Command reference

everycli <command> [options]

This reference describes everycli v0.8.2. Install or upgrade before using the top-level commands. These instructions use mainnet SN117, the default.

#Help and guided setup

Every command has its own options and example. Help needs no profile or credentials:

everycli help
everycli help deploy
everycli deploy --help
everycli setup --help

For a new miner, everycli setup --wallet my-miner --hotkey default --provider fal --max-hourly-usd 0.06 guides you through registration checks, hidden key prompts, initialization and a confirmed paid deployment. The provider and hourly ceiling are optional for this wizard; it prompts for a ceiling if omitted. It stops on an existing or uncertain deployment and does not activate or resume work automatically. See guided setup.

New setup is interactive only and rejects --yes and --json. After deployment it prints a numbered checklist; everycli setup --continue shows it again from the original local profile, without network calls or paid operations. The continuation mode supports --json without a terminal, but not --yes or new deployment options. It is not a live readiness check. For automated deployment, use the individual commands and explicitly approve any mutation that requires confirmation.

#Browser UI

For browser-based setup and management, run everycli ui. It opens a paired local interface on 127.0.0.1; --no-open prints the local URL instead and --port N selects a port. Keep the pairing URL private. Closing the browser or CLI does not stop cloud hosting. The UI checks keys before saving, preserves the current setup step and supports local worker labels. See browser setup.

#CLI updates

everycli update
everycli update --check
everycli update --json
everycli update --check --json
everycli auto-update
everycli auto-update --disable
everycli auto-update --enable
everycli auto-update --json
everycli --version

These update or inspect the local executable without accessing miner credentials or changing deployed workers. Official updates verify checksums and run a version probe before replacing the executable; the previous executable is retained as everycli.rollback. Source-built binaries are not silently replaced. The separate worker-update command discovers a compatible signed release and updates the existing worker. Use the original management profile.

auto-update shows the global preference and last background attempt. Eligible native installations check after successful interactive commands and when the UI starts, at most once every six hours, for the next invocation. Reopen everycli ui after an update. --disable opts out; --enable restores the default. EVERYCLI_DISABLE_AUTO_UPDATE=1 disables it for an environment. JSON/CI/non-interactive/help/version commands do not start background work. Settings are stored in ~/.config/everycli-updater/, not in miner profiles. No worker update, key activation, bid change or paid generation is performed.

update and update --check use readable text by default. Downloads show percentage and size when a total is available, otherwise downloaded size. Progress is written to stderr (one updating terminal line or plain milestones in redirected logs). --json suppresses progress and prints one structured result or error. See upgrade details, including the one-time behavior of older installed updaters.

#Identity and API keys

everycli reconnect --wallet NAME --hotkey NAME refreshes a saved profile using the same local hotkey after confirmation. --hotkey-file FILE is an alternative; omit signer options to use the saved path. It preserves API keys, labels and deployment records and never mutates a cloud VM or resumes work. Rerun to finish an interrupted local reconnect. Use --yes only after reviewing this operation when running without a terminal. See recovery.

If there is no local VM record and the bound app is absent from your Phala workspace, reconnect can ask for a separate hotkey-signed retirement confirmation. Only approve if you deleted the VM: a wrong-workspace token can also return 404. See deleted-workload recovery.

Public setup needs no invitation file or miner token. Existing managed deployments retain an optional legacy configuration import; it is not part of the public setup flow. init --secrets-file FILE optionally imports an owner-only dotenv file without shell expansion, preserving omitted saved keys.

Provider names: phala, fal, minimax, openrouter, bfl, replicate, google, runway, luma, elevenlabs, vivix, kling. Before initialization, providers shows release permission as Unknown (null in JSON), not denied. After initialization, it explains permissions from the signed release; a saved key alone does not enable models.

Optional billing-only names: fal-billing and openrouter-billing. These keys stay on the management device and are never deployed to workers.

register-hotkey, set-api-keys, remove-api-key and update --check print readable summaries by default. Use --json for structured output. Key prompts show saved/missing state; Enter keeps saved keys or skips missing ones. Terminal key saves validate format, not provider access. The browser UI performs free read-only checks before saving: rejected replacements leave the old key unchanged, and inconclusive checks show a warning rather than a false success. Neither path updates running workers automatically.

#Lifecycle and work

The hourly ceiling is a compute-rate limit, not a total budget. There is no automatic shutdown budget. Forced shutdown may interrupt paid work; deletion cannot be undone. A worker created on another computer can be deliberately deleted and replaced after signed ownership and exact target checks; this is not automatic restoration of its management journal. See replacement and operations.

#Health and status output

everycli health
everycli status
everycli health --json
everycli status --json

health is the all-green readiness checklist. PASS is green, WARN is amber and FAIL is red; unknown evidence is not a pass. It checks the local profile and release, coordinator, cloud workload, fresh heartbeat and attestation session, routing and support for active model offers. Run it from the original management profile for complete local and cloud checks. status is a table-based overview; a successful status read is not proof of readiness.

All green means the current readiness checks passed, not guaranteed traffic, provider funds, successful future generations or earnings. Historical accepted jobs are shown separately; zero active jobs is normal when idle. Neither command submits a paid generation, checks API balances or changes a deployed worker. Use balances separately for supported account balances. See how to read health.

Colors are enabled only for supported interactive terminals. NO_COLOR=1 disables them, and redirected output stays plain text. --json contains no table or ANSI colors. Existing status --json fields are preserved; health --json includes ok, checks and job activity when the profile can be loaded.

#Discount bids

everycli offers
everycli offer --model studio/fal/minimax/h3-max-turbo/text-to-video --discount-pct 10
everycli offer --model studio/fal/minimax/h3-max-turbo/text-to-video --withdraw

Choose a model currently offered to your deployment. Discounts range from 0 to 99.90%, with up to two decimal places. Invalid discounts are rejected before profile loading or network requests. The CLI previews the target and requires confirmation. A discount reduces your reward target, not provider bills; it is not guaranteed profit or traffic.

After a lost response, read back offers before retrying. Expired quotes and stale revisions are rejected. Only future assignments use a changed offer. See bidding economics.

#Batch offers

everycli offer-batch --models minimax/h3-max-turbo/text-to-video,minimax/h3-max/text-to-video --discount-pct 10

Choose actual IDs from everycli offers. One review binds the complete batch, price hashes and revisions. A conflict rejects every change. No uncertain submission is automatically retried; refresh offers before deciding to retry. Use --withdraw instead of --discount-pct to withdraw selected offers. Requires coordinator batch support, deployed on SN117. Does not resume mining.

#Balance snapshots

everycli balances
everycli balances --json
everycli balances --publish

Local reads support Fal, Phala credited funds, OpenRouter account credits, BFL, Runway and native Vivix W credits. W credits are not converted to USD or substituted with A credits. Unsupported providers and failed checks show an explicit status, not a false zero. Fal can use its generation key or an optional billing key; OpenRouter account credits may need a management key. Account balances may be shared across miners and must not be added together or treated as profit.

Run --publish only on the initialized profile holding provider/billing keys. It shares amounts, statuses and timestamps—not credentials—with your miner's authenticated coordinator view. A hotkey-only device can then read those owner-reported snapshots. They are marked stale after 15 minutes; refresh by publishing again. This manual publishing step installs no background synchronization and does not restart the worker. Compatible attested workers can separately report supported balances automatically; check the source and age. See balance setup.

#Global options

Mainnet's default profile is ~/.config/everycli-mainnet117. Use --state-dir for a different private profile; mainnet does not honor EVERYCLI_DIR. Unknown or misplaced flags fail closed.

#Exit codes

Without a profile, offers can show the signed public catalogue, while doctor and health explain the missing profile and setup steps rather than pretending a miner is ready. status, balances and earnings still require a configured profile. Current command errors use exit code 2; update scripts that only check for 1. health exits with 2 for both failed and unverified checks. A successful status read can still describe an offline or paused miner; use health as the readiness gate.

#Actionable diagnostics

An unregistered public-address lookup also prints a btcli registration example. Replace wallet/hotkey placeholders with the owning wallet names; the lookup does not submit a chain transaction. Read-only command help omits the unused --yes option.

--json retains structured diagnostics with ok, error, message and next, plus file or option when applicable. doctor also includes its check results. Errors omit credentials, provider request bodies and stack traces. Network failures are not automatically reported as missing registration, bad credentials or insufficient funds.

#Files and environment

Profiles use mode 0700. Symlinked sensitive paths are rejected. Never share or commit a profile, and preserve it when upgrading the CLI.

Miner commands reject DEBUG, PHALA_CLOUD_API_PREFIX and SSLKEYLOGFILE. The coordinator origin, signing key and chain identity are pinned. There is no supported option to bypass TLS or attestation. Network clients do not inherit proxy/custom-CA overrides.