The Autoheal CLI
autoheal (also installed as ah) drives the Autoheal platform from the command line. It is built for coding agents first: start an investigation, wait for the result, answer the agent's questions, read the RCA — all with stable JSON output and meaningful exit codes. Humans get readable text output on a TTY automatically.
Install
# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/accelos/monorepo/main/scripts/install-autoheal.sh | sh
# Homebrew
brew install accelos/autoheal/autoheal
# Windows
scoop bucket add autoheal https://github.com/accelos/scoop-autoheal; scoop install autoheal
winget install Accelos.Autoheal
Log in
autoheal login
One browser approval (OAuth device flow) and you're done — the CLI discovers your organization from the login, writes a default profile to ~/.autoheal/, and silently renews tokens afterwards. For a second org or a dev/BYOC host, add explicit profiles with autoheal auth login --org NAME or --domain HOST and switch with --profile / AUTOHEAL_PROFILE.
Headless/CI environments skip the browser: set AUTOHEAL_TOKEN (a raw bearer token) and AUTOHEAL_DOMAIN.
The agent workflow
# Start an investigation and block until there's an answer (or a question for you)
autoheal inv create "checkout error rate spiked at 14:00 UTC" --wait
# The run paused to ask something? List, answer, and re-enter the wait loop:
autoheal inv hitl <id>
autoheal inv hitl answer <id> --ref <ref> --text "us-east-1 production"
autoheal inv hitl approve <id> --ref <ref> --session
autoheal inv wait <id>
# Read the result
autoheal inv rca <id>
autoheal inv evidence <id>
--wait/wait return as soon as a human must act, printing what the run is blocked on. Exit codes tell an agent exactly what happened:
| Code | Meaning |
|---|---|
| 0 | success — root cause available/accepted, or resolved |
| 1 | error — CLI/API failure, or the run ended in error/stopped |
| 2 | usage error |
| 3 | authentication required |
| 4 | not found |
| 5 | wait timeout |
| 6 | awaiting human — answer/approve, then wait again |
autoheal inv follow <id> streams the live agent events instead of polling; autoheal chat ... offers the same verbs for chat sessions.
Everything else
Beyond the investigation/chat workflow, a small allowlist of API domains ships as generated command groups — alerts, integrations, and skills:
autoheal alerts list
autoheal alerts get <alert-id>
autoheal integrations list
autoheal skills list
Everything not in that allowlist stays reachable through the raw passthrough:
autoheal api GET /api/v1/incidents
And autoheal api is the raw escape hatch to any endpoint:
autoheal api GET /api/v1/alerts --query page=1
autoheal api POST /api/investigations/create --field query="db latency" --field mode=fast
Output auto-detects: human text on a TTY, JSON when piped (--json to force). Data goes to stdout, progress to stderr — pipe away.