XENO Agent CLI

Production terminal AI agent CLI from XENO Corporation.

Runtime Ownership

The current ownership level is release-audited and may be lower than the terminal P2 program target. Node is an external host through P2, self-contained release assets embed Node.js or Bun, and the TypeScript/npm development toolchain remains third-party infrastructure. Runtime and toolchain replacement are not roadmap items. The package must not be described as fully proprietary, entirely Xeno-owned, free of third-party runtime code, or built by an owned toolchain. The packaged policy and engineering clean-room controls are in ownership/.

Execution security uses the exact levels policy-only, process-hardened, and contained. Windows process hardening is trusted-workspace defense in depth and does not isolate filesystem reads or network access. Unavailable contained or untrusted execution fails closed. The SDK/CLI ship reviewed, digest-pinned MXC 0.7.0 native assets without the Microsoft JavaScript wrapper or its runtime transitives. Standalone candidates embed only their target-native adapter and require an executable-bound signed sidecar before they can report certified containment. Certified archives also carry the corresponding third-party notices and participate in one source-bound five-target candidate set. See CLI Execution Security.

Install

curl -fsSL https://unpkg.com/@xenosystem/agent-cli@latest/scripts/install.sh | sh

PowerShell:

irm https://unpkg.com/@xenosystem/agent-cli@latest/scripts/install.ps1 | iex

Or install directly:

npm install -g @xenosystem/agent-cli

Use

Keybindings are versioned, user-owned, conflict-validated, and shared across the TUI and attached terminals. Run xeno keybindings list, xeno keybindings validate, or /keybindings; the full contract is documented in ../../docs/KEYBINDINGS.md.

The runtime inspector explains everything the CLI will load and permit without activating extensions or exposing credentials. Run xeno environment, xeno environment --safe-mode, xeno environment --json, or /environment; see ../../docs/RUNTIME_ENVIRONMENT_INSPECTOR.md.

xeno chat
xeno run "summarize this repo"
xeno app-server --http
xeno remote validate --json
xeno specs init my-feature --title "My feature"
xeno review --production --staged
xeno index build
xeno control-room watch
xeno share list
xeno providers catalog
xeno hosted environment list
xeno hosted trigger list
xeno hosted events workspace:<workspace-id>
xeno hosted run message <run-id> "Continue after verification"
xeno hosted run controls <run-id>
xeno hosted run artifacts <run-id>
xeno hosted handoff pull <run-id> --out .xeno/handoffs/hosted-to-cli.json
xeno oracle "Should this change ship?" --primary primary --critics critic-a,critic-b
xeno librarian "Where is auth enforced?" --repo owner/project --connection research
xeno forge issues --repo owner/project
xeno recipes run release-check --dry-run
xeno plugin suggest --marketplace

Assistant is the default runtime profile. Use xeno --agent swe, xeno run --agent reviewer "<task>", xeno agents profiles, or xeno agents profile devops to select or inspect an enforceable specialist profile. See Agent Profiles.

Durable specs store requirements, design, task dependencies, risks, acceptance criteria, approvals, execution evidence, and drift reports under the shared Artifact Protocol. Production review runs independent specialist and verifier calls and persists a typed review report; model confidence without reproduction remains explicitly unverified. See Spec Workflows and Production Review.

Persistent repository intelligence combines bounded source chunks, symbols, imports, lexical search, optional exact-model semantic vectors, Git provenance, tests, documentation links, and freshness evidence while leaving current direct reads authoritative. The Agent Control Room projects durable agents, tasks, approvals, artifacts, monitors, goals, notifications, usage, and public activity into a hash-bound terminal supervisor. See Repository Intelligence and Agent Control Room.

Secure shares are signed, redacted, expiring, capability-bound, and read-only. Session handoffs request authority but cannot grant it, while provider connections store only credential reference names and use capability-driven routing. See Secure Sharing and Session Handoff and Provider Onboarding.

Hosted environments bind an exact manifest checksum and OCI digest; triggers are idempotent and event replay is hash-chain verified. Protocol-v2 adapters add durable redacted messages, exact-scope approval/rejection, acknowledgement history, Artifact Protocol evidence, and typed Git/PR results. xeno hosted handoff push continues local work remotely, and xeno hosted handoff pull verifies the connected service issuer before saving a private return document. Hosted execution fails closed unless the backend has a candidate-certified adapter. See Hosted Fleet and Cross-Device Handoff.

Oracle, Librarian, Forge browsing, Recipes, automatic Git mutation checkpoints, clipboard-image paste, OS-owned voice dictation, plugin signing/locking, and repository-aware plugin suggestions are documented in Advanced Agent Surfaces. These features retain their Artifact Protocol, provider, privacy, and release boundaries; none of the source-complete hosted adapters imply that a public fleet is deployed.

Interactive prompts soft-wrap and grow to six terminal rows while preserving the exact submitted text. Up and Down navigate wrapped rows before prompt history, and the file-panel assistant shares the same grapheme-safe cursor and editing behavior. The temporary XENO_INPUT_SOFT_WRAP=0 process setting restores the single-row horizontal viewport for rollback.

Markdown source labels are clickable in supported interactive terminals and keep their full visible URL in redirected output or when XENO_DISABLE_TERMINAL_LINKS=1 is set.

Background child sessions notify their parent automatically when they complete, fail, stop, or need input. Headless runs use the same bounded queue; XENO_AGENT_NOTIFICATIONS=0 disables automatic delivery without deleting queued records.

Foreground model-authored Bash commands are managed operations: Ctrl+B promotes the same process, the footer shows live operation activity, bounded TaskOutput waits do not consume model turns, and awaited completion resumes once from a durable checkpoint. Use /processes to inspect, attach, stop, or explicitly detach tasks.

Docs: https://xenostudio.ai