Bonfire CLI

Import a local project into Bonfire with an explicit file review before anything is uploaded. This repository contains both the bonfire command-line tool and the portable bonfire-share Agent Skill.

Install the CLI

The npm package will be installed with:

npm install -g @bonfire/cli
bonfire login

Until the first npm release, install it from source:

git clone https://github.com/bonfireai-build/bonfire-cli.git
cd bonfire-cli
npm install
npm run build
npm link
bonfire login

Install the Agent Plugin

The repository is an Agent Plugins package containing the bonfire-share skill. In Codex, add its marketplace and install Bonfire from /plugins:

codex plugin marketplace add bonfireai-build/bonfire-cli

Plugin installation loads the skill but does not place the bonfire executable on your shell PATH; install the CLI separately. For clients that do not yet support Agent Plugins, the CLI can install its bundled skill directly:

bonfire install-skill
bonfire skill-status

Restart the agent after installing the plugin or skill. Then ask it to share the current project, or invoke $bonfire-share where named skill invocation is supported.

Share a project

The skill reviews likely private material and performs a dry run before asking for explicit confirmation. To inspect the CLI manually:

bonfire share . --dry-run --json
bonfire share . --exclude .env.local --include .agents/skills --yes

bonfire share creates a new personal Bonfire Project from a one-time filesystem snapshot. It applies nested .gitignore rules, supports explicit includes and excludes, rejects unsafe symlinks, and never prompts in the terminal.

bonfire login uses browser-based device authorization. The revocable credential is stored outside the project in ~/.config/bonfire/credentials.json with owner-only permissions. A real share refuses to authenticate implicitly; log in again if the credential expires or is revoked.

The CLI trusts only https://api.bonfireai.build and loopback API origins by default. Custom servers require HTTPS and the explicit --allow-untrusted-api escape hatch. The bundled skill is prohibited from using that escape hatch.

Development

npm install
npm test
npm run typecheck
npm run build

The package is currently UNLICENSED; source is public for inspection, but no reuse license has been granted yet.