DOCS · CLI

Run the release gate. Keep the browser on your Mac.

The signed CLI runs the same stored projects and deterministic engine as the desktop app. Use it from a stable self-hosted macOS runner while sessions, private references and browser evidence remain in that RERUN profile.

Prepare a first project Back to docs

Signed launcher in the app
Exit codes for CI
Evidence stays on the runner

DOCS / CLI / RELEASE GATE

SELF-HOSTED CI

One stable Mac. One authoritative gate.

01
Prepare the project in RERUN
02
Verify the local runtime
03
Run the stored release gate
04
Return status to CI

CUSTOMER-MANAGED MAC EVIDENCE · LOCAL

EXIT STATUS 0 passed · 1 test decision failed

CLI

VERSION Desktop · current packaged build SCOPE macOS · Apple silicon · local runtime

On this page

01 Prepare
02 Commands
03 Integrate

CURRENT COMMANDS doctor projects flows run gate

OPERATING GUIDE

Commands, output boundaries and exit codes below match the signed CLI shipped inside the current RERUN application.

01 · PREPARE THE MAC

Use the signed application. Reuse its protected profile.

Version 1 targets a stable Apple Silicon Mac or Mac mini. Run the CLI as the same macOS user that activated RERUN, prepared the project, established its browser session and saved any private references.

1.1
LAUNCHER
Call the CLI shipped inside RERUN.app

The launcher lives inside the signed application, so an application update keeps the desktop and command line on the same version.
```
"/Applications/RERUN.app/Contents/Resources/cli/rerun" doctor
sudo ln -s "/Applications/RERUN.app/Contents/Resources/cli/rerun" /usr/local/bin/rerun
```
1.2

PROFILE
Prepare credentials in the desktop app

Run each flow interactively once and save required private references in its encrypted project-and-flow vault. The CLI never accepts secrets through flags or environment variables.
Settings → Web access · run each flow once · close the app
1.3
DOCTOR
Prove readiness without opening a journey

Check the managed browser, project store, secure storage, signed entitlement and isolated session before CI depends on the result.
```
rerun doctor
rerun doctor --json
```

02 · COMMANDS AND CONTRACTS

Select stable IDs. Treat every non-zero code precisely.

Projects and flows are selected by stable ID first, then exact case-sensitive name. Automation should use IDs so a rename cannot silently point a gate at another target.

2.1
DISCOVER
List exactly what CI can run

The flow list includes destination host, step count and whether headless execution is possible. Drafts, empty flows and human checkpoints remain visible exclusions.
```
rerun projects --json
rerun flows --project prj_0123456789abcdef --json
```
2.2
EXECUTE
Run one flow, a batch or the project gate

The gate uses one atomic project snapshot and passes only when at least one flow runs, every result passes, no warning or exclusion exists and the local gate record is persisted.
```
rerun run --project prj_0123456789abcdef --flow flow_0123456789abcdef
rerun run --project prj_0123456789abcdef --all --concurrency 2
rerun gate --project prj_0123456789abcdef --concurrency 2
```
2.3
OUTPUT
Consume JSON, JUnit and exit status deliberately

JSON uses schemaVersion 1. JUnit is reduced, written atomically with owner-only permissions and contains names and local paths, so uploading it is explicit customer egress.
```
rerun gate --project prj_0123456789abcdef --json --junit ./reports/rerun.xml
0 passed · 1 failed/warned/excluded · 2 usage/config · 3 runtime · 4 licence · 5 profile busy · 130 cancelled
```

03 · SELF-HOSTED CI

Return the decision. Keep the evidence where it ran.

Install a self-hosted CI agent on the stable Mac under the prepared account. GitHub, GitLab, Jenkins, Bitbucket and Azure DevOps can all call the same signed command and interpret its exit status.

3.1

GITHUB

Run directly from a self-hosted macOS job

Dispatch the pilot after the controlled deployment completes. It checks the reachable site without checking out repository or pull-request code, suppresses detailed output and requires no evidence upload step.

on:
  workflow_dispatch:
permissions:
  contents: read
jobs:
  critical-journeys:
    runs-on: [self-hosted, macOS, ARM64, rerun]
    env:
      RERUN_BIN: /Applications/RERUN.app/Contents/Resources/cli/rerun
      RERUN_PROJECT_ID: prj_0123456789abcdef
    steps:
      - run: '"$RERUN_BIN" doctor >/dev/null 2>&1'
      - run: '"$RERUN_BIN" gate --project "$RERUN_PROJECT_ID" >/dev/null 2>&1'

3.2

BOUNDARY
Know what appears in CI logs

Screenshots, DOM and video remain on the Mac. Normal output still exposes names, generic status and failure metadata, durations and local paths; redirect it if the provider should retain only the exit status.
No automatic artifact upload · JUnit and JSON are opt-in egress
3.3

LIMITS
Use an approved test environment

The CLI uses RERUN cookies and encrypted references but does not copy a live Chrome profile, mirror localStorage or bypass CAPTCHA and anti-bot challenges.
Stable session cookies · no CAPTCHA bypass · no hosted ephemeral runner

Use the signed application. Reuse its protected profile.

Call the CLI shipped inside RERUN.app

Prepare credentials in the desktop app

Prove readiness without opening a journey

Select stable IDs. Treat every non-zero code precisely.

List exactly what CI can run

Run one flow, a batch or the project gate

Consume JSON, JUnit and exit status deliberately

Return the decision. Keep the evidence where it ran.

Run directly from a self-hosted macOS job

Know what appears in CI logs

Use an approved test environment

Describe it once. Replay it deterministically.