@robinpath/cloud-cli

On-VPS agent for RobinPath. Runs as robinpath-gateway.service, holds a persistent outbound WebSocket to the control plane, and executes module operations via the Claude CLI inside short-lived Docker runners.

What it does

• Outbound WS to wss://exec.robinpath.com/api/v1/agent (jittered backoff).
• Dispatches RPC commands: installModule, runAutomation, setSecret, fetchMetrics, runScript, restartGateway, uninstall, heartbeat.
• Per-server Ed25519 keypair (libsodium-compatible) — private key never leaves the box. Public key is enrolled to the control plane on first run.
• Encrypted SQLite at /opt/robinpath/data/agent.db (XChaCha20-Poly1305).
• Local admin CLI: cloud-cli status | logs | enroll | uninstall | upgrade.

Install (one-liner, run as root on the target VPS)

curl -fsSL https://exec.robinpath.com/install.sh | \
  bash -s -- --enroll-token <token> --control-plane wss://exec.robinpath.com

The control plane streams install.sh over SSH on first connect; thereafter the agent self-updates via cloud-cli upgrade.

Requirements

• Ubuntu 22.04+ / 24.04 / 26.04 or Debian 12+
• ≥ 1 GB RAM, ≥ 5 GB free disk
• Outbound 443 to exec.robinpath.com
• Docker (installed automatically by install.sh)
• Node 22+ (installed automatically by install.sh)
• Claude CLI (installed automatically by install.sh)

Config

Resolved from /etc/robinpath/config.json, overridable by env vars:

| Env | Default | Meaning | | ---------------------------- | ------------------------------------ | -------------------------------- | | ROBINPATH_BASE_DIR | /opt/robinpath | Root for data/, logs/, bin/ | | ROBINPATH_CONTROL_PLANE | wss://exec.robinpath.com/api/v1/agent | WS endpoint | | ROBINPATH_ENROLL_TOKEN | (unset) | One-shot enrollment token | | ROBINPATH_HEARTBEAT_MS | 30000 | Heartbeat interval | | ROBINPATH_LOG_LEVEL | info | pino level | | ROBINPATH_RUNNER_MEMORY | 256m | Docker --memory per runner | | ROBINPATH_RUNNER_CPUS | 0.5 | Docker --cpus per runner |

Dev quickstart (Windows or Linux)

cd apps/cloud-cli
npm install
export ROBINPATH_BASE_DIR="$PWD/.dev"          # PowerShell: $env:ROBINPATH_BASE_DIR="$PWD\.dev"
export ROBINPATH_CONTROL_PLANE="ws://localhost:8787/api/v1/agent"
npm run dev                                     # tsx watch src/cli.ts serve

In another shell:

node dist/cli.js status
node dist/cli.js logs --tail 50

Runtime layout (prod)

/opt/robinpath/
  bin/                    # cloud-cli launcher
  data/
    agent.key             # Ed25519 private key (mode 0600)
    agent.crt             # signed cert from control plane
    agent.db              # SQLite (secrets, runs, commands_seen, metrics)
  logs/                   # rolled stdout (systemd captures journal too)
  containers/             # scratch dirs mounted into runner containers
/etc/robinpath/config.json
/etc/systemd/system/robinpath-gateway.service

Uninstall

cloud-cli uninstall --yes
# or, offline:
/opt/robinpath/uninstall.sh --yes

Removes the systemd unit, stops + prunes runner containers, deletes /opt/robinpath/, removes the robinpath user.

Choice of runtime

Node 22 + tsx for dev (no transpile step, native ESM, faster than ts-node). Production runs compiled JS via node dist/cli.js — no bun dep, fewer moving parts on customer servers.