GitHub - Reachpad/reachpad-cli: The reachpad CLI: workspaces where Claude, Codex and other coding agents build full-stack apps and share them by link, from your

Source: https://github.com/Reachpad/reachpad-cli

Run coding agents in durable cloud workspaces: disk and memory survive the machine underneath, so a paused workspace resumes mid-session.

Install

[](https://github.com/Reachpad/reachpad-cli#install) With Homebrew on Apple silicon macOS or x86_64/arm64 Linux:

brew install reachpad/tap/reachpad

With npm, anywhere Node 18+ runs:

npm install -g @reachpad/cli

Or with the checksum-verifying installer:

curl -fsSL https://reachpad.dev/install | sh

Linux x86_64/arm64 (musl, static) and macOS arm64/x86_64. The script fetches the latest release from this repository, verifies its checksum against SHA256SUMS, and installs to `~/.local/bin/reachpad` (override with `REACHPAD_INSTALL_DIR`).

All three deliver the same binary. `@reachpad/cli` is a launcher around it, not a second implementation — see `npm/README.md`, which also explains the macOS quarantine problem npm sidesteps.

Get started

[](https://github.com/Reachpad/reachpad-cli#get-started) Run Reachpad:

reachpad

On first use, the CLI shows a short code, opens WorkOS hosted sign-in, and then lists your workspaces. WorkOS handles the account login and any required MFA or SSO. After approval, Reachpad exchanges the short-lived WorkOS token once and saves a user-scoped Reachpad credential and the production endpoint with mode 0600. No password or authentication factor is entered into Reachpad.

On a remote machine without a usable browser, run `reachpad auth login --no-browser` and open the displayed URL on another device. The manual credential flow remains available from reachpad.dev/connect as a recovery path.

Then list, create, or attach to a workspace:

reachpad ws list reachpad ws create --name scratch reachpad attach <workspace-id>

Useful maintenance commands:

reachpad doctor reachpad update reachpad completions bash reachpad completions zsh reachpad completions fish

`reachpad update` respects how Reachpad was installed: Homebrew installs are directed to `brew upgrade reachpad` and npm installs to `npm install -g @reachpad/cli@latest`, while installer-managed binaries are updated in place after the release checksum is verified. Whoever installed the binary owns it — a second writer is how a working install becomes a broken one.

Docs: reachpad.dev/docs/cli

Source and provenance

[](https://github.com/Reachpad/reachpad-cli#source-and-provenance)

This repository carries the full CLI source: the `reach` package (shipped binary name `reachpad`) and its three library crates (`proto`, the frozen wire protocol; `authz`, Biscuit verify and offline attenuation; `runtime`, the config and tracing shell). Release binaries are built from this source by the release workflow on GitHub's runners, and every release carries a SHA256SUMS the install script verifies. To build it yourself (needs Rust and `protoc`):

cargo build --release -p reach ./target/release/reachpad --version

Every release tarball also carries a signed build-provenance attestation, so the chain is checkable without trusting us:

gh attestation verify reachpad-<target>.tar.gz --repo Reachpad/reachpad-cli

That proves the bytes came out of this repository's release workflow at the commit the tag names. It rests on no key of ours — the signing identity is a short-lived credential minted for that one workflow run, and the record is in a public transparency log.

The snapshot is synced from a private monorepo on every release, so file an issue rather than a PR for changes; a PR here would be overwritten by the next sync (the sync script and its header in `Cargo.toml` say the same). The CLI is an ordinary client of a public API: it holds no platform secrets and nothing it does is privileged (the server refuses anything a stranger could not do).