wraith/tasks/cli/serve-command.md

id, name, status, depends_on, scope, risk, impact, level

id	name	status	depends_on	scope	risk	impact	level
cli/serve-command	Implement `wraith serve` CLI subcommand with clap	completed	server/serve-loop	moderate	low	component	implementation

Description

Implement the wraith serve CLI subcommand using clap with derive macros. This translates ServeOptions into CLI flags and runs the server. All options from server.md CLI interface must be supported.

Environment variable defaults: none mandated for serve, but consistent with programmatic-first API.

The binary is the wraith crate at crates/wraith/src/main.rs.

Acceptance Criteria

• crates/wraith/src/main.rs defines CLI with clap derive: wraith with serve and connect subcommands (connect stub for now)
• wraith serve subcommand flags match server.md CLI interface exactly: --key, --authorized-keys, --cert-authority, --transport, --listen, --tls-cert, --tls-key, --acme-domain, --stealth, --proxy, --iroh-relay, --max-connections-per-ip, --max-auth-attempts
• --key is required (no default)
• --transport defaults to tcp
• --listen defaults to 0.0.0.0:22
• --stealth validates that --transport tls is set; error otherwise
• --transport iroh prints endpoint ID on startup
• --acme-domain requires acme feature (compile-time or runtime error if missing)
• Key inputs accept file paths (strings); in-memory key data is a library/API concern, not CLI
• CLI translates args into ServeOptions and calls Server::new(opts).run().await
• Errors reported to stderr with non-zero exit code
• cargo run -p wraith -- serve --help shows all flags with descriptions

References

• docs/architecture/server.md — CLI Interface section with all flags
• docs/architecture/overview.md — "A single binary with subcommands"

Notes

All 12 CLI flags implemented. ServeTransportModeArg ValueEnum maps to ServeTransportMode. Stealth validation checks transport==tls. ACME feature-gated at compile time. iroh prints endpoint ID on startup.

Summary

Implemented wraith serve CLI subcommand with all server.md flags. Clap derive with ServeTransportModeArg, stealth validation, ACME feature gate, iroh endpoint ID printing. Build/clippy/test pass across all feature combinations.