Keeping the CLI current
Each deployment serves the CLI binaries built from its own commit, so the right version of clika-rt is whichever one that deployment publishes. self-update fetches it, and version tells you what you are running now.
version
clika-rt version
Prints the release version stamped into the binary when it was built. It talks to nothing, so it works with no credentials and no network.
$ clika-rt version
1.4.2
A binary you built yourself with a plain go build reports dev. That is not a cosmetic difference. A non-semantic version cannot be compared against the channel's published version, so self-update refuses to act on it.
self-update
clika-rt self-update [flags]
Reads the latest published version from the deployment's release channel at <base-url>/files/installation/cli, and if it is newer than the running binary, downloads the matching asset for your operating system and architecture, verifies it, and atomically replaces the binary in place. Re-run clika-rt afterwards; the process that performed the update is still the old one.
| Flag | Type | Default | Meaning |
|---|---|---|---|
--check | bool | false | Report the latest published version and stop. Nothing is downloaded or replaced. |
$ clika-rt self-update --check
running 1.4.2, latest 1.5.0
$ clika-rt self-update
downloading clika-rt-linux-amd64 1.5.0 ...
checksum ok
signature ok
updated to 1.5.0, re-run clika-rt
It needs a credential
The release channel is authenticated, exactly like the rest of the deployment. self-update sends the same credential every other command uses (flag, then environment, then profile) on every fetch it makes: the version file, the checksum list, the signature list and the binary itself. A CLI that has never logged in cannot update itself, and says so with a 401.
clika-rt login --base-url https://platform.clika.io --api-key
clika-rt self-update
On an on-premise deployment with a self-signed certificate, pass --insecure-tls. This is one place the CLI cannot decide for you whether a certificate authority is trustworthy:
clika-rt --profile onprem --insecure-tls self-update
What is verified
Two independent checks, both of which must pass:
- The checksum, taken from the channel's
checksums.txt. - A detached signature over the binary, verified against a public key embedded in the CLI at build time.
The signature is the one that matters, because whoever serves the binary also serves the checksum. A checksum alone proves the download was not corrupted, not that it came from CLIKA. A release build refuses an update that is unsigned, tampered with, or signed by a different key.
A binary you built locally embeds no trust key. It logs that signature enforcement is off and falls back to the checksum alone, which is fine for development and is not what you should be shipping to anyone.
Transport is HTTPS only, and a redirect that would downgrade the connection is refused.
Installing in the first place
self-update replaces an installed CLI; it cannot bootstrap one. For the first install, and for the per-platform asset names, see the install section of the CLI overview.
The device agent is a separate channel
Do not confuse updating the CLI with updating the device agent, the program that runs on each of your devices. They use the same download and verification machinery but are different artifacts on different schedules.
| Command | What it does |
|---|---|
install list --os <linux|windows|android> | Prints the agent install script for a platform, which is what you run on a new device to enroll it. |
install availability --os <linux|windows|android> | Reports whether an agent build is available for that platform. |
install enrollment-payload | The Android enrolment QR payload, which is what a phone scans. |
devices update-create <name-or-id> | Triggers an agent update on one device. |
devices batch-update | Triggers an agent update on many devices. |
agent-versions list | The agent versions this deployment publishes. |
agent-versions latest | The newest one. |
See devices for the update policy and history commands.
Full command reference
Every command below is generated from the deployment's own API description, so
one subcommand is exactly one platform operation. Each entry names the method,
the endpoint and the MCP tool name, so the same operation is
identifiable whichever surface you drive it from. Path parameters are positional
arguments, query parameters are flags, and a request body is --body or
--body-file. The hand-written commands, the ones that stream, propagate an
exit code, or hand your terminal to ssh, carry no operation line.
The prose above covers the commands most people reach for. This section is the complete surface, for when you need the flag you have not used before.
clika-rt self-update
clika-rt self-update
Fetches the latest clika-rt version from the orchestrator's release channel (<base-url>/files/installation/cli), verifies its checksum and signature, and atomically replaces this binary. Re-run clika-rt after a successful update.
clika-rt self-update [flags]
| Flag | Type | Default | Meaning |
|---|---|---|---|
--check | bool | false | only report the latest version, do not update |
clika-rt version
clika-rt version
Prints the release version stamped into this binary at build time. A plain go build leaves it dev, which disables self-update.
clika-rt version [flags]
clika-rt install
install has 3 subcommands.
clika-rt install availability
Agent install availability
clika-rt install availability [flags]
| Flag | Type | Default | Meaning |
|---|---|---|---|
--os | string | none | Platform to probe (android, linux, windows). Defaults via User-Agent. |
--raw | bool | false | print raw response without pretty-printing |
clika-rt install enrollment-payload
Android enrollment QR payload
clika-rt install enrollment-payload [flags]
| Flag | Type | Default | Meaning |
|---|---|---|---|
--raw | bool | false | print raw response without pretty-printing |
--token | string | none | Enrollment token (JWT) to embed in the payload |
clika-rt install list
Get agent install script
clika-rt install list [flags]
| Flag | Type | Default | Meaning |
|---|---|---|---|
--os | string | none | Override platform detection: linux, windows, android |
--raw | bool | false | print raw response without pretty-printing |
--token | string | none | Pre-fill enrollment token in the generated script |
Related
- CLI overview: the install channel, its assets, and the credentials it accepts.
- Authentication and profiles: getting a credential that the channel accepts.
- Devices: updating the agents on your fleet.