Command line (CLI)
Use the governed Layer 1-9 API from a terminal: signals, graph intelligence, opportunities, pipeline, agents, and approvals.
Install
The CLI is a single workspace package with no runtime dependencies—just Node built-ins. It needs Node 20 or newer. Install the public package from npm, or build from source when working on the monorepo.
npm install -g @winlayer/cli
winlayer --version
# Local development
cd packages/cli
npm install
npm run build
npm link # puts `winlayer` on your PATH
winlayer --version
# Optional local/package-registry artifact
npm packcommand not found: winlayer after a global install means npm's global bin directory isn't on your PATH. Print it with npm prefix -g and add that folder's bin to your shell profile.
Sign in
Run winlayer login and pick a method — or just run winlayer, which signs you in if needed and then drops you straight into the interactive session.
| Method | Use it when |
|---|---|
account | Default. Approve the terminal in your browser on this machine. |
key | Paste a wl_live_… or wl_test_… key from the developer console — CI, containers, service accounts. |
device | No browser here: SSH sessions and headless boxes. Prints a code you approve on your phone or laptop. |
Skip the menu when you already know which one you want:
winlayer login # menu
winlayer login --method device # show a code to approve elsewhere
winlayer login --no-browser # same, without trying to open a browser
winlayer login --key wl_live_... # non-interactiveDevice login never sends your credential over the wire in the clear: the terminal generates a key pair, sends only the public key, and the credential comes back encrypted to it. Confirm which workspace you landed in with winlayer whoami.
Where the credential lives
In ~/.winlayer/config.json, written 0600 — owner read/write only, the same convention the aws and gh CLIs use. Environment variables always win over the file, so CI and one-off shells stay stateless:
| Variable | Effect |
|---|---|
WINLAYER_API_KEY | Use this key instead of the saved one. |
WINLAYER_API_URL | Point at a different API host (staging, self-hosted). |
WINLAYER_WEB_URL | Set the browser workspace origin used by winlayer open. |
WINLAYER_CHAT_TIER | Temporarily select fast, standard, or deep chat. |
WINLAYER_CONFIG_DIR | Store config somewhere other than ~/.winlayer. |
WINLAYER_COLOR=always | Force the purple theme even when the shell exports NO_COLOR. |
WINLAYER_MOTION=0 | Keep the visual theme but disable launch motion. |
winlayer logout revokes a browser-created CLI session and removes it locally. A developer API key is only forgotten on that machine; revoke it in the developer console to disable it everywhere. Manage developer keys on /developer.
Two ways to run it
Interactive. winlayer with no command opens the command center: a prompt that keeps your session, so you can chain questions without re-authenticating each time.
Press / or Ctrl K at an empty prompt to open the searchable command center. Search by command, description, or category; use the arrow keys to move, press Tab to fill a command into the prompt, or press Enter to run it immediately. Keys 1–4 launch the four Start Here actions directly.
One command, then exit. winlayer <command> runs and returns an exit code — this is the form to use in scripts, cron jobs, and CI.
Commands
| Command | What it does |
|---|---|
dashboard | Read-only workspace overview: capacity, opportunities, pipeline, approvals, and latest briefing. |
doctor | Check Node, config permissions, API health/readiness, credentials, and authentication. |
config | Inspect or update non-secret API, web, and chat-model settings. |
open [destination] | Open a named workspace page. Use open list to see all destinations. |
signals | Normalized source signals with provenance. --source, --type, --limit. |
forecasts | Published acquisition and recompete forecasts. --stage, --limit. |
agencies | Canonical agency graph nodes. --type, --query, --limit. |
relationships | Accepted procurement graph relationships. --type, --limit. |
intelligence | Published canonical intelligence objects. --type, --module, --limit. |
opportunities | Scored opportunities, ranked by fit and win probability. --min N, --limit N. |
opportunity <id> | One scored opportunity in full, with its evidence. |
pipeline | Your tracked pipeline. --status pursuing|watching|passed. |
contacts | Tenant-owned relationship contacts. --status, --category, --limit. |
export <resource> | Fetch successive pages as JSON, JSONL, CSV, or TSV. Output files are owner-only and never overwritten unless --force is used. |
agent | Run the autonomous Daily Growth Agent. --latest replays the last run. |
actions | Review the actions the agent proposed for approval. --status. |
approve <id> | Approve and execute a proposed action — audited. |
reject <id> | Reject a proposed action. |
agents | List the runnable AI agents and what each one takes. |
run-agent <id> | Preview policy with --dry-run or run any active registry agent. Add --signal when its input requires one. |
ask "<question>" | Ask the workspace analyst in plain English. |
brief <id> | Grounded, evidence-cited brief. --type capture|recompete|proposal. |
exec-brief | Portfolio-wide executive brief. |
usage | Customer-visible plan capacity for the workspace. |
model | Show or switch the chat model. --set fast|standard|deep. |
graphql '<query>' | Run a scoped read-only GraphQL query. Accepts a file, variables, and an operation name. |
schema | Print the versioned GraphQL schema. |
completion <shell> | Generate completion for Bash, Zsh, Fish, or PowerShell. |
whoami | Which workspace the current key belongs to. |
opps, opp, overview, and query are accepted as shorthand. daily is an alias for agent. Run winlayer help for the same list in your terminal.
Global options
| Flag | Effect |
|---|---|
--json | Machine-readable output on data, agent, model, approval, and logout commands. |
--url <url> | Override the API base URL for this command. |
--key <key> | Use this key for one command, ignoring saved config. |
--help, -h | Show help. |
--version, -v | Print the version. |
Scripting it
--json works on every data, agent, model, and approval command, so the CLI composes with whatever you already use. Nothing prompts when a key is supplied by environment, which is what makes it safe in CI:
export WINLAYER_API_KEY="wl_live_..."
# Everything worth pursuing this morning
winlayer opportunities --min 60 --json | jq '.opportunities[] | {title, fitScore, winProbability}'
# Run the Daily Growth Agent from cron and mail yourself the result
winlayer agent --json > /tmp/daily.json
# Export every signal page without replacing an existing file
winlayer export signals --format jsonl --output signals.jsonl
# Query the scoped, read-only GraphQL API
winlayer graphql 'query { apiVersion }' --jsonCommands exit non-zero on failure, so set -e behaves the way you expect. The CLI talks to the same public API documented under Authentication — the rate limits that apply to a key apply here too.