System Configuration

The CLI keeps three separate kinds of local state. Most machines only ever need the first one, and /login creates it for you.

Logs go to ~/.sg/logs/safeguard.log. Set LOG_DIR to write them somewhere else.

Deployment config

A cloud user signed in with /login does not need this. It exists for on-premise and managed deployments where the machine has to be pointed at a specific tenant and auth server.

Initialize

Use the configuration file downloaded from your organization's settings page:

safeguard init --config-file ./safeguard-config.json

Or pass the values directly. --tenant, --client-id and --auth-server are required:

safeguard init \
  --tenant <tenant-id> \
  --client-id <client-id> \
  --auth-server https://api.safeguard.sh/auth \
  --api-server https://api.safeguard.sh

Other flags: --org-id, --org-name, --client-secret and --env (dev, staging or prod, default prod).

View, change, reset

# Print the current deployment config
safeguard config show

# Change one value
safeguard config set api_server https://safeguard.example.internal

# Delete this machine's deployment and auth configuration
safeguard config reset

config set accepts these keys and rejects anything else: tenant_id, client_id, auth_server, api_server, org_name, environment.

config show exits non-zero when no configuration exists yet, so a script can tell "not configured" apart from "configured".

Cloud or on-premise

safeguard mode           # show the current mode and where it came from
safeguard mode cloud     # switch to cloud
safeguard mode onprem    # switch to on-premise

Assistant and terminal settings

The interactive terminal and the assistant (safeguard agent, safeguard exec) read settings.json from up to three places. Higher in the list wins:

1. Command-line flags
2. <workspace>/.safeguard/settings.local.json, your own overrides, kept out of git
3. <workspace>/.safeguard/settings.json, shared with the repository
4. ~/.safeguard/settings.json, your user settings
5. Built-in defaults

A repository's own settings apply only after you run safeguard trust in it, and they can never set sign-in, provider or server URLs. Those stay in the deployment config.

To turn off the background update check from settings:

{ "update": { "check": false } }

Credential storage

The sign-in token is a file readable only by you (mode 0600) by default. SAFEGUARD_CREDENTIAL_STORE selects where it is kept:

Scanner tools

Scans run syft, grype and trivy. The interactive terminal downloads them the first time it runs, into tools/<os> next to the binary. safeguard scan looks for them in TOOLS_DIR first, then next to the binary, then on your PATH. safeguard update refreshes their vulnerability databases, and safeguard update --scanner grype --import <archive> loads a database you downloaded by hand, for a machine with no internet access.

Environment variables

There is no API-key variable and no variable that points the CLI at a config file. Sign in with /login or safeguard login instead.

Next Steps

• Learn CLI usage
• Troubleshoot issues
• View support matrix