CLI reference

Stillwater is primarily configured through environment variables and a TOML config file. Command-line flags exist for a small set of administrative one-shot operations that must run offline (before or without starting the server).

When to use flags vs environment variables: use environment variables (or the config file) for everything that applies to a running server instance. Use CLI flags when you need to perform a one-time administrative action -- like resetting a password -- without starting the full server.

Subcommands

Subcommands are passed as the first positional argument before any flags:

stillwater reset-credentials

The reset-credentials subcommand wipes all stored credentials and forces a fresh setup on next start. It clears provider API keys, connection credentials, user accounts, and sessions. Use this when the encryption key is lost or credentials need to be re-entered from scratch.

Usage

stillwater [flags]
stillwater <subcommand>

The table below is generated from internal/cli.Flags and the Subcommands slice in the same package. Do not edit it by hand -- run make generate-docs after changing a CLI flag or subcommand.

Flags

Flag	Type	Default	Description
--reset-password	boolean	false	Reset the admin user password and exit. Prompts interactively unless --new-password is also set.
--username	string	(none)	Username for --reset-password. When omitted, defaults to the sole admin user in the database.
--new-password	string	(none)	New password for --reset-password (INSECURE: visible in process listings; prefer the interactive prompt instead).
--lock-damage-dry-run	boolean	false	Report which locked fields the damage repair would restore, then exit without writing. For validating against a database copy.
--lock-damage-pre-guard-dry-run	boolean	false	Report which locked fields the pre-guard (unattributable) damage repair would restore, then exit without writing. Preview this before --lock-damage-pre-guard-repair.
--lock-damage-pre-guard-repair	boolean	false	Restore the pre-guard (unattributable) locked-field damage previewed by --lock-damage-pre-guard-dry-run, then exit. Requires --lock-damage-pre-guard-approve with the digest that preview printed. Runs once per database, opens the database READ-WRITE and RUNS MIGRATIONS, so stop the server first and back up. Preview first.
--lock-damage-pre-guard-approve	string	(none)	The approval digest printed by --lock-damage-pre-guard-dry-run. Required by --lock-damage-pre-guard-repair, which refuses to write if the candidate set no longer matches it.

Subcommands

Subcommands are passed as the first positional argument before any flags (e.g. stillwater reset-credentials).

Subcommand	Summary
reset-credentials	Wipe all stored credentials and force a fresh setup on next start.

reset-credentials

Clears all provider API keys, connection credentials, user accounts, and active sessions from the database. Use this when the encryption key is lost or credentials need to be re-entered from scratch. The application will prompt for initial setup on the next start. Requires database access (SW_DB_PATH or SW_CONFIG_PATH must resolve to the live database).