CLI

The Burrowee CLI is the client you connect from. It is a small binary (burrowee-cli) with two jobs: it pairs your machine with a gateway, and it acts as a local forwarder — it listens on a local TCP port, opens an encrypted carrier to a relay, completes the per-service end-to-end handshake with the gateway, and pipes your local connection through. Ordinary tools like ssh, curl, or your browser just talk plain TCP to localhost; the CLI owns the transport and the crypto.

You normally reach it as burrowee …: the bare burrowee command is the universal dispatcher, which forwards anything it doesn't recognize to burrowee-cli. Everything on these pages works the same whether you type burrowee connect or burrowee-cli connect.

Commands at a glance

Command	What it does
bootstrap <blob> <pin>	First-time setup: pair with a gateway
connect --svc <s> [flags]	Forward a local TCP port through a relay to a service
ssh --svc <s> [ssh args…]	Connect, then exec ssh against the forwarded port
daemon [--config <path>] [--socket <path>]	Run the long-running transport daemon (unix only)
relays <list|use|rm|gateway|pair|probe|ping>	Manage the relay axis of the gateway×relay matrix
gateways <list|use|rm|relays|bridges|resync>	Manage the gateway axis of the matrix
routes [--json] [--config <path>]	Print the whole gateway×relay matrix
doctor [--fix] [--yes]	Run read-only health checks (--fix: thin remediations)
service <install|status>	Install or inspect the managed daemon service
status	Summarize the service, daemon, and version state
restart	Restart the managed daemon service
update [flags]	Update to the latest release
login [--console <url>] [--label <str>]	Authorize this device with the console
download-url [--console <url>] <comp> <version> <artifact>	Resolve a gated release-download URL
uninstall [--purge]	Back up state + clear the socket (--purge deletes all)
version	Print the version

Run burrowee --help to see this list plus every flag in your terminal.

Signing in (login and download-url)

Almost everything above never talks to the cloud console — connect/ssh/relays/gateways reach your gateway only through a relay. Two verbs are the exception, and both exist to support gated release downloads (an install script fetching one specific artifact):

burrowee login [--console <url>] [--label <str>]

login creates (or reuses) a device identity key at ~/.burrowee/cli/device.key, opens the console's device-authorization page in your browser (and prints the URL, for headless machines), then polls for up to about 3 minutes waiting for you to approve the device. --label sets the name shown next to the pending device in the console (default: your hostname); --console points at a non-default console (default https://console.burrowee.com).

burrowee download-url [--console <url>] <component> <version> <artifact>

Once you're logged in, download-url signs a request with your device key and prints a presigned, time-limited download URL for the named release artifact to stdout. This is what an installer calls under the hood via $(...) when a release is gated — you won't normally run it by hand. Without a prior login, it fails with a pointer back to it.

Where the CLI keeps its state

Everything lives in one directory, ~/.burrowee/cli/, written by bootstrap. There are no environment variables to set.

File	Contents
config.json	The gateway×relay matrix: every paired gateway and relay, the edges between them (which relay reaches which gateway), and the global defaults. Everything a pairing needs is stored inline here — there are no sidecar files.
client.key	Your client's own identity key, generated on first use and shared across every paired gateway
device.key	Only present after login: this device's identity key, used to authorize gated release downloads

You rarely need to touch these by hand: connect and ssh read config.json automatically, and the relays/gateways verbs rewrite it for you. uninstall backs the whole directory up when you want it gone.

Where to next

1. Bootstrap — pair with your gateway.
2. Connect & SSH — open your first session.
3. Daemon & service — keep a warm connection running in the background.
4. Relays — manage multiple gateways and relays, and read the route matrix.
5. Updates — keep the CLI itself current.