# Terminal

**English** · [Português](pt-BR/cli.md)

The `acaua` binary is both the CLI and the daemon. This page describes the
commands that exist in the `0.1.0` skeleton. Detection is not implemented yet;
`analyze` validates input and returns a stub report.

```text
acaua <command> [options]

Commands:
  serve    Start the API and embedded UI
  analyze  Analyze a Zeek log directory
  doctor   Check the local environment
  update   Check or apply a CLI update
```

## `acaua serve`

Starts the HTTP API and the embedded UI.

```bash
acaua serve --bind 127.0.0.1:8787 --data-dir .acaua
```

| Option | Default | Meaning |
|---|---|---|
| `--bind` | `127.0.0.1:8787` | Listen address |
| `--data-dir` | `.acaua` | Store and runtime files |

The default bind is loopback-only. Exposing the daemon on a network requires a
reverse proxy with authentication. The API is documented in
[architecture.md](architecture.md#api).

## `acaua analyze`

```bash
acaua analyze /var/log/zeek/current
acaua analyze /var/log/zeek/current --json
```

The directory is validated and a report is printed. In this skeleton the parser
does not read Zeek records yet: `logs seen` and `records` are placeholders, and
`alerts` is empty. The command is still useful to check path handling and the
JSON shape.

The future parser will support `conn.log`, `dns.log`, `ssl.log` and the protocol
logs needed for identity and lateral-movement features. NetFlow/IPFIX is a
degraded mode; it is not equivalent to full protocol logs.

## `acaua doctor`

```bash
acaua doctor
acaua doctor --json
```

Prints checks for Zeek, `curl`, `tar`, the optional DuckDB feature and the
isolation of `research/`, followed by the status (`skeleton` in `0.1.0`). A
missing optional dependency is reported as `falha` but does not abort the
command. It does not send telemetry.

## `acaua update`

```bash
acaua update
acaua update --apply
```

`update` queries the latest Gitea Release, compares the tag with the running
version and prints whether an update exists. `--apply` downloads the archive for
the current platform, verifies its SHA-256, extracts it and replaces the
`acaua` binary.

Requirements: `curl` and `tar` on `PATH`, and a writable binary location. The
updater refuses to replace any executable whose name is not `acaua`; the desktop
app must be updated through its installer. A failed checksum leaves the current
binary untouched.

## Exit codes

| Code | Meaning |
|---|---|
| `0` | Success |
| `1` | Runtime error (invalid path, failed update, I/O error) |
| `2` | Invalid command-line usage (clap) |

## Environment

The skeleton has no required environment variable. `RUST_LOG` is reserved for
the future tracing layer. The default data directory is relative to the current
working directory; use an absolute path for a system service.

## Examples

```bash
# Local lab
acaua doctor
acaua analyze ./fixtures/zeek --json
acaua serve --bind 127.0.0.1:8787 --data-dir ./.acaua

# Container
docker run --rm -p 127.0.0.1:8787:8787 -v "$PWD/zeek:/data:ro" acaua serve
```

See [docker.md](docker.md) for the image and volume layout.