Reachpad CLI – Spin up free sandboxes in seconds to develop and host apps

Reachpad has released a command-line interface (CLI) that lets developers spin up free cloud sandboxes in seconds to develop and host apps, with durable workspaces that survive machine pauses. The CLI, installable via Homebrew, npm, or a checksum-verifying script, supports macOS and Linux and integrates with WorkOS for authentication. It is source-available under copyright of Tako Research, with release binaries built from the repository and signed build-provenance attestations.

Run coding agents in durable cloud workspaces: disk and memory survive the machine underneath, so a paused workspace resumes mid-session. With Homebrew on Apple silicon macOS or x86 64/arm64 Linux: brew install reachpad/tap/reachpad With npm, anywhere Node 18+ runs: npm install -g @reachpad/cli Or with the checksum-verifying installer: curl -fsSL https://reachpad.dev/install | sh Linux x86 64/arm64 musl, static and macOS arm64/x86 64. The script fetches the latest release from this repository, verifies its checksum against SHA256SUMS, and installs to ~/.local/bin/reachpad override with REACHPAD INSTALL DIR . All three deliver the same binary. @reachpad/cli is a launcher around it, not a second implementation — see npm/README.md /Reachpad/reachpad-cli/blob/main/npm/README.md , which also explains the macOS quarantine problem npm sidesteps. Run Reachpad: reachpad On first use, the CLI shows a short code, opens WorkOS hosted sign-in, and then lists your workspaces. WorkOS handles the account login and any required MFA or SSO. After approval, Reachpad exchanges the short-lived WorkOS token once and saves a user-scoped Reachpad credential and the production endpoint with mode 0600. No password or authentication factor is entered into Reachpad. On a remote machine without a usable browser, run reachpad auth login --no-browser and open the displayed URL on another device. The manual credential flow remains available from reachpad.dev/connect https://reachpad.dev/connect as a recovery path. Then list, create, or attach to a workspace: reachpad ws list reachpad ws create --name scratch reachpad attach <workspace-id Useful maintenance commands: reachpad doctor reachpad update reachpad completions bash reachpad completions zsh reachpad completions fish reachpad update respects how Reachpad was installed: Homebrew installs are directed to brew upgrade reachpad and npm installs to npm install -g @reachpad/cli@latest , while installer-managed binaries are updated in place after the release checksum is verified. Whoever installed the binary owns it — a second writer is how a working install becomes a broken one. Docs: reachpad.dev/docs/cli https://reachpad.dev/docs/cli This repository carries the full CLI source: the reach package shipped binary name reachpad and its three library crates proto , the frozen wire protocol; authz , Biscuit verify and offline attenuation; runtime , the config and tracing shell . Release binaries are built from this source by the release workflow /Reachpad/reachpad-cli/blob/main/.github/workflows/release.yml on GitHub's runners, and every release carries a SHA256SUMS the install script verifies. To build it yourself needs Rust and protoc : cargo build --release -p reach ./target/release/reachpad --version Every release tarball also carries a signed build-provenance attestation, so the chain is checkable without trusting us: gh attestation verify reachpad-<target .tar.gz --repo Reachpad/reachpad-cli That proves the bytes came out of this repository's release workflow at the commit the tag names. It rests on no key of ours — the signing identity is a short-lived credential minted for that one workflow run, and the record is in a public transparency log. The snapshot is synced from a private monorepo on every release, so file an issue rather than a PR for changes; a PR here would be overwritten by the next sync the sync script and its header in Cargo.toml say the same . The CLI is an ordinary client of a public API: it holds no platform secrets and nothing it does is privileged the server refuses anything a stranger could not do . Source-available; copyright Tako Research, all rights reserved.