blocks
+or scan-failure blocking, and it only applies to plugin updates, not hook-pack
+updates.
+
+### Inspect
+
+```bash
+Durar plugins inspect <id>
+Durar plugins inspect <id> --json
+```
+
+Deep introspection for a single plugin. Shows identity, load status, source,
+registered capabilities, hooks, tools, commands, services, gateway methods,
+HTTP routes, policy flags, diagnostics, install metadata, bundle capabilities,
+and any detected MCP or LSP server support.
+
+Each plugin is classified by what it actually registers at runtime:
+
+- **plain-capability** — one capability type (e.g. a provider-only plugin)
+- **hybrid-capability** — multiple capability types (e.g. text + speech + images)
+- **hook-only** — only hooks, no capabilities or surfaces
+- **non-capability** — tools/commands/services but no capabilities
+
+See [Plugin shapes](/plugins/architecture#plugin-shapes) for more on the capability model.
+
+The `--json` flag outputs a machine-readable report suitable for scripting and
+auditing.
+
+`inspect --all` renders a fleet-wide table with shape, capability kinds,
+compatibility notices, bundle capabilities, and hook summary columns.
+
+`info` is an alias for `inspect`.
+
+### Doctor
+
+```bash
+Durar plugins doctor
+```
+
+`doctor` reports plugin load errors, manifest/discovery diagnostics, and
+compatibility notices. When everything is clean it prints `No plugin issues
+detected.`
+
+### Marketplace
+
+```bash
+Durar plugins marketplace list <source>
+Durar plugins marketplace list <source> --json
+```
+
+Marketplace list accepts a local marketplace path, a `marketplace.json` path, a
+GitHub shorthand like `owner/repo`, a GitHub repo URL, or a git URL. `--json`
+prints the resolved source label plus the parsed marketplace manifest and
+plugin entries.

package/docs/cli/qr.md

@@ -0,0 +1,52 @@
+---
+summary: "CLI reference for `Durar qr` (generate mobile pairing QR + setup code)"
+read_when:
+  - You want to pair a mobile node app with a gateway quickly
+  - You need setup-code output for remote/manual sharing
+title: "qr"
+---
+
+# `Durar qr`
+
+Generate a mobile pairing QR and setup code from your current Gateway configuration.
+
+## Usage
+
+```bash
+Durar qr
+Durar qr --setup-code-only
+Durar qr --json
+Durar qr --remote
+Durar qr --url wss://gateway.example/ws
+```
+
+## Options
+
+- `--remote`: prefer `gateway.remote.url`; if it is unset, `gateway.tailscale.mode=serve|funnel` can still provide the remote public URL
+- `--url <url>`: override gateway URL used in payload
+- `--public-url <url>`: override public URL used in payload
+- `--token <token>`: override which gateway token the bootstrap flow authenticates against
+- `--password <password>`: override which gateway password the bootstrap flow authenticates against
+- `--setup-code-only`: print only setup code
+- `--no-ascii`: skip ASCII QR rendering
+- `--json`: emit JSON (`setupCode`, `gatewayUrl`, `auth`, `urlSource`)
+
+## Notes
+
+- `--token` and `--password` are mutually exclusive.
+- The setup code itself now carries an opaque short-lived `bootstrapToken`, not the shared gateway token/password.
+- In the built-in node/operator bootstrap flow, the primary node token still lands with `scopes: []`.
+- If bootstrap handoff also issues an operator token, it stays bounded to the bootstrap allowlist: `operator.approvals`, `operator.read`, `operator.talk.secrets`, `operator.write`.
+- Bootstrap scope checks are role-prefixed. That operator allowlist only satisfies operator requests; non-operator roles still need scopes under their own role prefix.
+- Mobile pairing fails closed for Tailscale/public `ws://` gateway URLs. Private LAN `ws://` remains supported, but Tailscale/public mobile routes should use Tailscale Serve/Funnel or a `wss://` gateway URL.
+- With `--remote`, Durar requires either `gateway.remote.url` or
+  `gateway.tailscale.mode=serve|funnel`.
+- With `--remote`, if effectively active remote credentials are configured as SecretRefs and you do not pass `--token` or `--password`, the command resolves them from the active gateway snapshot. If gateway is unavailable, the command fails fast.
+- Without `--remote`, local gateway auth SecretRefs are resolved when no CLI auth override is passed:
+  - `gateway.auth.token` resolves when token auth can win (explicit `gateway.auth.mode="token"` or inferred mode where no password source wins).
+  - `gateway.auth.password` resolves when password auth can win (explicit `gateway.auth.mode="password"` or inferred mode with no winning token from auth/env).
+- If both `gateway.auth.token` and `gateway.auth.password` are configured (including SecretRefs) and `gateway.auth.mode` is unset, setup-code resolution fails until mode is set explicitly.
+- Gateway version skew note: this command path requires a gateway that supports `secrets.resolve`; older gateways return an unknown-method error.
+- After scanning, approve device pairing with:
+  - `Durar devices list`
+  - `Durar devices approve <requestId>`

package/docs/cli/reset.md

@@ -0,0 +1,35 @@
+---
+summary: "CLI reference for `Durar reset` (reset local state/config)"
+read_when:
+  - You want to wipe local state while keeping the CLI installed
+  - You want a dry-run of what would be removed
+title: "reset"
+---
+
+# `Durar reset`
+
+Reset local config/state (keeps the CLI installed).
+
+Options:
+
+- `--scope <scope>`: `config`, `config+creds+sessions`, or `full`
+- `--yes`: skip confirmation prompts
+- `--non-interactive`: disable prompts; requires `--scope` and `--yes`
+- `--dry-run`: print actions without removing files
+
+Examples:
+
+```bash
+Durar backup create
+Durar reset
+Durar reset --dry-run
+Durar reset --scope config --yes --non-interactive
+Durar reset --scope config+creds+sessions --yes --non-interactive
+Durar reset --scope full --yes --non-interactive
+```
+
+Notes:
+
+- Run `Durar backup create` first if you want a restorable snapshot before removing local state.
+- If you omit `--scope`, `Durar reset` uses an interactive prompt to choose what to remove.
+- `--non-interactive` is only valid when both `--scope` and `--yes` are set.