Overview

Arcane is continuous evaluation for AI-written code. A thin CLI watches your repo and streams each change to Arcane Cloud over TLS, where all analysis runs server-side against a shadow copy of your project. Your machine never runs analyzers, and the CLI never executes your code locally.

One result event fans out to two surfaces at once: the terminal TUI you keep next to your agent, and a live web dashboard you can share with your team. Same data, same moment, both places.

There is no local toolchain to install and nothing to configure to get started. If a repo runs on your machine, Arcane can watch it.

Quickstart

Four commands from zero to live evaluation.

1. Install

$ npm i @yassine115/arcane-cli

2. Sign in

$ arcane login
  To finish signing in, open:
    https://your-dashboard/activate?code=WDJB-MJHT
  and confirm this code:
    WDJB-MJHT

arcane login uses a browser device flow: it prints a short code, opens the dashboard, and you approve the device while signed in. The minted token is stored in ~/.arcane on this machine.

3. Link the repo

$ arcane link

Creates a project for the repo and uploads the initial snapshot the cloud analyzes against. The project id lands in .arcane/link.json.

4. Watch

$ arcane
# or: arcane watch [path]

Launches the live TUI. Edit a file (or let your agent write) and watch the evaluation stream, scores, and findings update in real time. The TUI header prints the dashboard URL for this project so you can open the same live view in the browser.

Commands

arcane login

Signs this machine in with a browser device flow and stores the token in ~/.arcane. Codes expire after about 10 minutes; run it again if you miss the window.

Exit codes: 0 on success, 1 on failure

arcane logout

Revokes the token server-side (a stolen token file stops working), then deletes ~/.arcane locally.

Exit codes: 0

arcane whoami

Prints the account the stored token belongs to.

Exit codes: 0 signed in, 1 not signed in

arcane link

arcane link [path]

Links the repo at path (default: current directory) to a project and uploads the initial snapshot. Respects your ignore rules from arcane.toml.

Exit codes: 0 on success, 1 on failure

arcane watch

arcane · arcane watch [path]

The main experience: bare arcane watches the current directory. Streams ordered change events to the cloud and renders the live evaluation stream, repo health rollup, branch status, and findings. Keys: j/k move, enter expand, d raw dimensions, / filter, ? help, q quit.

--no-color: disable colors (the NO_COLOR env var works too)

Exit codes: 0 on quit

arcane run

arcane run [workload] --compare --baseline <ref> [--yes]

Executes a workload you declared in arcane.toml inside Arcane Cloud's isolated sandbox and reports measured runtime behaviour (the Runtime Delta Engine). Nothing executes unless [execution] is enabled and you consent to the run.

--compare: measure baseline vs current and report the delta
--baseline <ref>: git ref to compare against, e.g. origin/main
--yes: skip the consent prompt (for CI; execution must be enabled)

Exit codes: 0 clean, 1 regression found, 2 usage/config error

arcane sendtest

arcane sendtest [path]

A one-shot smoke test of the full pipeline: login, link, send one change event, and wait for the acknowledgement. Useful to verify connectivity.

Exit codes: 0 on success, 1 on failure

Roadmap commands

These are specified and on the way, but not in the shipped CLI yet:

arcane init: Detect your stack, scaffold arcane.toml, suggest workloads.
arcane scan: One-shot: analyze the current state in the cloud, print a report.
arcane score: Print current scores.
arcane baseline set <ref>: Set the delta baseline ref.
arcane review: AI semantic review (opt-in).
arcane explain <id>: Plain-English explanation of a finding.
arcane fix: Apply a cloud-verified fix diff locally.
arcane gate: CI merge gate, delta-first.
arcane branches | contributors | ci | insights: Account-aware views mirroring the web tabs.

Exit-code contract

0: clean
1: findings or regressions (fails a CI build)
2: configuration or usage error

Configuration

Configuration lives in arcane.toml at the repo root. Everything is optional: Arcane works with zero config. The keys most projects touch are project.ignore, baseline.ref and [execution] enabled. Some sections configure features still rolling out to the CLI.

# ── General ──
[project]
languages = ["ts", "js"]          # detected if omitted
ignore    = ["dist", "node_modules", ".arcane"]
[ui]
theme   = "auto"                   # auto | dark | light
density = "summary"                # summary | full
accent  = "violet"
# ── Scoring & analyzers (analyzers run in Arcane Cloud) ──
[score]
weights = { quality = 1.0, security = 1.5, performance = 1.0, maintainability = 1.0 }
[analyzers]
enabled  = ["complexity", "escape-hatch", "semgrep", "knip", "gitleaks", "osv"]
disabled = []
[analyzers.complexity]
max_cyclomatic = 15
[analyzers.thresholds]
quality = 70                       # bar turns amber/red below thresholds
# ── Baseline / delta ──
[baseline]
ref = "origin/main"                # delta-first: only NEW findings vs this ref are surfaced
# ── Execution (OFF by default; runs in Arcane Cloud's isolated sandbox) ──
[execution]
enabled            = false         # master switch. nothing runs unless true
require_permission = true          # prompt before each run
allow_in_ci        = false         # CI must opt in explicitly (or pass --yes)
isolation          = "microvm"     # microvm | container
timeout_ms         = 30000         # watchdog SIGKILL on overrun
network            = "deny"        # deny | replay | allow (only with explicit grant)
# Declaring a workload is NOT permission to run it (still gated by [execution]).
[[workload]]
name       = "unit-tests"
command    = "npm test"
type       = "test"                # test | server | benchmark | function
auto_grant = false                 # true = skip the prompt for THIS workload only
[[workload]]
name       = "api-smoke"
command    = "npm run arcane:smoke"
type       = "server"
inputs     = "fixtures"            # tests | fixtures | zod | openapi | recorded | sample
perf_budget = { p95_ms = 200 }     # optional regression budget for the gate
# ── AI (opt-in, budgeted; runs in the cloud) ──
[ai]
enabled      = false
judge_model  = "claude-opus-4-8"
triage_model = "claude-haiku-4-5"
daily_budget_usd = 2.00
batch_in_ci  = true
# ── Gate (CI) ──
[gate]
gate_on = ["security", "performance"]   # which dimensions block a merge
fail_on = "new-regressions"             # never the legacy backlog
# ── Cloud (how Arcane gets your code) ──
[cloud]
mode           = "cloud"           # cloud | metadata-only | self-host
endpoint       = ""                # self-host engine URL (mode = self-host)
ephemeral      = false             # analyze-and-discard, persist results only
share_presence = false             # publish branch names + health (NEVER code)

How it works

Your saves become ordered events

The CLI normalizes every file save into an ordered change event and streams it over a token-gated WebSocket. Events are journaled locally until the cloud acknowledges them, so a dropped connection never loses work.

The cloud scores a shadow copy

Arcane Cloud applies your changes to a shadow copy of the repo and runs the analyzers server-side. Delta-first: with a baseline ref set, only NEW findings versus that ref are surfaced. Scores cover ten dimensions: complexity, deadcode, lint, security, secrets, deps, types, performance, concurrency and tests.

One result, two surfaces

Each result event fans out simultaneously to the terminal TUI and the web dashboard. Your whole team sees the same live data at the same moment.

Execution is opt-in and sandboxed

Runtime measurement (arcane run) only executes workloads you declared, only with [execution] enabled = true, and only after you consent to the run. Workloads run in an isolated cloud sandbox with resource limits, a watchdog timeout, and network access denied by default.

Security & privacy

Device-flow sign-in

arcane login never asks for a password in the terminal. You approve each machine in the browser; the CLI stores a per-device token in ~/.arcane.

Server-side revocation

arcane logout revokes the token in the cloud before deleting it locally, so a copied token file stops working.

TLS everywhere

Code changes travel encrypted to Arcane Cloud. Analysis happens against a shadow copy; the CLI ships bytes, never runs analyzers.

Metadata-only mode

Teams that never ship source can set [cloud] mode = "metadata-only": Arcane streams hashes and metadata instead of file contents.

Nothing executes by default

The execution sandbox is off unless you enable it, and every run is consent-gated even then.

Troubleshooting

"not logged in" when starting watch

Run arcane login first. Watch requires a signed-in device. arcane whoami tells you which account the machine is linked to.

"login failed" or connection errors

The CLI could not reach the cloud engine. Check your network, then retry. If you are running a self-hosted engine, make sure it is up.

The login code expired

Device codes are valid for about 10 minutes. Run arcane login again to get a fresh one.

Where is my project id?

arcane link prints it, and it is stored in .arcane/link.json in the repo. The dashboard URL for the project also appears in the watch TUI header.

Colors look wrong in my terminal

Pass --no-color or set the NO_COLOR environment variable.