Claude Code / Codex / Copilot / Antigravity

One CLI for every coding agent

Use one predictable command line across Claude Code, Codex CLI, GitHub Copilot CLI, and Antigravity CLI. Start, resume, find, name, fork, and hand off sessions without memorizing four incompatible interfaces - while keeping each agent CLI's native arguments one command away.

The productivity gain compounds: one muscle memory runs every agent, sessions stay findable and resumable however they were started, and switching vendors becomes a flag on the next session instead of a migration - your workflow is multi-vendor by default, so no single agent CLI can hold it hostage.

Install acli See the commands

Install acli

The installer detects your platform, downloads the precompiled binary acli 1.202.0, verifies its published SHA-256 digest, and installs it atomically in ~/.local/bin. 

curl -qfsSL https://www.lifub.com/acli/install.sh | bash

No package manager, administrator access, Rust toolchain, Cargo installation, Apple Developer ID, or access to the private source repository is required. You can inspect the installer before running it. After installation, acli update verifies and installs future releases atomically; rerunning this command remains a manual recovery path. If your installed version predates acli update, rerun the installer once to join the self-updating release line.

From install to first session

  1. Install and authenticate at least one supported agent CLI.
  2. Run acli doctor to check installations and compatibility.
  3. Start with acli start codex, or run acli resume to choose an existing session.
$ acli doctor
$ acli start codex
$ acli resume

Native terminal for coding agents

acli run opens a native terminal with saved sessions and resumable drafts. This Mac ARM preview targets Codex CLI 0.157.1, Claude Code 2.1.285, and GitHub Copilot CLI 1.0.89 while its daily-driver acceptance matrix remains in progress. Mac Intel and x86_64 Linux native builds are previews. The existing acli start and acli resume agent CLI workflows remain available.

Install and authenticate each agent CLI separately. Claude and Copilot also need a hash-verified Node 24.21.0 support bundle: run acli runtime install before opening those native sessions. Session startup never downloads a bundle or installs an agent CLI. acli runtime status checks the installed bundle offline. Claude's native Agent SDK and Copilot's AI credits can incur paid overage. Every native Claude or Copilot launch or resume requires --allow-paid-usage.

Kimi, MiniMax, MiMo, Z.AI, and Qwen direct API engines are alpha. Supply your own provider key and pass both --enable-alpha-api and --allow-paid-usage on every launch or resume. Qwen also needs your workspace's regional endpoint. These engines do not need the Node support bundle; live provider requests have not been validated for this release, and provider charges may apply. 

$ acli run --agent codex
$ acli runtime install
$ acli run --agent claude --allow-paid-usage
$ acli run --agent copilot --allow-paid-usage
$ acli run --agent kimi --enable-alpha-api --allow-paid-usage

The native view separates conversation, compact tool results, pending questions or approvals, and the composer. Markdown emphasis and code blocks are styled; the status bar distinguishes foreground work from reported background tasks. The subtitle shows model, effort, selected permissions, and the Claude profile. NO_COLOR preserves readable text without colors. Shift+Tab changes modes where supported; F2 answers questions; Ctrl+W deletes a word; Option+Left/Right moves by word; Ctrl+J inserts a newline. Exit saves unsent drafts and prints resume, handoff, and export commands.

The interface stays. The agent CLI can change.

acli translates a small, stable vocabulary into each installed agent CLI. Use the same agent names, session references, permission mode, model option, and reasoning-effort option; acli rejects combinations an agent CLI cannot support instead of quietly changing their meaning.

Start

Open a fresh session

acli start claude

Swap claude for codex, copilot, or antigravity. The command shape stays the same.

Continue

Find work by name

acli resume checkout --agent codex

Use a readable display name, narrow the picker with --agent, or pass a qualified UUID directly for the fastest exact-ID path.

Switch

Hand work to another agent CLI

acli resume claude:checkout --to codex

Create a new target session with the useful visible conversation carried forward.

Balanced from the first prompt

Fresh starts and handoff targets use Claude's provider default with xhigh effort and Codex's available provider default with xhigh. Copilot uses auto with high. Antigravity keeps the model it has saved.

Continue at the same quality

Resume restores recorded model and effort wherever the agent CLI persists them. Missing quality values receive independent agent-specific fallbacks. Permissions use the highest mode that destination policy permits; historical restrictions are not replayed. A native fork inherits source quality. Explicit model and effort overrides always win.

Maximum permitted access

Managed starts, resumes, forks, and handoff targets request the highest policy-permitted permissions. Claude uses bypassPermissions where allowed, auto when bypass is disabled, and Manual when both autonomous modes are disabled. Permissions never select a model, effort, or search policy.

acli MCP is ready by default

Managed start, resume, fork, and handoff launches make one aggregate acli MCP server available to the selected agent CLI. acli preflights the service and creates a persistent user-scope registration only when it is missing. Existing provider restrictions and deliberately disabled registrations remain authoritative.

One reviewed public catalog

The server exposes Lifub's hosted web, DNS, request, Site Audit, and WHOIS tools plus public resources and prompts. Private CI and local workspace read, write, and bash tools are not part of the public binary, even when called by a guessed name.

Per-launch opt-out

Add --no-acli-mcp before the native -- boundary to disable acli MCP for one managed launch without removing unrelated MCP servers. The choice is not saved, so a later launch returns to the default. acli exec remains exact and unmanaged.

Capability is not approval

Tool discovery never grants permission to call a tool: the selected agent CLI's approval and sandbox policy stays in control. Calls send their bounded inputs to https://api.lifub.com/mcp, where request-size, proof-of-work, rate, and quota limits apply.

Browser authority: Managed default accounts expose only configured personal browser tools; corporate accounts expose only configured corporate tools. Brave and Safari remain separate. Standalone acli mcp serve retains all configured operator bridges; use --bridge-profile default|corporate|all to choose its scope. A call can operate that live browser session with the authority already available there. acli ignores model-supplied session IDs and removes configured identifiers from forwarded data and errors.
Same-user boundary: the agent CLI and acli mcp serve run as the same operating-system user. This prevents accidental catalog exposure but is not credential isolation from a hostile process running as that user.

Recognize the session before you open it

acli resume opens one searchable catalog across agent CLIs, canonical native/API sessions, and legacy chat sessions supported by the installed build. Provider, profile, session name, saved model, and activity have separate fields. Default means your personal account; corporate is separate. Other engines show shared account status. Tab or Ctrl+T chooses a destination and returns to the list. Enter launches the displayed destination; Ctrl+Y copies its exact resume command. Ctrl+P previews and Ctrl+L refreshes. 

Choose a saved AI session
Search: checkout                         3/12 sessions

  Provider Profile           Session    Model        Activity
> claude   default (personal) checkout   opus         8m
  codex    corporate          checkout   gpt-6.1-sol  RUNNING
  copilot  shared             checkout   auto         2h

Destination: Original - claude / default (personal)

claude:1803904f-a859-49a9-91fe-85613902d39b | Ctrl+Y copy resume | ~/src/shop
Last assistant output
  The checkout tests pass. The remaining task is to update the release notes.

type to filter | arrow keys navigate | Enter launch | Tab/Ctrl+T destination | Ctrl+Y copy | Ctrl+L refresh | Ctrl+D delete | Esc cancel

Ambiguity is a choice, never a guess

Exact duplicate names and useful close matches open the same preview picker in an interactive terminal. Non-interactive commands fail with qualified candidates instead of consuming input or selecting a session silently.

See active work

A Codex session owned by another terminal is marked RUNNING. acli refuses a second normalized resume before two processes can write to the same session.

Readable in every terminal

ANSI color separates selection, status, metadata, and preview roles. NO_COLOR and the standard CLICOLOR controls are respected. The selected row has a subtle highlight; matching and total counts appear when space permits. Ctrl+Y copies an immutable-ID resume command for the displayed destination, including distinct source and destination profiles. Ctrl+D deletes an inactive session through its owning store. Live sessions stay protected; close them and use Ctrl+L to refresh.

Continue the work with another agent CLI

Use acli resume --to PROVIDER or Tab in the picker to continue in a fresh destination from private local context. New Codex, Claude, Copilot, and Antigravity destinations open their own agent CLI by default. Use --via native for acli's terminal with Codex, Claude, Copilot, or Antigravity. Set --name for an exact destination name, or keep the source name. acli adds no handoff, agent, model, or effort suffix. 

$ acli resume claude:checkout --to codex --name checkout-review
$ acli resume copilot:SESSION_UUID --to claude --skip-validation
$ acli resume native:SESSION_UUID --to claude --via native --allow-paid-usage

Choose settings before continuation

Source identity, live ownership, transfer eligibility, and archive integrity are checked before launch. Inside the destination, choose the model and supported effort before GO, Continue without revalidation, Later, or Skip. --skip-validation selects continuation without blanket workspace checks; it does not authorize GO or submit a saved draft. The agent CLI bootstrap uses one model turn. acli's native entry card sends no model turn before your choice.

Accepted history stays separate from drafts

acli carries visible user and assistant text without redacting it, so a secret or machine-local path pasted into the visible conversation crosses too. Review sensitive conversations before transferring them. Provider transcripts exclude hidden instructions, tool calls and output, attachments, agent-owned session IDs, workspace metadata, timestamps, and skill files. Legacy chat exports separately index original unsent drafts and attachment references; they exclude system/developer instructions and credentials. Native exports preserve the canonical journal and verified attachment snapshots, clearly separating accepted input, unsent drafts, and unresolved work. Drafts and their images are not sent automatically.

Private, bounded, and resumable

The handoff uses a size-bounded private artifact with private file and directory permissions. Its launch envelope identifies the source agent and artifact path. acli session context ARCHIVE pages accepted history with a 16 KiB output limit, opaque continuation cursors, and integrity checks. Drafts and attachments remain separate. Deferred imports and portable exports remain available for cold resume or manual delivery. Eager agent CLI imports are removed after a successful target exit; failed or uncertain delivery retains the archive for inspection. Unsupported direct delivery provides an export and import prompt instead of claiming success.

Codex reads without a new writable root

Codex receives the artifact's absolute path in its prompt; acli does not add the artifact directory as a writable --add-dir. Paths you explicitly pass with --add-dir remain additional workspace roots.

Resources resolve locally

acli never copies referenced skill or resource files. The target resolves each named resource from its own installed environment instead of assuming a source-machine absolute path exists, and reports anything missing without inventing a replacement.

Mark stale context explicitly

Add --unverified when the source may be outdated. The receiving agent must re-establish claims, decisions, file contents, and results before relying on them, even when blanket revalidation is skipped. Unknown pending operations are never replayed automatically.

Commands at a glance

The public CLI uses action-first commands. Run any command with --help for its exact agent, model, effort, JSON, and agent CLI argument options.

acli start <agent> [-p <prompt>] [--no-acli-mcp] [--permissions <mode>] [--model <model>] [--effort <level>] [--add-dir <dir>]...
Start a fresh Claude, Codex, Copilot, or Antigravity session with agent-specific model and effort defaults.
acli resume [session] [--agent <agent>] [--to <agent>] [--from-profile <profile>] [--to-profile <profile>] [--choose-provider] [--skip-validation] [-p <prompt>] [--no-acli-mcp] [--permissions <mode>] [--model <model>] [--effort <level>] [--add-dir <dir>]...
Resume through the unified picker, filter a provider/store, or choose a fresh provider/account destination. A qualified positional UUID, such as codex:0192d9f0-0000-7000-8000-000000000000, skips discovery.
acli fork [session] [--agent <claude|codex>] [-p <prompt>] [--no-acli-mcp] [--permissions <mode>] [--model <model>] [--effort <level>] [--add-dir <dir>]...
Branch through the native fork operation, preserving source quality unless --model or --effort overrides it.
acli handoff [source-session] [--from <agent>] [--to <agent>] [--name <name>] [--via cli|native] [--skip-validation] [--unverified] [--no-acli-mcp] [--permissions <mode>] [--model <model>] [--effort <level>] [--add-dir <dir>]...
Deprecated compatibility interface. Existing flags and explicit scripted --go remain supported; use acli resume for new workflows.
acli exec <agent> -- <native args>
Run the agent CLI with byte-for-byte arguments and no acli policy injection.
acli session list [--agent <agent>] [--json]
Inspect the cross-agent catalog, coverage diagnostics, names, workspaces, and active sessions. JSON uses a stable sessions array and session_count coverage field.
acli session capabilities [<agent>]
See which list, resume, fork, rename, archive, restore, and delete operations each agent CLI exposes safely.
acli session rename <agent>:<id-or-name> <display-name> [--json]
Apply a memorable display name through a public agent CLI rename interface or a safe acli-owned alias.
acli session archive|restore <agent>:<id>
Use supported agent session lifecycle operations with an exact qualified ID.
acli session delete <agent>:<id> --yes
Review stable-ID deletion, including native sessions and bounded Copilot cleanup. Live ownership, ambiguous outcomes, and unresolved fork dependencies remain protected.
acli context status|diff|sync
Inspect shared instructions and already-installed local resources. Sync creates missing links only to canonical resources already installed on this machine, never bundles or copies skills, and reports a missing source without inventing one.
acli mcp status|diff [--agent <agent>]
Inspect the persistent acli MCP registration across one installed agent CLI or every available one.
acli mcp sync|remove [--agent <agent>] --yes
Create or remove only exact acli-owned registrations. Sync verifies acli before retiring exact-owned lifub or loxal aliases; remove works offline.
acli mcp serve [--bridge-profile default|corporate|all]
Run the aggregate MCP server. Standalone serving defaults to all configured operator bridges; managed launches inherit their account scope. An explicit scope cannot widen an inherited broker.
acli repo commit [--stage-all] [--push]
Generate an AI commit message for staged changes. Add --stage-all to include the whole working tree and --push to push the new commit without pulling, rebasing, or resolving conflicts.
acli doctor [--profile default|corporate]
Check agent CLI versions, command contracts, available updates, session capabilities, and restriction sources without changing settings. Preview an explicit local permission reset, then add --fix to apply it with a report of changed files and settings.
acli update
Show the installed and latest acli versions, verify the immutable release manifest, size, SHA-256 digest, and staged binary version, then replace acli atomically.

Keep default and corporate Claude and Codex accounts separate

Claude uses --profile default when no profile is supplied, keeping the existing ~/.claude and ~/.claude.json layout. Opt into --profile corporate for the separate ~/.claude-corporate directory. Codex uses separate ~/.codex and ~/.codex-corporate roots, including account-bound SQLite stores and file-backed corporate credentials. --claude-profile remains an alias; the older personal and work spellings select default and corporate respectively.

Use --from-profile to select a source account and --to-profile to choose a destination. Changing account creates a fresh session from conversation context. Resume keeps each session's original configuration roots, including older isolated personal sessions. The corporate indicator appears in launch, picker, and native header metadata; it never changes your exact session name. 

$ acli doctor --profile default
$ acli doctor --profile default --reset-claude-permissions --fix
$ env CLAUDE_CONFIG_DIR="$HOME/.claude-corporate" claude auth login
$ acli start claude --profile corporate

Plain doctor is read-only. An explicit Claude reset removes local organization login pins and permission blockers, enables installed plugins and MCP servers, and preserves authentication, history, and unrelated preferences. Repairs identify every changed file and setting. Preview the operation by omitting --fix. Hooks are reported by EVENT:GROUP:HOOK; add --remove-claude-hook with a reviewed coordinate to the Claude reset to remove that restriction. Unselected automation remains intact.

Corporate setup creates an empty, private destination configuration. Credentials, configuration, hooks, permissions, plugins, MCP policies, and routing are never cloned from a source account. Install resources separately in the destination. The recognized doctor --clone-from compatibility flag fails before reading or writing a profile. Source policy does not become destination policy; destination and shared managed policy remain authoritative.

Official login runs in your foreground terminal and may apply corporate hooks and policy to that isolated account. Starting with acli 1.155.0, acli selects bypass where allowed, auto when bypass is disabled, and Manual when both autonomous modes are disabled. It reports the effective mode and policy source. Organization policy, hooks, MCP restrictions and account entitlement remain authoritative; acli never edits managed settings to evade them.

Unified does not mean pretending agent CLIs are identical

Agent CLIs expose different session APIs and accept different model and effort values. acli normalizes what can be normalized, reports the capability boundary supported by this acli version, and fails clearly when a requested operation is unsupported. Local cleanup is limited to verified supported stores and exact session identity; it never treats an unknown remote mutation as permission to delete local data.

Check before automating: run acli session capabilities <agent>. Every launch command accepts agent CLI options after --; acli exec is the exact, no-injection form.

Maximum permitted access

Managed starts, resumes, forks, and transfers use each agent CLI's maximum policy-permitted approval, sandbox, and trust controls. Claude falls back from bypassPermissions to auto, then Manual when policy disables both autonomous modes. Auto mode retains classifier checks and organization rules; Accept Edits is not an automatic fallback. Conflicting native permission flags fail instead of silently weakening the effective request. Permissions never select a model, effort, or search policy. Repeat --add-dir for explicit extra workspace roots. Use acli's default only in a workspace and account you intentionally trust with unattended access; managed agent or environment policy can still take precedence.

Copilot permissions: Allow All (--allow-all or --yolo) is Copilot's maximum tool, path, and URL permission mode. Autopilot controls execution independently. acli doctor --reset-copilot-permissions --fix resets local permission blockers without deleting authentication, history, plugins, or the saved execution mode. Organization policy can still constrain the requested permissions.
Fresh-session quality: Claude uses the provider's default model with xhigh effort. Codex uses its available provider default with xhigh; a known lower-tier default is promoted to gpt-6.1-sol when the account advertises it. Higher-tier and unfamiliar defaults are preserved. Copilot uses auto at high; Antigravity keeps its saved model and reasoning level. Claude's separate Ultracode workflow is preserved independently of effort. Claude accepts effort from low through max plus ultracode, Codex from none through ultra, and Copilot from none through max, including minimal.
Continuity first: Resume reapplies each recorded model and effort value when it is readable; explicit --model and --effort values always win. Missing quality components fall back independently to fresh-session quality. Permissions are resolved from the destination's current policy; recorded restrictions remain historical provenance. An unavailable saved model falls back to the provider default with a visible explanation; saved effort survives when the replacement supports it. Authentication, capacity, billing, and transport errors never prove a model is retired and never cause prompt replay. Claude's policy-aware fallback applies in default and corporate profiles and is checked before import and again before launch. Antigravity records no readable model or effort per conversation. Older Copilot sessions created with auto may expose only the last actual model. Fork delegates quality inheritance to the agent CLI unless you override it.

Platforms and requirements

macOS

Apple Silicon and Intel are supported on macOS 11 or newer.

Linux

x86_64 glibc Linux is supported and tested on Ubuntu 22.04 and 26.04. Linux ARM64 and Alpine/musl are not available yet.

Agent CLIs are separate prerequisites. acli does not bundle Claude Code, Codex CLI, GitHub Copilot CLI, or Antigravity CLI. Install and authenticate only the agent CLIs you intend to use. Those agent CLIs remain responsible for their own accounts and network traffic.

A fail-closed download path

For every public version, the release pipeline:

  1. builds with private features disabled under an otherwise empty, allowlisted environment;
  2. pattern-scans the resulting binary strings for known credential prefixes, private-key markers, private path patterns, and internal identifiers - a defense against accidental disclosure, not an absolute guarantee that a binary contains no sensitive data;
  3. publishes a versioned manifest containing the SHA-256 digest for every supported platform artifact;
  4. has the installer download to a temporary location, verify the expected SHA-256 digest, and fail closed on any mismatch;
  5. completes dependency and licensing review and tests each supported platform artifact; and
  6. installs atomically into a user-owned directory, without sudo, only after every check succeeds.

Piping a remote script into a shell carries risk. Inspect the installer before executing it and verify that the HTTPS hostname is exactly www.lifub.com before running the command.

Questions before you install

Does acli replace or bundle my agent CLIs?

No. It is a stable interface over the agent tools already installed and authenticated on your machine.

How do I update acli?

Run acli update. It shows the current and latest versions, downloads only from Lifub's fixed HTTPS release endpoint, verifies the immutable manifest, byte size, SHA-256 digest, and staged binary version, then atomically replaces the existing binary. Any failure leaves the old version installed. If your version predates this command, rerun the installer once; later releases update through acli itself.

How do I uninstall it?

Run acli mcp remove --yes first if you want exact acli-owned current and legacy MCP entries removed from every installed agent CLI, then remove ~/.local/bin/acli. Removing only the binary leaves the persistent provider registrations in place for direct provider launches, pointing at the now-missing executable. Agent-owned sessions remain untouched. acli state and display aliases remain in ~/.local/state/acli unless you choose to remove them separately.

Can I use acli in scripts?

Yes. Use a qualified positional UUID such as acli resume codex:0192d9f0-0000-7000-8000-000000000000 for deterministic selection and acli session list --json for machine-readable discovery. Its stable schema names records sessions and reports coverage with session_count. Non-interactive commands never open a picker or guess between ambiguous names.

What happens when an agent CLI changes?

acli doctor checks installed versions and the command options on which the unified interface depends, reports exact update commands for outdated clients, and identifies restriction sources without changing settings. Select --reset-claude-permissions or --reset-copilot-permissions for an explicit repair preview, then add --fix to apply it. Claude permission reset also requires --profile default. Repairs report changed files and settings; managed organization policy remains authoritative.

Keep the workflow. Choose the agent CLI.

Install acli, run acli doctor, and open your first unified session.

Install acli Browse every command