Diagnose first
lurus doctor
lurus status
lurus update --check
lurus doctor checks the environment without requiring login. lurus status shows the authentication source, profile and proxy information. In chat, use /doctor, /status, /stats and /cost; they do not repair problems automatically. update --check checks the version and may write the update cache. lurus update installs a newer version globally through npm; development builds do not install. Check the messages, because handled authentication or update failures do not always exit with code 1.
Auth source and logout
Warning: logout removes stored credentials; logout --all also attempts to log out all JWT sessions server-side. Neither command revokes API keys.
lurus login
lurus login --email
lurus login --api-key
lurus register
lurus logout
lurus logout --all
By default, login uses a browser and device code. Email and API keys are entered interactively as alternatives. The flags take no value; do not pass a key or password as an argument. If both flags are supplied, API-key input is used. Registration also uses the browser, not a password supplied as a CLI argument.
A nonempty LURUS_API_KEY, after trimming surrounding whitespace, takes precedence over stored API keys or JWT credentials. An invalid value causes an error rather than falling back to local authentication. If an unexpected account is used, check the source reported by status; never print actual keys.
logout deletes stored credentials. With JWT authentication, it also attempts server-side logout for the current session, or all sessions with --all. Stored API keys are not revoked server-side, and environment variables remain unchanged. A success message does not prove successful server-side revocation. Revoke or rotate compromised keys through account management rather than relying on logout alone.
Corporate proxies and TLS
HTTP_PROXY, HTTPS_PROXY and NO_PROXY are supported, along with their lowercase forms. Lowercase takes precedence. NO_PROXY accepts comma- or whitespace-separated entries; loopback addresses are also handled. Add trusted corporate certificates through NODE_EXTRA_CA_CERTS rather than disabling certificate validation. Proxy URLs may contain credentials: share only sanitized diagnostics. General troubleshooting does not require reading .env files, certificates or credential stores.
Configuration and extensions
| Symptom | Check |
|---|---|
| Ignored settings | Check the project directory, JSON, scope, consent and restart requirements in settings. /config does not reload settings. |
| Project indexing enabled again after restart | The project value is not applied. Use global disabling or the account option. |
| Command missing | Check the path-derived name and collisions with built-in commands. Restart; there is no reload command. |
| Agent not approved | Check the source, path, file changes and restart. See agent trust. |
| Inactive skill | Reload with /skills. Check source approval, bundled skill blocks and file patterns. |
| Hook does not block | Check the event, matcher, exit code and JSON output. Hook failures allow execution to continue; post-events cannot undo actions. |
| MCP tools missing | Check consent, scope, start command, directory, timeout and exact filter names. Distinguish restart from refresh-tools. |
| Child process lacks a variable | Approve specific names through *_PASS_ENV rather than forwarding the entire environment. |
Reports and damaged stores
Warning: Reports can overwrite files with the same name without another dialog. Opening the HTML report loads an external chart library. Review contents before sharing.
/report
/report --json diagnostics.json
/permissions
Reports contain metadata and counters, not full transcripts. HTML is saved as lurus-report.html; JSON uses the supplied filename in the current directory.
Repair only damaged permission or consent data: /permissions repair and /permissions repair trust back up damaged data and reset stored approvals for all projects. Confirmation defaults to No. This is not routine cleanup; do not delete stores manually. Use permission management for targeted revocation.