CLI reference

Everything the daemon binary does from a command line: the flags that override configuration, and the subcommands for the engine registry, sync and the Windows service.

With no subcommand the binary runs the daemon. Every flag is an override and wins over the TOML file and the environment.

bash

$ scalebrowser-daemon --config scalebrowser.toml

When a subcommand is present the daemon does not start: the subcommand runs and the process exits.

Global flags

Flag	What it does
`--config <FILE>`	The TOML file. Also applies to every subcommand.
`--data-dir <DIR>`	The data root. Relocates engines and profiles with it unless those are set explicitly.

Running the daemon

Flag	What it does
`--bind <ADDR>`	The native API address.
`--headless`	Run headless. Per-profile visibility is still chosen per launch.
`--open`	After binding, open the management interface in the default browser, pre-authenticated. Loopback only.
`--generate-token`	Mint a bearer token, store it under the data directory, print it, exit.
`--mcp-stdio`	Serve MCP over stdio instead of binding the HTTP APIs.
`--mcp-profiles <LIST>`	Comma-separated tool profiles.
`--mcp-read-only`	Refuse and hide every mutating tool.
`--enable-prometheus`	The opt-in scrape endpoint.
`--prometheus-bind <ADDR>`	Its listener.
`--sample-interval-ms <MS>`	Metrics sampler cadence.

--mcp-stdio needs --config or --data-dir. Without one it looks in the default data directory, which is not the one the desktop app uses. What happens then does not announce itself: it either attaches to some other daemon and answers every call unauthorized, or it starts a second daemon that responds normally and knows none of your profiles.

Newer builds detect both and stop with the directory they expected, the one they found, and the command that fixes it.

`engine`

The signed-engine registry. Offline, and it shares the global --config and --data-dir so it resolves the same directory the daemon reads.

Command	What it does
`engine install <SOURCE>`	Add a build from a local archive or an `https` URL, verify it, and pin it.
`engine update <SOURCE>`	Apply a signed delta package instead of a full download.
`engine list`	Installed builds and the active pin per operating system.
`engine verify [VERSION]`	Re-check a build against its signature and file manifest.
`engine pin <VERSION>`	Make a version the one profiles launch with.
`engine rollback`	Return to the previously pinned build.

Useful flags on install and update: --signature and --sha256 (both default to sidecars beside the archive), --token for a private URL, --no-pin, --force, and --os on the read-only commands to address the other operating system's build.

engine update additionally takes --zucchini for the patch tool and --full-fallback, which names a complete archive to install if the delta fails. That is what keeps a version bump from getting stuck.

`sync`

Profile sync from a command line, for a machine you drive over a shell.

Command	What it does
`sync status`	Whether it is set up, unlocked, and when it last ran.
`sync setup`	Set it up on this machine.
`sync unlock`	Unlock with the passphrase.
`sync lock`	Lock it again.
`sync push`	Push now.
`sync pull`	Pull now.
`sync passphrase`	Change the passphrase.
`sync new-recovery-key`	Issue a new recovery key.

These speak to the running daemon rather than opening the store: the data directory carries an exclusive lock, so a subcommand that opened the database would refuse to work exactly when the daemon is up.

`run`

Run a command with a profile's stored values in its environment, without ever holding them yourself:

bash

$ scalebrowser-daemon run --profile pr_9c21e4 \
    --env NPM_TOKEN=npmjs.com/token -- npm publish

The daemon starts the command, so no value crosses a socket and there is no route that could hand one out. Each --env names one variable and the stored value that fills it, and at least one is required: without that rule an npm publish would carry every value the profile holds, including passwords that have nothing to do with it.

Two things to expect. The child gets no terminal, so progress bars and colours look different, which is what keeps the output searchable. And the output arrives when the command finishes rather than line by line, because the secret filter needs the bytes before it can answer for them.

--cwd and --timeout-secs are the other two options.

`service` (Windows)

Install, uninstall, start, stop and query the Windows service wrapper. A stop drains gracefully rather than killing browsers under their owners.

`audio-loopback`

Internal. The daemon calls it on itself to capture a browser's audio on Windows; it is a subcommand rather than a second binary so the release has one file fewer to stage, sign and verify.

Configuration: the file these flags override.
The engine: what the registry is protecting.
Troubleshooting: what to run when a launch is refused.