CLI

The Sixb CLI creates, runs, and builds projects. It can also connect to a running API to query data and run operations.

Inside a project, use bun sixb. To use sixb directly from anywhere, install the CLI:

bun add --global @sixb/cli

Use sixb <command> --help for command-specific arguments and options.

Work with the agent

Run sixb alone to open Sixb in your terminal. Once connected to an instance, ask the agent anything: it works in the folder you opened it in, as you, with the sixb commands and the data you can see.

cd ~/work/q3-close
sixb

On your computer, the agent's commands run in the folder as you, with your tools and network. They can't read your Sixb sign-in, ~/.ssh, or ~/.aws, and never hold a credential: the CLI adds the run's own to its requests to your API. A conversation that runs on your computer takes messages from you alone, and works on the computer and in the folder it started in: sixb open there runs its turns. Opened from another folder or another of your computers, it says where it works; ctrl+f moves it here, and only here runs its turns from then on. Quitting, or closing the terminal, stops a turn running here: it ends interrupted, and runs again only if you retry it. A command the agent runs in the background, such as a dev server, keeps running after its turn, until it exits, the agent stops it, or you quit sixb there.

The agent also follows the folder's AGENTS.md (or CLAUDE.md), and those of the folders above it up to the repository's root: see project instructions.

In the app, such a conversation shows its computer and folder, and whether sixb is open there. A message you send from the app runs on your computer as one typed in sixb does, in the permission mode the app sends it with; while sixb is closed, it waits for it. Continue in the cloud moves the conversation to the cloud instead, for good: the waiting message runs there, and the files in the folder stay on your computer. A conversation moves only once no turn is running or waiting for your approval.

Messages from the app run only in folders you've chosen on this computer. Turn on Messages from the web in ctrl+p to choose this one, and off again to forget it. Until then a message waits, or you can move the conversation to the cloud. Forgetting a folder that sixb connect holds also ends a turn running there. Once a folder is chosen, whoever is signed in as you can send it messages, and the agent's commands run there without asking.

A new conversation in the app can start on your computer too, in any folder where sixb or sixb connect takes messages now: under the message box, choose the folder from those listed for each of your computers. It starts in the cloud until you do, and while none of them is open.

To keep a computer available without sixb open, such as a machine that stays on, run:

sixb connect ~/projects/notes

It asks once before allowing each folder for the project you're connected to, runs turns sent to conversations in your allowed folders, one at a time per folder, and stops on ctrl+c, ending a running turn as interrupted. Whatever keeps it running decides how long it stays connected. With no folder it uses the ones you've allowed for that project; --yes allows those named without asking, and --json prints status as JSON lines. Keep to one of sixb or sixb connect holding a folder: each runs its own turns one at a time, not each other's.

{"type":"folders","folders":["/Users/you/projects/notes"]}
{"type":"turn.started","folder":"/Users/you/projects/notes","threadId":"…","runId":"…"}
{"type":"turn.ended","folder":"/Users/you/projects/notes","threadId":"…","runId":"…","ran":true}
{"type":"session.lost","folder":"/Users/you/projects/notes","message":"…"}
{"type":"session.back","folder":"/Users/you/projects/notes"}

If your sign-in ends it exits with code 3.

While a turn runs on your computer, in sixb or sixb connect, it keeps a Mac awake, on battery too. Closing the lid still puts it to sleep, and a turn asleep for more than a minute ends interrupted. Turn this off with Keep computer awake during turns in ctrl+p; it applies from the next turn, and sixb connect reads it when it starts. On Linux and Windows, your computer's own sleep settings apply.

From a script, sixb agent asks once and prints the answer:

sixb agent "Which service cases are past their response window?"
sixb agent --cloud --json "How many cases are open?" | jq -r .text

The answer goes to standard output and the agent's steps to standard error. --thread <id> continues a conversation, from any folder. The turn runs in your mode in the conversation, unless --approval-mode <manual|accept-edits|auto> names one for it. When the agent waits for your approval, sixb agent asks in a terminal; with --json or anywhere else it exits with code 4. A turn that fails or is stopped, or that sixb agent stops following before it ends, exits with 1. With --json, an error is written to standard error as JSON.

In its own folder, with nothing else connected there, sixb agent runs the turn itself. Where sixb or sixb connect is holding the conversation's folder, that runs it, and sixb agent follows along. If nothing is holding it, the message waits and sixb agent exits with code 5. --detach sends the message and exits at once, printing the conversation's id.

Project commands

Run these from your project root:

dev serves the app on port 3000 and the API on 3001. The app runs even without an app/ folder, with its built-in pages. Backend changes restart the local stack; app changes use hot reload. Restart manually after changing environment variables. With --desktop, dev also opens the app in a desktop window.

Common project options:

Production services

Each command runs one service. See Deployment for the complete setup.

Worker types are agent, sync, pipeline, projection, workflow, and lake. Actions have no worker: they run in the process that requests them. With no types, worker-group selects the project's registered work.

Public-origin flags have matching environment variables:

sixb api accepts --trusted-proxies to choose which proxies identify the client address; see Run behind a proxy.

The API requires the API and app origins. The app server, agent workers, and workers that create download URLs need the API origin. Flags override environment variables.

Schema-using services migrate storage and prepare declared query structures at startup. Unchanged query declarations are checked without rebuilding. Use --no-migrate or SIXB_SKIP_MIGRATION=1 when sixb db migrate ran both steps in a separate release step. Initial PostgreSQL text backfills can block writes; allow maintenance time or prepare before starting the release.

Worker options

Set concurrency for one worker or per worker type in a group:

sixb worker sync --concurrency 2
sixb worker-group sync agent --concurrency sync=2 --concurrency agent=8

Agent workers default to 8 concurrent jobs, lake workers to 4, and other types to 1. The same per-type options work with sixb dev.

Set SIXB_<TYPE>_WORKER_CONCURRENCY to configure concurrency through the environment. Command flags take precedence. Replicas multiply the total concurrency.

Projection workers also index vector profiles, making up to 4 embedding calls at once independently of --concurrency. Raise or lower it with --vector-concurrency 8 or SIXB_VECTOR_CONCURRENCY=8 on dev, projection workers, or worker groups containing one. Your embedding provider's rate limit is the ceiling.

Agent turns have no time or step limit: a turn runs until the agent answers or someone stops it. Set AI limits to cap what a turn can spend.

When the agent delegates, its sub-agents run in the same worker as its turn. Each agent worker runs up to 4 sub-agents at once, and one turn keeps up to 4 at work. Change them with --subagent-concurrency and --subagent-concurrency-per-run, or SIXB_SUBAGENT_CONCURRENCY and SIXB_SUBAGENT_CONCURRENCY_PER_RUN, on the same commands.

Environment variables

Keep a project's values in one place. See Environment variables.

Deploy commands

Run these from a project with a sixb.deploy.ts. See Deploy to a server.

Connect to an instance

Sign in to an API and save it as a profile:

sixb login https://api.example.com --profile production
sixb status
sixb profile list
sixb profile use production

For an authenticated API, login opens the browser for approval and signs the CLI in as you. The sign-in renews itself while you use it and ends after the API's idle timeout (30 days by default) without use. It appears in your sessions on Settings › Personal in the app, and sixb logout signs it out. Use --token-stdin to supply an existing token without browser approval. A local API with authentication disabled needs no token.

Use --profile <name> on a remote command to select another saved instance. For automation, set SIXB_API_URL and SIXB_API_TOKEN. Use sixb logout to remove the selected profile.

Query and operate

Remote commands use the selected API and its permissions:

sixb project show
sixb ontology list
sixb objects inspect Invoice inv-1
sixb objects get-by Customer email ada@example.com

These commands return JSON. Use scoped help for the operation you need, such as sixb objects --help.

Tokens and service accounts

Create and revoke credentials from a profile signed in with sixb login:

sixb token create --name "Local script" --expires-in 30d
sixb token list
sixb token revoke token-id

sixb service-account create --id finance-integration --name "Finance integration" --group finance-team
sixb service-account token create finance-integration --name "Production" --expires-in 30d

Use --group to select permitted groups and --expires-in or --expires-at to set expiration. Tokens are shown only when created. Service-account commands need a membership policy with the serviceAccounts operation.

Creating a token requires that sign-in. A personal access token, whether passed with --token, set in SIXB_API_TOKEN, or saved with --token-stdin, can list and revoke tokens and manage service accounts but cannot create tokens, so no token can produce one with more access or a later expiry than its own. Service-account tokens cannot manage credentials at all.

Use --json for machine-readable output from profile and credential commands. See Members & service accounts for the access model.

Exit codes