# @agentify/cli

The Agentify CLI pairs a local workspace with Agentify Chat.

Agentify Chat lets you send encrypted prompts from `chat.agentify.sh` to a coding agent running on your own computer. The server routes ciphertext only; the workspace key and runner tokens stay local.

## Public Support

- Product: `https://chat.agentify.sh`
- Issues: `https://github.com/agentify-sh/chat/issues`
- Email: `team@agentify.sh`

The CLI does not include an Agentify billing flow. Provider usage, subscriptions, and local CLI authentication remain controlled by the provider CLIs you run on your own machine.

## Install

```bash
npm install -g @agentify/cli
agentify --help
```

The hosted setup flow at `https://chat.agentify.sh` can also install the CLI for a single user account without a global npm install.

## Main Commands

```bash
agentify chat pair --pairing-ticket <ticket> --workspace "$PWD" --label "$(basename "$PWD")"
agentify chat daemon --runner codex
agentify chat daemon --runner claude
agentify chat daemon --runner gemini
agentify chat daemon --runner opencode
agentify chat daemon --runner claude --model haiku
agentify doctor
```

`agentify chat pair` registers this machine as the local decrypting device for a workspace. `agentify chat daemon --runner codex` runs Codex through structured JSON events for reliable encrypted output streaming. Claude, Gemini, and opencode are available through the same `--runner` flag.

For Claude Code, the built-in runner uses your local Claude Code subscription login in headless `claude --print` mode. If headless auth still fails, create a long-lived subscription token:

```bash
claude setup-token
export CLAUDE_CODE_OAUTH_TOKEN="<token printed by claude setup-token>"
agentify chat daemon --runner claude
```

The built-in Claude runner ignores inherited `ANTHROPIC_API_KEY`, `CLAUDE_API_KEY`, and `ANTHROPIC_AUTH_TOKEN` so stale API keys do not override your Claude Code subscription login. Use `agentify chat daemon --runner-command ...` for custom local CLI commands or explicit API-key workflows.

By default, Agentify starts in fresh structured-run mode: every browser message launches a new local CLI invocation with that CLI's default model. In this mode, `/model` is informational only and does not change future messages. Pass `--model <model>` to pin the model for fresh runs, for example `--runner codex --model gpt-5.5`, `--runner claude --model haiku`, `--runner gemini --model gemini-2.5-flash`, or `--runner opencode --model opencode/qwen3.6-plus-free`.

Persistent live mode is advanced and experimental. Start it explicitly with `--persistent` or `--persistent-experimental` only when you want Agentify to keep the selected local CLI open between turns. In persistent mode, Agentify parses the virtual terminal screen, filters control output before sending browser chunks, and attempts vendor-specific `/model ...` automation. If model switching cannot be verified, use the local CLI picker directly or restart the fresh runner with `--model <model>`.

## Security Model

- Prompt and result payloads are encrypted before they leave the browser or local runner.
- The server does not receive the workspace encryption key.
- Poll tokens stay on the local machine.
- Browser enqueue tokens and approval state stay in the browser.
- V1 direct mode gives remote prompts the same local access as the selected CLI would have if you typed the prompt on this computer.
- Local logs stay on the paired computer.

## Local Development

To exercise the npm wrapper against a local Rust build:

```bash
AGENTIFY_CLI_BIN=/absolute/path/to/agentify node ./bin/agentify.js --help
```

To stage the current Rust binary into the npm package layout:

```bash
cargo build --release
npm run stage:bin -- --force
node ./bin/agentify.js --help
```

To verify release readiness:

```bash
npm run release:check
```

### Release automation

For one-command release prep across all supported platforms:

```bash
npm run release:all
```

From the workspace root, you can run the same flow with:

```bash
bash ../scripts/release-agentify-cli.sh
```

The release pipeline is non-publishing by default and runs:

- cross-platform Rust builds
- multi-target npm wrapper staging
- local version/release checks
- package verification
- release payload leak scan

Use explicit flags to publish:

```bash
npm run release:all:publish -- --npm-tag latest
```

or:

```bash
bash ./scripts/release-all.sh --publish-npm --publish-git --auto-commit --create-tag --push-git
```

Useful options:

```bash
--targets darwin-arm64,linux-x64
--publish-npm
--publish-git
--auto-commit
--create-tag
--push-git
--skip-leak-scan
--skip-cargo-test
--skip-npm-tests
--dry-run
```

Identity checks are enforced on publish:

- npm account must be `agentify`
- GitHub account must be `waml`

During local incubation, when only some platform binaries are staged, use:

```bash
npm run release:check -- --allow-missing-targets
```

Do not publish until the packed artifact has been inspected and the release check passes.
