CLI 참조 | Synapse

출력과 종료 코드

모든 명령에 해당하는 내용입니다 (영어 원문).

Every command prints English text. With --json it prints the envelope instead: {"ok": true, "data": ..., "warnings": [...]} or {"ok": false, "error": {...}}. Errors print two lines on stderr: the message, then reason: .... Exit codes: 0 done, 1 refused or failed, 2 usage, 130 cancelled.

명령 목록

연구자가 쓰는 명령

사용 중인 계정이면 누구나 쓸 수 있는 명령입니다. 내 작업공간과 내 결과, 내 계정만 다룹니다.

`synapse approval file`

Preview file of a requested image (used by the gateway).

synapse approval file [-h] approval index

Who: any enabled account
Flags: read-only
Result: ApprovalFile
When it fails: Could not open the preview file.

argument	flag	kind	marks	help
`approval`	positional	approval	required	Request ID, such as a-0031
`index`	positional	int	required	Preview number

`synapse approval ls`

Requests made from inside workspaces.

synapse approval ls [-h] [--workspace WORKSPACE] [--all] [--owner OWNER]

Who: any enabled account
Flags: read-only, inside a workspace
Result: list of ApprovalRow
When it fails: Could not list the requests.

argument	flag	kind	marks	help
`workspace`	`--workspace`	workspace	may be left out inside a workspace	Workspace ID (default inside a workspace: this one)
`all`	`--all`	flag	-	Closed requests too
`owner`	`--owner`	user	admins only	Owner account ID (admins: any account)

`synapse approval reject`

Reject a request.

synapse approval reject [-h] approval

Who: any enabled account
Result: ApprovalView
Errors: already_decided, busy
When it fails: Could not reject the request.

argument	flag	kind	marks	help
`approval`	positional	approval	required	Request ID, such as a-0031

`synapse approval show`

One request, with what it changes (recomputed now).

synapse approval show [-h] approval

Who: any enabled account
Flags: read-only, inside a workspace
Result: ApprovalView
MCP tool: request_status (Request status)
When it fails: Could not show the request.

argument	flag	kind	marks	help
`approval`	positional	approval	required	Request ID, such as a-0031

`synapse role ls`

Roles.

synapse role ls [-h]

Who: any enabled account
Flags: read-only
Result: list of Role
When it fails: Could not list the roles.

`synapse runs`

Commands I ran from the portal, the API or a workspace.

synapse runs [-h] [--limit LIMIT] [--user USER]

Who: any enabled account
Flags: read-only
Result: list of RunRecord
When it fails: Could not list your runs.

argument	flag	kind	marks	help
`limit`	`--limit`	int	-	Number of rows (default 50, at most 500)
`user`	`--user`	user	admins only	Only this account (admins only)

`synapse ssh guide`

How to connect to your workspaces over SSH: the one-time setup and each workspace's commands.

synapse ssh guide [-h]

Who: any enabled account
Flags: read-only
Result: SshGuide
Errors: ssh_not_allowed, ssh_unavailable
When it fails: Could not show how to connect over SSH.

`synapse ssh-key add`

synapse ssh-key add [-h] [--name NAME] [--user USER]

Who: any enabled account
Flags: secret on stdin, not with an API token, needs a recent code
Result: SshKey
Reads from stdin: Public key line
Errors: key_registered, ssh_not_allowed, limit_reached
When it fails: Could not add the SSH key.

argument	flag	kind	marks	help
`name`	`--name`	str	-	Key name (default: the key's comment, or ssh)
`user`	`--user`	user	own value only (admins: any)	Account to register it for (admins: any account)

`synapse ssh-key ls`

SSH keys.

synapse ssh-key ls [-h] [--user USER | --all]

Who: any enabled account
Flags: read-only
Result: list of SshKey
When it fails: Could not list the SSH keys.

argument	flag	kind	marks	help
`user`	`--user`	user	admins only	Only this account (admins only)
`all`	`--all`	flag	admins only	Every account's keys (admins only)

At most one of: user, all.

`synapse ssh-key revoke`

Revoke an SSH key (new connections with it are refused).

synapse ssh-key revoke [-h] id

Who: any enabled account
Result: SshKey
Errors: no_change
When it fails: Could not revoke the SSH key.

argument	flag	kind	marks	help
`id`	positional	ssh_key	required	SSH key ID

`synapse storage`

How full storage is: the pool and its areas (admins), and work folders against their limit.

synapse storage [-h]

Who: any enabled account
Flags: read-only
Result: StorageUse
When it fails: Could not measure the storage.

`synapse token create`

Create an API token for scripts.

synapse token create [-h] [--name NAME] [--days DAYS | --no-expiry]

Who: any enabled account
Flags: not with an API token, needs a recent code
Result: Token
One-time values: API token
When it fails: Could not create the API token.

argument	flag	kind	marks	help
`name`	`--name`	str	-	Token name
`days`	`--days`	int	-	Days until the token expires (1 to 365, default 90)
`no_expiry`	`--no-expiry`	flag	admins only	Never expire (admins only)

At most one of: days, no_expiry.

`synapse token ls`

API tokens.

synapse token ls [-h] [--user USER | --all]

Who: any enabled account
Flags: read-only
Result: list of Token
When it fails: Could not list the API tokens.

argument	flag	kind	marks	help
`user`	`--user`	user	admins only	Only this account (admins only)
`all`	`--all`	flag	admins only	Every account's tokens (admins only)

At most one of: user, all.

`synapse token revoke`

Revoke an API token.

synapse token revoke [-h] id

Who: any enabled account
Result: Token
Errors: no_change
When it fails: Could not revoke the API token.

argument	flag	kind	marks	help
`id`	positional	token	required	API token ID

`synapse user authenticator confirm`

Confirm the authenticator app with the code it shows.

synapse user authenticator confirm [-h]

Who: any enabled account
Flags: secret on stdin, not with an API token, during sign-in setup
Result: AuthenticatorConfirmed
Reads from stdin: Code from the app
Errors: wrong_code, authenticator_active
When it fails: Could not confirm the authenticator app.

`synapse user authenticator setup`

Start setting up an authenticator app (TOTP); then confirm it with a code.

synapse user authenticator setup [-h]

Who: any enabled account
Flags: not with an API token, during sign-in setup
Result: AuthenticatorSetup
One-time values: Setup link (otpauth), Setup key
Errors: authenticator_active
When it fails: Could not start setting up the authenticator app.

`synapse user claude-token`

Connect your Claude account with the token from claude setup-token.

synapse user claude-token [-h]

Who: any enabled account
Flags: secret on stdin, not with an API token
Result: ClaudeConnected
Reads from stdin: Claude token (sk-ant-...)
When it fails: Could not connect Claude.

`synapse user passwd`

Change your password (needs the current one; signs out every session and revokes your API tokens and SSH keys unless kept).

synapse user passwd [-h] [--keep-credentials]

Who: any enabled account
Flags: secret on stdin, not with an API token, during sign-in setup
Result: PasswordChanged
Reads from stdin: Current password, New password
Errors: wrong_password
When it fails: Could not change the password.

argument	flag	kind	marks	help
`keep_credentials`	`--keep-credentials`	flag	-	Keep your API tokens and SSH keys (they are revoked otherwise)

`synapse user show`

Account details (your own when no ID is given).

synapse user show [-h] [id]

Who: any enabled account
Flags: read-only, during sign-in setup
Result: Account
When it fails: Could not show the account.

argument	flag	kind	marks	help
`id`	positional	user	own value only (admins: any)	Account ID

`lake ls`

Your data (only what you can see).

lake ls [-h] [--depth DEPTH] [--folders] [--as AS_USER] [path]

Who: any enabled account
Flags: read-only, inside a workspace
Result: list of LakeEntry
MCP tool: list_data (Data you can add)
When it fails: Could not list the data.

argument	flag	kind	marks	help
`path`	positional	lake_path	-	Data path, such as /images/ct_2024
`depth`	`--depth`	int	-	Levels to list (1 to 3, default 1)
`folders`	`--folders`	flag	-	Folders and tables only
`as_user`	`--as`	user	admins only	See it as this account would (admins only)

`lake show`

One data path: kind, file count and description.

lake show [-h] [--as AS_USER] path

Who: any enabled account
Flags: read-only, inside a workspace
Result: LakeEntry
When it fails: Could not show the data path.

argument	flag	kind	marks	help
`path`	positional	lake_path	required	Data path, such as /images/ct_2024
`as_user`	`--as`	user	admins only	See it as this account would (admins only)

`ws add-data`

Add data to a workspace (data is never removed).

ws add-data [-h] [--approval APPROVAL] workspace data [data ...]

Who: any enabled account
Result: DataAdded
Errors: archived, not_ready, already_in_workspace, need_permission, admin_only, already_decided, command_mismatch
When it fails: Could not add the data.

argument	flag	kind	marks	help
`workspace`	positional	workspace	required	Workspace ID
`data`	positional	ref	required, one or more values	Data paths, release IDs or share links
`approval`	`--approval`	approval	-	Run this approved request (the approval page adds it)

`ws archive`

Archive a stopped workspace: remove its environment and free its GPU; the work folder, records and releases stay.

ws archive [-h] workspace

Who: any enabled account
Result: WorkspaceState
Errors: archived, still_running
When it fails: Could not archive the workspace.

argument	flag	kind	marks	help
`workspace`	positional	workspace	required	Workspace ID

`ws create`

Create a workspace (with all of your data unless you choose some).

ws create [-h] [--data DATA [DATA ...]] [--name NAME] [--net NET] owner

Who: any enabled account
Result: WorkspaceDetail
Errors: need_permission, admin_only, limit_reached
When it fails: Could not create the workspace.

argument	flag	kind	marks	help
`owner`	positional	user	own value only (admins: any), required	Owner account ID
`data`	`--data`	ref	one or more values	Data paths, release IDs or share links
`name`	`--name`	str	-	Workspace name
`net`	`--net`	str	admins only	Internet rule template (admins only)

`ws logs`

Environment output.

ws logs [-h] [--tail TAIL] workspace

Who: any enabled account
Flags: read-only
Result: Logs
When it fails: Could not read the environment output.

argument	flag	kind	marks	help
`workspace`	positional	workspace	required	Workspace ID
`tail`	`--tail`	int	-	Only the last N lines

`ws ls`

Workspaces (default: not archived; --archived: archived ones).

ws ls [-h] [--owner OWNER] [--archived]

Who: any enabled account
Flags: read-only
Result: list of WorkspaceSummary
When it fails: Could not list the workspaces.

argument	flag	kind	marks	help
`owner`	`--owner`	user	admins only	Owner account ID (admins: any account)
`archived`	`--archived`	flag	-	Archived workspaces instead

`ws net log`

Internet access log (one workspace, or all of them for admins).

ws net log [-h] [--all] [--denied] [--tail TAIL] [workspace]

Who: any enabled account
Flags: read-only
Result: list of NetLogEntry
When it fails: Could not read the internet access log.

argument	flag	kind	marks	help
`workspace`	positional	workspace	-	Workspace ID
`all`	`--all`	flag	admins only	Every workspace (admins only)
`denied`	`--denied`	flag	-	Refused requests only
`tail`	`--tail`	int	-	Only the last N lines

Exactly one of: workspace, all.

`ws net show`

A workspace's internet rules.

ws net show [-h] [workspace]

Who: any enabled account
Flags: read-only, inside a workspace
Result: NetPolicy
When it fails: Could not show the internet rules.

argument	flag	kind	marks	help
`workspace`	positional	workspace	may be left out inside a workspace, required	Workspace ID (default inside a workspace: this one)

`ws net templates`

Internet rule templates.

ws net templates [-h]

Who: any enabled account
Flags: read-only
Result: list of NetTemplate
When it fails: Could not list the internet rule templates.

`ws open`

Check and record opening the IDE (used by the portal).

ws open [-h] workspace

Who: any enabled account
Flags: read-only, not with an API token
Result: WorkspaceOpen
Errors: archived, not_ready, not_running
When it fails: Could not open the workspace.

argument	flag	kind	marks	help
`workspace`	positional	workspace	required	Workspace ID

`ws preview`

While choosing data: visible files and who can see the results (changes nothing).

ws preview [-h] [--owner OWNER | --workspace WORKSPACE] [--data DATA [DATA ...]]

Who: any enabled account
Flags: read-only, inside a workspace
Result: Preview
MCP tool: preview_add_data (Preview adding data)
Errors: need_permission, admin_only
When it fails: Could not work out who can see the results.

argument	flag	kind	marks	help
`owner`	`--owner`	user	own value only (admins: any)	Owner account ID (admins: any account)
`workspace`	`--workspace`	workspace	may be left out inside a workspace	Workspace ID (default inside a workspace: this one)
`data`	`--data`	ref	one or more values	Data paths, release IDs or share links

At most one of: owner, workspace.

`ws request add-data`

Ask to add data to this workspace (the researcher approves in the portal).

ws request add-data [-h] [--workspace WORKSPACE] data [data ...]

Who: any enabled account
Flags: inside a workspace
Result: ApprovalView
MCP tool: request_add_data (Request data)
Errors: archived, not_ready, already_in_workspace, duplicate_request, need_permission, admin_only, limit_reached
When it fails: Could not request the data.

argument	flag	kind	marks	help
`workspace`	`--workspace`	workspace	may be left out inside a workspace, required	Workspace ID (default inside a workspace: this one)
`data`	positional	ref	required, one or more values	Data paths, release IDs or share links

`ws request release`

Ask to release outputs (the researcher approves in the portal).

 ws request release [-h] [--workspace WORKSPACE] --outputs OUTPUTS [OUTPUTS ...] --reproduce REPRODUCE [--supersedes SUPERSEDES]

Who: any enabled account
Flags: inside a workspace
Result: ApprovalView
MCP tool: request_release (Request a release)
Errors: archived, not_ready, duplicate_request, symlink, not_regular_file, empty_folder, missing_file, bad_name, too_large, limit_reached
When it fails: Could not request the release.

argument	flag	kind	marks	help
`workspace`	`--workspace`	workspace	may be left out inside a workspace, required	Workspace ID (default inside a workspace: this one)
`outputs`	`--outputs`	home_path	required, one or more values	Output paths, relative to the work folder (~)
`reproduce`	`--reproduce`	home_path	required	Script that rebuilds the outputs, relative to the work folder
`supersedes`	`--supersedes`	release	-	Release that this one replaces

`ws restore`

Restore an archived workspace.

ws restore [-h] workspace

Who: any enabled account
Result: WorkspaceState
Errors: no_change, limit_reached
When it fails: Could not restore the workspace.

argument	flag	kind	marks	help
`workspace`	positional	workspace	required	Workspace ID

`ws show`

Workspace details.

ws show [-h] [workspace]

Who: any enabled account
Flags: read-only, inside a workspace
Result: WorkspaceDetail
MCP tool: workspace_info (Workspace info)
When it fails: Could not show the workspace.

argument	flag	kind	marks	help
`workspace`	positional	workspace	may be left out inside a workspace, required	Workspace ID (default inside a workspace: this one)

`ws start`

Start a stopped workspace (on a running one: rewrite its secret and info files).

 ws start [-h] [--cpus CPUS] [--memory MEMORY] [--gpus GPUS] [--gpu-memory GPU_MEMORY] [--image IMAGE] [--recreate] workspace

Who: any enabled account
Result: WorkspaceState
Errors: archived, not_ready, owner_disabled, limit_reached, still_running
When it fails: Could not start the workspace.

argument	flag	kind	marks	help
`workspace`	positional	workspace	required	Workspace ID
`cpus`	`--cpus`	float	-	CPU cores
`memory`	`--memory`	size	-	Memory, such as 32g
`gpus`	`--gpus`	str	admins only	GPUs, such as all or 0 (admins only)
`gpu_memory`	`--gpu-memory`	size	admins only	GPU memory limit, such as 64g (admins only)
`image`	`--image`	str	admins only	Environment image (admins only)
`recreate`	`--recreate`	flag	-	Create the environment again from its image with the current settings; the work folder stays (stopped workspaces only)

`ws stop`

Stop a workspace (it stays stopped until someone starts it).

ws stop [-h] workspace

Who: any enabled account
Result: WorkspaceState
When it fails: Could not stop the workspace.

argument	flag	kind	marks	help
`workspace`	positional	workspace	required	Workspace ID

`release access ls`

Access requests (default: open ones).

release access ls [-h] [--release RELEASE] [--all] [--user USER]

Who: any enabled account
Flags: read-only
Result: list of AccessRequestView
When it fails: Could not list the access requests.

argument	flag	kind	marks	help
`release`	`--release`	release	-	Only requests for this release
`all`	`--all`	flag	-	Closed requests too
`user`	`--user`	user	admins only	Only this account (admins only)

`release create`

Release outputs from a workspace.

 release create [-h] --workspace WORKSPACE --outputs OUTPUTS [OUTPUTS ...] --reproduce REPRODUCE [--supersedes SUPERSEDES] [--approval APPROVAL]

Who: any enabled account
Result: ReleaseCreated
Errors: archived, not_ready, symlink, not_regular_file, empty_folder, missing_file, bad_name, too_large, changed_since_request, already_decided, command_mismatch
When it fails: Could not release the outputs.

argument	flag	kind	marks	help
`workspace`	`--workspace`	workspace	required	Workspace ID
`outputs`	`--outputs`	home_path	required, one or more values	Output paths, relative to the work folder (~)
`reproduce`	`--reproduce`	home_path	required	Script that rebuilds the outputs, relative to the work folder
`supersedes`	`--supersedes`	release	-	Release that this one replaces
`approval`	`--approval`	approval	-	Run this approved request (the approval page adds it)

`release ls`

Releases you can see.

release ls [-h] [--mine] [--as AS_USER]

Who: any enabled account
Flags: read-only, inside a workspace
Result: list of ReleaseRow
MCP tool: list_releases (Releases you can see)
When it fails: Could not list the releases.

argument	flag	kind	marks	help
`mine`	`--mine`	flag	-	Only releases you created
`as_user`	`--as`	user	admins only	See it as this account would (admins only)

`release open`

Check permission and record a download or preview (used by the gateway).

release open [-h] --for {download,preview} [--path PATH [PATH ...]] release

Who: any enabled account
Flags: read-only
Result: ReleaseFiles
Errors: need_permission, admin_only
When it fails: Could not open the release files.

argument	flag	kind	marks	help
`release`	positional	release	required	Release ID or share link
`purpose`	`--for`	choice	required	What the files are opened for: download or preview
`path`	`--path`	str	one or more values	Output files, as release show lists them (default: every output)

`release request-access`

Ask an admin for access to a release.

release request-access [-h] [--note NOTE] release

Who: any enabled account
Result: AccessRequestView
Errors: already_allowed
When it fails: Could not request access.

argument	flag	kind	marks	help
`release`	positional	release	required	Release ID or share link
`note`	`--note`	str	-	Note to the admin

`release show`

One release: outputs, sources, reproduce command and who can see it.

release show [-h] [--as AS_USER] release

Who: any enabled account
Flags: read-only, inside a workspace
Result: ReleaseView
MCP tool: show_release (Show a release)
Errors: need_permission, admin_only
When it fails: Could not show the release.

argument	flag	kind	marks	help
`release`	positional	release	required	Release ID or share link
`as_user`	`--as`	user	admins only	See it as this account would (admins only)

작업공간 안에서

작업공간 터미널과 코딩 에이전트가 쓸 수 있는 명령으로, 그 작업공간만 다룹니다. 터미널에서 칠 때는 앞에 명령 이름을 붙입니다: synapse ws show. 데이터 더하기와 결과 내보내기는 ws request의 두 명령(add-data, release)으로 요청하고, 작업공간 주인이 승인해야 실행됩니다. MCP 도구는 같은 명령을 에이전트에게 주는 이름입니다.

명령	MCP 도구
`synapse approval ls`	없음
`synapse approval show`	`request_status`
`lake ls`	`list_data`
`lake show`	없음
`ws net show`	없음
`ws preview`	`preview_add_data`
`ws request add-data`	`request_add_data`
`ws request release`	`request_release`
`ws show`	`workspace_info`
`release ls`	`list_releases`
`release show`	`show_release`

관리자 명령

관리자만 쓸 수 있는 명령입니다.

`synapse audit`

Audit log (filter by actor, action, target or time).

synapse audit [-h] [--by ACTOR] [--action ACTION] [--target TARGET] [--since SINCE] [--before BEFORE] [--limit LIMIT]

Who: admins
Flags: read-only
Result: list of AuditEntry
When it fails: Could not read the audit log.

argument	flag	kind	marks	help
`actor`	`--by`	str	-	Only rows by this account
`action`	`--action`	str	-	Only this action, or a prefix ending in , such as user.
`target`	`--target`	str	-	Only rows about this target
`since`	`--since`	time	-	Only rows at or after this time, such as 2026-10-19 or 2026-10-19T14:02
`before`	`--before`	int	-	Only rows before this row ID (paging)
`limit`	`--limit`	int	-	Number of rows (default 50, at most 500)

`synapse brand check`

Check a brand colour: logo tile ink and contrast, and whether it can be the button colour.

synapse brand check [-h] --color COLOR

Who: admins
Flags: read-only
Result: BrandReport
When it fails: Could not check the brand colour.

argument	flag	kind	marks	help
`color`	`--color`	color	required	Brand colour (#rrggbb)

`synapse brand css`

Rebuild the brand stylesheet (brand.css) from the saved brand.

synapse brand css [-h]

Who: admins
Result: BrandSaved
When it fails: Could not build the brand stylesheet.

`synapse brand set`

Save the brand colour and logos and rebuild the brand stylesheet (brand.css).

synapse brand set [-h] [--color COLOR] [--logo LOGO] [--logo-mono LOGO_MONO] [--primary | --no-primary]

Who: admins
Result: BrandSaved
Errors: brand_refused, no_change, too_large, symlink, not_regular_file
When it fails: Could not save the brand.

argument	flag	kind	marks	help
`color`	`--color`	color	-	Brand colour (#rrggbb)
`logo`	`--logo`	source	-	Logo SVG: upload:<id>, or a file on the server
`logo_mono`	`--logo-mono`	source	-	Single-colour logo SVG: upload:<id>, or a file on the server
`primary`	`--primary`	flag	-	Use the brand colour for buttons, or stop using it

`synapse egress start`

Start the internet proxy (egress) with every workspace's rules.

synapse egress start [-h]

Who: admins
Result: ServiceState
When it fails: Could not manage the internet proxy.

`synapse egress status`

Whether the internet proxy runs.

synapse egress status [-h]

Who: admins
Flags: read-only
Result: ServiceState
When it fails: Could not manage the internet proxy.

`synapse egress stop`

Stop the internet proxy (workspaces lose internet access).

synapse egress stop [-h]

Who: admins
Result: ServiceState
When it fails: Could not manage the internet proxy.

`synapse gateway start`

Start the gateway (portal and workspace front end), or recreate it when its settings changed.

synapse gateway start [-h]

Who: admins
Result: ServiceState
When it fails: Could not manage the gateway.

`synapse gateway status`

Whether the gateway runs, and the portal address.

synapse gateway status [-h]

Who: admins
Flags: read-only
Result: ServiceState
When it fails: Could not manage the gateway.

`synapse gateway stop`

Stop the gateway (the portal and workspaces stop answering).

synapse gateway stop [-h]

Who: admins
Result: ServiceState
When it fails: Could not manage the gateway.

`synapse role add`

Create a role.

synapse role add [-h] [--desc DESC] id

Who: admins
Result: Role
Errors: already_exists
When it fails: Could not create the role.

argument	flag	kind	marks	help
`id`	positional	role	required	Role ID
`desc`	`--desc`	str	-	Role description

`synapse role rm`

Delete a role that nobody holds and nothing grants.

synapse role rm [-h] id

Who: admins
Result: Role
Errors: in_use
When it fails: Could not delete the role.

argument	flag	kind	marks	help
`id`	positional	role	required	Role ID

`synapse role set`

Change a role's description.

synapse role set [-h] --desc DESC id

Who: admins
Result: Role
Errors: no_change
When it fails: Could not change the role description.

argument	flag	kind	marks	help
`id`	positional	role	required	Role ID
`desc`	`--desc`	str	required	Role description

`synapse role show`

Role details.

synapse role show [-h] id

Who: admins
Flags: read-only
Result: RoleDetail
When it fails: Could not show the role.

argument	flag	kind	marks	help
`id`	positional	role	required	Role ID

`synapse snapshots`

Research data snapshots (admins).

synapse snapshots [-h] [--limit LIMIT]

Who: admins
Flags: read-only
Result: list of SnapshotRow
When it fails: Could not list the data versions.

argument	flag	kind	marks	help
`limit`	`--limit`	int	-	Number of rows (default 50, at most 500)

`synapse ssh start`

Start the SSH entrance (the OpenSSH jump host into workspaces), or recreate it when its settings changed.

synapse ssh start [-h]

Who: admins
Result: ServiceState
When it fails: Could not manage the SSH entrance.

`synapse ssh status`

Whether the SSH entrance runs, its addresses and host key.

synapse ssh status [-h]

Who: admins
Flags: read-only
Result: ServiceState
When it fails: Could not manage the SSH entrance.

`synapse ssh stop`

Stop the SSH entrance (new SSH connections are refused, open ones end).

synapse ssh stop [-h]

Who: admins
Result: ServiceState
When it fails: Could not manage the SSH entrance.

`synapse user add`

Create an account with a temporary password, changed at first sign-in.

synapse user add [-h] --name NAME [--admin] [--role ROLE [ROLE ...]] id

Who: admins
Flags: not with an API token, needs a recent code
Result: Account
One-time values: Temporary password
Errors: already_exists
When it fails: Could not create the account.

argument	flag	kind	marks	help
`id`	positional	user	required	Account ID
`name`	`--name`	str	required	Display name (1 to 64 characters, different from the ID)
`admin`	`--admin`	flag	-	Make the account an admin
`role`	`--role`	role	one or more values	Roles to give

`synapse user add-role`

Give an account a role.

synapse user add-role [-h] id role

Who: admins
Result: RoleMembership
Errors: no_change
When it fails: Could not add the role.

argument	flag	kind	marks	help
`id`	positional	user	required	Account ID
`role`	positional	role	required	Role ID

`synapse user disable`

Disable an account: block sign-in and API tokens, stop its running workspaces, keep its records.

synapse user disable [-h] [--reason REASON] id

Who: admins
Result: AccountDisabled
Errors: self_target, last_admin, no_change
When it fails: Could not disable the account.

argument	flag	kind	marks	help
`id`	positional	user	required	Account ID
`reason`	`--reason`	str	-	Why the account is disabled (admins see it)

`synapse user enable`

Enable a disabled account (its workspaces stay stopped).

synapse user enable [-h] id

Who: admins
Flags: not with an API token, needs a recent code
Result: Account
Errors: no_change
When it fails: Could not enable the account.

argument	flag	kind	marks	help
`id`	positional	user	required	Account ID

`synapse user ls`

Accounts, disabled ones included.

synapse user ls [-h]

Who: admins
Flags: read-only
Result: list of Account
When it fails: Could not list the accounts.

`synapse user remove-role`

Take a role from an account.

synapse user remove-role [-h] id role

Who: admins
Result: RoleMembership
Errors: no_change
When it fails: Could not remove the role.

argument	flag	kind	marks	help
`id`	positional	user	required	Account ID
`role`	positional	role	required	Role ID

`synapse user reset-password`

Create a temporary password, changed at next sign-in; signs out every session and revokes API tokens and SSH keys.

synapse user reset-password [-h] [--authenticator] id

Who: admins
Flags: not with an API token, needs a recent code
Result: PasswordReset
One-time values: Temporary password
Errors: self_target
When it fails: Could not create a temporary password.

argument	flag	kind	marks	help
`id`	positional	user	required	Account ID
`authenticator`	`--authenticator`	flag	-	Also remove the authenticator app (a lost phone)

`synapse user rm`

Delete an account with no records at all; disable the others.

synapse user rm [-h] id

Who: admins
Result: AccountRemoved
Errors: self_target, last_admin, not_empty
When it fails: Could not delete the account.

argument	flag	kind	marks	help
`id`	positional	user	required	Account ID

`synapse user set`

Change the name, the admin flag or SSH access, or require a new password at next sign-in.

synapse user set [-h] [--name NAME] [--admin | --no-admin] [--must-change] [--ssh | --no-ssh] id

Who: admins
Flags: not with an API token, needs a recent code
Result: AccountSet
Errors: last_admin, no_change
When it fails: Could not change the account.

argument	flag	kind	marks	help
`id`	positional	user	required	Account ID
`name`	`--name`	str	-	Display name (1 to 64 characters, different from the ID)
`admin`	`--admin`	flag	-	Make the account an admin, or stop it being one
`must_change`	`--must-change`	flag	-	Require a new password at next sign-in
`ssh`	`--ssh`	flag	-	Allow SSH into the account's workspaces, or stop allowing it

`lake add`

Add files or a folder (files at the same paths are replaced).

lake add [-h] source path

Who: admins
Result: LakeAdded
Errors: symlink, not_regular_file, empty_folder, bad_name
When it fails: Could not add the data.

argument	flag	kind	marks	help
`source`	positional	source	required	Files to add: upload:<id>[/<path>], or a path on the server (server terminal only)
`path`	positional	lake_path	required	Data path to add the files under

`lake grant`

Grant a role on a path (it applies to everything below).

lake grant [-h] path role

Who: admins
Result: GrantChange
Errors: no_change
When it fails: Could not grant the role.

argument	flag	kind	marks	help
`path`	positional	lake_path	required	Data path, such as /images/ct_2024
`role`	positional	role	required	Role ID

`lake revoke`

Revoke a role granted on a path.

lake revoke [-h] path role

Who: admins
Result: GrantChange
Errors: no_change
When it fails: Could not revoke the role.

argument	flag	kind	marks	help
`path`	positional	lake_path	required	Data path, such as /images/ct_2024
`role`	positional	role	required	Role ID

`lake rm`

Remove from the source data (it stays in the history).

lake rm [-h] path

Who: admins
Result: LakeRemoved
When it fails: Could not remove the data.

argument	flag	kind	marks	help
`path`	positional	lake_path	required	Data path, such as /images/ct_2024

`lake sync`

Update every workspace's data to match the permissions.

lake sync [-h]

Who: admins
Result: Synced
When it fails: Could not update the workspaces' data.

`ws net set`

Change a workspace's internet rules.

ws net set [-h] [--template TEMPLATE] [--allow ALLOW [ALLOW ...]] [--remove REMOVE [REMOVE ...]] [--clear] workspace

Who: admins
Result: NetPolicy
Errors: no_change
When it fails: Could not change the internet rules.

argument	flag	kind	marks	help
`workspace`	positional	workspace	required	Workspace ID
`template`	`--template`	str	-	Template ID
`allow`	`--allow`	rule	one or more values	Rules to add
`remove`	`--remove`	rule	one or more values	Extra rules to remove
`clear`	`--clear`	flag	-	Remove every extra rule

`release access deny`

Deny an access request.

release access deny [-h] [--note NOTE] request

Who: admins
Result: AccessRequestView
Errors: already_decided
When it fails: Could not handle the access request.

argument	flag	kind	marks	help
`request`	positional	access	required	Access request ID, such as q-0007
`note`	`--note`	str	-	Note to the requester

`release access grant`

Handle a request by giving the requester roles (they must then see the release).

release access grant [-h] --role ROLE [ROLE ...] request

Who: admins
Result: AccessRequestView
Errors: already_decided
When it fails: Could not handle the access request.

argument	flag	kind	marks	help
`request`	positional	access	required	Access request ID, such as q-0007
`role`	`--role`	role	required, one or more values	Roles to give

`release access relax`

Handle a request by widening who can see the release (reason required).

release access relax [-h] (--clause CLAUSE [CLAUSE ...] | --everyone) --reason REASON request

Who: admins
Result: AccessRequestView
Errors: already_decided, no_change
When it fails: Could not handle the access request.

argument	flag	kind	marks	help
`request`	positional	access	required	Access request ID, such as q-0007
`clause`	`--clause`	role	repeatable, one or more values	Roles of one line of the condition; anyone with one of them qualifies (repeat to require more lines)
`everyone`	`--everyone`	flag	-	Every signed-in account
`reason`	`--reason`	str	required	Why who can see it is widened (required; admins see it)

Exactly one of: clause, everyone.

`release relax`

Widen who can see a release (an admin decision with a reason), or undo it.

release relax [-h] (--clause CLAUSE [CLAUSE ...] | --everyone | --revoke) --reason REASON release

Who: admins
Result: RelaxResult
Errors: no_change
When it fails: Could not widen who can see the release.

argument	flag	kind	marks	help
`release`	positional	release	required	Release ID or share link
`clause`	`--clause`	role	repeatable, one or more values	Roles of one line of the condition; anyone with one of them qualifies (repeat to require more lines)
`everyone`	`--everyone`	flag	-	Every signed-in account
`revoke`	`--revoke`	flag	-	Undo the widening
`reason`	`--reason`	str	required	Why who can see it is widened (required; admins see it)

Exactly one of: clause, everyone, revoke.

`release relax-preview`

How widening would change who can see a release (changes nothing).

release relax-preview [-h] (--clause CLAUSE [CLAUSE ...] | --everyone) release

Who: admins
Flags: read-only
Result: RelaxPreview
When it fails: Could not preview the widening.

argument	flag	kind	marks	help
`release`	positional	release	required	Release ID or share link
`clause`	`--clause`	role	repeatable, one or more values	Roles of one line of the condition; anyone with one of them qualifies (repeat to require more lines)
`everyone`	`--everyone`	flag	-	Every signed-in account

Exactly one of: clause, everyone.

서버 명령

컨트롤 플레인 서버의 터미널에서만 쓰는 명령입니다.

서버 명령 5개 보기

`synapse init`

Prepare the database, storage and keys (run once; later runs add missing keys).

synapse init [-h]

Who: a terminal on the control-plane server
Result: Initialized
When it fails: Could not initialize Synapse.

`synapse migrate`

Upgrade the database schema (stop the gateway and the runner first).

synapse migrate [-h] [--check]

Who: a terminal on the control-plane server
Result: Migrated
When it fails: Could not upgrade the database schema.

argument	flag	kind	marks	help
`check`	`--check`	flag	-	Only report pending steps

`synapse serve`

Command runner (how the portal, the API and workspaces run the CLI).

synapse serve [-h] [--socket SOCKET]

Who: a terminal on the control-plane server
Result: none (runs until stopped)
When it fails: Could not start the command runner.

argument	flag	kind	marks	help
`socket`	`--socket`	str	-	Socket path

`synapse storage-helper`

Storage helper (the root process for ZFS and hard links).

synapse storage-helper [-h] [--socket SOCKET] [--allow-uid ALLOW_UID]

Who: a terminal on the control-plane server
Result: none (runs until stopped)
When it fails: Could not start the storage helper.

argument	flag	kind	marks	help
`socket`	`--socket`	str	-	Socket path
`allow_uid`	`--allow-uid`	int	repeatable	Another uid that may connect (repeat for more)

`ws monitor`

Environment monitor: GPU memory limits, recorded endings, restarts after a server restart and cleanup (always on).

ws monitor [-h] [--kill] [--interval INTERVAL] [--once]

Who: a terminal on the control-plane server
Result: none (runs until stopped)
When it fails: Could not run the environment monitor.

argument	flag	kind	marks	help
`kill`	`--kill`	flag	-	End the largest process of a workspace over its GPU memory limit
`interval`	`--interval`	float	-	Seconds between passes (default 10)
`once`	`--once`	flag	-	Make one pass, then exit

결과 형식

아래는 영어 원문입니다.

Fields marked owner are shown to the account the result belongs to and to admins; admin fields only to admins. A hidden field is left out. The types the results refer to follow them.

`WorkspaceCounts`

field	type	visible to
`active`	`number`	all
`archived`	`number`	all
`running`	`number`	all

`ClaudeLink`

field	type	visible to
`connected`	`boolean`	all
`updated_at`	`string \| null`	all

`Account`

field	type	visible to
`id`	`string`	owner
`name`	`string`	all
`admin`	`boolean`	all
`enabled`	`boolean`	all
`roles`	`string[]`	all
`created_at`	`string`	all
`must_change`	`boolean`	owner
`temporary_until`	`string \| null`	owner
`temporary_expired`	`boolean`	owner
`last_login_at`	`string \| null`	owner
`workspaces`	`WorkspaceCounts`	owner
`claude`	`ClaudeLink`	owner
`api_tokens`	`number`	owner
`authenticator`	`AuthenticatorState`	owner
`authenticator_at`	`string \| null`	owner
`unconfirmed_sign_ins`	`number`	owner
`unconfirmed_since`	`string \| null`	owner
`ssh_allowed`	`boolean`	owner
`ssh_keys`	`number`	owner
`disabled_at`	`string \| null`	admin
`disabled_by`	`string \| null`	admin
`disabled_reason`	`string \| null`	admin
`removable`	`boolean`	admin
`last_admin`	`boolean`	admin

`AccountSet`

field	type	visible to
`account`	`Account`	all
`changed`	`("name" \| "admin" \| "must_change" \| "ssh")[]`	all

`AccountDisabled`

field	type	visible to
`account`	`Account`	all
`stopped`	`string[]`	all
`not_stopped`	`string[]`	all
`sessions_revoked`	`number`	all

`AccountRemoved`

field	type	visible to
`user`	`string`	admin

`RoleMembership`

field	type	visible to
`user`	`string`	admin
`role`	`string`	all
`workspaces`	`string[]`	all

`PasswordChanged`

field	type	visible to
`sessions_revoked`	`number`	all
`tokens_revoked`	`number`	all
`ssh_keys_revoked`	`number`	all

`PasswordReset`

field	type	visible to
`user`	`string`	admin
`sessions_revoked`	`number`	all
`tokens_revoked`	`number`	all
`ssh_keys_revoked`	`number`	all
`authenticator_removed`	`boolean`	all
`temporary_until`	`string`	all

`ClaudeConnected`

field	type	visible to
`refreshed`	`string[]`	all

`Role`

field	type	visible to
`id`	`string`	all
`description`	`string`	all
`members`	`number`	admin
`grants`	`number`	admin

`RoleMember`

field	type	visible to
`id`	`string`	admin
`name`	`string`	all
`enabled`	`boolean`	all

`RoleDetail`

field	type	visible to
`id`	`string`	all
`description`	`string`	all
`members`	`RoleMember[]`	admin
`grants`	`string[]`	admin
`relaxations`	`string[]`	admin

`Token`

field	type	visible to
`id`	`string`	all
`user`	`string`	owner
`name`	`string`	all
`created_at`	`string`	all
`expires_at`	`string \| null`	all
`last_used_at`	`string \| null`	all
`revoked_at`	`string \| null`	all

`AuthenticatorSetup`

field	type	visible to
`user`	`string`	owner
`issuer`	`string`	all
`algorithm`	`"SHA1"`	all
`digits`	`number`	all
`period`	`number`	all

`AuthenticatorConfirmed`

field	type	visible to
`user`	`string`	owner
`sessions_revoked`	`number`	all
`password_change`	`boolean`	all

`SshKey`

field	type	visible to
`id`	`string`	all
`user`	`string`	owner
`name`	`string`	all
`key_type`	`string`	all
`fingerprint`	`string`	all
`created_at`	`string`	all
`created_side`	`"lan" \| "internet" \| "local"`	all
`revoked_at`	`string \| null`	all

`SshGuide`

field	type	visible to
`user`	`string`	owner
`setup`	`SshSetup`	all
`settings`	`SshSettings`	all
`workspaces`	`SshConnect[]`	all

`ApprovalOutput`

field	type	visible to
`path`	`string`	all
`size`	`number`	all
`sha256`	`string \| null`	all
`kind`	`OutputKind`	all
`preview`	`number \| null`	all

`ApprovalChanges`

field	type	visible to
`files_now`	`number`	all
`files_after`	`number`	all
`audience_now`	`Audience`	all
`audience_after`	`Audience`	all
`audience_at_request`	`Audience`	all
`recomputed_at`	`string`	all

`ApprovalOutcome`

field	type	visible to
`release`	`string \| null`	all
`added`	`string[]`	all

`DataRef`

field	type	visible to
`ref`	`string`	all
`files`	`number`	all

`ApprovalView`

field	type	visible to
`id`	`string`	all
`workspace`	`string`	all
`workspace_name`	`string \| null`	owner
`owner`	`string`	owner
`action`	`ApprovalAction`	all
`via`	`Via`	all
`argv`	`string[]`	all
`command`	`string`	all
`requested_at`	`string`	all
`status`	`ApprovalStatus`	all
`ended`	`Ended \| null`	all
`interrupted`	`boolean`	all
`last_error`	`CommandError \| null`	all
`decided_at`	`string \| null`	all
`decided_by`	`string \| null`	admin
`decided_by_name`	`string \| null`	all
`outcome`	`ApprovalOutcome \| null`	all
`changes`	`ApprovalChanges`	all
`data`	`DataRef[] \| null`	all
`outputs`	`ApprovalOutput[] \| null`	all
`reproduce`	`string \| null`	all
`supersedes`	`string \| null`	all
`url`	`string`	all

`ApprovalRow`

field	type	visible to
`id`	`string`	all
`workspace`	`string`	all
`workspace_name`	`string \| null`	owner
`owner`	`string`	owner
`action`	`ApprovalAction`	all
`via`	`Via`	all
`requested_at`	`string`	all
`status`	`ApprovalStatus`	all
`ended`	`Ended \| null`	all
`interrupted`	`boolean`	all
`command`	`string`	all
`url`	`string`	all

`ApprovalFile`

field	type	visible to
`approval`	`string`	all
`index`	`number`	all
`path`	`string`	all
`size`	`number`	all
`sha256`	`string`	all
`kind`	`"image"`	all
`file`	`string`	all

`Condition`

field	type	visible to
`clauses`	`string[][]`	all
`admin_only`	`boolean`	all

`Audience`

field	type	visible to
`count`	`number`	all
`total`	`number`	all

`Member`

field	type	visible to
`id`	`string`	admin
`name`	`string`	all
`sees`	`boolean`	all

`AudienceDetail`

field	type	visible to
`count`	`number`	all
`total`	`number`	all
`members`	`Member[]`	admin

`NetSummary`

field	type	visible to
`template`	`string`	all
`label`	`string`	all
`builtin`	`boolean`	all
`rules`	`string[]`	all

`GpuSample`

field	type	visible to
`used_mib`	`number`	all
`limit_mib`	`number \| null`	all
`sampled_at`	`string`	all
`last_action`	`GpuAction \| null`	all
`last_action_at`	`string \| null`	all

`DataEntry`

field	type	visible to
`ref`	`string`	all
`kind`	`"lake" \| "release"`	all
`files`	`number`	all
`added_at`	`string`	all
`added_via`	`AddedVia`	all

`SshEntrance`

field	type	visible to
`lan_host`	`string \| null`	all
`lan_port`	`number`	all
`internet_host`	`string \| null`	all
`fingerprint`	`string`	all

`OsCommand`

field	type	visible to
`os`	`OsFamily`	all
`command`	`string`	all

`SshRoute`

field	type	visible to
`side`	`Side`	all
`tunnel`	`string \| null`	all
`config`	`string`	all

`SshFailure`

field	type	visible to
`kind`	`SshFailureKind`	all
`says`	`string[]`	all
`side`	`Side \| null`	all

`SshSettings`

field	type	visible to
`routes`	`SshRoute[]`	all
`side`	`Side \| null`	all
`open_config`	`OsCommand[]`	all
`vscode_settings`	`string`	all
`entrance_fingerprint`	`string`	all
`failures`	`SshFailure[]`	all

`SshSetup`

field	type	visible to
`keygen`	`string`	all
`show_key`	`OsCommand[]`	all
`cloudflared`	`OsCommand[]`	all

`SshTerminal`

field	type	visible to
`side`	`Side`	all
`terminal`	`string`	all

`SshConnect`

field	type	visible to
`workspace`	`string`	all
`terminals`	`SshTerminal[]`	all
`short`	`string`	all
`keys`	`number`	all
`host_fingerprint`	`string \| null`	all

`WorkspaceSsh`

field	type	visible to
`connect`	`SshConnect`	all
`settings`	`SshSettings`	all

`Inherited`

field	type	visible to
`role`	`string`	all
`source`	`string`	all

`LakeEntry`

field	type	visible to
`path`	`string`	all
`name`	`string`	all
`kind`	`LakeKind`	all
`files`	`number`	all
`folders`	`number`	all
`description`	`string \| null`	all
`roles`	`string[]`	admin
`inherited`	`Inherited[]`	admin
`changed_at`	`string \| null`	admin
`entries`	`LakeEntry[] \| null`	all

`GrantChange`

field	type	visible to
`path`	`string`	all
`role`	`string`	all
`workspaces`	`string[]`	all
`recomputed`	`string[]`	all

`LakeAdded`

field	type	visible to
`path`	`string`	all
`files`	`number`	all
`replaced`	`number`	all

`LakeRemoved`

field	type	visible to
`path`	`string`	all

`Synced`

field	type	visible to
`changed`	`string[]`	all

`Output`

field	type	visible to
`path`	`string`	all
`size`	`number`	all
`sha256`	`string`	all
`kind`	`OutputKind`	all

`Inputs`

field	type	visible to
`selected`	`string[]`	all
`releases`	`string[]`	all
`hidden`	`boolean`	all
`units`	`string[]`	admin

`LineageNode`

field	type	visible to
`id`	`string`	all
`kind`	`"folder" \| "table" \| "workspace" \| "result" \| "hidden"`	all
`owner`	`string \| null`	owner
`owner_name`	`string \| null`	all
`name`	`string \| null`	owner
`output`	`string \| null`	all
`relaxed`	`boolean`	all

`LineageEdge`

field	type	visible to
`source`	`string`	all
`target`	`string`	all

`Lineage`

field	type	visible to
`nodes`	`LineageNode[]`	all
`edges`	`LineageEdge[]`	all

`Relaxation`

field	type	visible to
`condition`	`Condition`	all
`natural_at`	`Condition`	all
`reason`	`string`	all
`by`	`string`	admin
`by_name`	`string`	all
`at`	`string`	all
`stale`	`boolean`	all

`HistoryEntry`

field	type	visible to
`at`	`string`	all
`kind`	`HistoryKind`	all
`condition`	`Condition`	all
`cause`	`ChangeReason`	all
`detail`	`Record<string, unknown>`	admin
`note`	`string \| null`	all
`actor`	`string`	admin

`SavedState`

field	type	visible to
`work_folder`	`string`	all
`image`	`string \| null`	all
`agent_log`	`string`	all

`ReleaseView`

field	type	visible to
`id`	`string`	all
`title`	`string`	all
`workspace`	`string`	all
`workspace_name`	`string \| null`	owner
`created_by`	`string`	owner
`created_by_name`	`string`	all
`created_at`	`string`	all
`outputs`	`Output[]`	all
`inputs`	`Inputs`	all
`reproduce`	`string`	all
`condition`	`Condition`	all
`relaxed`	`boolean`	all
`verification`	`Verification`	all
`supersedes`	`string \| null`	all
`superseded_by`	`string[]`	all
`audience`	`AudienceDetail`	all
`lineage`	`Lineage`	all
`environment_saved`	`boolean`	all
`natural`	`Condition`	admin
`relaxation`	`Relaxation \| null`	admin
`history`	`HistoryEntry[]`	admin
`snapshots`	`string[]`	admin
`saved`	`SavedState \| null`	admin

`ReleaseRow`

field	type	visible to
`id`	`string`	all
`title`	`string`	all
`outputs`	`number`	all
`workspace`	`string`	all
`created_by`	`string`	owner
`created_by_name`	`string`	all
`created_at`	`string`	all
`condition`	`Condition`	all
`relaxed`	`boolean`	all
`verification`	`Verification`	all
`audience`	`Audience`	all
`requests`	`number`	admin
`stale`	`boolean`	admin

`ReleaseCreated`

field	type	visible to
`id`	`string`	all
`title`	`string`	all
`workspace`	`string`	all
`created_by`	`string`	owner
`condition`	`Condition`	all
`audience`	`AudienceDetail`	all
`environment_saved`	`boolean`	all
`image`	`string \| null`	owner
`approval`	`string \| null`	all

`ReleaseFiles`

field	type	visible to
`release`	`string`	all
`purpose`	`Purpose`	all
`files`	`Output[]`	all

`RelaxPreview`

field	type	visible to
`release`	`string`	all
`condition_now`	`Condition`	all
`condition_after`	`Condition`	all
`audience_now`	`AudienceDetail`	all
`audience_after`	`AudienceDetail`	all

`RelaxResult`

field	type	visible to
`release`	`string`	all
`relaxed`	`boolean`	all
`condition`	`Condition`	all
`natural`	`Condition`	admin
`audience`	`AudienceDetail`	all
`recomputed`	`string[]`	all
`workspaces`	`string[]`	all

`AccessRequestView`

field	type	visible to
`id`	`string`	all
`release`	`string`	all
`user`	`string`	owner
`user_name`	`string`	all
`requested_at`	`string`	all
`note`	`string`	all
`status`	`AccessStatus`	all
`missing`	`Clause[]`	all
`can_view_now`	`boolean`	all
`granted_roles`	`string[]`	all
`decided_at`	`string \| null`	all
`decided_by`	`string \| null`	admin
`decided_by_name`	`string \| null`	all
`decision_note`	`string \| null`	all
`created`	`boolean`	all

`Initialized`

field	type	visible to
`root`	`string`	all
`token_key`	`string \| null`	all
`version`	`number`	all
`created`	`boolean`	all
`totp_key`	`string \| null`	all
`ssh_host_key`	`string \| null`	all

`Migrated`

field	type	visible to
`from_version`	`number`	all
`to_version`	`number`	all
`steps`	`string[]`	all
`backup`	`string \| null`	all

`ServiceState`

field	type	visible to
`service`	`Service`	all
`state`	`ServiceStatus`	all
`name`	`string \| null`	all
`portal_url`	`string \| null`	all
`entrance`	`SshEntrance \| null`	all

`PoolUse`

field	type	visible to
`size`	`number`	all
`used`	`number`	all
`free`	`number`	all
`percent`	`number`	all
`nearly_full`	`boolean`	all

`AreaUse`

field	type	visible to
`area`	`StorageArea`	all
`used`	`number`	all

`WorkFolderUse`

field	type	visible to
`workspace`	`string`	all
`name`	`string \| null`	all
`owner`	`string`	owner
`owner_name`	`string`	all
`status`	`Status`	all
`use`	`FolderUse`	all

`StorageUse`

field	type	visible to
`pool`	`PoolUse`	admin
`areas`	`AreaUse[]`	admin
`work_folders`	`WorkFolderUse[]`	all

`RunRecord`

field	type	visible to
`id`	`string`	all
`argv`	`string[]`	all
`command`	`string`	all
`started_at`	`string`	all
`seconds`	`number`	all
`code`	`number`	all
`error_code`	`string \| null`	all
`via`	`RunVia`	all
`workspace`	`string \| null`	all
`hidden`	`boolean`	all
`actor`	`string`	owner

`AuditEntry`

field	type	visible to
`id`	`number`	all
`at`	`string`	all
`actor`	`string`	admin
`action`	`AuditAction`	all
`target`	`string`	all
`detail`	`Record<string, unknown>`	admin

`SnapshotRow`

field	type	visible to
`id`	`string`	all
`created_at`	`string`	all
`actor`	`string`	admin
`reason`	`ChangeReason`	all
`detail`	`Record<string, unknown>`	admin

`Ramp`

field	type	visible to
`rest`	`string`	all
`hover`	`string`	all
`active`	`string`	all
`text`	`string`	all
`selected`	`string`	all

`PrimaryCheck`

field	type	visible to
`accepted`	`boolean`	all
`refusal`	`BrandRefusal \| null`	all
`light`	`Ramp \| null`	all
`dark`	`Ramp \| null`	all

`BrandReport`

field	type	visible to
`color`	`string`	all
`ink`	`string`	all
`ink_contrast`	`number`	all
`keyline_light`	`number`	all
`keyline_dark`	`number`	all
`primary`	`PrimaryCheck`	all

`BrandSaved`

field	type	visible to
`color`	`string`	all
`primary`	`boolean`	all
`logo`	`boolean`	all
`logo_mono`	`boolean`	all
`css`	`string`	all

`Resources`

field	type	visible to
`cpus`	`number`	all
`memory`	`string`	all
`gpus`	`string`	all
`gpu_memory`	`string \| null`	all

`WorkspacePaths`

field	type	visible to
`data`	`string`	all
`home`	`string`	all

`Ending`

field	type	visible to
`reason`	`EndReason`	all
`at`	`string`	all
`exit_code`	`number \| null`	all
`by`	`string \| null`	admin

`FolderUse`

field	type	visible to
`used`	`number`	all
`quota`	`number \| null`	all
`percent`	`number \| null`	all
`nearly_full`	`boolean`	all

`NetTemplate`

field	type	visible to
`id`	`string`	all
`label`	`string`	all
`description`	`string`	all
`builtin`	`boolean`	all
`rules`	`string[]`	all
`default`	`boolean`	all

`NetLogEntry`

field	type	visible to
`at`	`string`	all
`workspace`	`string`	all
`method`	`string`	all
`target`	`string`	all
`status`	`number`	all
`allowed`	`boolean`	all

`NetPolicy`

field	type	visible to
`workspace`	`string`	all
`template`	`string`	all
`label`	`string`	all
`description`	`string`	all
`builtin`	`boolean`	all
`rules`	`string[]`	all
`allow`	`string[]`	all
`updated_at`	`string \| null`	all
`updated_by`	`string \| null`	admin
`applied`	`boolean \| null`	all

`WorkspaceSummary`

field	type	visible to
`id`	`string`	all
`name`	`string \| null`	all
`owner`	`string`	owner
`owner_name`	`string`	all
`status`	`Status`	all
`environment`	`Environment \| null`	all
`state`	`ShownState`	all
`url`	`string \| null`	owner
`created_at`	`string`	all
`archived_at`	`string \| null`	all
`archived_by`	`string \| null`	admin
`data`	`DataEntry[]`	all
`files`	`number`	all
`condition`	`Condition`	all
`audience`	`Audience`	all
`network`	`NetSummary`	all
`pending_approvals`	`number`	owner
`gpu`	`GpuSample \| null`	owner
`desired`	`Desired`	all
`ended`	`Ending \| null`	all
`waiting`	`SettingChange[]`	owner
`out_of_memory_at`	`string \| null`	owner

`WorkspaceDetail`

field	type	visible to
`id`	`string`	all
`name`	`string \| null`	all
`owner`	`string`	owner
`owner_name`	`string`	all
`status`	`Status`	all
`environment`	`Environment \| null`	all
`state`	`ShownState`	all
`url`	`string \| null`	owner
`created_at`	`string`	all
`archived_at`	`string \| null`	all
`archived_by`	`string \| null`	admin
`data`	`DataEntry[]`	all
`files`	`number`	all
`condition`	`Condition`	all
`audience`	`AudienceDetail`	all
`network`	`NetSummary`	all
`pending_approvals`	`number`	owner
`gpu`	`GpuSample \| null`	owner
`desired`	`Desired`	all
`ended`	`Ending \| null`	all
`waiting`	`SettingChange[]`	owner
`out_of_memory_at`	`string \| null`	owner
`seen`	`string[]`	owner
`network_policy`	`NetPolicy`	all
`resources`	`Resources \| null`	owner
`image`	`string \| null`	admin
`paths`	`WorkspacePaths`	admin
`ssh`	`WorkspaceSsh \| null`	owner
`ssh_off`	`SshOff \| null`	owner
`work_folder`	`FolderUse \| null`	owner

`Preview`

field	type	visible to
`owner`	`string`	owner
`workspace`	`string \| null`	all
`data`	`string[]`	all
`files`	`number`	all
`condition`	`Condition`	all
`audience`	`AudienceDetail`	all

`DataAdded`

field	type	visible to
`workspace`	`string`	all
`owner`	`string`	owner
`added`	`string[]`	all
`files`	`number`	all
`condition`	`Condition`	all
`audience`	`AudienceDetail`	all
`approval`	`string \| null`	all

`WorkspaceState`

field	type	visible to
`id`	`string`	all
`owner`	`string`	owner
`status`	`Status`	all
`environment`	`Environment \| null`	all
`state`	`ShownState`	all
`url`	`string \| null`	owner
`resources`	`Resources \| null`	owner
`image`	`string \| null`	admin
`claude_connected`	`boolean \| null`	owner
`rejected`	`string[]`	all
`desired`	`Desired`	all
`ended`	`Ending \| null`	all
`waiting`	`SettingChange[]`	owner
`out_of_memory_at`	`string \| null`	owner
`refreshed`	`boolean`	all
`recreated`	`boolean`	all

`WorkspaceOpen`

field	type	visible to
`id`	`string`	all
`owner`	`string`	owner
`host`	`string`	all

`Logs`

field	type	visible to
`workspace`	`string`	all
`text`	`string`	all

`Clause`

field	type
`roles`	`string[]`
`has`	`boolean`

`BrandRefusal`

field	type
`rule`	`"hue" \| "status_distance" \| "chroma"`
`hue`	`number`
`status`	`StatusMark \| null`
`distance`	`number \| null`
`chroma_loss`	`number \| null`

`SettingChange`

field	type
`setting`	`Setting`
`now`	`string`
`wanted`	`string`

오류 코드

아래는 영어 원문입니다.

Scope G: any command (never listed per command); C: listed in a command's errors; W: a warning; GW: the gateway only; B: the web's own, when a request gets no HTTP answer at all (never the backend's). An appended message follows the command's fail sentence.

An error, or a warning, is the object CommandError: code, message, reason, data when the code has data (its type is named with the code, its fields under Error data types), and command, the command path or null.

`usage`

HTTP 400, scope G, message standalone, data UsageData.

variant	message	reason
problem=argparse	Invalid command usage.	<detail>. Usage: <usage>
problem=unknown_command	Invalid command usage.	Unknown command: <detail>. Usage: <usage>
problem=no_json	Invalid command usage.	This command does not print JSON.
problem=confirm_mismatch	Invalid command usage.	The two entries differ.
problem=workspace_required	Invalid command usage.	Give a workspace ID; it can be left out only inside a workspace. Usage: <usage>

`invalid`

HTTP 400, scope G, message appended, data InvalidData.

variant	message	reason
rule=via_scope	The run path and the workspace scope disagree.	This is a gateway or runner fault. Report it to an admin.
rule=hidden_write	A command that changes something cannot run hidden.	Run it visibly in the console.
rule=name_is_id	The name must differ from the ID.	Other people see the name instead of the ID.
rule=name_length	The name must be 1 to 64 characters.	Give a shorter or non-empty name.
rule=password_rule	The new password is too weak.	Use at least 10 characters, different from the current password.
rule=claude_token	This is not a Claude token.	Paste the token that claude setup-token printed (sk-ant-...).
rule=path_dotdot	A data path cannot contain "..": <value>	Give a path inside the data, such as /images/ct_2024.
rule=path_reserved	The top-level name "releases" is reserved.	Choose another folder name.
rule=path_root	The data root cannot be removed.	Name a folder or file below it.
rule=host_source	Only uploaded files can be added from the portal or the API.	Upload the files first, then add them as upload:<id>.
rule=resource_limit	The request is above the limit: <field>	Requested <value>; the limit is <limit>.
rule=home_path	Not a path in the work folder: <value>	Give a path relative to the work folder (~), such as project/outputs/model.pt.
rule=file_changing	A file is still being written: <value>	Wait until it is complete, then request again.
rule=days_range	The expiry must be 1 to 365 days.	Give --days between 1 and 365.
rule=depth_range	The depth must be 1 to 3.	Give --depth between 1 and 3.
rule=reason_required	A reason is required.	Give it with: --reason "..."
rule=still_cannot_view	The requester still cannot see the release.	Still missing: <role>
rule=color	Not a colour of the form #rrggbb: <value>	Example: --color #246099
rule=logo, problem=doctype	The logo cannot be accepted.	It has a DOCTYPE. Use a plain SVG without one.
rule=logo, problem=external_url	The logo cannot be accepted.	It refers to an external URL. Use a plain SVG without external references.
rule=logo, problem=not_svg	The logo cannot be accepted.	It is not an SVG image.
rule=logo, problem=parse	The logo cannot be accepted.	It is not well-formed XML.
rule=net_rule, problem=empty	Not a valid internet rule: <value>	A rule cannot be empty.
rule=net_rule, problem=format	Not a valid internet rule: <value>	Write a host, host:port, host:, an address, a CIDR range, or internal, for example github.com:22.
rule=net_rule, problem=port	Not a valid internet rule: <value>	A port is 1-65535, a range such as 8000-8100, or *.
rule=net_rule, problem=host	Not a valid internet rule: <value>	Not a host name or an address.
rule=not_extra_rule	Not an extra rule: <value>	Only extra rules can be removed. To drop a template rule, choose another template.
rule=id_format, field=user	Not a valid account ID: <value>	Use 1 to 64 letters, digits, ".", "_", "@" or "-", not starting with "-".
rule=id_format, field=role	Not a valid role ID: <value>	Use 1 to 64 ASCII letters, digits, ".", "_" or "-".
rule=time_format	Not a time: <value>	Give an ISO date or time, such as 2026-10-19 or 2026-10-19T14:02.
rule=sealed_image	A saved environment cannot run as a workspace: <value>	Saved environments stay with their release. Choose a workspace image.
rule=path_taken	A file and a folder cannot share a path: <value>	Rename it in the source, or first remove the one in the data with: lake rm <value>
rule=config, problem=unknown_key	The configuration is invalid: <field>	Unknown setting. Check its spelling or remove it.
rule=config, problem=missing	The configuration is invalid: <field>	This setting is required.
rule=config, problem=type	The configuration is invalid: <field>	Wrong kind of value: <value>
rule=config, problem=range	The configuration is invalid: <field>	Out of range: <value> (allowed: <limit>)
rule=config, problem=host_template	The configuration is invalid: <field>	Write it as {ws}.<domain>, with {ws} once, as the whole left-most label.
rule=config, problem=portal_matches_workspace	The configuration is invalid: <field>	The portal host must not match the workspace host template.
rule=config, problem=https_needs_tls	The configuration is invalid: <field>	public_scheme https needs gateway.tls_cert and gateway.tls_key, or a proxy listener.
rule=config, problem=proxy_pair	The configuration is invalid: <field>	Set gateway.proxy_port and gateway.trusted_proxies together, or neither.
rule=config, problem=catch_all	The configuration is invalid: <field>	A catch-all range cannot be trusted. List the proxy addresses instead.
rule=config, problem=overlaps_workspaces	The configuration is invalid: <field>	It overlaps the workspace or Docker networks: <value>. Forwarding headers from there are never trusted.
rule=config, problem=port_collision	The configuration is invalid: <field>	gateway.port, gateway.proxy_port, gateway.ws_api_port, ssh.port and ssh.tunnel_port must differ.
rule=config, problem=db_group	The configuration is invalid: <field>	The DB folder's group is <value>; gateway.user's primary group is <limit>. Use one group for both.
rule=config, problem=rule	The configuration is invalid: <field>	Not a valid internet rule in a template: <value>
rule=config, problem=unknown_template	The configuration is invalid: <field>	No such template: <value>. Name a built-in template or one in [network.templates].
rule=config, problem=key_in_db_folder	The configuration is invalid: <field>	Keys must be outside the DB folder, which the gateway mounts.
rule=config, problem=public_needs_proxy	The configuration is invalid: <field>	gateway.public needs the proxy listener (gateway.proxy_port and gateway.trusted_proxies): the tunnel connects there.
rule=config, problem=public_needs_https	The configuration is invalid: <field>	gateway.public needs public_scheme https.
rule=config, problem=public_lan_plaintext	The configuration is invalid: <field>	With gateway.public, the main listener needs gateway.tls_cert and gateway.tls_key, or bind = "127.0.0.1": passwords and codes never cross the office network in clear.
rule=config, problem=secrets_placement	The configuration is invalid: <field>	runtime.secrets_dir must be apart from runtime.runtime_dir and the DB folder: secrets stay in memory, not on disk with them.
rule=config, problem=not_writable	The configuration is invalid: <field>	The folder is missing or this account cannot write it: <value>. Create it at boot (deploy/tmpfiles/synapse.conf).
rule=config, problem=ssh_host	The configuration is invalid: <field>	ssh.host must differ from the portal host and must not match the workspace host template.
rule=config, problem=ssh_disabled	The configuration is invalid: <field>	Set ssh.enabled = true, with ssh.host_key and a route (ssh.lan_host, or ssh.host with ssh.tunnel_port), to run the SSH entrance.
rule=config, problem=public_wildcard_bind	The configuration is invalid: <field>	With gateway.public, bind the main listener and the SSH entrance to the office address or 127.0.0.1, never to every interface: <value>
rule=config, problem=host_name	The configuration is invalid: <field>	Write a host name (letters, digits, dots and hyphens) or an IPv4 address: <value>
rule=ssh_key, problem=private_key	This SSH public key cannot be used.	This is a private key. Never paste it anywhere. Paste the line of the .pub file instead, such as ~/.ssh/id_ed25519.pub.
rule=ssh_key, problem=format	This SSH public key cannot be used.	Paste one public key line, such as the content of ~/.ssh/id_ed25519.pub (never the private key).
rule=ssh_key, problem=type	This SSH public key cannot be used.	Use an ssh-ed25519, ecdsa-sha2-nistp256/384/521, sk-ssh-ed25519 or sk-ecdsa key, or an RSA key of 3072 bits or more.
rule=ssh_key, problem=rsa_size	This SSH public key cannot be used.	The RSA key has <value> bits. Use at least 3072, or an ed25519 key: ssh-keygen -t ed25519
rule=needs_https	Setting up an authenticator app needs HTTPS.	The portal is served over plain HTTP, where the setup key would cross the network in clear. Set the app up after an admin turns on HTTPS.

`not_found`

HTTP 404, scope G, message appended, data NotFoundData.

variant	message	reason
noun=workspace	Not found: <ref>	No such workspace: <ref>. List workspaces with: ws ls
noun=release	Not found: <ref>	No such release: <ref>. List releases with: release ls
noun=path	Not found: <ref>	No such path: <ref>. List your data with: lake ls
noun=approval	Not found: <ref>	No such approval: <ref>. List requests with: synapse approval ls
noun=user	Not found: <ref>	No such user: <ref>. List accounts with: synapse user ls
noun=role	Not found: <ref>	No such role: <ref>. List roles with: synapse role ls
noun=token	Not found: <ref>	No such token: <ref>. List tokens with: synapse token ls
noun=access	Not found: <ref>	No such access: <ref>. List access requests with: release access ls
noun=upload	Not found: <ref>	No such upload: <ref>. The upload is missing or unfinished. Upload it again.
noun=output	Not found: <ref>	No such output: <ref>. List the release's outputs with: release show
noun=template	Not found: <ref>	No such template: <ref>. List templates with: ws net templates
noun=authenticator	Not found: <ref>	No such authenticator: <ref>. Set one up with: synapse user authenticator setup
noun=ssh_key	Not found: <ref>	No such ssh_key: <ref>. List SSH keys with: synapse ssh-key ls

`admin_required`

HTTP 403, scope G, message appended, data AdminData.

variant	message	reason
kind=command	Only admins can do this.	Run it as an admin.
kind=option	Only admins can do this.	Only admins can set this option: <flag>
kind=value	Only admins can do this.	Only admins can act for another account: <flag> <value>

`local_only`

HTTP 403, scope G, message appended, data none.

variant	message	reason
-	This runs only in a terminal on the server.	Run it in a terminal on the control-plane server.

`not_registered`

HTTP 403, scope G, message appended, data RefData.

variant	message	reason
-	The account is not registered.	No registered account: <ref>. Ask an admin for an account.

`account_disabled`

HTTP 403, scope G, message appended, data none.

variant	message	reason
-	The account is disabled.	An admin disabled this account. Contact an admin.

`must_change_password`

HTTP 403, scope G, message appended, data none.

variant	message	reason
-	Change your password first.	You signed in with a temporary password. Change it, then try again.

`api_forbidden`

HTTP 403, scope G, message appended, data none.

variant	message	reason
-	API tokens cannot do this.	Sign in to the portal for this. API tokens cannot create or enable accounts, change names, admin rights or passwords, create tokens, connect Claude, set up an authenticator app, add SSH keys or open workspaces.

`out_of_scope`

HTTP 403, scope G, message appended, data none.

variant	message	reason
-	This cannot be done inside a workspace.	Inside a workspace, commands act only on that workspace.

`rate_limited`

HTTP 429, scope G, message appended, data WaitData.

variant	message	reason
-	Too many attempts.	Try again in 2 minutes.

`storage_unavailable`

HTTP 503, scope G, message appended, data CauseData.

variant	message	reason
-	Storage is not available.	The storage helper did not answer (<cause>). An admin can check it with: scripts/dev-services.sh status

`runtime_unavailable`

HTTP 503, scope G, message appended, data CauseData.

variant	message	reason
-	Docker refused the request.	Docker said: <cause>

`schema_outdated`

HTTP 503, scope G, message standalone, data SchemaData.

variant	message	reason
-	Synapse is being upgraded and cannot be used right now.	The database schema is version 2; this code needs 2. An admin upgrades it with: synapse migrate

`cancelled`

HTTP 409, scope G, message standalone, data none.

variant	message	reason
-	Cancelled.	The run was interrupted.

`internal`

HTTP 500, scope G, message standalone, data InternalData.

variant	message	reason
-	The command did not finish.	Unhandled error (<type>): <detail>

`need_permission`

HTTP 403, scope C, message appended, data NeedPermission.

variant	message	reason
context=view	Seeing this release needs other roles.	Visible to: <role>. You can ask an admin for access: release request-access <release>
context=add	The owner cannot see this release: <release>	Visible to: <role>. Add data the owner can see.

`admin_only`

HTTP 403, scope C, message appended, data NeedPermission.

variant	message	reason
context=view	Only admins can see this release now.	Nothing was widened, and no role can see the source data. Contact an admin.
context=add	Only admins can see this release: <release>	Nothing was widened, and no role can see the source data. Contact an admin.

`wrong_password`

HTTP 403, scope C, message appended, data none.

variant	message	reason
-	The current password is wrong.	Check your current password.

`already_exists`

HTTP 409, scope C, message appended, data ExistsData.

variant	message	reason
removed=False	Already exists: <ref>	Choose another ID.
removed=True	Already exists: <ref>	IDs of deleted accounts are never reused. Choose another ID.

`already_in_workspace`

HTTP 409, scope C, message appended, data RefsData.

variant	message	reason
-	This data is already in the workspace.	Already chosen: <ref>. Only new data can be added.

`already_allowed`

HTTP 409, scope C, message appended, data RefData.

variant	message	reason
-	You can already see this release.	You can see it now. Open it again.

`duplicate_request`

HTTP 409, scope C, message appended, data RequestData.

variant	message	reason
-	The same request is already waiting: <ref>	It is waiting for approval. Give the researcher the approval link: <url>

`already_decided`

HTTP 409, scope C, message appended, data DecidedData.

variant	message	reason
status=done	The request is already closed: <ref>	It was done. Make a new request if needed.
status=rejected	The request is already closed: <ref>	It was rejected. Make a new request if needed.
status=granted	The request is already closed: <ref>	It was granted. Make a new request if needed.
status=relaxed	The request is already closed: <ref>	It was relaxed. Make a new request if needed.
status=denied	The request is already closed: <ref>	It was denied. Make a new request if needed.

`busy`

HTTP 409, scope C, message appended, data RefData.

variant	message	reason
-	An approved request is running: <ref>	Try again when it has finished.

`command_mismatch`

HTTP 409, scope C, message appended, data CommandData.

variant	message	reason
-	The command differs from the request.	Requested command: <command>

`changed_since_request`

HTTP 409, scope C, message appended, data ChangedData.

variant	message	reason
-	Files changed after the request.	Changed after the request: <added>, <removed>, <changed>. Ask the agent to request again.

`archived`

HTTP 409, scope C, message appended, data RefData.

variant	message	reason
-	The workspace is archived: <ref>	Restore it first with: ws restore <ref>

`not_ready`

HTTP 409, scope C, message appended, data NotReadyData.

variant	message	reason
status=creating	The workspace is not ready: <ref>	The workspace is still being created. Try again shortly.
status=failed	The workspace is not ready: <ref>	Creating this workspace failed. It can only be archived; create a new one.

`not_running`

HTTP 409, scope C, message appended, data RefData.

variant	message	reason
-	The environment is not running: <ref>	Start it in the portal, then open it again.

`owner_disabled`

HTTP 409, scope C, message appended, data RefData.

variant	message	reason
-	The owner's account is disabled.	Disabled account: <ref>. It can start once an admin enables the account.

`limit_reached`

HTTP 409, scope C, message appended, data LimitData.

variant	message	reason
kind=active	The workspace limit is reached.	2 workspaces are not archived: <workspace> (limit 2). Archive one you no longer use, then try again.
kind=running	The running workspace limit is reached.	2 workspaces are running or were left running: <workspace> (limit 2). Stop one (an ended one counts too), then try again.
kind=requests	The waiting request limit is reached.	2 requests are waiting (limit 2). Request again after the researcher handles them.
kind=ssh_keys	The SSH key limit is reached.	2 SSH keys are registered (limit 2). Revoke one you no longer use, then try again.

`last_admin`

HTTP 409, scope C, message appended, data none.

variant	message	reason
-	This is the last enabled admin.	It is the only enabled admin. Make another account an admin first.

`self_target`

HTTP 409, scope C, message appended, data none.

variant	message	reason
-	This cannot be done to your own account.	Another admin must do this for your account.

`in_use`

HTTP 409, scope C, message appended, data InUseData.

variant	message	reason
-	The role is in use.	Members 2, grants 2, widened releases 2. Remove them all, then delete the role.

`not_empty`

HTTP 409, scope C, message appended, data FootprintData.

variant	message	reason
-	The account has records. Disable it instead.	Workspaces 2, releases 2, records 2.

`no_change`

HTTP 409, scope C, message appended, data NoChangeData.

variant	message	reason
rule=same	Nothing changes.	It is already that way.
rule=not_wider	Nothing changes.	This condition lets no one new see the release.
rule=not_relaxed	Nothing changes.	Nothing has been widened.

`symlink`

HTTP 422, scope C, message appended, data PathData.

variant	message	reason
-	A path is a symbolic link.	Symbolic link: <path> -> <target>. Replace it with the real file, then try again.

`not_regular_file`

HTTP 422, scope C, message appended, data PathData.

variant	message	reason
-	A path is not a regular file.	Not a regular file or folder: <path>

`empty_folder`

HTTP 422, scope C, message appended, data PathData.

variant	message	reason
-	A folder is empty.	Empty folder: <path>

`missing_file`

HTTP 422, scope C, message appended, data PathData.

variant	message	reason
-	A path is not in the work folder.	Not in the work folder: <path>. Paths are relative to the work folder (~).

`bad_name`

HTTP 422, scope C, message appended, data PathData.

variant	message	reason
-	A file name is not valid UTF-8.	The name is not UTF-8: <path>. Rename it, then try again.

`too_large`

HTTP 413, scope C, message appended, data SizeData.

variant	message	reason
unit=files	It is over the size limit.	More than 2 files. Zip the folder and release the zip.
unit=bytes	It is over the size limit.	The limit is 2 bytes.

`brand_refused`

HTTP 422, scope C, message appended, data BrandRefusal.

variant	message	reason
rule=hue	The brand colour cannot be the button colour.	Hue 0.5 degrees is outside 215-335 degrees, where no status colour lives. Keep the brand colour in the logo tile.
rule=status_distance	The brand colour cannot be the button colour.	It is too close to the running status colour (distance 0.5, minimum 0.10). Keep the brand colour in the logo tile.
rule=chroma	The brand colour cannot be the button colour.	Making it usable would remove 0.5% of its colour (at most 40%). Keep the brand colour in the logo tile.

`must_enroll`

HTTP 403, scope G, message appended, data none.

variant	message	reason
-	Set up an authenticator app first.	This installation asks every account for a code from an authenticator app. Set one up on the authenticator page, or with: synapse user authenticator setup

`wrong_code`

HTTP 403, scope C, message appended, data none.

variant	message	reason
-	The code is wrong.	Enter the 6-digit code the app shows now. If codes keep failing, check that the phone sets its clock automatically.

`authenticator_active`

HTTP 409, scope C, message appended, data RefData.

variant	message	reason
-	An authenticator app is already set up.	To move to another phone, an admin removes the current one first: synapse user reset-password <ref> --authenticator

`still_running`

HTTP 409, scope C, message appended, data RunningData.

variant	message	reason
-	The environment is running: <ref>	Changes: image from <now> to <wanted>. Stop it first with: ws stop <ref>

`ssh_not_allowed`

HTTP 403, scope C, message appended, data RefData.

variant	message	reason
-	SSH is not allowed for this account.	An admin allows SSH per account: synapse user set <ref> --ssh

`ssh_unavailable`

HTTP 409, scope C, message appended, data none.

variant	message	reason
-	SSH is not available on this installation.	An admin has not turned on the SSH entrance. Ask an admin if you need it.

`key_registered`

HTTP 409, scope C, message appended, data KeyRegisteredData.

variant	message	reason
kind=active	This SSH key is already registered: <ref>	It is an active key of this account and works now. How to connect: synapse ssh guide
kind=used	This SSH key is already registered: <ref>	A key is registered once, and a revoked key cannot be registered again. Make a new key with ssh-keygen -t ed25519, answer y to replace the old one, and register the new one.

`reauth_required`

HTTP 403, scope G, message appended, data none.

variant	message	reason
-	Confirm it with a code from your authenticator app first.	Adding SSH keys, API tokens, accounts or temporary passwords, and changing accounts, need a code entered in the last 10 minutes. Enter the code the app shows now, then try again.

`sync_incomplete`

HTTP -, scope W, message standalone, data WorkspacesData.

variant	message	reason
cause	The change is saved, but some workspaces' data was not updated.	<cause>. An admin finishes it with: lake sync
error=cancelled	The change is saved, but some workspaces' data was not updated.	The run was interrupted. An admin finishes it with: lake sync

`not_applied`

HTTP -, scope W, message standalone, data WorkspacesData.

variant	message	reason
cause	Running environments were not updated right away.	<cause>. It applies at the next start.
error=cancelled	Running environments were not updated right away.	The run was interrupted. It applies at the next start.

`not_enrolled`

HTTP -, scope W, message standalone, data AccountsData.

variant	message	reason
-	Some accounts have no authenticator app yet.	They are asked to set one up at their next sign-in: <account>

`service_down`

HTTP -, scope W, message standalone, data ServicesData.

variant	message	reason
-	The workspace started, but a service it needs is not running.	Not running: gateway. The IDE needs the gateway, internet access the egress proxy, SSH the SSH entrance. An admin starts them with: synapse gateway start

`nearly_full`

HTTP -, scope W, message standalone, data NearlyFullData.

variant	message	reason
-	Storage is nearly full.	The storage pool is 2% full (warning at 2%), and ZFS slows down as it fills. Free space or enlarge the pool. Work folders at 2% of their limit or more: <workspace>. Delete files that are no longer needed.

`ssh_not_applied`

HTTP -, scope W, message standalone, data WorkspacesData.

variant	message	reason
cause	The change is saved, but SSH access was not updated yet.	<cause>. The environment monitor (ws monitor) writes the SSH access files again within a minute.
error=cancelled	The change is saved, but SSH access was not updated yet.	The run was interrupted. The environment monitor (ws monitor) writes the SSH access files again within a minute.

`unreachable`

HTTP -, scope B, message standalone, data none.

variant	message	reason
-	Could not reach Synapse.	Check the network connection and try again. If it keeps failing, tell an admin.

`unauthenticated`

HTTP 401, scope GW, message standalone, data none.

variant	message	reason
-	Sign in first.	Sign in at the portal, or send an API token.

`login_failed`

HTTP 401, scope GW, message standalone, data none.

variant	message	reason
-	Could not sign in.	The ID or password is wrong. If the account can no longer be used, contact an admin.

`cross_origin`

HTTP 403, scope GW, message standalone, data none.

variant	message	reason
-	A request started elsewhere was refused.	Open Synapse at its own address and try again.

`unknown_host`

HTTP 421, scope GW, message standalone, data none.

variant	message	reason
-	This server does not serve this address.	Check the address. Workspaces open from the portal.

`ticket_invalid`

HTTP 403, scope GW, message standalone, data RefData.

variant	message	reason
-	The open link has expired.	Open the workspace again from the portal.

`workspace_down`

HTTP 502, scope GW, message standalone, data RefData.

variant	message	reason
-	The workspace environment is not answering.	Start the workspace in the portal, then open it again.

`unknown_workspace`

HTTP 403, scope GW, message standalone, data none.

variant	message	reason
-	This address is not a running workspace.	Only a running workspace can use this address.

`workspace_network`

HTTP 403, scope GW, message standalone, data none.

variant	message	reason
-	Requests from a workspace network are refused here.	Inside a workspace, use the synapse command or the MCP tools.

`runner_down`

HTTP 503, scope GW, message standalone, data none.

variant	message	reason
-	The command runner is not reachable.	The command runner is not running. An admin starts it with: scripts/dev-services.sh start runner

`disk_full`

HTTP 507, scope GW, message standalone, data none.

variant	message	reason
-	The server is out of disk space.	Free disk space on the server, then try again.

`upload_offset`

HTTP 409, scope GW, message standalone, data OffsetData.

variant	message	reason
-	The chunk does not continue the file.	The file has 2 bytes so far. Send the chunk that starts there.

`login_expired`

HTTP 401, scope GW, message standalone, data none.

variant	message	reason
-	The sign-in has expired.	Sign in again with your ID and password.

`code_failed`

HTTP 401, scope GW, message standalone, data TriesData.

variant	message	reason
-	The code is wrong.	Enter the code the app shows now (2 tries left).

`code_locked`

HTTP 403, scope GW, message standalone, data RefData.

variant	message	reason
-	Codes are locked for this account.	There were 100 wrong codes in 30 days. An admin must remove the authenticator app: synapse user reset-password <ref> --authenticator

`enroll_required`

HTTP 403, scope GW, message standalone, data none.

variant	message	reason
-	This account has no authenticator app yet.	From the internet, sign-in needs a code. Set up the app on the office network first, or ask an admin for a temporary password.

`internet_token`

HTTP 403, scope GW, message standalone, data none.

variant	message	reason
-	API tokens are not accepted from the internet.	Use the token on the office network. An admin can accept tokens from the internet with gateway.internet_tokens = true.

`misrouted`

HTTP 421, scope GW, message standalone, data none.

variant	message	reason
-	This entrance does not take tunnel traffic.	Tunnel traffic is taken only on the proxy listener with gateway.public = true. Point the Cloudflare Tunnel at 127.0.0.1 and gateway.proxy_port, never at the main listener, and set gateway.public = true.

`overloaded`

HTTP 503, scope GW, message standalone, data none.

variant	message	reason
-	The server is busy.	Too many sign-ins are being checked at once. Try again in a minute.

오류 데이터 형식

아래는 영어 원문입니다.

`UsageData`

field	type
`problem`	`UsageProblem`
`usage`	`string`
`detail`	`string`

`InvalidData`

field	type
`rule`	`InvalidRule`
`field`	`string \| null`
`value`	`string \| null`
`limit`	`string \| null`
`clauses`	`Clause[] \| null`
`problem`	`NetRuleProblem \| LogoProblem \| ConfigProblem \| SshKeyProblem \| null`

`NotFoundData`

field	type
`noun`	`NotFoundNoun`
`ref`	`string`

`AdminData`

field	type
`kind`	`"command" \| "option" \| "value"`
`flag`	`string \| null`
`value`	`string \| null`

`RefData`

field	type
`ref`	`string`

`WaitData`

field	type
`minutes`	`number`

`CauseData`

field	type
`cause`	`string`

`SchemaData`

field	type
`have`	`number`
`want`	`number`

`InternalData`

field	type
`type`	`string`
`detail`	`string`

`NeedPermission`

field	type
`release`	`string`
`context`	`"view" \| "add"`
`clauses`	`Clause[]`
`admin_only`	`boolean`
`request`	`RequestBrief \| null`

`ExistsData`

field	type
`ref`	`string`
`removed`	`boolean`

`RefsData`

field	type
`refs`	`string[]`

`RequestData`

field	type
`ref`	`string`
`url`	`string`

`DecidedData`

field	type
`ref`	`string`
`status`	`"done" \| "rejected" \| "granted" \| "relaxed" \| "denied"`

`CommandData`

field	type
`command`	`string`

`ChangedData`

field	type
`added`	`string[]`
`removed`	`string[]`
`changed`	`string[]`

`NotReadyData`

field	type
`ref`	`string`
`status`	`"creating" \| "failed"`

`LimitData`

field	type
`kind`	`"active" \| "running" \| "requests" \| "ssh_keys"`
`limit`	`number`
`current`	`number`
`workspaces`	`string[]`

`InUseData`

field	type
`members`	`number`
`grants`	`number`
`relaxations`	`number`

`FootprintData`

field	type
`workspaces`	`number`
`releases`	`number`
`actions`	`number`

`NoChangeData`

field	type
`rule`	`"same" \| "not_wider" \| "not_relaxed"`

`PathData`

field	type
`path`	`string`
`target`	`string \| null`

`SizeData`

field	type
`limit`	`number`
`unit`	`"files" \| "bytes"`

`RunningData`

field	type
`ref`	`string`
`changes`	`SettingChange[]`

`KeyRegisteredData`

field	type
`ref`	`string`
`kind`	`"active" \| "used"`

`WorkspacesData`

field	type
`workspaces`	`string[]`
`cause`	`string \| null`
`error`	`ErrorRecord \| null`

`AccountsData`

field	type
`accounts`	`string[]`

`ServicesData`

field	type
`services`	`Service[]`

`NearlyFullData`

field	type
`pool`	`number \| null`
`workspaces`	`string[]`
`threshold`	`number`

`OffsetData`

field	type
`offset`	`number`

`TriesData`

field	type
`left`	`number`

`RequestBrief`

field	type
`id`	`string`
`status`	`AccessStatus`
`requested_at`	`string`
`decided_at`	`string \| null`
`decision_note`	`string \| null`

`ErrorRecord`

field	type
`code`	`string`
`data`	`Record<string, unknown> \| null`
`command`	`string \| null`

값 목록

아래는 영어 원문입니다.

The closed sets of values that the types above name.

type	values
`NotFoundNoun`	`workspace`, `release`, `path`, `approval`, `user`, `role`, `token`, `access`, `upload`, `output`, `template`, `authenticator`, `ssh_key`
`UsageProblem`	`argparse`, `unknown_command`, `no_json`, `confirm_mismatch`, `workspace_required`
`NetRuleProblem`	`empty`, `format`, `port`, `host`
`LogoProblem`	`doctype`, `external_url`, `not_svg`, `parse`
`ConfigProblem`	`unknown_key`, `missing`, `type`, `range`, `host_template`, `portal_matches_workspace`, `https_needs_tls`, `proxy_pair`, `catch_all`, `overlaps_workspaces`, `port_collision`, `db_group`, `rule`, `unknown_template`, `key_in_db_folder`, `public_needs_proxy`, `public_needs_https`, `public_lan_plaintext`, `secrets_placement`, `not_writable`, `ssh_host`, `ssh_disabled`, `public_wildcard_bind`, `host_name`
`SshKeyProblem`	`private_key`, `format`, `type`, `rsa_size`
`InvalidRule`	`via_scope`, `hidden_write`, `name_is_id`, `name_length`, `password_rule`, `claude_token`, `path_dotdot`, `path_reserved`, `path_root`, `host_source`, `resource_limit`, `home_path`, `file_changing`, `days_range`, `depth_range`, `reason_required`, `still_cannot_view`, `color`, `logo`, `net_rule`, `not_extra_rule`, `id_format`, `time_format`, `sealed_image`, `path_taken`, `config`, `ssh_key`, `needs_https`
`AccessStatus`	`open`, `granted`, `relaxed`, `denied`
`Setting`	`image`, `cpus`, `memory`, `gpus`, `shm_size`, `pids_limit`, `sudo`, `runtime`, `ide_downloads`, `extensions`, `fence`
`Service`	`gateway`, `egress`, `ssh`
`StatusMark`	`running`, `waiting`, `failed`, `off`
`RunVia`	`portal`, `api`, `mcp`, `terminal`
`Side`	`lan`, `internet`
`OsFamily`	`windows`, `macos`, `linux`
`SshFailureKind`	`key_refused`, `starting`, `not_running`, `prohibited`, `entrance_down`, `outside_office`, `tunnel_not_started`, `cloudflared_missing`, `tunnel_closed`, `no_settings`, `too_many_keys`, `host_changed`
`LoginStep`	`signed_in`, `code`
`NoticeCode`	`not_found`, `archived`, `not_ready`, `not_running`, `ticket_invalid`, `workspace_down`, `no_portal`, `unavailable`
`Via`	`local`, `portal`, `api`, `mcp`, `terminal`
`AddedVia`	`create`, `approval`, `portal`, `api`, `local`
`GpuAction`	`warn`, `over`, `kill`, `gone`
`SshOff`	`not_allowed`, `unavailable`
`AuthenticatorState`	`none`, `started`, `active`
`LakeKind`	`folder`, `table`, `file`
`Status`	`creating`, `active`, `failed`, `archived`
`Environment`	`starting`, `running`, `stopped`, `removed`
`ShownState`	`off`, `starting`, `running`, `ended`, `creating`, `failed`, `archived`
`Desired`	`running`, `stopped`
`EndReason`	`user`, `admin`, `account_disabled`, `out_of_memory`, `exited`, `host_restart`, `docker_restart`, `start_failed`, `missing`
`ChangeReason`	`lake.grant`, `lake.revoke`, `lake.add`, `lake.rm`, `lake.sync`, `user.add`, `user.add_role`, `user.remove_role`, `ws.create`, `ws.add_data`, `ws.archive`, `ws.restore`, `release.input`, `release.register`, `release.relax`, `release.relax_revoke`, `access.grant`, `access.relax`
`OutputKind`	`image`, `table`, `weights`, `metrics`, `file`
`HistoryKind`	`create`, `recompute`, `relax`, `revoke`
`Verification`	`unverified`, `verified`, `partially_verified`
`Purpose`	`download`, `preview`
`ApprovalStatus`	`pending`, `running`, `done`, `rejected`
`Ended`	`rejected`, `archived`, `changed`
`ApprovalAction`	`add-data`, `release`
`AuditAction`	`cli.run`, `system.init`, `system.migrate`, `user.add`, `user.set`, `user.disable`, `user.enable`, `user.rm`, `user.add_role`, `user.remove_role`, `user.passwd`, `user.reset_password`, `claude.connect`, `role.add`, `role.set`, `role.rm`, `token.create`, `token.revoke`, `lake.grant`, `lake.revoke`, `lake.add`, `lake.rm`, `lake.sync`, `ws.create`, `ws.add_data`, `ws.open`, `ws.start`, `ws.stop`, `ws.stopped`, `ws.failed`, `ws.archive`, `ws.restore`, `ws.network`, `release.create`, `release.failed`, `release.view`, `release.download`, `release.preview`, `release.relax`, `release.access_request`, `release.access_decide`, `approval.request`, `approval.run`, `approval.done`, `approval.failed`, `approval.rejected`, `gpu.warn`, `gpu.over`, `gpu.kill`, `gpu.gone`, `brand.set`, `gateway.start`, `gateway.stop`, `egress.start`, `egress.stop`, `login`, `login.failed`, `logout`, `ide.fetch`, `gateway.cross_origin_blocked`, `upload.done`, `upload.refused`, `wsapi.refused`, `user.authenticator_setup`, `user.authenticator_confirm`, `ssh_key.add`, `ssh_key.revoke`, `ws.resumed`, `ws.recover_failed`, `ws.out_of_memory`, `ssh.start`, `ssh.stop`, `gateway.token_refused`
`ServiceStatus`	`running`, `stopped`, `missing`
`LoginFailReason`	`unknown`, `no_password`, `disabled`, `password`, `rate_limited`, `code`, `code_locked`, `not_enrolled`, `expired`
`StorageArea`	`lake`, `releases`, `views`, `work_folders`

출력과 종료 코드

명령 목록

연구자가 쓰는 명령 명령 43개

관리자 명령 명령 38개

서버 명령 명령 5개

연구자가 쓰는 명령

synapse approval file

synapse approval ls

synapse approval reject

synapse approval show

synapse role ls

synapse runs

synapse ssh guide

synapse ssh-key add

synapse ssh-key ls

synapse ssh-key revoke

synapse storage

synapse token create

synapse token ls

synapse token revoke

synapse user authenticator confirm

synapse user authenticator setup

synapse user claude-token

synapse user passwd

synapse user show

lake ls

lake show

ws add-data

ws archive

ws create

ws logs

ws ls

ws net log

ws net show

ws net templates

ws open

ws preview

ws request add-data

ws request release

ws restore

ws show

ws start

ws stop

release access ls

release create

release ls

release open

release request-access

release show

작업공간 안에서

관리자 명령

synapse audit

synapse brand check

synapse brand css

synapse brand set

synapse egress start

synapse egress status

synapse egress stop

synapse gateway start

synapse gateway status

synapse gateway stop

synapse role add

synapse role rm

synapse role set

synapse role show

synapse snapshots

synapse ssh start

synapse ssh status

synapse ssh stop

synapse user add

synapse user add-role

synapse user disable

synapse user enable

synapse user ls

synapse user remove-role

synapse user reset-password

synapse user rm

synapse user set

lake add

lake grant

`synapse approval file`

`synapse approval ls`

`synapse approval reject`

`synapse approval show`

`synapse role ls`

`synapse runs`

`synapse ssh guide`

`synapse ssh-key add`

`synapse ssh-key ls`

`synapse ssh-key revoke`

`synapse storage`

`synapse token create`

`synapse token ls`

`synapse token revoke`

`synapse user authenticator confirm`

`synapse user authenticator setup`

`synapse user claude-token`

`synapse user passwd`

`synapse user show`

`lake ls`

`lake show`

`ws add-data`

`ws archive`

`ws create`

`ws logs`

`ws ls`

`ws net log`

`ws net show`

`ws net templates`

`ws open`

`ws preview`

`ws request add-data`

`ws request release`

`ws restore`

`ws show`

`ws start`

`ws stop`

`release access ls`

`release create`

`release ls`

`release open`

`release request-access`

`release show`

`synapse audit`

`synapse brand check`

`synapse brand css`

`synapse brand set`

`synapse egress start`

`synapse egress status`

`synapse egress stop`

`synapse gateway start`

`synapse gateway status`

`synapse gateway stop`

`synapse role add`

`synapse role rm`

`synapse role set`

`synapse role show`

`synapse snapshots`

`synapse ssh start`

`synapse ssh status`

`synapse ssh stop`

`synapse user add`

`synapse user add-role`

`synapse user disable`

`synapse user enable`

`synapse user ls`

`synapse user remove-role`

`synapse user reset-password`

`synapse user rm`

`synapse user set`

`lake add`

`lake grant`

`lake revoke`

`lake rm`

`lake sync`

`ws net set`

`release access deny`

`release access grant`

`release access relax`

`release relax`