CLI reference
Environment variables
Read by wb#
| Variable | Effect |
|---|---|
WORKBENCH_HOME |
The data directory. Defaults to ~/.workbench. Must be on a local disk. |
NO_COLOR |
Disable color in human output. |
FORCE_COLOR |
Force color in human output. |
DO_NOT_TRACK |
Any non-empty value other than 0 disables anonymous save and run counts and their notice. |
E2B_API_KEY |
The E2B key. Overrides the key saved by wb connect --runtime e2b for one process. Never enters a sandbox. |
DAYTONA_API_KEY |
The Daytona key. Overrides the saved key for one process. Never enters a sandbox. |
DAYTONA_API_URL |
A Daytona API endpoint other than the public one. |
GH_TOKEN, GITHUB_TOKEN |
GitHub access for private sources and --repo runs, in that order, falling back to gh auth login. |
| Provider keys | Such as OPENAI_API_KEY, ANTHROPIC_API_KEY, OPENROUTER_API_KEY. See Provider variables. |
CLAUDE_CODE_OAUTH_TOKEN |
A claude setup-token subscription token for Claude Code on Docker and E2B. |
| Declared variables | Names the Workbench declares under env, bound into the run. |
Read by the installer#
| Variable | Effect |
|---|---|
XDG_BIN_HOME |
Where to install, when set. Otherwise ~/.local/bin. |
WORKBENCH_INSTALL_DIR |
Install somewhere else, the same as --bin-dir. |
Set inside a run#
| Variable | Value |
|---|---|
WORKBENCH_OUTPUT_DIR |
The run's outbox. Files written here are returned as artifacts. |
WORKBENCH_WORKSPACE_<NAME> |
The path of each bound named workspace, with hyphens as underscores. |
GH_TOKEN |
For --repo runs, the GitHub credential the runner's git and gh use. |
Only manifest-declared values, credential variables for the selected provider, and the selected runner's private credential store reach a run. Runtime keys stay on the host.
Files in WORKBENCH_HOME#
| Path | Contents |
|---|---|
catalog.json, packages/ |
Saved aliases and content-addressed package snapshots. |
wb.db, files/ |
Sessions, runs, events, and projects in one SQLite database, and the runner state, checkouts, and scratch they refer to. |
outcomes/, blobs/ |
Retained results. |
connections.json |
wb connect defaults. No secrets. |
metadata/models/ |
The cached model catalog, refreshed every 6 hours. |
studio/ |
The running Studio's owner-only state and its one-time open pages. |
credentials.json |
Registry organization keys, mode 0600. |
runtime.secrets.json |
E2B and Daytona keys, mode 0600. |
runtime-credentials/e2b/<runner>/ |
Runner credentials synced into E2B sandboxes. |
worker/ |
A worker's own engine home, key, and member directories. |
Never open the credential files. Check them with wb whoami and wb connect --runtime <name> --status.