reachpad CLI

Run coding agents in durable cloud workspaces: the disk survives the machine
underneath, so a paused workspace costs nothing and picks up from its last
save. Files survive a pause; running processes do not.

Install

With Homebrew on Apple silicon macOS or x86_64/arm64 Linux:

brew install reachpad/tap/reachpad

With npm, anywhere Node 18+ runs:

npm install -g @reachpad/cli

Or with the checksum-verifying installer:

curl -fsSL https://reachpad.dev/install | sh

Linux x86_64/arm64 (musl, static) and macOS arm64/x86_64. The script fetches
the latest release from this repository, verifies its checksum against
SHA256SUMS, and installs to ~/.local/bin/reachpad (override with
REACHPAD_INSTALL_DIR).

All three deliver the same binary. @reachpad/cli is a launcher around it, not
a second implementation — see npm/README.md, which also
explains the macOS quarantine problem npm sidesteps.

Get started

Run Reachpad:

reachpad

On first use, the CLI shows a short code, opens WorkOS hosted sign-in, and then
lists your workspaces. WorkOS handles the account login and any required MFA or
SSO. After approval, Reachpad exchanges the short-lived WorkOS token once and
saves a user-scoped Reachpad credential and the production endpoint with mode
0600. No password or authentication factor is entered into Reachpad.

On a remote machine without a usable browser, run reachpad auth login --no-browser and open the displayed URL on another device. The manual
credential flow remains available from
reachpad.dev/connect as a recovery path.

Then create a workspace, work in it, and put it away:

reachpad create scratch
reachpad list
reachpad attach <workspace-id>
reachpad run <workspace-id> -- cargo test
reachpad pause <workspace-id>

create prints the workspace id the other verbs take. The name is only a
label; there is no lookup by name.

Useful maintenance commands:

reachpad doctor
reachpad update
reachpad completions bash
reachpad completions zsh
reachpad completions fish

reachpad update respects how Reachpad was installed: Homebrew installs are
directed to brew upgrade reachpad and npm installs to npm install -g @reachpad/cli@latest, while installer-managed binaries are updated in place
after the release checksum is verified. Whoever installed the binary owns it —
a second writer is how a working install becomes a broken one.

Docs: reachpad.dev/docs/cli

Source and provenance

This repository carries the full CLI source: the reach package (shipped
binary name reachpad) and its two library crates (proto, the frozen wire
protocol, and authz, Biscuit verify and offline attenuation). Release
binaries are built from this source by
the release workflow on GitHub's runners, and
every release carries a SHA256SUMS the install script verifies. To build it
yourself (needs Rust and protoc):

cargo build --release -p reach
./target/release/reachpad --version

Every release tarball also carries a signed build-provenance attestation, so
the chain is checkable without trusting us:

gh attestation verify reachpad-<target>.tar.gz --repo Reachpad/reachpad-cli

That proves the bytes came out of this repository's release workflow at the
commit the tag names. It rests on no key of ours — the signing identity is a
short-lived credential minted for that one workflow run, and the record is in
a public transparency log.

The snapshot is synced from a private monorepo on every release, so file an
issue rather than a PR for changes; a PR here would be overwritten by the
next sync (the sync script and its header in Cargo.toml say the same).
The CLI is an ordinary client of a public API: it holds no platform secrets
and nothing it does is privileged (the server refuses anything a stranger
could not do).

Source-available; copyright Tako Research, all rights reserved.