Labor0 CLI command reference

Run l0 <command> --help for complete flags and l0 completion <shell> for Bash, Elvish, Fish, PowerShell, or Zsh completion. Resource identifiers are lowercase UUIDs shown by list and detail commands.

Authentication and context

Need	Command
Sign in and securely store a named profile	`l0 --profile <name> auth login`
Verify the effective credential	`l0 --profile <name> auth status`
Remove or revoke a profile credential	`l0 --profile <name> auth logout [--revoke]`
List or delete profiles	`l0 profile list`; `l0 profile delete <name>`
Inspect or change saved scope	`l0 context`; `l0 context set`; `l0 context clear`
Select a Workspace or Project	`l0 workspace use <id>`; `l0 project use <id>`

L0_API_KEY takes precedence over secure profile storage for commands that accept API-key authorization. User API-token commands require a fresh interactive sign-in, and GitHub connection commands require an interactive terminal and browser handoff. Supply API keys through an approved CI secret mechanism; do not put them in a command argument or build log.

Product work

Area	Commands	Required access
Tenant and Workspace	`tenant list/create`; `workspace list/show/create/current/use/clear/update`	Visible access for reads and context selection; eligible first-time users or Enterprise Admins for Tenant creation; Tenant Admin or inherited Enterprise Admin for Workspace creation; Workspace Admin or inherited Tenant or Enterprise Admin for Workspace updates
Project and settings	`project list/show/create/current/use/clear/update/archive/settings`	Workspace Viewer or higher for reads and context selection; Workspace Operator or higher for creation, updates, archive, and settings mutations
GitHub and repositories	`repository github-app`; `repository github-user`; `repository list/register/binding`	Workspace Viewer or higher for lists; Workspace Operator or higher for GitHub connection, registration, and binding mutations
Graph	`graph show/watch`; `graph prompt`; `graph update review`; `graph insertion`	Workspace Viewer or higher for Graph, pending-prompt, review, and insertion reads; Workspace Operator or higher for submissions, cancellations, and review or insertion mutations
Tasks	`task list/show/update-settings/start/retry/retry-failed-project-tasks/diagnose/remove`	Workspace Viewer or higher for list, show, and diagnosis; Workspace Operator or higher for settings and lifecycle mutations
Task details	`task attachment`; `task usage`; `task network-usage`; `task billed-usage`; `task pull-request`; `task notification`	Workspace Viewer or higher for attachment and usage reads and downloads; Workspace Operator or higher for uploads, pull-request actions, and notification actions
Sessions	`session list/show/watch/execution-history/transcript/respond/plan`	Workspace Viewer or higher for session reads and watches; Workspace Operator or higher for responses and Plan decisions
Attention	`notification list/watch/clear`	Workspace Viewer or higher for list and watch; Workspace Operator or higher to clear

Workspace access includes qualifying inherited Tenant or Enterprise roles. Authorization is always checked by Labor0.

Long requests and repository URLs are read from stdin or another input source named by the command. For example:

printf '%s\n' 'https://github.com/example/repository' | l0 repository register --stdin --yes
printf '%s\n' 'Create a reviewable documentation task.' | l0 graph prompt submit --stdin --yes

The completion result is a resource UUID and safe status. Repository names, prompts, provider payloads, credentials, and signed transfer material are not returned in machine output.

Administration

Area	Commands	Required access
Members and invitations	`member list/invite/cancel-invite/set-role/remove`; `member accept-invite`	Matching-scope Admin for listing and management; the invited user for acceptance
Groups	`group list/create/update/archive/restore/move`; `group member list/add/remove/resolve`	Tenant Viewer or higher for list and resolve commands; Tenant Admin for mutations
User API tokens	`token list/create/revoke`	The current user with a fresh interactive sign-in and direct Workspace Viewer or higher access, or inherited Tenant or Enterprise Admin access
Runtime credentials	`credential list/set/delete`	Workspace Viewer or higher to list configured metadata; Workspace Admin, including inherited Tenant or Enterprise Admin, to set or delete
Security	`security passkey list/register/delete`; `security review-bot-policy show/update`	The current user for personal passkeys; Workspace Viewer or higher to show review-bot policy; Workspace Operator or higher to update it
Billing	`billing overview`; `billing plan`; `billing subscription`; `billing payment`; `billing usage`; `billing invoice`; `billing budget-alert`	Direct Workspace Viewer or higher, or billing-owner Admin, for Workspace billing reads; billing-owner Tenant or Enterprise Admin for plan, subscription, payment, and budget mutations

Tenant Viewer and Tenant Operator inheritance does not grant Workspace administration, runtime-credential mutation, or Tenant-wide billing access. Authorization is always checked by Labor0. Destructive actions require confirmation in an interactive terminal only when --yes is omitted; noninteractive mutations require --yes. In an interactive terminal, high-risk actions always require confirmation and also require exact-target re-entry when --yes is omitted.

Browser-required handoffs

GitHub OAuth, payment setup, and passkey registration remain browser-managed. Their initiating CLI command prints a validated Labor0 URL in the progress channel, opens it only with --open-browser, and waits for the authoritative result. Leave the command running until it succeeds, expires, or you interrupt it. Ordinary list, configuration, Graph, task, session, notification, usage, and administration commands do not require navigating the app.

Output and recovery

Human output is the default. Use --json for a non-streaming machine-readable result, and use the machine option shown by built-in help for watch commands. Results stay separate from progress, browser URLs, and confirmations. NO_COLOR and --no-color disable color.

List commands return one page unless --all is supplied. When a mutation result is uncertain, follow the command's recovery guidance and repeat it only when the command explicitly identifies replay as safe. For example, repeat l0 repository register with the exact same repository URL to return the canonical registration without creating a duplicate. Otherwise, use the command's authoritative list or show guidance instead of repeating the mutation. Use l0 doctor for safe readiness checks and Manage and troubleshoot for recovery and private support handoff.

Expected result

Each successful command returns a safe resource identifier or status that you can use for the next step. If access, connectivity, or a browser handoff changes during an operation, the command provides a bounded recovery action instead of exposing private service details.

Local runners

runner, service, doctor, diagnostics, completion, and version retain the local-runner lifecycle described in Set up and run. Runner and service commands use the default profile boundary and do not change another named profile.

Non-GA and preview features, raw API access, raw terminal input, a full-screen interface, YAML, and TSV commands are not included.