Agent CLI

Hiver ships the popular agent CLIs, each in a ready-to-run image. Pick one, provision its image, pass the right credential as an env var, and drive it with exec (one-shot) or execStream (live output).

Run Claude Code inside a sandbox. The claude image ships the CLI ready to go.

One-shot task

claude -p runs a single prompt non-interactively and prints the result. Use exec when you just need the final output.

index.ts

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("claude", {
image: "claude",
env: { ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY! },
});

const result = await sandbox.exec(["claude", "-p", "Fix the bug in src/main.ts"], {
cwd: "/workspace",
});
console.log(result.stdout);

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("claude", {
image: "claude",
env: { ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY! },
});

const result = await sandbox.exec(["claude", "-p", "Fix the bug in src/main.ts"], {
cwd: "/workspace",
});
console.log(result.stdout);

The key is injected once at creation and is immutable, every later exec on this sandbox inherits it automatically, so you never pass it again.

Using your Claude subscription

Instead of billing an ANTHROPIC_API_KEY, you can authenticate Claude Code with your Claude Pro or Max subscription. Start the sandbox without a key, then log in interactively from a shell:

hiver start claude-agent --image claude   # no API key needed
hiver shell claude-agent                   # then run `claude` and complete the browser login

hiver start claude-agent --image claude   # no API key needed
hiver shell claude-agent                   # then run `claude` and complete the browser login

The login is stored in the sandbox, so subsequent commands reuse it:

hiver shell claude-agent --command "claude -p 'what skills do you have?'"

hiver shell claude-agent --command "claude -p 'what skills do you have?'"

Streaming output

Agents can run for a while and produce a lot of output. Use execStream to see stdout and stderr as they happen instead of waiting for the process to finish.

index.ts

const proc = await sandbox.execStream(["claude", "-p", "Refactor the auth module"], {
  cwd: "/workspace",
});

for await (const chunk of proc.pipes) {
  if (chunk.stdout) process.stdout.write(chunk.stdout);
  if (chunk.stderr) process.stderr.write(chunk.stderr);
}

console.log("exit code:", await proc.exitCode);

const proc = await sandbox.execStream(["claude", "-p", "Refactor the auth module"], {
  cwd: "/workspace",
});

for await (const chunk of proc.pipes) {
  if (chunk.stdout) process.stdout.write(chunk.stdout);
  if (chunk.stderr) process.stderr.write(chunk.stderr);
}

console.log("exit code:", await proc.exitCode);

Interactive TUI

The quickest way to drive Claude Code's full-screen interface is hiver shell, which drops you into the sandbox with a live PTY attached:

hiver shell claude-agent   # then run `claude` for the interactive TUI

hiver shell claude-agent   # then run `claude` for the interactive TUI

To build the same experience into your own tool, attach over a PTY yourself, see Pseudo Terminals for a complete example.

Keep secrets out of the agent's reach: rather than giving Claude your third-party API keys, allow the hosts it needs and inject credentials with an egress override, the agent uses them without ever seeing them.

Run OpenAI Codex inside a sandbox. The codex image ships the CLI.

codex exec runs a single prompt non-interactively, which pairs naturally with exec:

index.ts

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("codex", {
image: "codex",
env: { OPENAI_API_KEY: process.env.OPENAI_API_KEY! },
});

const result = await sandbox.exec(["codex", "exec", "Add tests for src/parser.ts"], {
cwd: "/workspace",
});
console.log(result.stdout);

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("codex", {
image: "codex",
env: { OPENAI_API_KEY: process.env.OPENAI_API_KEY! },
});

const result = await sandbox.exec(["codex", "exec", "Add tests for src/parser.ts"], {
cwd: "/workspace",
});
console.log(result.stdout);

Streaming output

For longer runs, stream output as it's produced with execStream:

index.ts

const proc = await sandbox.execStream(["codex", "exec", "Migrate the app to ESM"], {
  cwd: "/workspace",
});
for await (const chunk of proc.pipes) {
  if (chunk.stdout) process.stdout.write(chunk.stdout);
}
console.log("exit code:", await proc.exitCode);

const proc = await sandbox.execStream(["codex", "exec", "Migrate the app to ESM"], {
  cwd: "/workspace",
});
for await (const chunk of proc.pipes) {
  if (chunk.stdout) process.stdout.write(chunk.stdout);
}
console.log("exit code:", await proc.exitCode);

The OPENAI_API_KEY you set at creation is inherited by every later exec, so you set it once. To drive Codex's interactive UI from your terminal, attach over a PTY, see Pseudo Terminals.

Run the GitHub Copilot CLI inside a sandbox. The copilot image ships the CLI; authenticate with a GitHub token.

copilot -p runs a single prompt non-interactively:

index.ts

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("copilot", {
image: "copilot",
env: { GITHUB_TOKEN: process.env.GITHUB_TOKEN! },
});

const result = await sandbox.exec(
["copilot", "-p", "Explain what src/server.ts does", "--allow-all-tools"],
{ cwd: "/workspace" },
);
console.log(result.stdout);

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("copilot", {
image: "copilot",
env: { GITHUB_TOKEN: process.env.GITHUB_TOKEN! },
});

const result = await sandbox.exec(
["copilot", "-p", "Explain what src/server.ts does", "--allow-all-tools"],
{ cwd: "/workspace" },
);
console.log(result.stdout);

Streaming output

Stream output live for longer tasks:

index.ts

const proc = await sandbox.execStream(
  ["copilot", "-p", "Add a health check endpoint", "--allow-all-tools"],
  { cwd: "/workspace" },
);
for await (const chunk of proc.pipes) {
  if (chunk.stdout) process.stdout.write(chunk.stdout);
}
console.log("exit code:", await proc.exitCode);

const proc = await sandbox.execStream(
  ["copilot", "-p", "Add a health check endpoint", "--allow-all-tools"],
  { cwd: "/workspace" },
);
for await (const chunk of proc.pipes) {
  if (chunk.stdout) process.stdout.write(chunk.stdout);
}
console.log("exit code:", await proc.exitCode);

The GitHub token you set at creation is inherited by every later exec. To drive Copilot's interactive UI from your terminal, attach over a PTY, see Pseudo Terminals.

Run the open-source OpenClaw assistant (🦞) inside a sandbox. The openclaw image ships the CLI built in.

openclaw agent --local runs a single task without the background daemon:

index.ts

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("openclaw", {
image: "openclaw",
env: { ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY! },
});

const result = await sandbox.exec(
["openclaw", "agent", "--local", "--message", "Add tests for src/parser.ts", "--json"],
{ cwd: "/workspace" },
);
console.log(result.stdout);

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("openclaw", {
image: "openclaw",
env: { ANTHROPIC_API_KEY: process.env.ANTHROPIC_API_KEY! },
});

const result = await sandbox.exec(
["openclaw", "agent", "--local", "--message", "Add tests for src/parser.ts", "--json"],
{ cwd: "/workspace" },
);
console.log(result.stdout);

OpenClaw configures its model, agents, and credentials through an onboarding wizard, see the OpenClaw docs. Swap the model in the config (and the matching provider key in env) to run against any supported provider.

Run Google Antigravity's terminal coding agent, agy, inside a sandbox. The antigravity image ships it ready to go.

agy -p runs a single prompt non-interactively and prints the result:

index.ts

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("antigravity", {
image: "antigravity",
env: { ANTIGRAVITY_API_KEY: process.env.ANTIGRAVITY_API_KEY! },
});

const result = await sandbox.exec(["agy", "-p", "Add a health check endpoint to server.ts"], {
cwd: "/workspace",
});
console.log(result.stdout);

import { getOrCreateSandbox } from "@hiver.sh/client";

const sandbox = await getOrCreateSandbox("antigravity", {
image: "antigravity",
env: { ANTIGRAVITY_API_KEY: process.env.ANTIGRAVITY_API_KEY! },
});

const result = await sandbox.exec(["agy", "-p", "Add a health check endpoint to server.ts"], {
cwd: "/workspace",
});
console.log(result.stdout);

Stream output live for longer runs with execStream, exactly as with the other CLIs.

By default agy authenticates with an interactive Google sign-in, which doesn't work in a headless sandbox. For automated runs, provide credentials non-interactively — pass your key in env and check the Antigravity CLI docs for the exact variable and headless-auth flags, then keep it out of the agent's reach with an egress override.

Next: Claude Agent SDK