CLI & npm guide

Install from npm

Add the engine to your repo (Node 20+). You can use npx without a global install.

npm install @lintora/core --save-dev

Run the binary via:

npx lintora run

Sign in from the terminal (required for a normal run)

lintora run talks to the hosted license gate. On your workstation, save a session once per machine (or after you replaced the active device). From the project root where @lintora/core is installed:

cd /path/to/your/repo
npm install
npx lintora login

The CLI prints a https://lintora.dev/account/cli-link.html?... URL. Open it in a browser that is signed into the same Lintora account, approve the link, then return to the terminal. Next:

npx lintora run

Clear saved credentials and license cache under ~/.lintora/ (or LINTORA_HOME):

npx lintora logout

Show local paths, install key fingerprint, and short license state:

npx lintora status

List server-side devices (needs a saved session):

npx lintora status --devices

No node_modules yet? Either install first (npm install @lintora/core --save-dev) or invoke the published package directly (same commands, one-off download):

npx --yes -p @lintora/core@latest lintora login
npx --yes -p @lintora/core@latest lintora run

License server HTTP 500 (internal_error): that is a server-side failure inside license-check (not "you forgot login" by itself). Fix the Supabase Edge deploy, migrations, and Edge secrets for your project, wait a moment, then run npx lintora login again and npx lintora run. If you ever exported a stale LINTORA_INSTALL_KEY, run unset LINTORA_INSTALL_KEY so the key from lintora login wins on a normal laptop.

Update an existing project

npx lintora run uses the package already in node_modules; it does not fetch a new release each time. From your project root, bump within the semver range in package.json (for example ^1.2.2) with:

npm update @lintora/core

To install one exact published version (for example after a changelog fix), run npm install @lintora/core@1.2.2 --save-dev with the version you want, then commit the updated lockfile. See @lintora/core on npm for what is published.

After lintora login, the CLI keeps your session under ~/.lintora/ by default (for example credentials.json and license.json). They are never created in your project root by npm; treat that directory as local-only and do not commit it.

Multiple accounts on one computer: signing out on the website and signing in with another email only changes the browser session. The CLI still reads whatever is stored on disk for the active shell. To keep accounts isolated, set LINTORA_HOME to a dedicated directory before npx lintora login and every npx lintora run for that account (for example export LINTORA_HOME="$HOME/.lintora-work" in a shell profile or per-project script). Use npx lintora logout to clear credentials and license cache under whichever directory is currently in effect.

Install key precedence: on a normal workstation, the key saved by lintora login in credentials.json is used before LINTORA_INSTALL_KEY from the shell (CI is the opposite so job secrets work without a home directory). If you once exported an old key, either unset LINTORA_INSTALL_KEY or set it to the current key so it matches what you expect.

If run prints that the license backend did not return WASM policy keys, that is separate from "device replaced" or the rolling device-change limit: it means the online license response did not include encrypted policy keys (the hosted license-check stack must expose that field). Creating a new install key does not fix that by itself.

If your terminal is not already in the project root, set the scan root with --cwd (absolute or relative path). Example from a parent directory:

npx lintora run --cwd ./my-app

Prefer pinning the version in package.json so CI and teammates stay aligned.

Sign in, active device, replace flow, and CI service keys

Run lintora login on a machine you trust, then approve the session in the browser. Your account keeps one active workstation key; replacing it is limited per rolling 30-day window. Use lintora status for local state and lintora status --devices (with a saved session) to fetch the server-side device list.

For GitHub Actions and other headless runners, create a service install key on Install keys, set LINTORA_INSTALL_KEY in the job, and rotate or revoke the key from the same page when a secret leaks.

Replace this workstation (no second laptop required)

Lintora allows one active personal install key per account. Moving to a new machine means approving a replacement in the browser. You do not need a second physical laptop: any separate environment with its own shell is enough, for example a cloud IDE (Codespaces, Gitpod), a disposable cloud VM, or a colleague's computer where you are allowed to run the CLI once.

1. In the new environment, install Node 20+, install @lintora/core, then run npx lintora login (or lintora login --token ... if you use a token).
2. Copy the https://lintora.dev/account/cli-link.html?... URL the CLI prints.
3. On your everyday browser (already signed into the same Lintora account), open that URL. If you already have an active device, the page shows Replace and authorize or Cancel. Confirm only if you intend to move the active key to the new environment.
4. Return to the new environment's terminal and wait for the CLI to finish; it stores the new install key under ~/.lintora/ on that machine.

Limits and counts: lintora status --devices (with a saved session on the machine that has your access token) shows how many replacements you used in the rolling window. Full policy: device binding doc in the monorepo.