Docs · Reference

CLI reference

Every public command in the published build, with its flags, the platform it runs on, and what it tells you when it says no. Every flag here was read from the released binary.

How to read this#

nodeau <command> [arguments] [flags]
nodeau <command> --help        # always current, for the binary you have

A few conventions run through the whole page:

• Platform. Linux means Linux with an NVIDIA GPU. macOS means an Apple Silicon Mac. Both means the command works on either.
• Plan. Mentioned only where a plan actually decides something. Most commands need no account at all.
• Arguments in UPPER CASE are required, and [BRACKETS] are optional.

Namespaces#

Workload commands take --namespace or -n, and the default is nodeau-dev. Unless you've created others, it's the only one you'll ever use. Where it's offered, -A or --all-namespaces looks across all of them.

Exit codes#

There are five, on purpose. A script needs three answers without reading any text: did it work, was it called wrongly, and is it worth trying again?

The difference between 3 and 4 is the one that matters most. A script that retries should retry on 4 and never on 3.

Two commands use a narrower contract of their own. nodeau doctor returns 0 when everything passed or only warnings came back, 1 when something failed, and 2 when it was called wrongly. nodeau batch wait returns 0 when the job finished and 1 when it failed, was cancelled or the wait timed out.

--json#

Every command that prints a table also takes --json, and commands that only perform an action generally don't.

The JSON is a contract. Field names are part of the CLI's interface, and reason codes inside it keep their names. Use it rather than parsing the human output, which is written for people and will keep getting better.

--json never implies consent. A command that would change the machine still asks, or tells you to pass --yes.

Setting up#

nodeau install#

nodeau install [flags]

Check the machine, show a plan, and set up what's missing. Both, with a different body on each platform: see Linux and macOS.

On Linux it installs, when they're absent, the NVIDIA Container Toolkit, K3s, the NVIDIA device plugin, the per-device GPU driver and Nodeau's own control plane. When they're already there it adopts them, uses them exactly as it found them, and writes that down. That record is what makes uninstalling safe.

Your NVIDIA driver, Secure Boot, the bootloader, the kernel command line, your partitions and any Kubernetes cluster Nodeau didn't create all stay exactly as they are.

Running it again is safe. It re-checks everything, skips what's done, keeps your API key, and never re-decides who owns a component.

When it stops. A blocking preflight check exits 3 and names the check. On Linux, a missing or broken NVIDIA driver stops the install so you can fix it your way first. With no terminal attached and no --yes, it asks for --yes rather than acting unasked.

nodeau join#

nodeau join CODE [flags]

Add this machine to an existing fleet as a worker. Linux.

Get the code from the machine that already runs Nodeau with nodeau fleet invite, which checks your plan's machine limit before it creates one. This machine needs an NVIDIA GPU with a working driver, and it has to be able to reach the other machine on your network. If it already runs a cluster of its own, Nodeau stops and tells you, and your cluster stays as it is.

A Mac runs Nodeau standalone, so this one is for Linux machines. See add and run machines.

nodeau doctor#

nodeau doctor [flags]

Diagnose this installation and explain anything that needs attention. Both. Every check only reads. Doctor never installs, configures, mounts, starts or stops anything.

It looks at two things. The host: can this machine run Nodeau at all? And the installation: is Nodeau itself working? That covers its control plane, the agent on each machine, whether each machine's GPU report is fresh enough to schedule against, whether the models on disk still verify, and what your services and batch jobs are doing.

Exit 0 when everything passed or only warnings came back, 1 when something failed, 2 when it was called wrongly. Every code is listed under health and alerts.

nodeau environment#

nodeau environment [--json]        # alias: nodeau env

Print what Nodeau has detected about this machine: operating system, processor, memory, GPUs, network, and which disks Nodeau may write to and which belong to another operating system. Both. It only reads.

nodeau version#

nodeau version [--json]

The build identity of this binary: version, commit, build date, channel, Go version and platform. Both.

nodeau update#

nodeau update [flags]

Compare this machine's Nodeau with the published release channel. Both. By default it only looks.

If a cluster is reachable it also shows what each machine in your fleet is running. Nodeau updates only when you ask it to, and a machine that can't reach the internet keeps working exactly as it is. See updates and release channels.

nodeau uninstall#

nodeau uninstall [flags]

Remove Nodeau's own components and keep everything Nodeau didn't install. Both. The whole plan is printed before anything happens, and every option that deletes something is named for exactly what it deletes. See uninstalling.

Each flag says what it removes. There's no vague "remove more" switch.

Running models#

nodeau quickstart#

nodeau quickstart [flags]

Download a model, start it, and print a curl command that works. Linux. Everything it does is one of the other commands, stitched together. See your first model. On a Mac, nodeau run does the same job.

nodeau run#

nodeau run MODEL|SERVICE [flags]

Start a model on one of your GPUs and print how to use it. Both. This is the everyday command on Linux and macOS alike.

Give it a model id and Nodeau picks a GPU that can hold it, starts it, waits for it to load and prints an endpoint. Give it something that's already running and it just brings the local endpoint back. If the model isn't downloaded yet, it tells you the size and the licence and asks first.

The endpoint binds 127.0.0.1. By default it installs a user service, so it keeps running after you close the terminal. --foreground runs it right here instead.

nodeau run qwen3.5-4b-q4km                       # a catalog model
nodeau run qwen-local                            # bring an existing one's endpoint back
nodeau run my-model --task embed --port 8081     # an imported model, as an embedder

Exit codes. 0 running, with an endpoint. 2 the model or service name wasn't recognised. 3 refused, and the answer stays the same until something changes. 4 still starting, and ran out of time to wait.

nodeau ps#

nodeau ps [flags]          # alias: nodeau list

Every workload using a GPU, models you're serving and batch jobs alike, with where each one is and what it's doing. Both.

nodeau status#

nodeau status [flags]

The state of every Nodeau workload and local endpoint. Linux. On a Mac, nodeau ps gives you the same picture.

Nothing here comes from a cache. Workload state comes from the cluster, endpoint state from the service manager, and "answering" from a real connection to the port, so a stale record can't make it report something that isn't true.

Flags: --all-namespaces/-A, --namespace/-n, --json.

nodeau stop#

nodeau stop SERVICE [flags]

Stop serving a model locally. Both. By default this stops the local endpoint and leaves the model loaded on its GPU, so starting again is instant.

Your downloaded model files stay put whichever you choose.

A model started from your account at app.nodeau.ai is stopped through your account: --workload asks Nodeau Cloud to stop the copy this machine runs and waits until it has, so the next sync doesn't start it again. With --local, or when this machine can't reach Nodeau Cloud, the model stops here right away and your account starts it again at the next sync, and the command says so.

nodeau restart#

nodeau restart SERVICE [flags]

Restart the model behind a service so it re-reads its configuration. Linux.

The model server reads its configuration, including your API key, once, when it starts. A regenerated key or a change to a mounted file takes effect when the process restarts, and this is how you restart it. Nothing is reconfigured and nothing is deleted except the running pod, which Kubernetes recreates straight away. Expect a short gap while the model reloads into VRAM.

Flags: --wait (default true), --timeout (default 10m), --namespace/-n.

nodeau logs#

nodeau logs WORKLOAD [flags]

Read what a workload is printing, no kubectl needed. Both.

nodeau logs qwen-local                     # the model server's own output
nodeau logs my-batch                       # a batch job's worker
nodeau logs --system nodeau-controller     # one of Nodeau's own components (Linux)

Prompts, completions and batch records are never written to a log, so they'll never show up here.

nodeau dashboard#

nodeau dashboard [flags]

Serve a local dashboard showing hardware, models, running services and your plan. Both. It binds loopback only and asks for a token, which is printed in the URL and swapped for a session cookie the first time you open it.

The page is compiled into the binary, so there's nothing to install or download, and it works with no internet connection at all. It's read-only apart from one action: it can stop a batch job. The same server also serves the Playground.

Flags: --addr (default 127.0.0.1:7371, must be loopback), --cache-dir.

nodeau playground#

nodeau playground [WORKLOAD] [flags]

Open the Playground in your browser to talk to the models running here: streamed chat, questions about an image, embeddings, reranking and side by side comparison. Both. Name a running workload to open it with that model chosen. It's served by the same loopback server as nodeau dashboard, so if the dashboard is already running it prints the Playground's address on it. Your prompts go only to your own models, and Nodeau attaches the API key itself.

Flags: --addr (default 127.0.0.1:7371, must be loopback), --cache-dir, --namespace/-n (for a name two running workloads share).

nodeau endpoint serve#

nodeau endpoint serve [flags]

Run the loopback reverse proxy in the foreground until you stop it. Both. This is what the generated user service runs. Run it directly to see exactly why an endpoint won't start.

Flags: --service, --namespace, --model, --port (default 8080, 0 lets the OS choose), --upstream (resolved from the service when you leave it out).

nodeau service#

nodeau service get [NAME] [flags]     # alias: nodeau svc
nodeau service explain NAME [flags]
nodeau service apply -f FILE [flags]

Work with GPUService objects directly. Linux. These talk to the Kubernetes API with your kubeconfig and your permissions.

• get lists services, or shows one. Flags: --all-namespaces/-A, --namespace/-n, --json.
• explain shows the reasoning behind Nodeau's decision, including the VRAM arithmetic. Everything it prints comes from the object's status, written by the controller at the moment it decided. It reads that record rather than redoing the sums, so there's only ever one answer.
• apply creates or updates a service from a YAML manifest (-f - reads stdin). The controller admits the workload a moment later and records its decision in status, so follow it with get or explain.

nodeau placement explain#

nodeau placement explain WORKLOAD [flags]

Why a workload is where it is, and what each alternative would have cost. Linux. Flags: --namespace/-n, --json. See placement.

Models#

nodeau model and nodeau models are the same command.

nodeau model list#

nodeau model list [flags]          # alias: ls

Models Nodeau can serve, and what's downloaded. Both. It shows the curated catalog with each model's role, hardware rung, size and status, then your own imported models in a list of their own, because they're a different kind of trust.

Flags: --all (include deprecated and legacy models), --cache-dir, --namespace/-n (show custom models from one namespace), --json.

nodeau model info#

nodeau model info MODEL [flags]

Licence, provenance and the configurations that have been measured. Both.

The measurements are the interesting part, and an empty list is a real answer: it means every decision about this model is worked out from its shape rather than observed. Each row also says whether its figure counted the whole device or one process, because those are different quantities.

Flags: --cache-dir, --namespace/-n, --json.

nodeau model install#

nodeau model install MODEL [flags]

Download a model from its publisher and verify it. Both.

Nothing downloads until you agree: the size, licence and source come first. An interrupted download resumes. A file that fails verification is moved aside, so the evidence survives and the next run can't mistake it for a good copy.

Flags: --consent (agree without being asked, for scripts), --verify (re-verify what's already downloaded and fetch nothing), --cache-dir.

nodeau model verify#

nodeau model verify MODEL [flags]

Read the whole file and recompute its SHA-256. Both.

Having a file and having the right file are two different things. This is worth running on a machine that's been power-cycled or had storage trouble, because a corrupted model can load, answer fluently and still look healthy. It checks this machine. Each machine also verifies its own copy continuously and publishes the result, which nodeau model status shows.

Flags: --cache-dir, --namespace/-n.

nodeau model status#

nodeau model status [MODEL] [flags]

The fleet's view of models: which machine holds which weights, whether each machine's bytes have been checked, which GPUs are big enough, and what's using them. Linux.

The GPU columns answer is this card big enough, judged as if the card were free of Nodeau workloads. Whether it's free right now is a separate column, because "too small" and "busy" call for completely different next steps.

Flags: --context-size (default 4096), --parallel (default 1), --namespace/-n, --cache-dir, --json.

nodeau model remove#

nodeau model remove MODEL [flags]      # alias: rm

Delete the weights for one model, on this machine only. Both.

Nodeau first checks that no service references the model, and names the one that does if there is one. When it can't reach the cluster to check, it stops and says so, because not knowing whether something is in use is a reason to wait. Only that one model's file is touched.

Flags: --yes, --namespace/-n, --cache-dir.

nodeau model copies#

nodeau model copies [MODEL]      # alias: models copies

Every copy of a model a machine in your fleet has been asked to keep: the model, the machine, whether that machine has verified every file, its size, and who asked, you or a workload's recovery. Linux fleets.

Flags: --json.

nodeau model copy#

nodeau model copy MODEL --to MACHINE [flags]      # alias: models copy

Ask a machine to keep a verified copy of a catalog model. That machine fetches the files from the model's publisher into its own model cache and checks every SHA-256 itself; the copy is ready once it has. Linux fleets, Home Pro and Business. A model you imported is never fetched: place the same file there with nodeau model import <file> --no-register. See model copies.

nodeau model import#

nodeau model import PATH --alias NAME [flags]

Bring your own GGUF model into Nodeau. Linux. See bring your own model.

Use --alias or --no-register, one or the other.

nodeau model qualify#

nodeau model qualify MODEL [flags]

Find out, on your own hardware, what a custom model can really do. Linux.

Qualification uses free capacity and leaves healthy workloads running. If your cards are busy, admission says so and the run reports it straight away.

Batch inference#

Linux, with Home Pro or Business. On a Mac these commands explain that batch runs on Linux and exit with the refused code 3. See batch inference.

nodeau batch submit#

nodeau batch submit FILE --model MODEL [flags]

Submit a JSONL file of requests.

--workers and --gpus answer different questions, and mixing them up costs you throughput without any error to warn you. See workers and GPUs.

nodeau batch status#

nodeau batch status NAME [flags]

One batch job in detail, including how many workers are running and how many are waiting for a card. Flags: --namespace/-n, --json.

nodeau batch list#

nodeau batch list [flags]          # alias: ls

Flags: --all-namespaces/-A, --namespace/-n, --json.

nodeau batch wait#

nodeau batch wait NAME [flags]

Block until the job reaches a final state, then exit. The exit code is the outcome, so it chains nicely in a shell:

nodeau batch wait my-job && nodeau batch results my-job

0 the job finished. 1 it failed, was cancelled, or the wait timed out. Flags: --timeout (default 24h), --namespace/-n.

nodeau batch results#

nodeau batch results NAME [flags]

Download the results, one JSON object per line. They're written to a file by default. These are your model's answers, and a file keeps them out of your terminal's scrollback, your screenshots and any issue you paste.

Flags: --output/-o (default NAME-results.jsonl), --stdout, --namespace/-n.

nodeau batch cancel#

nodeau batch cancel NAME [flags]

Stop a batch job. Results it has already produced are kept and stay available. Nodeau waits for the model server to actually exit before it releases the GPU, so a cancelled job can take a few seconds to finish stopping. Flags: --namespace/-n.

Your machines#

nodeau fleet invite#

nodeau fleet invite [flags]

Print a code that adds another machine to your fleet. Linux. Your plan's machine limit is checked before the code is created: Home is one machine, Home Pro up to three, and Business as many as you need.

The code is a credential for as long as it lives, so paste it into the other machine's terminal rather than a chat log. It expires on its own whether or not anyone uses it, and a machine that has joined never needs it again.

Flags: --expires-in (default 15m), --address (the address the new machine should use to reach this one; defaults to this machine's LAN address).

nodeau fleet list#

nodeau fleet list [--json]         # alias: ls

Every machine in your fleet and the GPUs in it. Linux.

nodeau fleet remove#

nodeau fleet remove MACHINE [flags]

Take a machine out of the fleet for good, because it's retired, failed or been sold. Linux.

Nodeau removes its cluster membership, the storage and identity it created for it, and the credential that let it reconnect, then frees the plan slot it was using. If workloads are placed on the machine, Nodeau lists them and waits for you: stop them first, or pass --force if the machine is already gone.

The machine's own installation is left as it is. Rejoining afterwards takes a fresh invitation, and that's deliberate: a removed machine can't reappear on its own.

Flags: --dry-run, --force, --yes, --json.

nodeau fleet connect#

nodeau fleet connect [flags]

Let Nodeau Cloud show you this fleet from anywhere. Linux. It needs an account (nodeau login).

Your machines reach out to Nodeau Cloud, and every connection starts on your side. This command opens no inbound port, callback or remote shell. What travels is what someone running machines needs to see: which machines exist, what's plugged into them, what's running, and whether anything needs attention. What you compute stays on your hardware.

Inference carries on whether or not the connector is running.

Flags: --yes, --no-linger (skip the offer to keep the connector running when you're logged out).

nodeau fleet disconnect#

nodeau fleet disconnect

Stop and remove the fleet connector. Linux. Everything else carries on, and this machine stays linked to your account for its plan. nodeau logout is the command that unlinks it.

nodeau fleet status#

nodeau fleet status [--json]

Whether this fleet is reporting to Nodeau Cloud. Linux.

nodeau fleet upgrade plan#

nodeau fleet upgrade plan [flags]

See what moving your fleet to a Nodeau release would involve, before any machine moves. Linux. It reads and changes nothing. nodeau fleet upgrade on its own prints help for all five subcommands.

The target is resolved once, to a version, the commit it was built from, and the digest of every artifact it names, so the plan describes one specific build. For each machine you get where it would go, whether it's ready, waiting for your maintenance window, already up to date, or blocked (with the reason in words and a code), the order the machines would go in, and what it would mean for the workloads running there. The machine that runs your control plane goes last.

nodeau fleet upgrade plan                          # the channel's current release
nodeau fleet upgrade plan --to v0.15.0-beta.7      # one exact version
nodeau fleet upgrade plan --machine garage --json  # one machine, for a script

Exit 0 whenever a plan was worked out, whatever it says about each machine, and 1 when one couldn't be, for example with no network to read the release from. With --json, even a failure comes back as JSON, with an error field, so a script always has something to parse.

The plan uses the maintenance window and channel policy Nodeau Cloud holds for your fleet, and its notes say whether it could see them: a policy it couldn't see is reported as unknown and holds every machine that would move. In --json, each machine's key is its node UID (it was the name before v0.15.0-beta.7) and name is its name. See upgrading a fleet.

nodeau fleet upgrade apply#

nodeau fleet upgrade apply [flags]

Show the plan, ask, then ask Nodeau Cloud to authorise that exact plan. Linux, with Home Pro or Business and the fleet connected to your account. Nodeau Cloud works out its own plan and refuses if the two differ, so what you approve is what you saw. Your machines then upgrade one at a time, workers first and the control plane last, each checked on what it reports running before the next. Workloads on a machine being upgraded stop and start again on that machine.

One rollout runs at a time: cancel an unfinished one before approving another.

nodeau fleet upgrade status#

nodeau fleet upgrade status [--json]

The rollout Nodeau Cloud has authorised for this fleet, as it last told this installation, beside this installation's own record of the step it ran. Linux. What was asked for and what a machine reports are shown separately: a step is complete only when its machine reports running the target.

nodeau fleet upgrade cancel#

nodeau fleet upgrade cancel [rollout-id]

Stop a rollout before its next machine. Linux. Before any machine has started, the rollout ends at once. A machine already upgrading finishes or fails first, and no machine starts after it. With no id, it acts on the fleet's current rollout.

nodeau fleet upgrade resume#

nodeau fleet upgrade resume [rollout-id]

Retry the machine a held rollout stopped on. Linux. The machine is tried again as a new attempt of the same step, and every check it has to pass first is run again. With no id, it acts on the fleet's current rollout.

nodeau scheduling mode#

nodeau scheduling mode [efficiency|balanced|performance] [flags]

Show or set how Nodeau chooses where work runs. Linux. With no argument it shows the current mode. Flags: --node <name> (set it for one machine instead of the whole fleet), --json.

nodeau scheduling constraints#

nodeau scheduling constraints [flags]

Show or set the hard limits Nodeau must respect on a machine. Linux.

Flags: --node, --power-budget <W>, --idle-watts <W>, --max-accelerators <n>, --deny-device <uuid>, --allow-device <uuid>, --clear, --json. See hard constraints.

nodeau scheduling drain / undrain#

nodeau scheduling drain   --node MACHINE
nodeau scheduling undrain --node MACHINE

Stop placing new work on a machine while everything already there keeps running, and later put it back into service. Linux. Undraining leaves every workload where it is now.

nodeau recovery set#

nodeau recovery set WORKLOAD automatic|never [flags]

Choose what a workload does when its machine stops answering: never (the default) waits for that machine; automatic starts it on another of your machines that can hold it, after the delay you choose, from a verified copy of its model kept ready there. Nothing that is running restarts. Linux fleets, Home Pro and Business. See recovery.

nodeau recovery status#

nodeau recovery status [WORKLOAD] [flags]

Each workload's recovery choice, how many machines hold a verified copy of its model, and its last recovery: held or recovering, with the machine's own sentence about which machine, since when, and what happens next.

Flags: --namespace/-n, --json.

nodeau governance#

nodeau governance [flags]

Show or set your organisation's limits on this fleet. Linux. On a Mac it explains that limits belong to a fleet and exits 3. With no flags it shows the current policy.

Lowering a quota leaves everything already running exactly as it is. A quota decides what may start. See limits and policies.

nodeau health#

nodeau health [--json]
nodeau health history [flags]

How each machine is doing (processor, memory, storage and network) and anything that needs attention. Linux. On a Mac both exit 3 and say why.

history prints one machine's recorded telemetry. Flags: --machine, --since (default 1h), --resolution, --metric (repeatable), --device (repeatable), --max-points, --json.

Storage is reported as how full a filesystem is. See health and alerts.

nodeau power#

nodeau power [--json]
nodeau power set --device UUID --limit WATTS
nodeau power set --device UUID --clear

Show what each GPU is allowed to draw and what it's drawing, and set one card's software power limit. Linux. set is local: it applies to a card in the machine you run it on and never crosses the network.

It sets a software power limit and nothing else: no firmware, no VBIOS, no voltage, no clocks. See power limits and budgets.

Keys, accounts and plans#

nodeau auth show#

nodeau auth show [--quiet]

Print the local API key, creating one the first time. Both.

It's written for substitution, so the bare key is the only thing on stdout and anything explanatory goes to stderr:

export NODEAU_API_KEY="$(nodeau auth show)"

--quiet/-q prints only the key, with no notices on stderr.

nodeau auth token#

nodeau auth token SERVICE [flags]

Print the token to use against one service's endpoint. Linux. Where auth show prints your local key, this checks which credential the service actually enforces, and tells you when it isn't one Nodeau can print, instead of handing you a key that would be rejected.

Flags: --export (print a shell export line you can eval), --namespace/-n.

nodeau auth rotate#

nodeau auth rotate [--yes]

Generate a new local API key and discard the current one. Both. Every saved curl command, script and SDK configuration using the old key stops working straight away, which is the point of rotating. The running endpoint keeps going without a restart: it forwards whatever Authorization header it receives and never reads the key file itself.

nodeau auth publish#

nodeau auth publish SERVICE [flags]

Make the local API key the one a service enforces. Linux. This fixes an endpoint that rejects the key auth show prints, which happens when the service references a Secret Nodeau didn't publish.

The model server reads its key file once at startup, so the workload restarts. Expect a short gap while the model reloads into VRAM. Flags: --yes, --namespace/-n.

nodeau login#

nodeau login [flags]

Link this installation to a Nodeau account. Both. It's optional: Nodeau runs completely without one.

You never paste a token. Nodeau shows a short code, you approve it in a browser where you're already signed in, and this machine receives its own credential directly.

nodeau logout#

nodeau logout [--json]

Remove this machine's account link. Both. Everything keeps running: inference, batch and every local capability carry on, on the free Home plan. It's a local operation, so the installation stays listed in your Nodeau account until you remove it there.

nodeau plan show#

nodeau plan show [--json]          # alias: nodeau entitlement show

The current plan, its capabilities and its limits. Both.

nodeau plan refresh#

nodeau plan refresh [--json]

Fetch a current entitlement from Nodeau Cloud. Both. Run it after changing plan, and to renew before the current one expires.

A failed refresh changes nothing. The entitlement already on the machine keeps working until it expires, and an installation with no entitlement at all runs the free Home plan with every safety and integrity check in place.

nodeau plan set#

nodeau plan set --from-file FILE      # or - for stdin

Install a signed entitlement token. Both. Most people want nodeau login instead. The token is read from a file or stdin, never from a command-line argument, so it stays out of your shell history and the process list.

nodeau plan export / import#

nodeau plan export [FILE] [-o FILE]
nodeau plan import FILE [--json]

Carry an entitlement to a machine with no internet. Both.

The entitlement names the installation and organisation it was issued for, so the file works on the machine it belongs to and nowhere else. An imported entitlement goes through exactly the same checks as a fetched one, so it's never less verified. There's nothing secret in the file.

Support#

nodeau support bundle#

nodeau support bundle [flags]

Write a sanitised diagnostic archive to the current directory. Both. The bundle stays on your disk until you choose to send it. Flags: --output/-o, --namespace/-n.

See support bundles for exactly what goes in and what stays out.

Also in the binary#

nodeau completion generates a shell completion script. It's standard Cobra behaviour.

Two commands are hidden because they're plumbing rather than part of the everyday vocabulary: nodeau fleet refresh-connector, which the installer calls for you, and, on macOS, nodeau native, a low-level diagnostic that skips the catalog, consent and the endpoint. The ordinary commands do the same work on both platforms, and they're the ones to use.

These docs describe the current release, the beta channel. Spotted something wrong or missing? Tell us. A report from a machine we have never seen is the most useful thing we get.