CLI command reference

This page indexes the current customer CLI surface, including Aient CLI 0.10.16. Use aient COMMAND --help to confirm the flags supported by your installed version.

Authentication

Command	Purpose
`aient auth login [--print-url] [--project-access=auto\|none]`	Sign in through browser OAuth and, by default, reconcile bounded project access.
`aient auth status`	Verify and display the selected login or repository-private project lease.
`aient auth logout`	Stop the selected profile’s managed project services, then revoke and remove the login.
`aient auth profiles`	List named non-secret profile metadata.
`aient auth profiles default NAME`	Set the fallback customer profile.
`aient auth export`	Deliberately export a short-lived access-only credential.
`aient auth export --store-in-project`	Repair or reconcile manager-owned access for the nearest configured project.
`aient auth exec -- COMMAND...`	Run a trusted task with a renewable, restricted Aient credential.

See Authentication and project profiles.

Sandboxes

Command	Purpose
`aient sandbox list`	List visible sandboxes.
`aient sandbox create`	Create a retained sandbox.
`aient sandbox status SANDBOX`	Show sandbox state.
`aient sandbox wait SANDBOX`	Wait for readiness.
`aient sandbox sync SANDBOX [LOCAL_WORKSPACE]`	Synchronize exact Git and selected extra-file state.
`aient sandbox run -- COMMAND...`	Create, run, and clean up a disposable sandbox.
`aient sandbox exec SANDBOX -- COMMAND...`	Run a supervised command in a retained sandbox.
`aient sandbox shell SANDBOX`	Open a new interactive shell.
`aient sandbox logs SANDBOX`	Read a bounded sandbox runtime log snapshot.
`aient sandbox delete SANDBOX`	Delete a sandbox.

See Run and synchronise workspaces and Retained sandbox lifecycle.

An environment-bound customer sandbox requires --environment on status, wait, and logs, and its original environment and repository selectors on exec and execution. sync, files, and shell apply only to sandboxes without an environment binding. Start a fresh run --keep to transfer changed customer workspace state.

Retained workspace operations

Command	Purpose
`aient sandbox workspace status OPERATION`	Inspect the current phase of one retained workspace publication.
`aient sandbox workspace resume OPERATION`	Continue that exact interrupted workspace publication.
`aient sandbox workspace discard OPERATION`	Release an uncommitted retained publication after the server confirms it is safe.

These commands use the immutable local receipt created by a workspace-backed sandbox run or sandbox sync. They never rebuild a new operation under the same ID. See Run and synchronise workspaces.

Environment secrets

Command	Purpose
`aient environment secrets set --environment ENV NAME --stdin`	Set or replace one encrypted environment secret.

See Environment secrets. Only current organisation owners and administrators can set secrets.

Supervised executions

Command	Purpose
`aient sandbox execution attach SANDBOX EXECUTION`	Receive new live output.
`aient sandbox execution status SANDBOX EXECUTION`	Read content-free current state.
`aient sandbox execution wait SANDBOX EXECUTION`	Wait for a content-free terminal outcome.
`aient sandbox execution cancel SANDBOX EXECUTION`	Cancel the exact execution.

See Executions, output, and files. Repeat the original --environment and --repository selectors on every execution observation or cancellation of an environment-bound customer command.

Explicit files

Command	Purpose
`aient sandbox files put SANDBOX LOCAL_PATH ABSOLUTE_REMOTE_DIRECTORY`	Upload one file or directory.
`aient sandbox files get SANDBOX ABSOLUTE_REMOTE_FILE LOCAL_PATH`	Download one file.
`aient sandbox files ls SANDBOX [ABSOLUTE_REMOTE_DIRECTORY]`	List a directory.
`aient sandbox files rm SANDBOX ABSOLUTE_REMOTE_PATH`	Remove a path.

Utility commands

Command	Purpose
`aient version`	Print version, source commit, and build time.
`aient completion bash	fish	powershell	zsh`	Generate shell completion.
`aient help [COMMAND]`	Show help.

Global customer flags

Flag	Meaning
`--profile NAME`	Select a named customer profile.
`--access-token-file PATH`	Read one mode-`0600` access-only JSON envelope.
`--timeout DURATION`	API request budget; for `sandbox exec`, also the remote command budget. For workspace-sync archives, this is an inactivity budget that resets while bytes flow or a response begins. Default `5m`.
`--verbose`	Print safe request metadata and detailed progress.
`--version`, `-v`	Print version information.
`--help`, `-h`	Show help.

Reference

Changelog

CLI command reference

CLI command reference

Authentication

Sandboxes

Retained workspace operations

Environment secrets

Supervised executions

Explicit files

Utility commands

Global customer flags

​CLI command reference

​Authentication

​Sandboxes

​Retained workspace operations

​Environment secrets

​Supervised executions

​Explicit files

​Utility commands

​Global customer flags

CLI command reference

Authentication

Sandboxes

Retained workspace operations

Environment secrets

Supervised executions

Explicit files

Utility commands

Global customer flags