CLI reference

Last updated 2026-05-19·8 min read

CLI pre-betaThe cendriix npm package is not published yet. Design partners use the web app at app.example.com. Only whoami, runs list, and runs get exist in the private CLI repo, commands below are the target interface.

Overview

cendriix initCreate a new workspace

cendriix loginAuthenticate the CLI

cendriix runTrigger and manage runs

cendriix logsStream run logs

cendriix workspaceManage workspaces and connectors

cendriix replayTime-travel replay of past runs

cendriix policyManage guardrail policies

cendriix auditQuery and export audit events

Install (coming soon, not on npm yet):

bash

# Planned:
# npm install -g cendriix

# Today: request design-partner access at /contact/?topic=demo

cendriix init

Scaffolds a workspace configuration and authenticates the session in one step.

bash

cendriix init [workspace-slug]

Flag	Default	Description
`--region`	`us-east-1`	Primary cloud region for the workspace control plane.
`--plan`	`starter`	Billing plan: `starter`, `growth`, or `enterprise`.
`--no-browser`	—	Print the auth URL instead of opening a browser tab.

bash

# Create a workspace called acme-prod
cendriix init acme-prod

# Headless init (CI / container)
cendriix init acme-prod --no-browser

Authenticates or re-authenticates the CLI without creating a new workspace.

bash

cendriix login [--workspace <slug>]

Flag	Description
`--workspace`	Target a specific workspace slug (defaults to the one in `.cendriix/config.yaml`).
`--token`	Provide a service-account token directly (non-interactive / CI).
`--no-browser`	Print the device-flow URL instead of opening a browser.

bash

# Interactive login
cendriix login

# CI: pass a pre-issued service token
cendriix login --token $CENDRIIX_TOKEN

cendriix run

Trigger a workflow run, approve or reject a paused run, or cancel an in-progress run.

bash

cendriix run <workflow> [options]
cendriix run approve --run <run-id>
cendriix run reject  --run <run-id> [--note "reason"]
cendriix run cancel  --run <run-id>

Flag	Description
`--ticket`	Jira / Linear ticket key to attach to the run (e.g. `JIRA-3421`).
`--dry-run`	Plan without executing. Prints the agent chain and estimated cost.
`--env`	Target environment: `preview`, `staging`, `production`.
`--model`	Override the default LLM (e.g. `claude-opus-4-5`).
`--run`	Run ID for subcommands (approve / reject / cancel). Use `latest` shorthand.
`--note`	Human note attached to approve / reject events (visible in audit log).

bash

# Trigger ship-from-ticket
cendriix run ship-from-ticket --ticket JIRA-3421

# Dry run to preview cost
cendriix run ship-from-ticket --ticket JIRA-3421 --dry-run

# Approve the latest paused run
cendriix run approve --run latest --note "LGTM"

# Cancel a specific run
cendriix run cancel --run run_a1b2c3d4

cendriix logs

Stream or retrieve structured logs for a run.

bash

cendriix logs [--run <run-id>] [--follow] [--level <level>]

Flag	Default	Description
`--run`	`latest`	Run ID to fetch logs for.
`--follow`	`false`	Stream live logs (SSE). Ctrl+C to stop.
`--level`	`info`	Minimum log level: `debug`, `info`, `warn`, `error`.
`--output`	`pretty`	Output format: `pretty` or `json`.

bash

# Follow latest run
cendriix logs --follow

# JSON output for piping
cendriix logs --run run_a1b2c3d4 --output json | jq '.cost'

cendriix workspace

Manage workspace settings, cloud connectors, and team members.

bash

cendriix workspace show
cendriix workspace cloud connect --provider aws
cendriix workspace scm   connect --provider github
cendriix workspace member invite --email alice@example.com --role developer

Subcommand	Description
`show`	Print workspace metadata (slug, region, plan, connector status).
`cloud connect`	Link an AWS / GCP / Azure account.
`scm connect`	Install the GitHub / GitLab / Bitbucket App.
`member invite`	Invite a team member with a given role.
`member list`	List all members and their roles.

cendriix replay

Replay a past run deterministically, useful for debugging, auditing, or testing policy changes without triggering real side effects.

bash

cendriix replay --run <run-id> [--step <n>] [--dry-run]

Flag	Description
`--run`	Run ID to replay.
`--step`	Stop replay at step N (1-indexed). Useful for inspecting intermediate state.
`--dry-run`	Simulate replay without re-executing real cloud actions.

bash

# Full replay with dry-run (safe)
cendriix replay --run run_a1b2c3d4 --dry-run

# Replay and stop at step 3 for inspection
cendriix replay --run run_a1b2c3d4 --step 3

Side-effect isolationIn dry-run mode, all MCP tool calls are intercepted and logged but not executed. The replay uses the original LLM responses stored in the audit snapshot.

cendriix policy

Create, list, enable, or disable guardrail policies.

bash

cendriix policy list
cendriix policy create --file ./policies/no-delete-prod.yaml
cendriix policy enable  --id pol_xyz
cendriix policy disable --id pol_xyz

cendriix audit

Query structured audit events and export them for compliance tooling.

bash

cendriix audit query --since 2026-05-01 --until 2026-05-19
cendriix audit export --format csv --output ./audit-may.csv

Flag	Description
`--since`	ISO 8601 start date (inclusive).
`--until`	ISO 8601 end date (inclusive). Defaults to now.
`--actor`	Filter by actor email or service account ID.
`--event`	Filter by event type (e.g. `run.approved`).
`--format`	Export format: `json` (default), `csv`, `ndjson`.

Global flags

These flags are accepted by every command:

Flag	Description
`--workspace`	Override the active workspace slug.
`--config`	Path to the config file (default: `.cendriix/config.yaml`).
`--json`	Output machine-readable JSON.
`--no-color`	Disable ANSI colour output.
`--debug`	Enable verbose debug logging.
`--version`	Print the CLI version and exit.
`--help`	Print help for any command.

Environment variables

Variable	Description
`CENDRIIX_TOKEN`	Service-account token. Skips browser OAuth when set.
`CENDRIIX_WORKSPACE`	Active workspace slug. Overrides `--workspace`.
`CENDRIIX_API_URL`	API base URL (for self-hosted / EU region). Default: `https://api.example.com/v1`.
`CENDRIIX_LOG_LEVEL`	`debug`, `info`, `warn`, or `error`.

CI environmentsSet CENDRIIX_TOKEN as a secret in your CI environment and pass--no-color --json for clean machine-readable output.