Run coding agents in durable cloud workspaces: disk and memory survive the machine underneath, so a d workspace resumes mid-session.
With Homebrew on Apple silicon macOS or x86_64/arm64 Linux:
brew install reachpad/tap/reachpad
With npm, anywhere Node 18+ runs:
npm install -g @reachpad/cli
Or with the checksum-verifying installer:
curl -fsSL https://reachpad.dev/install | sh
Linux x86_64/arm64 (musl, static) and macOS arm64/x86_64. The script fetches
the latest release from this repository, verifies its checksum against
SHA256SUMS, and installs to ~/.local/bin/reachpad
(override with
REACHPAD_INSTALL_DIR
).
All three deliver the same binary. @reachpad/cli
is a launcher around it, not a second implementation — see npm/README.md, which also explains the macOS quarantine problem npm sidesteps.
Run Reachpad:
reachpad
On first use, the CLI shows a short code, opens WorkOS hosted sign-in, and then lists your workspaces. WorkOS handles the account login and any required MFA or SSO. After approval, Reachpad exchanges the short-lived WorkOS token once and saves a user-scoped Reachpad credential and the production endpoint with mode 0600. No password or authentication factor is entered into Reachpad.
On a remote machine without a usable browser, run reachpad auth login --no-browser
and open the displayed URL on another device. The manual credential flow remains available from reachpad.dev/connect as a recovery path.
Then list, create, or attach to a workspace:
reachpad ws list
reachpad ws create --name scratch
reachpad attach <workspace-id>
Useful maintenance commands:
reachpad doctor
reachpad update
reachpad completions bash
reachpad completions zsh
reachpad completions fish
reachpad update
respects how Reachpad was installed: Homebrew installs are
directed to brew upgrade reachpad
and npm installs to npm install -g @reachpad/cli@latest
, while installer-managed binaries are updated in place after the release checksum is verified. Whoever installed the binary owns it — a second writer is how a working install becomes a broken one.
Docs: reachpad.dev/docs/cli
This repository carries the full CLI source: the reach
package (shipped
binary name reachpad
) and its three library crates (proto
, the frozen
wire protocol; authz
, Biscuit verify and offline attenuation; runtime
,
the config and tracing shell). Release binaries are built from this source
by the release workflow on GitHub's
runners, and every release carries a SHA256SUMS the install script verifies.
To build it yourself (needs Rust and protoc
):
cargo build --release -p reach
./target/release/reachpad --version
Every release tarball also carries a signed build-provenance attestation, so the chain is checkable without trusting us:
gh attestation verify reachpad-<target>.tar.gz --repo Reachpad/reachpad-cli
That proves the bytes came out of this repository's release workflow at the commit the tag names. It rests on no key of ours — the signing identity is a short-lived credential minted for that one workflow run, and the record is in a public transparency log.
The snapshot is synced from a private monorepo on every release, so file an
issue rather than a PR for changes; a PR here would be overwritten by the
next sync (the sync script and its header in Cargo.toml
say the same). The CLI is an ordinary client of a public API: it holds no platform secrets and nothing it does is privileged (the server refuses anything a stranger could not do).
Source-available; copyright Tako Research, all rights reserved.