CLI reference
Workspace and host commands.
Workspace: agentgate
Runs inside the agent workspace. No GitHub token needed. AGENTGATE_URL defaults to http://agentd:7432.
agentgate doctor
agentgate renew
agentgate pr list [--repo OWNER/REPO] [--state open|closed|all] [--page N] [--per-page N]
agentgate pr view NUMBER [--repo OWNER/REPO]
agentgate pr create --title TITLE --base BRANCH [--head BRANCH] [--body-file FILE] [--ready] [--upstream OWNER/REPO] [--repo OWNER/REPO]
agentgate pr comment NUMBER --body-file FILE [--repo OWNER/REPO]
agentgate pr review NUMBER --body-file FILE [--repo OWNER/REPO]
agentgate pr merge NUMBER --sha HEAD_SHA [--method squash|merge|rebase] [--repo OWNER/REPO]
agentgate ci list [--repo OWNER/REPO] [--branch BRANCH] [--page N] [--per-page N]
agentgate ci view RUN_ID [--repo OWNER/REPO]
agentgate ci jobs RUN_ID [--repo OWNER/REPO] [--page N] [--per-page N]
agentgate ci logs JOB_ID [--repo OWNER/REPO] [--output FILE] [--force]| Command | Notes |
|---|---|
doctor | Checks Git/LFS, commit identity, and broker connectivity. Doesn't prove App permissions. |
renew | Re-runs workspace setup so Git sends a renewed runtime assertion. |
pr create | Drafts unless --ready. --upstream opens a fork PR. |
pr review | Always a COMMENT review. |
pr merge | Needs human approval and the full 40-character head SHA. Defaults to squash. |
ci logs | Plain text. --output writes mode 0600 and refuses to overwrite without --force. |
agentgate-egress-check validates host isolation — see Docker workspace.
Host: npm scripts
Run on the trusted host, never in the workspace.
| Script | Purpose |
|---|---|
npm start | Start agentd |
npm run approvals | List approvals (pending, superseded) |
npm run approve -- <id> | Approve (full ID or ≥8-char prefix) |
npm run deny -- <id> | Deny |
npm run approval-web | Start the approval web UI |
npm run audit:verify [dir] | Verify the audit hash chain |
npm run audit:forward | Ship audit records off-host |
npm run demo | Credential-free demo |
npm test | Unit and real-Git integration tests |
npm run test:fuzz | Protocol fuzzing |
npm run test:docker | Container smoke test |
npm run test:live | Live GitHub App smoke test |
Host: scripts
| Script | Purpose |
|---|---|
scripts/issue-runtime.js | Mint an Ed25519 runtime assertion |
scripts/sign-bundle.js | Sign a policy or revocation bundle |
scripts/detect.js | Run SIEM detections over audit records |
scripts/make-dev-cert.sh | Development CA and broker certificate |