Command Code CLI

Run the genuine Command Code v1 CLI inside an agentOS VM.

Quick start

import commandCode from "@agentos-software/command-code";
import { agentOS, setup } from "@rivet-dev/agentos";

const vm = agentOS({ software: [commandCode] });

export const registry = setup({ use: { vm } });
registry.start();

import { createClient } from "@rivet-dev/agentos/client";
import type { registry } from "./server";

const client = createClient<typeof registry>({
	endpoint: "http://localhost:6420",
});
const agent = client.vm.getOrCreate("my-agent");
const apiKey = process.env.COMMAND_CODE_API_KEY;
if (!apiKey) throw new Error("COMMAND_CODE_API_KEY is required");

await agent.mkdir("/workspace", { recursive: true });
const result = await agent.execArgv(
	"cmd",
	[
		"-p",
		"What files are in the current directory?",
		"--output-format",
		"json",
		"--trust",
		"--yolo",
		"--skip-onboarding",
		"--no-auto-update",
	],
	{
		cwd: "/workspace",
		env: { COMMAND_CODE_API_KEY: apiKey },
	},
);
if (result.exitCode !== 0) throw new Error(result.stderr || result.stdout);
console.log(result.stdout);

The registry package projects command-code@1.1.0 as cmd, cmdc, command-code, and commandcode. It uses the genuine upstream CLI, rebundled for the VM with compatibility patches recorded in the package’s agentos-build.json. It is a command package, not an ACP agent. Invoke it with execArgv or attach a terminal for interactive use.

The CLI is sourced from the npm release, whose package metadata is UNLICENSED; the public Command Code GitHub repository does not contain the CLI implementation. Review the upstream terms before publishing or redistributing the packed artifact.

Credentials

Create a Command Code API key and pass it to the command as COMMAND_CODE_API_KEY, sourced from your server’s environment. The credential stays inside the VM process environment and is read by the packaged Command Code CLI.

See Command Code’s documentation for account and model details.

Verified command surface

The agentOS end-to-end test runs the packaged command in a real VM and verifies:

• version and help output;
• unauthenticated status JSON and the documented headless authentication exit code;
• .agents/skills/ discovery with cmd skills list --debug;
• local TypeScript mod installation and discovery with cmd mods add / list;
• project-scoped HTTP MCP add/get configuration and the resulting .mcp.json;
• all four projected command aliases.

The opt-in network test installs the pinned cmd-mod-hi@0.1.1 npm mod in a standard VM. npm-backed mods require the default common software bundle’s sh; a minimal VM created with defaultSoftware: false must add @agentos-software/coreutils. The opt-in live test also verifies API-key authentication and reaches Command Code’s hosted model endpoint. The available test key reached the billing boundary but had insufficient credits, so a complete generated model response has not been validated. Interactive help was also exercised through an agentOS terminal, but a complete interactive login and model turn has not been validated.

Runtime support matrix

Legend: 🟢 Supported means the platform provides the required behavior; notes identify any Command Code path that has not yet been exercised end to end. 🟡 Partial identifies a concrete platform limitation, not merely missing test coverage. 🔴 Not implemented / unsupported means the current implementation does not provide the behavior; it does not necessarily mean the behavior is impossible to add.

This Cloudflare column evaluates running the npm CLI directly in a standard Worker isolate with nodejs_compat. It does not describe an official Command Code Worker implementation—none was found—and it does not cover Cloudflare Sandbox, which is a separate container product with a real filesystem and shell.

agentOS does not currently implement registry-mediated self-update. cmd update replaces a globally installed npm package, but it cannot replace the content-addressed, read-only package projected at /opt/agentos. A future host-mediated updater could select a newer registry package without mutating that projection; for now, run with --no-auto-update and upgrade the registry package from the host. Mods install into writable user/project storage instead, which is why local and pure TypeScript npm mods work; npm-backed installation needs sh, while Git sources need Git and native Node add-ons cannot load in the VM.

Sources: Command Code CLI reference, headless mode, MCP, skills, mods, hooks, Cloudflare Node.js compatibility, and Cloudflare Worker filesystem.

Permissions and updates

--yolo lets Command Code edit files and run shell commands without its own prompts. Those operations remain subject to the VM’s filesystem, process, network, and resource policies. Only use it with trusted prompts and least-privilege VM configuration.

The registry package is immutable at /opt/agentos, so use --no-auto-update (or COMMANDCODE_SKIP_UPDATES=1) and update through a newer registry package instead.