Opaline CLI

Capture Claude Code and OpenAI Codex sessions and upload them to Opaline for
team analytics. The production API remains at
https://app.rudel.ai during the Opaline migration.

Quick start

Requires Node.js 20 or newer.

npm install --global @opalinehq/cli
opaline login
opaline enable

opaline login opens a browser-based device flow. opaline enable installs
the available Claude Code and/or Codex hooks so completed sessions upload
automatically.

Existing rudel users do not need to log in again. Opaline intentionally reads
the existing ~/.rudel credential and state directory, and the rudel package
continues as a compatibility alias.

Typical workflow

# Check the installation and service connection
opaline doctor

# See the authenticated account
opaline whoami

# Upload existing sessions interactively
opaline upload

# Retry transient hook/upload failures
opaline upload --retry

# Stop automatic uploads
opaline disable

Key concepts

Sessions: Claude Code and Codex JSONL transcripts discovered on the local
machine.
Hooks: Agent lifecycle commands installed by opaline enable. Hooks run
headlessly, filter known secret patterns, and upload the completed session.
Organizations: The Opaline workspace receiving uploads. Use
opaline set-org to change the organization associated with a project.
Local state: Credentials, retry queues, logs, and project mappings remain
in ~/.rudel for compatibility. Set OPALINE_CONFIG_DIR to opt into another
directory; RUDEL_CONFIG_DIR remains supported.
Compatibility alias: The rudel executable delegates to the same Opaline
implementation with unchanged arguments, standard input/output, and exit
status. Its only addition is one rename notice on stderr per invocation.

Commands

Command	Description
`opaline login`	Authenticate through the browser device flow.
`opaline logout`	Revoke the current credential and log out locally.
`opaline whoami`	Show the authenticated user and local upload failures.
`opaline doctor`	Run read-only auth, API latency, config, version, and hook diagnostics.
`opaline enable`	Install available Claude Code and Codex upload hooks.
`opaline disable`	Remove Opaline upload hooks.
`opaline upload [session]`	Upload one session or choose past sessions interactively.
`opaline upload --retry`	Retry locally queued transient upload failures.
`opaline set-org`	Set the Opaline organization for the current project.
`opaline --help`	Show complete command and flag help.
`opaline --version`	Print the installed CLI version.

Configuration

The CLI defaults to the current production API at https://app.rudel.ai.

Variable	Purpose
`OPALINE_LOG_LEVEL=debug`	Print verbose, token-safe diagnostics to stderr for any command.
`OPALINE_API_BASE`	Override the API base; legacy `RUDEL_API_BASE` is also accepted.
`OPALINE_CONFIG_DIR`	Override local state; legacy `RUDEL_CONFIG_DIR` is also accepted.
`OPALINE_ALLOW_INSECURE_API_BASE=1`	Permit plaintext non-loopback login/auth traffic.
`OPALINE_ALLOW_INSECURE_ENDPOINT=1`	Permit plaintext non-loopback transcript uploads.

The insecure overrides transmit credentials or transcripts without transport
encryption. Use them only for a trusted self-hosted network.

Troubleshooting

Start with:

OPALINE_LOG_LEVEL=debug opaline doctor

Not authenticated: run opaline login. Existing credentials should be
found automatically under ~/.rudel/credentials.json.
API unreachable: confirm that https://app.rudel.ai/health is reachable
and check OPALINE_API_BASE/RUDEL_API_BASE overrides.
Hooks disabled: run opaline enable from the project where the agent is
used. Existing rudel hook commands are recognized and upgraded when the
hook is installed again.
Queued upload failures: run opaline upload --retry. Permanent failures
remain visible in opaline whoami.
Machine-readable scripts changed after installing rudel: the alias
keeps command stdout unchanged; its rename notice is written only to stderr.

Security and data handling

Opaline uploads full coding-agent session transcripts and related metadata.
Transcripts may contain prompts, model responses, source code, tool output,
file contents, command output, URLs, repository metadata, and sub-agent
transcripts. Enable uploads only for projects and environments where that data
may be sent to the hosted service.

Before upload, the CLI applies deterministic filtering for known secret
patterns to the main transcript and sub-agent transcripts. Secret filtering is
best-effort, not a guarantee: custom credentials, split or encoded secrets,
unusual formats, screenshots, and other sensitive values may not match. Safety
limits stop an upload when filtering cannot preserve transcript integrity,
cannot converge, or redacts an unexpectedly large portion of the payload, but
they cannot prove that the remaining transcript is free of secrets.

Keep secrets out of agent sessions, review your organization's data policies,
and treat filtering as defense in depth. Report security issues through the
private process in SECURITY.md.

Development

bun install
bun run verify
bun run --cwd apps/cli dev --help

See CONTRIBUTING.md for the contribution workflow.

License

MIT