CLI reference

The lim CLI drives every Limrun instance type from Linux, Windows, or macOS. This page lists every command in lim 0.35.1 and the behavior they share. For a command's full flag list, run it with --help:

lim ios create --help

Install and update

Install the lim package globally with npm, pnpm, or bun. The CLI needs Node.js 20 LTS or newer:

npm install --global lim

Run the same command again to update, and lim version to print the installed version.

Authenticate

Every command that talks to Limrun resolves an API key in this order:

1. The --api-key flag.
2. The LIM_API_KEY environment variable. The CLI also reads it from a .env file in the working directory.
3. The key stored in ~/.lim/config.yaml by lim login (browser sign-in) or lim set-api-key.

lim logout removes the stored key. Headless hosts such as CI runners and cloud agents should set LIM_API_KEY from a secret. A command pinned to a single instance through set-instance or the LIM_<TYPE>_INSTANCE_* variables needs no API key at all; see Sandboxed agents.

Target an instance

Device and build commands accept --id <instance-id>; get and delete take the ID as a positional argument instead (lim ios delete <instance-id>). Without an ID, they use the instance of that type you created last in the current workspace. The CLI records these per workspace in ~/.lim/last-instances.json; a workspace is the current git repository or worktree unless you assign one with lim set-workspace-dir, --workspace, or LIM_WORKSPACE. See The CLI's default instance.

Pass --id explicitly in scripts, CI, and agents that create more than one instance.

When the targeted instance no longer exists, device and build commands create a replacement automatically; pass --no-create to fail instead. create, delete, list, get, logs, tools, pull-file, and version never create a replacement; they fail with not-found instead.

Shared flags

Commands that act on instances share these flags. Account commands such as lim login and lim skills install take only some of them.

lim session start starts the same background connection explicitly for one instance, lim session status lists running sessions, and lim session stop stops one or all of them.

Environment variables

Access tokens

Create a temporary credential with repeated --permission flags, and revoke it using the returned ID or token value:

lim access-token create --permission "android:$INSTANCE_ID:all" --ttl-seconds 900 --json
lim access-token revoke "$TOKEN_ID"
# Or pass the token itself:
lim access-token revoke "$ACCESS_TOKEN"

create --quiet prints only the token. --json includes its ID, token, permissions, and expiry. When given a token, revoke extracts its JWT jti; a token without that claim cannot be revoked this way. The command still needs your API key or login. See Permissions and access tokens for the complete tables and revocation limits.

Commands

The Guide column links to the page that explains a command in context. Commands without a guide are covered by their --help output.

iOS simulators

Android emulators

Xcode sandboxes

Gradle sandboxes

Bazel

Assets

Private tunnels

Skills, sessions, and account

Build upload permissions

lim xcode build --upload <name> and lim gradle build --upload <name> authorize the upload inside the workload. The CLI adds exact-name create, upload, and expiry-update permissions to the creation request. Add other grants with repeatable --permission <asset:target:verb> flags. All four instance create commands accept --permission too.

Named uploads keep the selected instance, including a workspace prepared with earlier create and run commands. The CLI adds exact-name create, upload, and update grants to the live role, preserving other grants and retrying concurrent changes. The caller must control the instance and be able to delegate the resulting permissions. RBE auto-upload adds grants at tunnel startup; each permission-based upload obtains fresh workload credentials. --reuse-if-exists matches labels regardless of permissions; selection itself leaves the role unchanged. --signed-upload-url and its environment default retain their existing behavior and do not change permissions.

See Workload Identity for SDK examples and the permission syntax.