Commands

Commands

The command-line surface of SynapseOS, and the short list of privileged actions the desktop is allowed to run without a password.

---

Command-line tools

Every tool is prefixed syn and self-documents with --help (or help).

Command	What it does
syn	Top-level CLI — syn status, syn info, syn model/net/guard …, syn shell, syn ui, syn install
synsh	Natural-language shell — type plain English or normal commands; --no-ai for pure shell, --intent-check to test an intent
syn-model	Model manager — download [mistral-7b|phi3|tiny], list, status, remove
syn-install	Install SynapseOS to disk (the live-ISO installer)
synctl	Talk to the running synui compositor over its control socket — synctl clients, workspaces, outputs, activewindow, dispatch <action> [arg]
synui-ai-backend	Switch synapd's inference device — gpu / cpu / off / toggle / status (see synapd)
synapd · synguard · synnet · synui	The daemons and compositor — normally started by systemd, not by hand

Check the daemons and kernel module:

systemctl status synapd      # AI inference daemon
systemctl status synguard    # security monitor
systemctl status synnet      # network policy
lsmod | grep synapse_kmod    # kernel module
cat /sys/kernel/synapse/status

---

Privileged desktop actions (sudo -n)

synui runs as the session user — under a greetd session it is not root — and the target has no polkit agent to prompt for a password. So the handful of desktop actions that genuinely need root are granted passwordless through tightly-scoped /etc/sudoers.d rules (written by syn-install). Each helper self-escalates with sudo -n, and these are the only commands %wheel may run without a password:

Command	Rule file	Triggered by
sudo -n systemctl reboot · poweroff	power-menu	Start-menu Reboot / Shut Down
sudo -n systemctl stop synapd · start synapd	synapd-gamemode	Game mode (Super+G) frees the GPU
sudo -n synui-ai-backend gpu|cpu|off|toggle	synapd-backend	"AI backend" row (control panel / Super+Escape)

Everything else still prompts for a password (%wheel ALL=(ALL:ALL) ALL). When synui instead runs as root via synui.service, the sudo -n re-exec is a no-op — the helpers already hold the privilege they need.

Why not polkit? There is no authentication agent in the session (see Troubleshooting), so an interactive pkexec/polkit prompt would hang with nothing to answer it. A sudo -n NOPASSWD rule, scoped to one exact command, is the deliberate substitute.

See also: Keybindings, synapd, synui.