Dough CLI

Overview

The dough CLI publishes and installs Dough agents from your terminal. It is a single self-contained binary — no Node, Python, or other runtime required.

Agents are versioned bundles: an agent.yaml manifest plus skills, instructions, and supporting files. Publishing uploads a new version to your organization's registry; installing downloads a bundle into a local folder.

The CLI is self-describing — run dough --help for the command map, and dough agent --help or dough skill --help for the full subcommands, flags, and notes. This makes it easy for coding agents like Claude Code to discover the right command on demand.

Update the CLI

Re-run the installer for your platform — it always fetches the latest release, so install, reinstall, and update are the same command. Check your current version with dough --version.

• If a command fails with an out-of-date message (HTTP 426), the server is rejecting your CLI version — re-run the installer, then retry. The CLI prints the reinstall command automatically on a 426.

shellcurl -fsSL https://raw.githubusercontent.com/Dough-AI/dough-installer/main/install.sh | sh

shellirm https://raw.githubusercontent.com/Dough-AI/dough-installer/main/install.ps1 | iex

Log in

Authenticate before using the registry. dough login opens your browser to complete SSO and saves the session locally. It defaults to https://app.usedough.ai; pass --url to target another deployment.

• dough status verifies the saved session with Dough and prints its email and organization id, so you can compare it with the orgId shown by proposal tools.
• dough evidence upload prints that same organization id beside the evidence id; evidence cannot be consumed by an MCP session authenticated to another organization.
• dough logout clears the saved session.

shelldough login

shelldough status

shelldough logout

Run and update agents

Browse the agents published in your organization, then open one. run fetches the agent and starts a Claude Code session already inside it — being in that directory is what loads the agent's instructions and skills, and what lets its scripts reach their credentials.

• Without --version, both fetch the latest published version.
• sync <name> fetches the files without opening a session, and prints the path. It also removes files the new version dropped, leaving anything you created untouched.
• Both overwrite the agent directory whether or not it already exists, so there is no separate install or upgrade step.

shelldough agent list

shelldough agent run <name> [--version X.Y.Z]

shelldough agent sync <name> [--version X.Y.Z]

Write query results to CSV

Use dough query run when an agent or build script needs a large governed Data Lake result on disk. The command uses the organization from dough login, follows every result cursor itself, and writes rows straight to the output file instead of sending them through an agent's context.

Prefer --saved for recurring work. The saved query is fetched again on every run, so an updated organization definition takes effect without copying SQL into an agent folder. Every parameter declared by a saved query must be supplied explicitly as --param name=value; missing or undeclared parameters fail before the query runs.

• --sql and --sql-file are available for ad-hoc work. Their named parameters are passed through, but the CLI has no saved declaration to check for missing names; the governed query tool still rejects invalid or non-read-only SQL.
• dough query get --saved <id> prints a saved query's SQL, its declared parameters and a sha256 of the two, without running it. The hash changes only when the SQL or a parameter's name, type or default changes, so a script can record it and notice later that the query was edited.
• Rows go only to --out. Progress and the final row and byte counts go to stderr, so stdout never fills with query data.
• The output is replaced only after every page succeeds. A query, paging, or file error exits non-zero without leaving a partial CSV behind.

shelldough query run --saved <query-id> --param period=2026-01 --out balance_activity.csv

shelldough query run --sql-file tieout.sql --param period=2026-01 --out tieout.csv

shelldough query get --saved <query-id> --json

Publish an agent

Run publish pointing at a bundle directory that contains an agent.yaml. The CLI packs the folder and uploads it; the server assigns the next patch version.

On a first publish there is usually no agent.yaml or skill.yaml yet. Rather than failing on the missing file, publish writes one from the markdown that is already there — CLAUDE.md for an agent, SKILL.md for a skill — and stops so you can read it before anything is sent. A first publish fixes the name and the owner permanently, and an agent still needs its examples written by hand.

• agent.yaml requires name, version (semver x.y.z), owner (your email), description, and a non-empty examples list of prompt strings.
• Each skill in .claude/skills/<name>/ carries a skill.yaml; on publish the CLI resolves every skill to a published version and writes a lock, so the agent pins exact skill versions instead of vendoring files. Publish a skill first if it has unpublished changes (see below).
• The first publish uses the version in agent.yaml; every later publish gets the next patch version, assigned by the server and written back to agent.yaml. publish takes no --version — it is derived, not chosen.
• Publishing is refused when the version in your yaml is not the registry's latest, because that means someone published while your copy sat here and publishing now would drop their work. Run dough agent sync <name> (or dough skill sync <name>) first — but read the warning it prints: sync is destructive, and what it destroys differs between agents and skills.
• A published version can never be replaced, and can never go backwards: the server rejects any version that is not strictly greater than the current latest.
• Published versions are immutable — you cannot overwrite a version that already exists.
• Only the owner can publish. The first publish must declare you (the agent.yaml owner must match your logged-in account), and only that owner can publish later versions.
• dough agent draft <directory> pushes a draft instead of publishing. Any org member can push one (the agent must already have a published version, and your agent.yaml version must be the current head). A draft gets its own version number, is never deleted, and never becomes what sync <name> or run <name> resolve — fetch one with dough agent sync <name> --draft (the head) or --version <x.y.z>. Attach an evaluation report with --report <path> or dough agent report <name>@<version> <path>.
• The owner promotes the head draft with dough agent publish <name>@<version>, adding --release-notes "<text>" for what version history shows (or the Publish box on the agent page); the owner can edit them later on the version page. Older open drafts are archived as superseded. To publish an older draft, archive the ones above it first with dough agent archive <name>@<version> (the owner or the draft's author can archive). dough agent info <name> lists versions, drafts, the head, and the report summary; dough agent list shows head <version> (<n> drafts).
• While drafts are open, a direct dough agent publish <directory> is refused — publish or archive the drafts first. The owner can send a draft back with dough agent review request-changes <name> <version> --note "..." (the --note is required and is what the author sees); the author pushes a new draft on top.

shelldough agent publish <directory>

shelldough agent draft <directory>

shelldough agent info <name>

shelldough agent publish <name>@<version>

shelldough agent archive <name>@<version>

shelldough agent report <name>@<version> <path>

shelldough agent sync <name> --draft

shelldough agent review show <name>

shelldough agent review request-changes <name> <version> --note "..."

Publish, review, and install skills

Skills are first-class, independently versioned registry entities. A skill bundle has a skill.yaml (name, version, owner, description) plus its SKILL.md, and follows the same immutable, owner-only rules as agents.

• --draft submits a candidate version for the skill's owner to review; it is not promoted to latest until approved. dough skill review show <name> prints the candidate and a plain-English summary of what changed.
• The owner approves or requests changes with dough skill review approve|request-changes <name> <version> — also available as buttons on the skill's registry page.
• dough skill sync <name> assembles a skill into ~/.claude/skills/<name>/ — user scope, not the current directory. Claude Code discovers that folder in every session, so a synced skill is available wherever you are. Override with DOUGH_SKILL_DIR, or skillsDir in the CLI config.
• Downloads land first in a shared cache at ~/.dough/skills/<name>/<version>/, so a skill pinned by several agents is fetched once. The sync is a copy out of that cache, and it REPLACES ~/.claude/skills/<name>/ — anything you edited in place there is overwritten, which is why it is sync and not install.
• A published agent pins the exact skill versions it was built against; dough agent sync resolves those pins from the same cache and assembles the agent's own .claude/skills/.

shelldough skill list

shelldough skill publish <directory>

shelldough skill publish <directory> --draft

shelldough skill review show <name>

shelldough skill review approve <name> <version>

shelldough skill sync <name>[@version]

Keep the CLI up to date

The registry requires a current CLI. If yours is older than the deployed version, registry commands fail with an upgrade message — re-run the install command for your platform to update to the latest release.