Skip to main content

CLI reference

The Standard Agents CLI is the @standardagents/cli package. Its command is agents. You do not need to install it:
Inside a project that has the package installed, pnpm exec agents <command> or npx agents <command> runs the same program. The examples on this page write agents <command> for both forms. The CLI supports Node.js 22 (22.12 or newer) and Node.js 24. An older Node.js stops with the version to install. A newer release line prints a warning and continues. agents --help lists the commands, and agents <command> --help lists the flags of one command. agents --version prints the CLI version. In a terminal, agents with no command opens a menu. Without a terminal, it prints the help text on the error stream and exits with code 1.

Commands

Exit codes

deploy, builds, rollback, and redeploy share these codes. Their --help output lists them: terms uses codes 2 and 3 with its own meanings: a confirmation is needed and nothing was recorded (2), or you are not signed in (3). Three results exit with code 0 although the work is not finished. Check the output for them in a script:
  • deploy prints Only the push was verified when it cannot read the build. See deploy.
  • deploy --no-wait returns after the push and does not follow the build.
  • unpack without a package name lists the packages and unpacks nothing.

JSON output

Every command writes errors and warnings to stderr, and status lines and results to stdout. With --json, stdout holds exactly one JSON document, and status lines move to stderr. diag tail --json is the exception: it prints one JSON frame per line. For available-models, list-packed, and the diag subcommands, a command that exits with a nonzero code prints a document with an error member. error.code and error.message are always present. An unknown command or flag, or a missing argument, prints the same document with the code usage_error whenever --json is among the arguments. The other commands that accept --json print their own documents. The README of the @standardagents/cli package shows each document and lists the error codes.

Run without a terminal

Scripts, CI jobs, and coding agents have no interactive terminal. In that case a command that needs an answer exits with code 1 and names the flag to pass. Setting STANDARD_AGENTS_BROWSER=none has the same effect as --no-open for init, login, and git-login. STANDARD_AGENTS_BROWSER can also name the browser these three commands open: an application name on macOS and Windows ("Google Chrome"), or a command on Linux (firefox). When the browser cannot be opened, the command prints a warning in place of Opening your browser, and waits while you open the printed sign-in URL yourself. A headless sign-in, deployment, and result check:

Platform API address

init, login, git-login, logout, builds, terms, and the Git credential helper use the first address that one of these names:
  1. The flag of the command: --endpoint <url> or --api-url <url>
  2. STANDARD_AGENTS_API_URL
  3. PLATFORM_ENDPOINT
  4. STANDARD_AGENTS_PLATFORM_URL
  5. https://api.standardagents.ai
The Git credential helper and builds read the same three variables from the .dev.vars of your project after the environment. --endpoint and --api-url are two names for one option, and every command that takes a platform address accepts both. The help of init lists --api-url; the help of the other commands lists --endpoint. When a command line has both, the CLI uses --api-url. The CLI sends your session or API key to this address, so the address must use HTTPS. Plain HTTP is accepted only for this machine: localhost, 127.0.0.1, or [::1]. For any other address the command exits with code 1 before it sends a request, and the message shows the https:// address to use. An address that contains a user name or a password is refused in the same way. A request that carries your session, API key, or setup code is never redirected. When the platform answers with a redirect, the command stops and names the host. Check the platform address.

Request time limits

Each request to the platform, to an instance, or to the model guide ends after 30 seconds without a complete answer (15 seconds for each model guide address). The message names the host that did not answer and the command to run next. Waiting for a browser sign-in or for a build has its own limit: the lifetime of the sign-in session, or --timeout.

Where credentials are stored

The CLI configuration directory is $XDG_CONFIG_HOME/standardagents when XDG_CONFIG_HOME is set. Otherwise it is ~/.config/standardagents on macOS and Linux, and %APPDATA%\standardagents on Windows. The CLI writes .dev.vars, .agents/bootstrap-session.json, and auth-state.json so that only your user can read them. Before each write to one of the two project files, the CLI adds .dev.vars and .agents to your .gitignore when Git does not ignore them. When Git tracks one of these files, the command stops and prints the git rm --cached command that stops the tracking. On macOS, git-login keeps the account session and the account API key in the Keychain, and auth-state.json holds no secret. The secret never appears in the arguments of a process. On Linux and Windows the CLI supports no credential store, so auth-state.json holds both values, readable only by your user. The same file is used on macOS in two cases:
  • The Keychain is not available, for example because it is locked in an SSH session. git-login says so.
  • You set STANDARD_AGENTS_CREDENTIAL_STORE=file when you run git-login.
A sign-in that an earlier release saved in auth-state.json keeps working. It moves to the Keychain the next time you run git-login on macOS. A sign-in saved from a desktop session is in the Keychain, which an SSH session cannot read until you run security unlock-keychain; the credential helper says so. To use one sign-in from both, run git-login with STANDARD_AGENTS_CREDENTIAL_STORE=file. The credential helper stores no password. Each time Git contacts a Standard Agents repository, the helper requests a short-lived token from the platform. It uses the project API key from the nearest .dev.vars first, then a project session, then the git-login sign-in. These environment variables also sign the CLI in, and they take effect until you unset them: STANDARD_AGENTS_API_KEY, STANDARD_AGENTS_SESSION_COOKIE, STANDARDAGENTS_BOOTSTRAP_SESSION_COOKIE. logout removes the stored credentials and revokes the ones that the platform can revoke.

When a build fails

deploy and builds status --wait exit with code 1 when a build fails, and they print the error message from the platform.
  1. Read the build log:
    Without a build ID, the command reads the newest build of the checked-out commit. To choose another build, list the builds with agents builds and pass an ID.
  2. If the log shows an error in your project, correct it, commit, and deploy again:
  3. If the failure needs no change to your code, run the same build again and wait for its result:
  4. If production is broken after a build went live, make the earlier production build live again, then correct the code in a new commit:
deploy and builds use the project API key in .dev.vars, or your account sign-in from agents login or agents git-login. rollback and redeploy need the account sign-in, by an owner or admin of the account that owns the project. Without a stored sign-in or key, deploy reports Only the push was verified, and the other commands exit with code 3. Exit code 4 means that the platform stored your push and waits for the terms. Run terms accept. An acceptance starts no build by itself: the command offers to start each deploy that waits, and agents builds retry starts one later. The local build script of a project stops with a message. Builds run on the platform from your committed package.json and lockfile, so commit both.

Project commands

init

Creates a project on the Standard Agents platform and sets it up on your machine. The command prints a sign-in URL and opens your browser. After you sign in and create the project there, it clones the project repository into the current directory, writes .dev.vars, registers the Git credential helper for the repository, installs dependencies, and starts the dev server on 127.0.0.1. It stays attached to the dev server until you press Ctrl-C. project-name fills in the name field of the browser form. The command exits with code 1 when the dev server does not start or stops with an error. Your project stays cloned and configured, and the output ends with the commands that start the server again.

scaffold

Adds Standard Agents to the Vite project in the current directory. It adds @standardagents/builder to package.json, adds the builder() plugin to your vite.config, sets the registry for the @standardagents scope, adds the generated type files to tsconfig.json, and creates the agents/ directories with an AGENTS.md guide in each one. scaffold does not install dependencies, sign you in, or write .dev.vars. The root AGENTS.md that it writes lists those remaining steps. It keeps your application files. Without --force it keeps an AGENTS.md that already exists, and it says how many kept guides differ from the current version. The command runs five stages: vite-config, package-json, registry-pin, guides, and tsconfig. It exits with code 1 when a stage fails. It names that stage and the command that resumes it, completes the other stages, and keeps the files that it wrote.

support-files

Writes the local support files of a project repository that you cloned yourself. init runs the same step for you. The command writes a package.json when the repository has none, adds local build and development directories to .gitignore, and sets the registry for the @standardagents scope. It keeps files that already exist. The command exits with code 1 when it cannot set the registry, after it prints the setting to add by hand.

init-chat

Creates a React chat application in a new project-name directory. The application connects to a running Standard Agents instance. In a terminal, the command asks for the framework, the address of the instance, and the package manager. It then installs dependencies, starts the dev server of the chat application, opens the browser, and stays attached to the server. Without a terminal, the command never asks. It needs project-name, and either --yes or a flag for each of the three values. It installs dependencies, prints the command that starts the dev server, and exits. It starts the server only when you pass --dev.
The command exits with code 1, before it creates anything, when a value is missing or not supported, or when the directory already exists. It also exits with code 1 when the installation fails. When the dev server exits with an error, the command exits with the same code.

Account commands

login

Signs the current project in to your Standard Agents account. It never creates a project. Without a code, the command prints the sign-in URL, opens your browser, waits until you approve the sign-in, and saves an account session for the project. Ctrl-C cancels the sign-in on the platform too. With the setup code from the project’s Overview page in the dashboard, the command also saves the project API key in .dev.vars. The local instance needs that key before you can sign in to it with your account.

logout

Removes every stored credential: the Git sign-in for this machine, the project session, and STANDARD_AGENTS_API_KEY in the nearest .dev.vars. It then revokes the project API key, the Git API key, and the account session on the platform, which also signs you out of the dashboard. The output lists what the command removed, what it revoked, and what still works. Each API key revokes itself, so the command needs no session for it. A platform that has no route for this reports the project API key as still valid; the key is gone from this machine, and you revoke it under API keys in the dashboard. Credentials in environment variables stay until you unset them. The command exits with code 1 when a credential on this machine still works or a revocation failed. The local credentials are removed in both cases.

git-login

Signs Git in on this machine for Standard Agents repositories. You run it once for each machine. The command opens the browser sign-in page, saves the sign-in (see Where credentials are stored), and registers the credential helper in your global Git configuration for git.standardagents.ai and git.standardagentbuilder.com only. deploy, builds, rollback, and redeploy can use the same sign-in. The sign-in includes an account API key that does not expire, so Git keeps working after the browser session ends. When you run git-login again as the same user of the same account, the command keeps that key. When the saved key belongs to another user, account, or platform, the command revokes it before it creates a new one. The number of active keys for the machine therefore stays at one. A key that could not be revoked is named in a warning.

git-credential

The credential helper that init and git-login register. Git runs it; you do not need to. It follows the Git credential helper protocol: Git writes the request to the standard input, and the helper prints a user name and a short-lived password. The helper answers the get operation for HTTPS requests to git.standardagents.ai and git.standardagentbuilder.com. It prints nothing for other hosts and other operations, so your other credential helpers keep working. When it has no credential for a Standard Agents host, it prints the git-login command on the error stream.

Deployment commands

deploy

Pushes the checked-out commit to the branch of the same name on the origin remote, then follows the platform build of that commit and reports the result. The command does not use push.default or the upstream setting of the branch. It exits with code 2 when the remote is not a Standard Agents repository, or when no branch is checked out and you pass no --branch. A push to the default branch deploys to production. A push to another branch deploys a preview. When the remote branch already has the commit, the command pushes nothing and reads the existing build of that commit.

builds

[build] is a build ID, or a prefix of a build ID or a commit that matches one build. Without it, status and logs use the newest build of the checked-out commit, or the newest build when that commit has none. retry uses the newest build of the checked-out branch, when that build failed. These commands use the project API key in .dev.vars, or your account sign-in. They exit with the shared codes.

rollback

Makes an earlier production build live again. Without [build], the target is the production build that was live before the current one. The command accepts only a production build that was live earlier. The command asks for confirmation in a terminal. Without a terminal it changes nothing and exits with code 2 unless you pass --yes. It needs an account sign-in from agents login; a project API key is not enough.

redeploy

Deploys the live production build again, so that changed environment values take effect. No build runs. The command needs an account sign-in from agents login.

Model commands

current-models

Prints the current model guide as Markdown. The command requests https://standardagentspec.org/models.md first, and https://standardagentspec.com/models.md when the first request fails. It needs no project and no sign-in. The command exits with code 1 when no address returns the guide. An address that does not answer within 15 seconds counts as failed.

available-models

Lists the model IDs of one provider as a Markdown table. Run it from a project with its dependencies installed. The command uses the provider’s own key when the project has one. Otherwise it uses the account key of the project, STANDARD_AGENTS_API_KEY. The command exits with code 1 when a key is missing, the request fails, or the provider returns no models. It also exits with code 1, before any request, when the account key would go to a platform address that is neither HTTPS nor on this machine.

Coding agent commands

skill

Installs the agentbuilder skill for your coding agent. In a terminal, the command asks which target to install. See @standardagents/skill for what the skill covers. The command exits with code 1 when the skill is already installed and you did not pass --force.

Packing commands

Run these commands from the root of a project with its dependencies installed. They use the Standard Agents Builder that the project installs. Without it, each command prints the install command and exits with code 1.

pack

Packs an agent and everything it depends on into a package in agents/packed/. The command then removes the original files that only that agent uses, and it lists those files before it removes them. It keeps files that another agent also uses.

unpack

Copies a packed agent into editable files under agents/. Without package, the command lists the packages that it found and exits with code 0. It has no flags.

list-packed

Lists the packed agents in agents/packed/ and in the installed packages of the project, with their version, source, and entry agent.

Diagnostic commands

diag

Diagnoses a running instance: a local dev server or a deployed project. These commands read the request logs of an instance. Build logs are in builds. <id> and <thread> accept the start of a thread ID. Each command prints one line that starts with diag: on stderr and exits with code 1 when the instance cannot be reached, does not answer within 30 seconds, or refuses the request. A --token is sent only to an HTTPS instance address, or to plain HTTP on this machine; any other address exits with code 1 before a request. A request with a token is not redirected. diag tail exits with code 0 when the stream closes normally, and with code 1 when the connection fails or closes abnormally.

Terms commands

terms

terms shows the Terms of Service and the Privacy Policy that are in force: each title, version, and URL, and whether you accepted that version. terms status does the same. terms accept shows the same documents and the acknowledgement sentence, then asks for your confirmation. An acceptance starts no build. The command lists each deploy that waits and asks whether to start it; with --agree it starts them without a second question. To start one later, run agents builds retry in its project on the branch that you pushed. Both commands use the sign-in that login or git-login saved. An API key cannot accept terms, because acceptance belongs to a person. Without a terminal, terms accept records nothing and exits with code 2. It prints the two links, the acknowledgement sentence, and the command that accepts those versions. A coding agent shows you the links and the sentence, and runs that command only after you say yes. When a document changed after you reviewed it, the command records nothing, exits with code 2, and prints the current documents.

Generate types

The dev server generates the type files of a project. It writes .agents/types.d.ts and .agents/virtual-module.d.ts when it starts, and again after each change under agents/:
Start the dev server once before you run the type checker in a new project. The type checker reports missing type files until then. There is no separate type-generation command.