Go CLI / Daemon SDK

The rensei binary is the platform's Go CLI. It ships the full donmai OSS command surface (agent, fleet, governor, queue, dashboard, status) plus platform-exclusive commands for auth, project management, daemon lifecycle, and org administration - all authenticated via rsk_live_* API keys or WorkOS browser login.

Installation

brew tap RenseiAI/tap
brew install rensei

After install, verify:

rensei --version

The Homebrew cask pulls notarized binaries from github.com/RenseiAI/releases. The source is closed-source; only compiled binaries are distributed.

First-time setup

rensei auth add --user

echo "$RENSEI_API_KEY" | rensei auth add --kind org_token --token-stdin

rensei setup

rensei host install

rensei status

Command tree

Auth - rensei auth

Manages named auth contexts stored in ~/.config/rensei/config.json. Supports three kinds: user (WorkOS device flow), org_token (rsk_ key scoped to an org), and project_token (rsk_ key scoped to a project).

Config is stored at ~/.config/rensei/config.json. Secrets are placed in the OS keychain by default; --secret-store encrypted_file or --secret-store env are available for headless environments.

Org - rensei org

# List org members
rensei org members list

# Invite a new member
rensei org invites create alice@example.com --role member

# Create an API key
rensei org api-keys create --name "ci-deploy" --scope read --scope write

# List API keys
rensei org api-keys list

Project - rensei project

# Add a GitHub repository to the active project
rensei project repo add https://github.com/acme/backend

# Connect a Linear workspace as the issue tracker
rensei project trackers connect linear

# List project tokens (worker registration keys)
rensei project tokens list

# Create a new project registration token
rensei project tokens create --name "macbook-worker"

Host - rensei host

Lifecycle commands for the local daemon process and launchd/systemd service registration. rensei host is the CLI's top-level noun for "this machine" (ADR-2026-08-03). As of v0.9.0 the legacy top-level worker alias (18 leaf paths, hidden since 2026-05-06) is removed outright, not deprecated further - rensei worker host install and friends now error with "unknown command."

Linux scope flags (applicable to install, uninstall, doctor):

rensei host install --user    # user-scoped systemd unit (default)
rensei host install --system  # system-scoped unit, requires sudo

Host capacity - rensei host capacity

This machine's capacity envelope, session counts, and workarea pool - the only surface for this local state as of v0.9.0. It used to be reachable three ways: the top-level worker capacity alias and the hidden, never-deprecated daemon stats/daemon set/daemon evict duplicate tree both forwarded to the same factories host capacity composes. Both are deleted outright, not deprecated further.

# Show local capacity, session counts, and pool stats
rensei host capacity status [--pool] [--by-machine] [--machines] [--json]

# Adjust max concurrent sessions at runtime
rensei host capacity set capacity.maxConcurrentSessions 4

# Set maximum pool disk usage (LRU eviction threshold)
rensei host capacity set capacity.poolMaxDiskGb 20

# Evict stale workarea pool members
rensei host capacity evict --repo https://github.com/acme/backend --older-than 24h

--machines enriches per-machine stats with org-level fleet metadata from the platform - it and --by-machine used to be masked because daemon stats was their only documented home; now that daemon stats is gone, both flags are un-hidden here so the org-level view stays discoverable. set writes to ~/.rensei/daemon.yaml atomically and signals the running daemon to reload the affected subsystem without a restart.

For the platform-sourced view of every host and sandbox across the whole org (not just this machine), use rensei capacity show --kind persistent-host instead - see CLI: Capacity.

Global flags

All commands accept these persistent flags:

Configuration

Config is read from ~/.config/rensei/config.json. Key fields:

{
  "apiBaseURL": "https://app.rensei.ai",
  "activeAuth": "my-org",
  "auths": {
    "my-org": {
      "kind": "org_token",
      "orgSlug": "acme",
      "activeProjectSlug": "backend"
    }
  }
}

View with rensei config show, change defaults with rensei config set <key> <value>, reset to defaults with rensei config reset.

Daemon config - ~/.rensei/daemon.yaml

The daemon reads its configuration from ~/.rensei/daemon.yaml at startup. Key sections:

platform:
  url: https://app.rensei.ai

capacity:
  maxConcurrentSessions: 2
  poolMaxDiskGb: 20

projects:
  - id: backend
    repository: https://github.com/acme/backend.git

The projects allowlist must include an entry for each repository the daemon is permitted to accept work for. Bind repositories with rensei project repo add, then enable the project for the host with rensei host project enable.

Daemon HTTP API

The daemon exposes a local HTTP control API on 127.0.0.1:7734 (configurable). The rensei host commands talk to this API. You can also reach it directly:

# Status
curl http://127.0.0.1:7734/api/daemon/status

# Stats
curl http://127.0.0.1:7734/api/daemon/stats?pool=true

Credential socket protocol

The daemon mediates credential delivery to agent subprocesses over a Unix socket at $XDG_RUNTIME_DIR/rensei/credentials.sock (or /var/run/rensei/credentials.sock for system-scoped installs).

Protocol is line-delimited JSON, one connection per agent session:

Agent → Daemon:   {"type":"HELLO","sessionId":"sess_..."}
Daemon → Agent:   {"type":"INITIAL","env":{"ANTHROPIC_API_KEY":"sk-...","LINEAR_API_KEY":"..."}}
Daemon → Agent:   {"type":"UPDATE","env":{"ANTHROPIC_API_KEY":"sk-rotated..."}}  # on OAuth rotation
Agent → Daemon:   {"type":"BYE"}

The daemon resolves credentials at spawn time by calling POST /api/daemon/credentials/snapshot on the platform (Bearer rsk_* auth) and merges them into the child process's exec environment. The socket provides a fallback and live-rotation channel.

RENSEI_CREDENTIAL_SNAPSHOT_FAILED=1 in the child's env signals that the spawn-time snapshot failed; the agent should rely on the socket INITIAL frame.

For more details, see credential socket.

Worker registration flow

When you run rensei host install, the CLI registers the service with launchd/systemd and prepares the local daemon configuration. Project admission is a separate, explicit step:

1. Bind each project repository with rensei project repo add.
2. Enable that project on the local host with rensei host project enable <slug>.
3. Use rensei --org <slug> host project enable <project> when enabling a project for another organization on the same service.

On boot, the daemon registers through the platform's scoped credential flow. Subsequent heartbeat, polling, and session-lifecycle calls use its runtime credential.

See the worker registration reference for the full protocol.

Upgrading

brew upgrade rensei

launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/dev.rensei.daemon.plist
rm ~/Library/LaunchAgents/dev.rensei.daemon.plist
rensei host install