Go CLI / Daemon SDK

The rensei binary is the platform's Go CLI. It ships the full donmai OSS command surface (agent, fleet, governor, queue, dashboard, status) plus platform-exclusive commands for auth, project management, daemon lifecycle, and org administration - all authenticated via rsk_live_* API keys or WorkOS browser login.

Installation

brew tap RenseiAI/tap
brew install rensei

After install, verify:

rensei --version

The Homebrew cask pulls notarized binaries from github.com/RenseiAI/releases. The source is closed-source; only compiled binaries are distributed.

First-time setup

rensei auth add --user

echo "$RENSEI_API_KEY" | rensei auth add --kind org_token --token-stdin

rensei setup

rensei host install

rensei status

Command tree

Auth - rensei auth

Manages named auth contexts stored in ~/.config/rensei/config.json. Supports three kinds: user (WorkOS device flow), org_token (rsk_ key scoped to an org), and project_token (rsk_ key scoped to a project).

Config is stored at ~/.config/rensei/config.json. Secrets are placed in the OS keychain by default; --secret-store encrypted_file or --secret-store env are available for headless environments.

Org - rensei org

# List org members
rensei org members list

# Invite a new member
rensei org members add --email alice@example.com --role member

# Create an API key
rensei org api-keys create --name "ci-deploy" --scopes "read,write"

# List API keys
rensei org api-keys list

Project - rensei project

# Add a GitHub repository to the active project
rensei project repo add --url https://github.com/acme/backend

# Connect a Linear workspace as the issue tracker
rensei project trackers connect --provider linear

# List project tokens (worker registration keys)
rensei project tokens list

# Create a new project registration token
rensei project tokens create --name "macbook-worker"

Worker host - rensei host

Lifecycle commands for the local daemon process and launchd/systemd service registration. rensei host is the canonical surface; the legacy rensei worker host alias is hidden from help but still works for one release.

Linux scope flags (applicable to install, uninstall, doctor):

rensei host install --user    # user-scoped systemd unit (default)
rensei host install --system  # system-scoped unit, requires sudo

Worker capacity - rensei worker capacity

# Show local capacity, session counts, and pool stats
rensei worker capacity status [--pool] [--by-machine]

# Adjust max concurrent sessions at runtime
rensei worker capacity set capacity.maxConcurrentSessions 4

# Set maximum pool disk usage (LRU eviction threshold)
rensei worker capacity set capacity.poolMaxDiskGb 20

# Evict stale workarea pool members
rensei worker capacity evict --repo https://github.com/acme/backend --older-than 24h

The set command writes to ~/.rensei/daemon.yaml atomically and signals the running daemon to reload the affected subsystem without a restart.

Daemon stats - rensei daemon stats

# Standard stats table
rensei daemon stats

# Include workarea pool breakdown
rensei daemon stats --pool

# Per-machine breakdown (multi-host)
rensei daemon stats --by-machine

# Org-level fleet view
rensei daemon stats --machines

# JSON output
rensei daemon stats --json

--machines enriches per-machine stats with org-level fleet metadata from the platform.

Global flags

All commands accept these persistent flags:

Configuration

Config is read from ~/.config/rensei/config.json. Key fields:

{
  "apiBaseURL": "https://app.rensei.ai",
  "activeAuth": "my-org",
  "auths": {
    "my-org": {
      "kind": "org_token",
      "orgSlug": "acme",
      "activeProjectSlug": "backend"
    }
  }
}

View with rensei config show, change defaults with rensei config set <key> <value>, reset to defaults with rensei config reset.

Daemon config - ~/.rensei/daemon.yaml

The daemon reads its configuration from ~/.rensei/daemon.yaml at startup. Key sections:

platform:
  url: https://app.rensei.ai
  registrationToken: rsk_live_xxxx   # minted at host install

capacity:
  maxConcurrentSessions: 2
  poolMaxDiskGb: 20

projects:
  - id: backend
    repository: https://github.com/acme/backend.git

The projects allowlist must include an entry for each repository the daemon is permitted to accept work for. rensei host install seeds this automatically from the active project's connected repositories.

Daemon HTTP API

The daemon exposes a local HTTP control API on 127.0.0.1:7734 (configurable). The rensei worker host commands talk to this API. You can also reach it directly:

# Status
curl http://127.0.0.1:7734/api/daemon/status

# Stats
curl http://127.0.0.1:7734/api/daemon/stats?pool=true

Credential socket protocol

The daemon mediates credential delivery to agent subprocesses over a Unix socket at $XDG_RUNTIME_DIR/rensei/credentials.sock (or /var/run/rensei/credentials.sock for system-scoped installs).

Protocol is line-delimited JSON, one connection per agent session:

Agent → Daemon:   {"type":"HELLO","sessionId":"sess_..."}
Daemon → Agent:   {"type":"INITIAL","env":{"ANTHROPIC_API_KEY":"sk-...","LINEAR_API_KEY":"..."}}
Daemon → Agent:   {"type":"UPDATE","env":{"ANTHROPIC_API_KEY":"sk-rotated..."}}  # on OAuth rotation
Agent → Daemon:   {"type":"BYE"}

The daemon resolves credentials at spawn time by calling POST /api/daemon/credentials/snapshot on the platform (Bearer rsk_* auth) and merges them into the child process's exec environment. The socket provides a fallback and live-rotation channel.

RENSEI_CREDENTIAL_SNAPSHOT_FAILED=1 in the child's env signals that the spawn-time snapshot failed; the agent should rely on the socket INITIAL frame.

For more details, see credential socket.

Worker registration flow

When you run rensei host install, the CLI:

1. Calls POST /api/projects/<id>/runtime-tokens with the stored rsk_* token to mint a project-scoped worker registration token (rsk_live_*).
2. Writes the token to ~/.rensei/daemon.yaml under platform.registrationToken.
3. Wipes ~/.rensei/daemon.jwt so the daemon performs a fresh registration on first boot.
4. Seeds the project allowlist with the project's connected GitHub repository URL.
5. Registers the service with launchd/systemd.

On boot, the daemon calls POST /v1/daemon/register with the registration token and receives back a short-lived runtimeJwt. All subsequent calls (heartbeat, poll, session lifecycle) use Authorization: Bearer <runtimeJwt>.

See the worker registration reference for the full protocol.

Upgrading

brew upgrade rensei

launchctl bootout gui/$(id -u) ~/Library/LaunchAgents/dev.rensei.daemon.plist
rm ~/Library/LaunchAgents/dev.rensei.daemon.plist
rensei host install