@winlayer/cli

The WinLayer Layer 1-9 command-line client—signals, graph intelligence, federal opportunities, your pipeline, and grounded AI workflows. It signs in through your browser and talks only to the governed public REST API (/api/v1/public).

winlayer                         # login if needed, then open the interactive command center
winlayer login                   # opens WinLayer in your browser for approval
winlayer opportunities --min 60  # top scored opportunities
winlayer brief <opportunity-id>  # run the Qualification Agent on one opportunity

Install

Install the public package from npm:

npm install -g @winlayer/cli
winlayer --version

For local development, build and link it from this monorepo:

cd packages/cli
npm install
npm run build
npm link

# Optional local/package-registry artifact
npm pack

Requires Node 20+.

Authentication

winlayer login on a terminal offers three ways in:

  ▰ ▰ ▰  WinLayer
  SECURE TERMINAL SIGN-IN

  ──────────────────────────────────────────────────────────────

  01  WinLayer account   Approve securely in your browser  RECOMMENDED
  02  API key            Paste a scoped developer key
  03  Another device     Approve from a phone or second computer

  ──────────────────────────────────────────────────────────────
  Choose 1–3  ›

Skip the menu with --method, which is what scripts and dotfiles should use:

winlayer login --method account  # browser on this machine
winlayer login --method key      # prompt for a pasted key (never echoed)
winlayer login --method device   # print a code to approve elsewhere; same as --no-browser

1 — WinLayer account. Uses your normal subscription login. The browser displays the requesting computer, workspace, and access before you approve. The short code expires after 10 minutes and the encrypted credential can be consumed only once.

2 — API key. For sandbox (wl_test_) or workspace (wl_live_) credentials minted in the developer console. Useful when you want a scoped key rather than a session tied to your user.

3 — Another device. Same approval flow, but nothing launches locally — the terminal prints a code you approve from a phone or another machine. This is the one for SSH sessions, containers, and headless servers.

winlayer logout revokes a browser-created CLI session server-side and removes the local credential. A developer API key is only forgotten locally; revoke that key in the developer console when it should stop working everywhere.

After authentication, bare winlayer stays open as an interactive session:

  ▰ ▰ ▰  WinLayer
  ● LIVE  Meridian Data Systems                         CLI 0.5.2
  meridian · api.winlayer.ai                  SOLO · PROFILE READY

  ╭─ NEXT DECISION ──────────────────────────────────── REVIEW ╮
  │ Review 1 proposed action                                   │
  │ Nothing executes until a member approves or rejects it.    │
  │ › actions                                      TYPE TO OPEN │
  ╰────────────────────────────────────────────────────────────╯

  TODAY                                                LIVE SNAPSHOT
  8 matches · 2 pursuits                  1 approval · 3/10 analyses

  QUICK ACTIONS                                           TYPE 1–4
  1 Find contracts  2 Pipeline       3 Daily brief  4 Approvals

  ? GUIDED START   / ALL TOOLS   ↑↓ HISTORY   plain English works

  ╭─ ASK WinLayer ───────────────────── / COMMANDS  ^K ╮
  ╰─❯ how is my pipeline looking?

The home screen reads the current workspace and selects one concrete next decision without starting an AI run. Type home at any time to refresh it. Press ? for a task-first guide, or press / or Ctrl K at an empty prompt for the searchable Layer 1–9 command center. Type one or more search terms, use the arrow keys to move, press Tab to fill the highlighted command without running it, or press Enter to run it immediately. The number keys 1–4 launch four read-only quick actions; key 3 opens the latest saved daily briefing without starting a generation. Each completed command suggests a useful next step, while errors point to a recovery command. The layout stays inside terminals as narrow as 32 columns, and NO_COLOR keeps a clean monochrome mode for scripts and accessibility preferences. If the terminal profile itself has an unusual default color, WINLAYER_COLOR=always winlayer explicitly restores the purple WinLayer theme; use WINLAYER_COLOR=256 for older terminals. Set WINLAYER_MOTION=0 to keep the full visual theme while disabling launch motion. To save the choice without editing a shell profile, run winlayer config set color always; auto, 256, truecolor, and never are also available.

Direct API keys remain available for CI and service accounts. These bypass the menu entirely — nothing prompts when a key arrives by flag, pipe, or environment:

winlayer login --key wl_live_…   # non-interactive
echo "$WINLAYER_KEY" | winlayer login   # piped

The key is stored at ~/.winlayer/config.json (owner-only, 0600). Environment variables override the saved file, which is what you want in CI:

• WINLAYER_API_KEY — the key
• WINLAYER_API_URL — API base URL (defaults to the hosted dev API)
• WINLAYER_WEB_URL — browser workspace origin used by winlayer open
• WINLAYER_CHAT_TIER — temporary fast, standard, or deep chat override
• WINLAYER_COLOR — always, 256, or truecolor to force color; never to disable it
• WINLAYER_CONFIG_DIR — where config lives (defaults to ~/.winlayer)

A CLI session or API key acts as the user who authorized it, with that user's current workspace role. Revoking that member's access disables its AI runs.

Commands

| Command | What it does | | --- | --- | | login / logout / whoami | Manage and inspect your credentials | | home / refresh | Refresh the live decision board in an interactive session; print the same read-only snapshot in one-command mode | | guide / start | Choose a goal without memorizing commands | | dashboard [--limit N] | Read-only workspace, capacity, pipeline, approvals, and briefing overview | | doctor [--timeout N] | Check Node, config permissions, API health/readiness, and authentication | | config [show\|path\|set\|unset] | Inspect and update non-secret API, web, model, and terminal color settings | | open [destination] | Open a workspace page; open list shows every destination | | signals [--source X] [--type X] [--limit N] [--cursor X] | Normalized source signals with provenance | | forecasts [--stage X] [--limit N] [--cursor X] | Published acquisition and recompete forecasts | | agencies [--type X] [--query X] [--cursor X] | Canonical agency graph nodes | | relationships [--type X] [--cursor X] | Accepted procurement graph relationships | | intelligence [--type X] [--module X] [--cursor X] | Published canonical intelligence objects | | opportunities [--min N] [--limit N] [--cursor X] | List scored opportunities | | opportunity <id> | Show one scored opportunity | | pipeline [--status pursuing\|watching\|passed] [--cursor X] | Your tracked pipeline | | contacts [--status X] [--category X] [--cursor X] | Tenant-owned relationship contacts | | export <resource> [--format json\|jsonl\|csv\|tsv] | Fetch successive pages and export data safely | | agent [--latest] / daily | Run the Daily Growth Agent or replay its latest result | | actions [--status X] | Review governed actions proposed by an agent | | approve <id> / reject <id> | Decide a proposed action | | agents | List the runnable AI agents | | run-agent <id> [--signal X] [--dry-run] | Preview policy or run any active registry agent | | ask "<question>" | Ask the workspace analyst in plain English | | brief <id> [--type capture\|recompete\|proposal] [--latest] | Run (or fetch) a grounded brief | | exec-brief [--latest] | Portfolio-wide executive brief | | usage | Plan capacity for the workspace | | model [--set fast\|standard\|deep] | Show or switch the analyst model | | graphql '<query>' / schema | Query the scoped read-only GraphQL API or print its SDL | | completion <shell> | Generate completion for Bash, Zsh, Fish, or PowerShell |

Common flags: --json (on data, AI, model, approval, and logout commands), --url, --key, and --help. Use --version on its own.

Scripting

Every data, agent, model, and approval command supports --json, so you can pipe into jq:

winlayer opportunities --min 70 --json | jq -r '.opportunities[] | "\(.fitScore)\t\(.title)"'
winlayer brief "$ID" --type proposal --json | jq '.brief.recommendedActions'
winlayer export signals --format jsonl --output signals.jsonl
winlayer graphql 'query { apiVersion }' --json

Notes on AI runs

agent, run-agent, brief, and exec-brief (without --latest) can trigger a governed generation server-side. Use run-agent --dry-run to inspect its policy without starting one. Runs are subject to the workspace plan, per-tenant hourly cap, and AI kill switch—the same controls as the web app. Results are cached per identical evidence. winlayer usage shows customer-visible plan capacity; internal token and provider-cost telemetry stays private.