Command CLI

`datarim`

External-agent surface — non-interactive CLI that drives the full Datarim pipeline through HTTP webhook (AAL 3 opt-in)

Overview

The datarim CLI is a standalone, non-interactive command-line interface designed for external AI agents and automation systems. It exposes the entire Datarim pipeline — from task intake to artifact delivery — through an HTTP webhook interface. The CLI uses a JSON-based request format and supports all stages of the Datarim workflow: /dr-init, /dr-cowork, /dr-approve, /dr-exit, and /dr-status.

Introduced in v2.18.0 (TUNE-0271), the CLI enforces AAL 3 (Adaptive Authentication Level) for every request, requiring digital signature verification, nonce replay protection, and time-bound tokens.

When to use vs slash command

Use case	Slash command	`datarim` CLI
Interactive, human-operated sessions	Recommended	Not suited
Automated / CI / agent-driven pipelines	Not supported	Recommended
Non-interactive script invocation	Not supported	Required
AAL 3 authenticated operations	Optional	Mandatory
Bulk processing (multi-task batches)	Not supported	Supported via `--batch`

Installation

The CLI distribution is a single PHP script with no external dependencies. Run the automated installer:

curl -sSL https://datarim.club/cli/install.sh | bash

This installs the datarim command to /usr/local/bin and sets up the configuration directory ~/.config/datarim/. Verify installation:

datarim version

Subcommands

Subcommand	Description
`run`	Execute a Datarim pipeline stage. Accepts a JSON request body from stdin or `--request`. Returns JSON response.
`audit`	Display the audit log for a specific task or session. Required argument: `--task-id`.
`halt`	Pause a running pipeline. Required argument: `--task-id`.
`resume`	Resume a halted pipeline. Required argument: `--task-id`.
`purge`	Delete all artifacts and logs for a completed task. Required argument: `--task-id`. Confirmation prompt unless `--force` is set.
`stats`	Display aggregate pipeline statistics: total tasks, active sessions, average duration, error rate.
`version`	Print the CLI version and exit.
`help`	Display this usage information.

AAL 3 mitigations

Every datarim CLI request must satisfy six AAL 3 requirements:

Digital signature — the request payload must be signed with a registered Ed25519 keypair. The public key is submitted during agent registration.
Nonce replay protection — each request includes a unique nonce. The server rejects any nonce it has already seen.
Time-bound tokens — every token is valid for a maximum of five minutes. Expired tokens are rejected.
Session binding — the signature binds to the current session ID. Replay across sessions is impossible.
Audit trail — every mutation is logged to an immutable audit store with sender identity, timestamp, and request digest.
Rate limiting — no more than 60 authenticated requests per minute per sender. Burst limits apply.

Exit codes