WinLayer Docs
Product documentation · Beta behavior. A documented path is not production acceptance; availability still depends on source health, workspace plan, provider setup, and deployed evidence.

Command line (CLI)

Use the governed Layer 1-9 API from a terminal: signals, graph intelligence, opportunities, pipeline, agents, and approvals.

Install

The CLI is a single workspace package with no runtime dependencies—just Node built-ins. It needs Node 20 or newer. Install the public package from npm, or build from source when working on the monorepo.

bash
npm install -g @winlayer/cli
winlayer --version

# Local development
cd packages/cli
npm install
npm run build
npm link          # puts `winlayer` on your PATH

winlayer --version

# Optional local/package-registry artifact
npm pack

command not found: winlayer after a global install means npm's global bin directory isn't on your PATH. Print it with npm prefix -g and add that folder's bin to your shell profile.

Sign in

Run winlayer login and pick a method — or just run winlayer, which signs you in if needed and then drops you straight into the interactive session.

MethodUse it when
accountDefault. Approve the terminal in your browser on this machine.
keyPaste a wl_live_… or wl_test_… key from the developer console — CI, containers, service accounts.
deviceNo browser here: SSH sessions and headless boxes. Prints a code you approve on your phone or laptop.

Skip the menu when you already know which one you want:

bash
winlayer login                      # menu
winlayer login --method device      # show a code to approve elsewhere
winlayer login --no-browser         # same, without trying to open a browser
winlayer login --key wl_live_...    # non-interactive

Device login never sends your credential over the wire in the clear: the terminal generates a key pair, sends only the public key, and the credential comes back encrypted to it. Confirm which workspace you landed in with winlayer whoami.

Where the credential lives

In ~/.winlayer/config.json, written 0600 — owner read/write only, the same convention the aws and gh CLIs use. Environment variables always win over the file, so CI and one-off shells stay stateless:

VariableEffect
WINLAYER_API_KEYUse this key instead of the saved one.
WINLAYER_API_URLPoint at a different API host (staging, self-hosted).
WINLAYER_WEB_URLSet the browser workspace origin used by winlayer open.
WINLAYER_CHAT_TIERTemporarily select fast, standard, or deep chat.
WINLAYER_CONFIG_DIRStore config somewhere other than ~/.winlayer.
WINLAYER_COLOR=alwaysForce the purple theme even when the shell exports NO_COLOR.
WINLAYER_MOTION=0Keep the visual theme but disable launch motion.

winlayer logout revokes a browser-created CLI session and removes it locally. A developer API key is only forgotten on that machine; revoke it in the developer console to disable it everywhere. Manage developer keys on /developer.

Two ways to run it

Interactive. winlayer with no command opens the command center: a prompt that keeps your session, so you can chain questions without re-authenticating each time.

Press / or Ctrl K at an empty prompt to open the searchable command center. Search by command, description, or category; use the arrow keys to move, press Tab to fill a command into the prompt, or press Enter to run it immediately. Keys 1–4 launch the four Start Here actions directly.

One command, then exit. winlayer <command> runs and returns an exit code — this is the form to use in scripts, cron jobs, and CI.

Commands

CommandWhat it does
dashboardRead-only workspace overview: capacity, opportunities, pipeline, approvals, and latest briefing.
doctorCheck Node, config permissions, API health/readiness, credentials, and authentication.
configInspect or update non-secret API, web, and chat-model settings.
open [destination]Open a named workspace page. Use open list to see all destinations.
signalsNormalized source signals with provenance. --source, --type, --limit.
forecastsPublished acquisition and recompete forecasts. --stage, --limit.
agenciesCanonical agency graph nodes. --type, --query, --limit.
relationshipsAccepted procurement graph relationships. --type, --limit.
intelligencePublished canonical intelligence objects. --type, --module, --limit.
opportunitiesScored opportunities, ranked by fit and win probability. --min N, --limit N.
opportunity <id>One scored opportunity in full, with its evidence.
pipelineYour tracked pipeline. --status pursuing|watching|passed.
contactsTenant-owned relationship contacts. --status, --category, --limit.
export <resource>Fetch successive pages as JSON, JSONL, CSV, or TSV. Output files are owner-only and never overwritten unless --force is used.
agentRun the autonomous Daily Growth Agent. --latest replays the last run.
actionsReview the actions the agent proposed for approval. --status.
approve <id>Approve and execute a proposed action — audited.
reject <id>Reject a proposed action.
agentsList the runnable AI agents and what each one takes.
run-agent <id>Preview policy with --dry-run or run any active registry agent. Add --signal when its input requires one.
ask "<question>"Ask the workspace analyst in plain English.
brief <id>Grounded, evidence-cited brief. --type capture|recompete|proposal.
exec-briefPortfolio-wide executive brief.
usageCustomer-visible plan capacity for the workspace.
modelShow or switch the chat model. --set fast|standard|deep.
graphql '<query>'Run a scoped read-only GraphQL query. Accepts a file, variables, and an operation name.
schemaPrint the versioned GraphQL schema.
completion <shell>Generate completion for Bash, Zsh, Fish, or PowerShell.
whoamiWhich workspace the current key belongs to.

opps, opp, overview, and query are accepted as shorthand. daily is an alias for agent. Run winlayer help for the same list in your terminal.

Global options

FlagEffect
--jsonMachine-readable output on data, agent, model, approval, and logout commands.
--url <url>Override the API base URL for this command.
--key <key>Use this key for one command, ignoring saved config.
--help, -hShow help.
--version, -vPrint the version.

Scripting it

--json works on every data, agent, model, and approval command, so the CLI composes with whatever you already use. Nothing prompts when a key is supplied by environment, which is what makes it safe in CI:

bash
export WINLAYER_API_KEY="wl_live_..."

# Everything worth pursuing this morning
winlayer opportunities --min 60 --json | jq '.opportunities[] | {title, fitScore, winProbability}'

# Run the Daily Growth Agent from cron and mail yourself the result
winlayer agent --json > /tmp/daily.json

# Export every signal page without replacing an existing file
winlayer export signals --format jsonl --output signals.jsonl

# Query the scoped, read-only GraphQL API
winlayer graphql 'query { apiVersion }' --json

Commands exit non-zero on failure, so set -e behaves the way you expect. The CLI talks to the same public API documented under Authentication — the rate limits that apply to a key apply here too.

Prefer a window to a prompt? The desktop app puts the same workspace one keystroke away, and the two share nothing but your account — install either, or both.