@runtime-judgement/cli
v0.1.0
Published
Runtime Judgement CLI — same ops as the UI, scriptable. Implements P8 (programmable in both directions) from the AI-native principles ADR.
Maintainers
Readme
@runtime-judgement/cli
The rj command-line interface for Runtime Judgement — the failure-attribution debugger for multi-agent AI systems.
P8 of the AI-native principles ADR (dev-docs/strategy/2026-05-26-adr-ai-native-principles.md in the main repo) says: if you can click it, you can curl it. This package is the CLI half of that contract — everything available in the agent-page UI is also available as rj <noun> <verb>.
This first cut ships 6 read commands (agents list, tests list, runs get, headline get, whoami, login). Write commands (mutating snapshots, runs, pipeline) land in a follow-up release alongside the MCP write tools.
Quickstart
# 1. Install (Node 18+)
npm install -g @runtime-judgement/cli
# 2. Authenticate — opens your browser, mints a key, writes ~/.rj/token
rj login
# 3. Verify
rj whoamiThat's it. From here, rj agents list, rj tests list <agent-id>, etc.
Other installers
pnpm add -g @runtime-judgement/cli # pnpm
yarn global add @runtime-judgement/cli # yarn classic
# No global install — one-shot via npx:
npx -y @runtime-judgement/cli@latest whoami
# From source (contributors):
git clone https://github.com/proveai/runtime-judgement-app
cd runtime-judgement-app
pnpm install
pnpm --filter @runtime-judgement/cli build
node packages/rj-cli/dist/index.js --helpConfigure
Recommended: rj login.
rj loginThe CLI opens your browser to the settings page, which mints a fresh API key and posts it back to a one-shot local listener. The token is written to ~/.rj/token (0600) and you're ready to go. No copy/paste required.
For headless environments (SSH, CI bootstrap, no browser), use --paste:
rj login --paste
# Prompts: "Paste your rj token (input hidden): "
# Generate the token at <base-url>/app/settings/api-keys first.Other flags:
--base-url <url>— override the deployment URL (default:https://runtime-judgement-app.vercel.app).--no-open— print the login URL instead of auto-opening it. Useful for SSH or remote desktops where the local browser isn't the right one.--timeout-ms <ms>— how long to wait for the browser callback (default 300000 / 5 min).
Manual configuration
If you'd rather skip rj login and manage credentials yourself, the CLI resolves config in this order:
RJ_BASE_URLenv var (default:https://runtime-judgement-app.vercel.app)RJ_AUTH_TOKENenv var, OR- The contents of
~/.rj/token(one line, no quotes)
Generate a token at <base-url>/app/settings/api-keys.
Quick check:
export RJ_AUTH_TOKEN=rj_live_…
rj whoamiExpected output:
rj
base URL https://runtime-judgement-app.vercel.app
token rj_live_abcd…wxyz
OKCommands
rj agents list
List the agents you can see. Default output is a table; pass --json for raw output.
rj agents list
rj agents list --limit 5
rj agents list --json | jq '.agents[].id'ID NAME LAST RUN HEALTH
----------------------- --------------- -------------------- ----------
agt_demo_cx_support cx-support 2026-05-26T17:42:00Z regressed
agt_demo_payments payments-agent 2026-05-26T16:11:09Z greenrj tests list <agent-id>
List tests (snapshots) attached to one agent. --filter is a substring match on test name.
rj tests list agt_demo_cx_support
rj tests list agt_demo_cx_support --filter "order"
rj tests list agt_demo_cx_support --jsonrj runs get <run-id>
Fetch the full per-test breakdown for a single run.
rj runs get run_01HZ123…
rj runs get run_01HZ123… --json | jq '.perTest[] | select(.verdict != "PASSED")'rj headline get <agent-id> [--section]
Read the judge-authored P1 headline for an agent section. Defaults to overview; other sections are tests, suites, runs, pipeline, settings.
rj headline get agt_demo_cx_support
rj headline get agt_demo_cx_support --section pipeline
rj headline get agt_demo_cx_support --jsonrj whoami
Diagnostic — prints the resolved config (with the token truncated for safety) and runs a connectivity check against agents.list.
rj whoamirj login
Authenticate the CLI. By default this opens your browser to the settings page, mints a key, and writes it to ~/.rj/token. See Configure above for --paste, --no-open, --base-url, and --timeout-ms.
rj login
rj login --paste # headless / SSH
rj login --no-open # print URL instead of opening
rj login --base-url https://staging.runtimejudgement.comSample output (browser flow):
rj login
base URL https://runtime-judgement-app.vercel.app
callback listener on http://127.0.0.1:57563
opening https://runtime-judgement-app.vercel.app/app/settings/api-keys?cli=1&port=57563
waiting for browser…
wrote token to /Users/you/.rj/token
verifying…
rj
base URL https://runtime-judgement-app.vercel.app
token rj_live_abcd…wxyz
OK
rj login: success.Troubleshooting
rj: no auth token found.
You haven't authenticated yet. Run rj login. For headless boxes (CI, SSH, no browser) use rj login --paste and paste a token minted from <base-url>/app/settings/api-keys.
rj login opens the wrong browser (remote desktop, SSH-with-X-forwarding).
Use rj login --no-open to print the URL and visit it manually, or rj login --paste to skip the browser entirely.
rj whoami fails with a 401 / "unauthorized".
Your token is invalid, revoked, or pointed at the wrong deployment. Re-mint at <base-url>/app/settings/api-keys, then rj login --paste (or overwrite ~/.rj/token). If you've recently moved deployments, also unset / reset RJ_BASE_URL.
rj whoami fails with a network error.
Confirm the base URL is reachable from your shell: curl -fsS $(rj whoami --json | jq -r .baseUrl)/api/health should return 200. If you're behind a corporate proxy, ensure Node's HTTPS_PROXY env var is set.
I want to point the CLI at a staging / self-hosted deployment.
Set RJ_BASE_URL=https://<your-host> (no trailing slash). rj login --base-url <url> does the same for one-off login flows.
Where's ~/.rj/token stored?
~/.rj/token is a one-line file (0600 permissions). Delete it to log out. Multi-account support is not in scope today — use RJ_AUTH_TOKEN env vars to switch on a per-command basis.
Architecture
- HTTP JSON-RPC to
/api/mcpon the host deployment. - One module per command under
src/commands/. Each command exports both acommander.Commandand arun…()function so tests can call the logic without parsing argv. src/mcp-client.tsis a tiny custom client. We do not depend on@modelcontextprotocol/sdkbecause we POST a single envelope and parse the response synchronously — the SDK is geared toward stdio/SSE.
Tests (contributors)
pnpm --filter @runtime-judgement/cli testThe suite mocks fetch end-to-end; no network calls are made.
License
MIT.
