Commands
Every command in Cloakroom 0.9.0, from its own help text.
Commands you type
| Command | What it does | When to run it | First in the changelog |
|---|---|---|---|
cloakroom check [--mode {full,rules}] [file] | what would be masked, by kind; never prints the values | The same engine works on any file or pipe, which is handy for checking what it would do | early release |
cloakroom mask [--mode {full,rules}] [file] | the masked text, as Claude would see it | early release | |
cloakroom explain [--mode {full,rules}] [file] | every finding with the rule that found it, and what was skipped as safe | run cloakroom explain on the file to see which rule fired and add an allow entry. | early release |
cloakroom install {codex,gemini,git-hook} | add Cloakroom's hooks to another coding agent (Codex, Gemini CLI), or this repo's git hooks (git-hook) | 0.7.0 | |
cloakroom uninstall {codex,gemini,git-hook} | remove Cloakroom's hooks from another coding agent (Codex, Gemini CLI), or this repo's git hooks (git-hook) | 0.7.0 | |
cloakroom scan [dir] | list the commands this repo's agent config would run (Claude Code, Codex, Gemini CLI, VS Code tasks) and flag the npm-worm shape | 0.8.0 | |
cloakroom give [--list] [--forget NAME] [--hours HOURS] [name] | hand the agent a key without typing it into a prompt: you type it hidden here, the agent gets a placeholder, local files and commands get the real value | When the agent needs a key (a Stripe key, a database password), don't paste it into a prompt. | 0.9.0 |
cloakroom doctor [--retry-key] | check this machine: Python, vault key store, model, service | Every line should say ok, except service: down, which is normal before the first use. | 0.1.0 - 0.1.6 |
cloakroom dashboard [--print] | open the local dashboard in your browser (alerts, labels) | when it masks something harmless (a false alarm), mark it once in the dashboard and a rule stops it next time. | 0.2.0 |
cloakroom report [--since SINCE] [--format {csv,json}] [--verify] | counts per day and session from the event log (no values); --verify checks it | 0.6.0 | |
cloakroom update [--check] | update Cloakroom with the installer you used (uv, pipx or pip), keeping its optional parts, then set up its checks again for Codex, Gemini CLI and git commits where they were set up | Codex, Gemini CLI, git commits, or a cloakroom you installed yourself: run cloakroom update in a terminal. | 0.8.1 |
cloakroom exposure [--since SINCE] [--format {text,json}] | which keys and passwords your agents saw (Cloakroom's log and old agent transcripts), with a rotate list; hints only, never values | lists the keys and passwords your coding agents saw, so you know what to rotate. | 0.8.0 |
Rarely typed
| Command | What it does | When to run it | First in the changelog |
|---|---|---|---|
cloakroom export-onnx [--out OUT] [--if-no-gpu] | export the model to ONNX for fast CPU inference (needs cloakroom[torch] once) | Any other machine (Intel Mac, most Windows and Linux) | 0.2.0 |
cloakroom status | mode, service, vault sessions | early release | |
cloakroom serve | start the local service by hand; it normally starts on first use | 0.6.4 | |
cloakroom clean-history [--dry-run] [--yes] | find keys and passwords in old Claude Code transcripts and replace them | 0.6.0 | |
cloakroom hook [--agent {claude,codex,gemini}] {start,prompt,pre,post,scrub} | Claude Code hook entry point (reads hook JSON on stdin) | early release | |
cloakroom git-check {commit,push,checkout,merge} | the git hook's check (cloakroom install git-hook): keys and passwords a commit or push adds | early release |
Generated from cloakroom --help of release 0.9.0, the handbook and CHANGELOG.md.