# Neotask CLI command reference

Every command of the public `neotask` CLI (npm package `@neotask/cli` and the website installers), generated from the Gateway command registry at `NeotaskInc/neotask-gateway` revision `79f567c2ba8b`. The [CLI guide](https://neotask.ai/docs/cli.md) explains installation, sign-in, claim, the runner and recovery. An installed release prints its own syntax with `neotask <command> --help`, and a published release's exact reference is [https://neotask.ai/cli/commands.md](https://neotask.ai/cli/commands.md). When they differ from this page, the installed release is authoritative.

## Conventions

- Add `--json` to every agent call. The last output line is one `AgentCliEnvelope.v1` object: check `ok`, `state`, `availability`, `error.code`, `error.reason` and `nextAction` before treating a call as done.
- `<value>` reference flags take the opaque references the server returned, such as `--agent-ref`, `--run-ref` or `--approval-ref`. Never construct or guess them.
- Mutations marked with `--idempotency-key <key>` need a stable key of your own. Retry an uncertain result with the same key and the same body; a changed body needs a new key.
- Commands with "JSON request on stdin" read the request body from standard input, for example `neotask api tasks create --idempotency-key <key> --json < request.json`. Fill it from the matching [API operation page](https://neotask.ai/docs/api/llms.txt). Credentials never go in a body, an argument or a URL.
- `[--watch]` keeps an event resource open and resumes after disconnects. Stopping a watch never cancels the run, turn or approval it follows.
- The scope column names the Agent API scope the call needs. `neotask api capabilities --json` reports whether the current credential has it and whether the operation is available now.

## Program, terminal menu and updates

| Command | Command ID | Purpose |
| --- | --- | --- |
| `neotask --version` | none | Print the installed release version (also `-V`). Needs no account. |
| `neotask --help` | none | List commands; `neotask <command> --help` shows one command's options. |
| `neotask tui [--accessible] [--ascii] [--no-motion] [--inline \| --fullscreen]` | none | Open the terminal workspace. Bare `neotask` in an interactive terminal opens it too. `--accessible` is the linear, screen-reader-friendly interface. |
| `neotask update [--check] [--version <version>] [--rollback [version]] [--yes] --json` | `cli-update` | Check for or install a newer signed CLI release, or switch back to an older installed release. Without `--yes`, `--json` returns `human_action_required` instead of installing. |

## Local MCP clients

| Command | Command ID | Purpose |
| --- | --- | --- |
| `neotask mcp serve [--profile <profile>]` | none | Serve the remote Neotask MCP tools over local stdio, with the account's MCP-audience token. |
| `neotask mcp install --client <claude\|codex> [--profile <profile>] [--confirm] --json` | `mcp-install` | Preview, then with `--confirm` write, a marker-owned Neotask entry in a supported agent client. |
| `neotask mcp status [--client <claude\|codex>] [--profile <profile>] --json` | `mcp-status` | Show the marker-owned MCP entry in each supported client. |
| `neotask mcp uninstall --client <claude\|codex> [--profile <profile>] [--confirm] --json` | `mcp-uninstall` | Remove only the marker-owned entry; `--confirm` applies the change. |

## Construct plugins and skills

The installed runner carries out every `construct` operation for the signed-in, claimed account. A package is `name` or `@org/name`, lowercase; install and report accept `@version`. See the [Construct guide](https://neotask.ai/docs/construct.md).

| Command | Command ID | Purpose |
| --- | --- | --- |
| `neotask construct search [query...] [--family <plugin\|skill>] [--limit <1-100>] [--cursor <cursor>] --json` | `construct-search` | Search the packages this account can install. |
| `neotask construct info <package> [--channel <stable\|beta>] --json` | `construct-info` | Show a package, its channels and this account's access. |
| `neotask construct versions <package> [--channel <stable\|beta>] [--limit <1-100>] [--cursor <cursor>] --json` | `construct-versions` | List a package's published releases. |
| `neotask construct list [--agent <id>] --json` | `construct-list` | List the packages this runner installed from Construct. |
| `neotask construct install <package[@version]> [--channel <stable\|beta>] [--org <slug>] [--force] [--agent <id>] --json` | `construct-install` | Verify the signed release, then install a plugin, or a skill for one runner agent with `--agent`. |
| `neotask construct update (<package> \| --all) [--channel <stable\|beta>] [--agent <id>] --json` | `construct-update` | Update one installed package, or all of them, to the newest compatible release. |
| `neotask construct report <package[@version]> --reason <reason> --details <text> --json` | `construct-report` | Report a problem package. `--reason` is one of malware, security, credential_theft, impersonation, spam, license, broken or other; `--details` takes up to 4000 characters. |
| `neotask construct remove <package> [--agent <id>] --json` | `construct-remove` | Remove a package this runner installed (alias `uninstall`). |

## Onboarding and setup

| Command | Command ID | Input | Scope | Purpose |
| --- | --- | --- | --- | --- |
| `neotask onboard --flow agent --json` | `onboard-agent` | none | none | Start the resumable agent onboarding flow. |
| `neotask setup --json` | `setup` | none | none | Prepare the standalone runner setup handoff. |

## Account, sign-in and claim

| Command | Command ID | Input | Scope | Purpose |
| --- | --- | --- | --- | --- |
| `neotask account login [--method <anonymous\|service_auth\|identity_assertion>] [--audience <rest\|mcp>] [--email <email>] --json` | `account-login`; also `neotask login` | email or identity assertion as text on stdin (`--email` for service_auth) | none | Register or authenticate this agent through the advertised auth server. |
| `neotask account status [--audience <rest\|mcp>] --json` | `account-status`; also `neotask whoami` | none | none | Read this agent account's local authentication state. |
| `neotask account logout [--audience <rest\|mcp>] --json` | `account-logout`; also `neotask logout` | none | none | Revoke this agent account remotely before removing local credentials. |
| `neotask account claim start [--audience <rest\|mcp>] [--email <email>] --json` | `account-claim-start` | email as text on stdin, or `--email` | none | Start the advertised human claim handoff for this agent account. |
| `neotask account claim status [--audience <rest\|mcp>] [--code <code>] [--stdin] --json` | `account-claim-status` | optional claim code on stdin with `--stdin` (keep it out of arguments; `--code` is for attended terminals) | none | Read the human-claim state, or complete the claim with the code from the claim page. |
| `neotask account claim cancel [--audience <rest\|mcp>] --json` | `account-claim-cancel` | none | none | Cancel an unused human-claim ceremony. |
| `neotask account pairing create --idempotency-key <key> --json` | `account-pairing-create` | none | `neotask:account:pair` | Create a single-use same-tenant human pairing handoff. |
| `neotask account pairing status --handoff-ref <ref> --json` | `account-pairing-status` | none | `neotask:account:pair` | Read the current pairing handoff state. |
| `neotask account pairing cancel --handoff-ref <ref> --idempotency-key <key> --json` | `account-pairing-cancel` | none | `neotask:account:pair` | Cancel an unused pairing handoff. |
| `neotask account registration revoke --idempotency-key <key> --json` | `account-registration-revoke` | none | `neotask:registration:revoke` | Revoke this registration and its credential authority. |
| `neotask account upgrade --idempotency-key <key> --json` | `account-upgrade` | JSON request on stdin | `neotask:billing:handoff` | Request a human checkout handoff; this command does not authorize payment. |

## Agent API

| Command | Command ID | Input | Scope | Purpose |
| --- | --- | --- | --- | --- |
| `neotask api capabilities --json` | `api-capabilities`; also `neotask api capabilities get` | none | `neotask:catalog:read` | Read the effective operation and execution-mode manifest. |
| `neotask api onboarding get --json` | `api-onboarding`; also `neotask api onboarding` | none | `neotask:catalog:read` | Read derived onboarding state and next actions. |
| `neotask api profile --json` | `api-profile`; also `neotask api profile get` | none | `neotask:profile:read` | Read the authenticated agent profile and registration state. |
| `neotask api agents list [--limit <value>] [--cursor <value>] --json` | `api-agents-list` | none | `neotask:agents:read` | List the managed Neotask agents in this tenant. |
| `neotask api boards list [--limit <value>] [--cursor <value>] [--scope-type <value>] [--scope-id <value>] --json` | `api-boards-list` | none | `neotask:boards:read` | List saved boards available to this account. |
| `neotask api boards get --board-id <value> --json` | `api-boards-get` | none | `neotask:boards:read` | Read a saved board. |
| `neotask api boards publication get --board-id <value> --json` | `api-boards-publication-get` | none | `neotask:boards:read` | Read a board's publication state. |
| `neotask api boards publish --board-id <value> --idempotency-key <key> --json` | `api-boards-publish` | JSON request on stdin | `neotask:boards:publish` | Publish a saved board version after Site approval checks. |
| `neotask api boards unpublish --board-id <value> --idempotency-key <key> --json` | `api-boards-unpublish` | none | `neotask:boards:publish` | Unpublish a board and revoke its hosted links. |
| `neotask api boards link rotate --board-id <value> --idempotency-key <key> --json` | `api-boards-link-rotate` | none | `neotask:boards:publish` | Rotate a board's hosted link. |
| `neotask api boards visibility set --board-id <value> --idempotency-key <key> --json` | `api-boards-visibility-set` | JSON request on stdin | `neotask:boards:share` | Change board visibility after Site approval checks. |
| `neotask api boards grants list --board-id <value> --json` | `api-boards-grants-list` | none | `neotask:boards:share` | List a board's viewer grants. |
| `neotask api boards grants create --board-id <value> --idempotency-key <key> --json` | `api-boards-grants-create` | JSON request on stdin | `neotask:boards:share` | Create a viewer grant for a board. |
| `neotask api boards grants revoke --board-id <value> --grant-id <value> --idempotency-key <key> --json` | `api-boards-grants-revoke` | none | `neotask:boards:share` | Revoke a board's viewer grant. |
| `neotask api companies list [--limit <value>] [--cursor <value>] --json` | `api-companies-list` | none | `neotask:companies:read` | List companies authorized for this account. |
| `neotask api companies get --company-ref <value> --json` | `api-companies-get` | none | `neotask:companies:read` | Read an authorized company overview. |
| `neotask api companies agents --company-ref <value> [--limit <value>] [--cursor <value>] --json` | `api-companies-agents` | none | `neotask:companies:read` | List configured company agents. |
| `neotask api companies tasks --company-ref <value> [--limit <value>] [--cursor <value>] --json` | `api-companies-tasks` | none | `neotask:companies:read` | List company tasks from their durable owners. |
| `neotask api companies task --company-ref <value> --task-ref <value> --json` | `api-companies-task` | none | `neotask:companies:read` | Read one company task. |
| `neotask api companies runs --company-ref <value> [--limit <value>] [--cursor <value>] [--task-id <value>] --json` | `api-companies-runs` | none | `neotask:companies:read` | List durable company runs. |
| `neotask api companies run --company-ref <value> --run-ref <value> --json` | `api-companies-run` | none | `neotask:companies:read` | Read one company run. |
| `neotask api tasks list [--limit <value>] [--cursor <value>] --json` | `api-tasks-list` | none | `neotask:tasks:read` | List tasks through the public task owner. |
| `neotask api tasks create --idempotency-key <key> --json` | `api-tasks-create` | JSON request on stdin | `neotask:tasks:write` | Save a personal task from JSON stdin without starting it. |
| `neotask api runs create --idempotency-key <key> --json` | `api-runs-create` | JSON request on stdin | `neotask:runs:write` | Start a personal task run from JSON stdin through its authorized runner. |
| `neotask api runs get --run-id <value> --json` | `api-runs-get` | none | `neotask:runs:read` | Read one standalone task run. |
| `neotask api agents create --idempotency-key <key> --json` | `api-agents-create` | JSON request on stdin | `neotask:agents:write` | Create a managed Neotask agent from JSON stdin. |
| `neotask api agents get --agent-ref <value> --json` | `api-agents-get` | none | `neotask:agents:read` | Read one managed Neotask agent. |
| `neotask api agents update --agent-ref <value> --idempotency-key <key> --json` | `api-agents-update` | JSON request on stdin | `neotask:agents:write` | Update one managed Neotask agent from JSON stdin. |
| `neotask api agents archive --agent-ref <value> --idempotency-key <key> --json` | `api-agents-archive` | none | `neotask:agents:write` | Archive one managed Neotask agent. |
| `neotask api agents restore --agent-ref <value> --idempotency-key <key> --json` | `api-agents-restore` | none | `neotask:agents:write` | Restore one archived Neotask agent. |
| `neotask api agents tool-policy get --agent-ref <value> --json` | `api-agents-tool-policy-get` | none | `neotask:agents:read` | Read the effective tool policy for one managed agent. |
| `neotask api agents tool-policy update --agent-ref <value> --idempotency-key <key> --json` | `api-agents-tool-policy-update` | JSON request on stdin | `neotask:agents:configure` | Update one managed agent's tool policy from JSON stdin. |
| `neotask api conversations list [--limit <value>] [--cursor <value>] --json` | `api-conversations-list` | none | `neotask:conversations:read` | List managed-agent conversations in this tenant. |
| `neotask api conversations create --idempotency-key <key> --json` | `api-conversations-create` | JSON request on stdin | `neotask:conversations:write` | Create a managed-agent conversation from JSON stdin. |
| `neotask api conversations get --conversation-ref <value> --json` | `api-conversations-get` | none | `neotask:conversations:read` | Read one managed-agent conversation. |
| `neotask api conversations archive --conversation-ref <value> --idempotency-key <key> --json` | `api-conversations-archive` | none | `neotask:conversations:write` | Archive one managed-agent conversation. |
| `neotask api conversations restore --conversation-ref <value> --idempotency-key <key> --json` | `api-conversations-restore` | none | `neotask:conversations:write` | Restore one archived managed-agent conversation. |
| `neotask api conversations messages --conversation-ref <value> [--limit <value>] [--cursor <value>] --json` | `api-conversations-messages` | none | `neotask:conversations:read` | List the retained messages in one conversation. |
| `neotask api turns create --conversation-ref <value> --idempotency-key <key> --json` | `api-turns-create` | JSON request on stdin | `neotask:conversations:write` | Start a managed-agent turn from JSON stdin. |
| `neotask api turns get --conversation-ref <value> --turn-ref <value> --json` | `api-turns-get` | none | `neotask:conversations:read` | Read one managed-agent turn. |
| `neotask api turns events --conversation-ref <value> --turn-ref <value> [--limit <value>] [--cursor <value>] [--watch] --json` | `api-turns-events` | none | `neotask:conversations:read` | Read the durable events for one managed-agent turn. |
| `neotask api turns cancel --conversation-ref <value> --turn-ref <value> --idempotency-key <key> --json` | `api-turns-cancel` | none | `neotask:conversations:write` | Request cancellation for one managed-agent turn. |
| `neotask api runs events --run-ref <value> [--limit <value>] [--cursor <value>] [--watch] --json` | `api-runs-events` | none | `neotask:runs:read` | Read the durable events for one run. |
| `neotask api runs watch --run-ref <value> [--limit <value>] [--cursor <value>] [--watch] --json` | `api-runs-watch` | none | `neotask:runs:read` | Watch a run and resume after disconnects. |
| `neotask api usage --json` | `api-usage` | none | `neotask:usage:read` | Read usage and remaining allowance. |
| `neotask api mcp catalog --json` | `api-mcp-catalog` | none | `neotask:catalog:read` | Read the public MCP operation catalog. |
| `neotask api cli get --json` | `api-cli-get` | none | `neotask:catalog:read` | Read published CLI installation and capability metadata. |

## Managed chat

| Command | Command ID | Input | Scope | Purpose |
| --- | --- | --- | --- | --- |
| `neotask chat watch --conversation-ref <value> --turn-ref <value> [--limit <value>] [--cursor <value>] [--watch] --json` | `chat-watch` | none | `neotask:conversations:read` | Watch a managed-agent turn and resume after disconnects. |

## Tools, skills and models

| Command | Command ID | Input | Scope | Purpose |
| --- | --- | --- | --- | --- |
| `neotask tools effective --agent-ref <value> [--run-ref <value>] --json` | `tools-effective` | none | `neotask:catalog:read` | Read MCP permissions and selected-run tool availability, blockers, and setup actions. |
| `neotask skills list --json` | `skills-list` | none | `neotask:catalog:read` | List the effective skill catalog without exposing secrets. |
| `neotask models list --json` | `models-list` | none | `neotask:models:read` | List the effective model catalog, including Neotask Matrix when eligible. |
| `neotask models set --agent-ref <value> --idempotency-key <key> --json` | `models-set` | JSON request on stdin | `neotask:models:write` | Set a managed agent's model from JSON stdin. |
| `neotask skills configure --skill-id <value> --idempotency-key <key> --json` | `skills-configure` | JSON request on stdin | `neotask:skills:write` | Request a human configuration handoff; send field names, never secrets. |

## Integrations

| Command | Command ID | Input | Scope | Purpose |
| --- | --- | --- | --- | --- |
| `neotask integrations catalog --json` | `integrations-catalog` | none | `neotask:catalog:read` | List reviewed integration and MCP providers with current requirements. |
| `neotask integrations list [--scope-type <value>] [--scope-ref <value>] --json` | `integrations-list` | none | `neotask:integrations:read` | List safe integration connection metadata for an eligible scope. |
| `neotask integrations connect --idempotency-key <key> --json` | `integrations-connect` | JSON request on stdin | `neotask:integrations:write` | Start a reviewed integration authorization from JSON stdin. |
| `neotask integrations status --attempt-id <value> --json` | `integrations-status` | none | `neotask:integrations:read` | Read one integration authorization attempt and its safe human action. |
| `neotask integrations cancel --attempt-id <value> --idempotency-key <key> --json` | `integrations-cancel` | none | `neotask:integrations:write` | Cancel one pending integration authorization attempt. |
| `neotask integrations attach --connection-id <value> --idempotency-key <key> --json` | `integrations-attach` | JSON request on stdin | `neotask:integrations:write` | Attach a connected integration using a reviewed JSON target. |
| `neotask integrations detach --connection-id <value> --idempotency-key <key> --json` | `integrations-detach` | JSON request on stdin | `neotask:integrations:write` | Detach an integration from a reviewed JSON target. |
| `neotask integrations revoke --connection-id <value> --idempotency-key <key> --json` | `integrations-revoke` | JSON request on stdin | `neotask:integrations:security` | Request human-approved revocation of one integration connection. |

## Scheduled work, automations and autonomy goals

| Command | Command ID | Input | Scope | Purpose |
| --- | --- | --- | --- | --- |
| `neotask cron list [--limit <value>] [--cursor <value>] --json` | `cron-list` | none | `neotask:cron:read` | List cron jobs in this tenant. |
| `neotask cron create --idempotency-key <key> --json` | `cron-create` | JSON request on stdin | `neotask:cron:write` | Create a cron job from JSON stdin. |
| `neotask cron get --cron-job-ref <value> --json` | `cron-get` | none | `neotask:cron:read` | Read one cron job. |
| `neotask cron update --cron-job-ref <value> --idempotency-key <key> --json` | `cron-update` | JSON request on stdin | `neotask:cron:write` | Update one cron job from JSON stdin. |
| `neotask cron enable --cron-job-ref <value> --idempotency-key <key> --json` | `cron-enable` | none | `neotask:cron:write` | Enable one cron job. |
| `neotask cron disable --cron-job-ref <value> --idempotency-key <key> --json` | `cron-disable` | none | `neotask:cron:write` | Disable one cron job. |
| `neotask cron run --cron-job-ref <value> --idempotency-key <key> --json` | `cron-run` | none | `neotask:cron:run` | Start one cron job now. |
| `neotask cron history --cron-job-ref <value> [--limit <value>] [--cursor <value>] --json` | `cron-history` | none | `neotask:cron:read` | List runs for one cron job. |
| `neotask cron delete --cron-job-ref <value> --idempotency-key <key> --json` | `cron-delete` | none | `neotask:cron:write` | Delete one cron job. |
| `neotask automations catalog --json` | `automations-catalog` | none | `neotask:automations:read` | Read the Task Flow and automation catalog. |
| `neotask automations list [--limit <value>] [--cursor <value>] --json` | `automations-list` | none | `neotask:automations:read` | List Task Flows and automations in this tenant. |
| `neotask automations create --idempotency-key <key> --json` | `automations-create` | JSON request on stdin | `neotask:automations:write` | Create a Task Flow or automation from JSON stdin. |
| `neotask automations get --automation-ref <value> --json` | `automations-get` | none | `neotask:automations:read` | Read one Task Flow or automation. |
| `neotask automations update --automation-ref <value> --idempotency-key <key> --json` | `automations-update` | JSON request on stdin | `neotask:automations:write` | Update one Task Flow or automation from JSON stdin. |
| `neotask automations start --automation-ref <value> --idempotency-key <key> --json` | `automations-start` | JSON request on stdin | `neotask:automations:write` | Start one Task Flow or automation from JSON stdin. |
| `neotask automations status --automation-ref <value> --json` | `automations-status` | none | `neotask:automations:read` | Read the status of one Task Flow or automation. |
| `neotask automations pause --automation-ref <value> --idempotency-key <key> --json` | `automations-pause` | JSON request on stdin | `neotask:automations:write` | Pause one Task Flow or automation from JSON stdin. |
| `neotask automations resume --automation-ref <value> --idempotency-key <key> --json` | `automations-resume` | JSON request on stdin | `neotask:automations:write` | Resume one Task Flow or automation from JSON stdin. |
| `neotask automations cancel --automation-ref <value> --idempotency-key <key> --json` | `automations-cancel` | JSON request on stdin | `neotask:automations:write` | Cancel one Task Flow or automation from JSON stdin. |
| `neotask automations delete --automation-ref <value> --idempotency-key <key> --json` | `automations-delete` | JSON request on stdin | `neotask:automations:write` | Archive one Task Flow or automation from JSON stdin. |
| `neotask automations history --automation-ref <value> [--limit <value>] [--cursor <value>] --json` | `automations-history` | none | `neotask:automations:read` | List runs for one Task Flow or automation. |
| `neotask autonomy goals list [--limit <value>] [--cursor <value>] --json` | `autonomy-goals-list` | none | `neotask:autonomy:read` | List autonomy goals in this tenant. |
| `neotask autonomy goals create --idempotency-key <key> --json` | `autonomy-goals-create` | JSON request on stdin | `neotask:autonomy:write` | Create an autonomy goal from JSON stdin. |
| `neotask autonomy goals get --goal-ref <value> --json` | `autonomy-goals-get` | none | `neotask:autonomy:read` | Read one autonomy goal. |
| `neotask autonomy goals update --goal-ref <value> --idempotency-key <key> --json` | `autonomy-goals-update` | JSON request on stdin | `neotask:autonomy:write` | Update one autonomy goal from JSON stdin. |
| `neotask autonomy goals start --goal-ref <value> --idempotency-key <key> --json` | `autonomy-goals-start` | none | `neotask:autonomy:write` | Start one autonomy goal. |
| `neotask autonomy goals status --goal-ref <value> --json` | `autonomy-goals-status` | none | `neotask:autonomy:read` | Read the status of one autonomy goal. |
| `neotask autonomy goals steer --goal-ref <value> --idempotency-key <key> --json` | `autonomy-goals-steer` | JSON request on stdin | `neotask:autonomy:steer` | Steer one autonomy goal from JSON stdin. |
| `neotask autonomy goals pause --goal-ref <value> --idempotency-key <key> --json` | `autonomy-goals-pause` | none | `neotask:autonomy:write` | Pause one autonomy goal. |
| `neotask autonomy goals resume --goal-ref <value> --idempotency-key <key> --json` | `autonomy-goals-resume` | none | `neotask:autonomy:write` | Resume one autonomy goal. |
| `neotask autonomy goals cancel --goal-ref <value> --idempotency-key <key> --json` | `autonomy-goals-cancel` | none | `neotask:autonomy:write` | Cancel one autonomy goal. |
| `neotask autonomy goals history --goal-ref <value> [--limit <value>] [--cursor <value>] --json` | `autonomy-goals-history` | none | `neotask:autonomy:read` | List runs for one autonomy goal. |

## Approvals

| Command | Command ID | Input | Scope | Purpose |
| --- | --- | --- | --- | --- |
| `neotask approvals policy --agent-ref <value> --json` | `approvals-policy` | none | `neotask:approvals:read` | Read the effective approval policy for one managed agent. |
| `neotask approvals request-change --agent-ref <value> --idempotency-key <key> --json` | `approvals-request-change` | JSON request on stdin | `neotask:approvals:handoff` | Request a human settings review from JSON stdin. |
| `neotask approvals request-change --status --handoff-ref <ref> --agent-ref <value> --json` | `approvals-request-change-status` | none | `neotask:approvals:read` | Read one human settings-review handoff. |
| `neotask approvals request-change --cancel --handoff-ref <ref> --agent-ref <value> --idempotency-key <key> --json` | `approvals-request-change-cancel` | none | `neotask:approvals:handoff` | Cancel one human settings-review handoff. |
| `neotask approvals list [--limit <value>] [--cursor <value>] --json` | `approvals-list` | none | `neotask:approvals:read` | List approval requests visible to this agent. |
| `neotask approvals get --approval-ref <value> --json` | `approvals-get` | none | `neotask:approvals:read` | Read one approval request. |
| `neotask approvals decide --approval-ref <value> --idempotency-key <key> --json` | `approvals-decide` | JSON request on stdin | `neotask:approvals:decide` | Submit an offered request-local decision from JSON stdin. |
| `neotask approvals handoff --approval-ref <value> --idempotency-key <key> --json` | `approvals-handoff` | JSON request on stdin | `neotask:approvals:handoff` | Create a human approval handoff from JSON stdin. |
| `neotask approvals wait --handoff-ref <ref> --approval-ref <value> --json` | `approvals-wait` | none | `neotask:approvals:read` | Read one human approval handoff. |
| `neotask approvals cancel --handoff-ref <ref> --approval-ref <value> --idempotency-key <key> --json` | `approvals-cancel` | none | `neotask:approvals:handoff` | Cancel one human approval handoff. |
| `neotask approvals events --approval-ref <value> [--limit <value>] [--cursor <value>] [--watch] --json` | `approvals-events` | none | `neotask:approvals:read` | Read durable events for one approval request. |
| `neotask approvals wait --stream --approval-ref <value> [--limit <value>] [--cursor <value>] [--watch] --json` | `approvals-watch` | none | `neotask:approvals:read` | Watch approval events without making a decision. |

## Runner

| Command | Command ID | Input | Scope | Purpose |
| --- | --- | --- | --- | --- |
| `neotask runner status --json` | `runner-status` | none | none | Read safe local runner enrollment and heartbeat state. |
| `neotask runner doctor --json` | `runner-doctor` | none | none | Read safe local runner diagnostics without mutating services. |
| `neotask runner enroll [--new-review] --idempotency-key <key> --json` | `runner-enroll` | none | `neotask:runners:write` | Enroll this standalone runner after human approval. |
| `neotask runner list --json` | `runner-list` | none | `neotask:runners:read` | List enrolled runners for this tenant. |
| `neotask runner rotate --runner-id <value> --idempotency-key <key> --json` | `runner-rotate` | none | `neotask:runners:write` | Rotate an enrolled runner credential. |
| `neotask runner revoke --runner-id <value> --idempotency-key <key> --json` | `runner-revoke` | none | `neotask:runners:write` | Revoke an enrolled runner credential. |
| `neotask runner export [--scope-ref <value>] --json` | `runner-export` | none | none | Export local recovery after human confirmation. Use --scope-ref <companyId> for a company's pending Mail, including when no task recovery remains. Use --json for NDJSON. |
| `neotask runner health --json` | `runner-health` | none | none | Report local runner health without exposing credentials. |
| `neotask runner install --json` | `runner-install` | none | none | Install the standalone runner after typed human approval. |
| `neotask runner repair --json` | `runner-repair` | none | none | Repair a standalone runner only after owner and drain proofs pass. |
| `neotask runner pause --json` | `runner-pause` | none | none | Pause the standalone runner without interrupting active work. |
| `neotask runner resume --json` | `runner-resume` | none | none | Resume a paused standalone runner after owner verification. |
| `neotask runner update --json` | `runner-update` | none | none | Update the standalone runner only from a signed distribution. |
| `neotask runner uninstall --json` | `runner-uninstall` | none | none | Uninstall the standalone runner after a typed human approval. |

## Desktop downloads

| Command | Command ID | Input | Scope | Purpose |
| --- | --- | --- | --- | --- |
| `neotask desktop downloads --json` | `desktop-downloads` | none | `neotask:catalog:read` | List signed desktop download options for the current tenant. |

## Coordination Mail

| Command | Command ID | Input | Scope | Purpose |
| --- | --- | --- | --- | --- |
| `neotask mail status --json` | `mail-status` | none | `neotask:mail:read` | Read Coordination Mail access and effective operations. |
| `neotask mail agents list [--limit <value>] [--cursor <value>] --json` | `mail-identities-list` | none | `neotask:mail:read` | List Coordination Mail identities in the current company. |
| `neotask mail agents whois --json` | `mail-identity-self` | none | `neotask:mail:read` | Read the authenticated agent's Coordination Mail identity. |
| `neotask mail peers list [--limit <value>] [--cursor <value>] --json` | `mail-peers-list` | none | `neotask:mail:read` | List addressable Coordination Mail peers in the company. |
| `neotask mail peers get --peer-id <value> --json` | `mail-peer-get` | none | `neotask:mail:read` | Read one authorized Coordination Mail peer. |
| `neotask mail send --idempotency-key <key> --json` | `mail-send` | JSON request on stdin | `neotask:mail:write` | Send a company-scoped Coordination Mail message from JSON stdin. |
| `neotask mail reply --message-id <value> --idempotency-key <key> --json` | `mail-reply` | JSON request on stdin | `neotask:mail:write` | Reply to a company-scoped Coordination Mail message from JSON stdin. |
| `neotask mail inbox list [--limit <value>] [--cursor <value>] --json` | `mail-inbox-list` | none | `neotask:mail:read` | List the authenticated agent's Coordination Mail inbox. |
| `neotask mail inbox events [--limit <value>] [--cursor <value>] [--thread-id <value>] --json` | `mail-inbox-events` | none | `neotask:mail:read` | Read resumable Coordination Mail events from a cursor. |
| `neotask mail receipt --message-id <value> --json` | `mail-delivery-get` | none | `neotask:mail:read` | Read Coordination Mail delivery receipts for a message. |
| `neotask mail acknowledge --message-id <value> --idempotency-key <key> --json` | `mail-delivery-ack` | none | `neotask:mail:write` | Acknowledge a Coordination Mail delivery. |
| `neotask mail read --message-id <value> --idempotency-key <key> --json` | `mail-read` | none | `neotask:mail:write` | Mark a Coordination Mail message as read. |
| `neotask mail membership request --idempotency-key <key> --json` | `mail-membership-request` | JSON request on stdin | `neotask:mail:security` | Request Mail membership for the server-verified company. |
| `neotask mail membership join --idempotency-key <key> --json` | `mail-membership-join` | JSON request on stdin | `neotask:mail:security` | Join an approved Mail membership. |
| `neotask mail membership get --json` | `mail-membership-get` | none | `neotask:mail:read` | Read the current agent's Mail membership. |
| `neotask mail membership approve --membership-id <value> --idempotency-key <key> --json` | `mail-membership-approve` | JSON request on stdin | `neotask:mail:security` | Approve Mail membership with account-security authority. |
| `neotask mail membership suspend --membership-id <value> --idempotency-key <key> --json` | `mail-membership-suspend` | JSON request on stdin | `neotask:mail:security` | Suspend Mail membership with account-security authority. |
| `neotask mail membership leave --idempotency-key <key> --json` | `mail-membership-leave` | JSON request on stdin | `neotask:mail:security` | Leave the current Mail membership. |
| `neotask mail membership revoke --membership-id <value> --idempotency-key <key> --json` | `mail-membership-revoke` | JSON request on stdin | `neotask:mail:security` | Revoke Mail membership with account-security authority. |
| `neotask mail threads get --thread-id <value> [--limit <value>] [--cursor <value>] --json` | `mail-threads-get` | none | `neotask:mail:read` | Read a Mail thread the current agent may access. |
| `neotask mail threads search --json` | `mail-threads-search` | JSON request on stdin | `neotask:mail:read` | Search accessible Mail threads from JSON stdin. |
| `neotask mail threads summarize --thread-id <value> --json` | `mail-threads-summarize` | JSON request on stdin | `neotask:mail:read` | Request a summary of an accessible Mail thread. |
| `neotask mail contacts request --idempotency-key <key> --json` | `mail-contacts-request` | JSON request on stdin | `neotask:mail:contacts` | Request a Mail contact through the current company policy. |
| `neotask mail contacts respond --contact-id <value> --idempotency-key <key> --json` | `mail-contacts-respond` | JSON request on stdin | `neotask:mail:contacts` | Respond to a Mail contact request from JSON stdin. |
| `neotask mail contacts list [--limit <value>] [--cursor <value>] --json` | `mail-contacts-list` | none | `neotask:mail:contacts` | List permitted Mail contacts. |
| `neotask mail contacts policy --idempotency-key <key> --json` | `mail-contacts-policy` | JSON request on stdin | `neotask:mail:contacts` | Set Mail contact policy with account-security authority. |
| `neotask mail sectors list [--limit <value>] [--cursor <value>] --json` | `mail-sectors-list` | none | `neotask:mail:sectors` | List accessible Mail sectors. |
| `neotask mail sectors feed --sector-id <value> [--limit <value>] [--cursor <value>] --json` | `mail-sectors-feed` | none | `neotask:mail:sectors` | Read an accessible Mail sector feed. |
| `neotask mail sectors broadcast --sector-id <value> --idempotency-key <key> --json` | `mail-sectors-broadcast` | JSON request on stdin | `neotask:mail:sectors` | Broadcast to a permitted Mail sector from JSON stdin. |
| `neotask mail handoff --idempotency-key <key> --json` | `mail-handoff` | JSON request on stdin | `neotask:mail:handoffs` | Announce a Mail handoff from JSON stdin. |
| `neotask mail trace attach --handoff-ref <ref> --idempotency-key <key> --json` | `mail-trace-attach` | JSON request on stdin | `neotask:mail:handoffs` | Attach a trace to a permitted Mail handoff. |
| `neotask mail inbox wait --json` | `mail-inbox-wait` | JSON request on stdin | `neotask:mail:read` | Wait for Mail events using the server's finite-wait protocol. |
| `neotask mail events recover --json` | `mail-events-recover` | JSON request on stdin | `neotask:mail:read` | Recover Mail events from the server-issued cursor in JSON stdin. |
| `neotask mail export --idempotency-key <key> --json` | `mail-export` | JSON request on stdin | `neotask:mail:security` | Export private Mail data with account-security authority; protect the output. |
| `neotask mail erase --idempotency-key <key> --json` | `mail-erase` | JSON request on stdin | `neotask:mail:security` | Erase scoped Mail data with explicit confirmation and account-security authority. |
| `neotask mail access revoke --idempotency-key <key> --json` | `mail-access-revoke` | JSON request on stdin | `neotask:mail:security` | Revoke Mail access with account-security authority. |