# Run your agent CLIs in the cloud

URL: https://briq.cloud/docs/guides/run-agent-clis-in-the-cloud

> Claude Code, Codex, Copilot CLI, Cursor, Grok Build and Mistral Vibe on a computer of your own, signed in with your own plans, working while your laptop is closed.

Recipe:

- [Agent home](https://briq.cloud/cookbook/agent-home.md): One person's computer for agent CLIs: Claude Code, Codex, Copilot CLI, Cursor, Grok Build and Mistral Vibe, unmodified and pinned. The person signs in with each vendor's own flow in the terminal at the private URL; sign-ins stay on its volume, which is never forked or backed up. Drive sessions with briq_exec (claude -p, codex exec); heavy work goes to a sandbox briq.

An agent home is a briq for one person: the vendors' agent CLIs, unmodified, on a microVM that
keeps your sign-ins, your files and your repos. You sign in once per vendor with its own flow.
Sessions then run there, started from your agent, a script or an app.

```text
briq_run({ recipe: "agent-home", stack: "home", expose: "private" })
→ bq_8f3k2m9x1p4a home (ghcr.io/briq-cloud/agent-home:latest) running · cost so far … · sleeps at 18:42 UTC unless used
  URL: https://home-x7k2.briq.run/?briq_token=…
```

1. `briq_run` starts the home: a `small` microVM with a 5 GB volume at `/work`.
2. The URL opens a terminal. Run each vendor's sign-in there, once
   ([the commands](https://briq.cloud/cookbook/agent-home#sign-in)).
3. Each sign-in stays in `/work/.logins/<cli>`, through sleep, restarts and newer images.
4. Unused for 30 minutes, the home sleeps and costs nothing. The next call or visit wakes it.

## A session from outside

Start a CLI with `briq_exec` and `async: true`, then read its output from an offset until it ends:

```text
briq_exec({ briq: "bq_…", cmd: ["claude", "-p", "Fix the failing test in /work/shop", "--output-format", "stream-json", "--verbose"], async: true })
→ ex_4n8w2k5p1qzt running since 10:02 UTC
briq_exec_result({ briq: "bq_…", exec: "ex_4n8w2k5p1qzt", offset: 0 })
→ {"type":"system",…} … nextOffset: 18342
briq_exec_result({ briq: "bq_…", exec: "ex_4n8w2k5p1qzt", offset: 18342, waitMs: 30000 })
```

* The CLI finds your sign-in through the home's own variables (`CLAUDE_CONFIG_DIR`,
  `CODEX_HOME`…). Leave out `clearEnv`: it drops them too. Nothing in the home's env replaces
  your plan: it refuses a vendor's key except [as a team secret](#an-api-key-instead-of-a-plan).
* A session that takes follow-up messages or approvals starts with `stdinOpen: true`. Send each
  one with `briq_exec_input`, for example to `claude -p --input-format stream-json`.
* Codex: run one `codex app-server` per home, a thread per session. Two Codex processes that
  refresh the same sign-in sign each other out.

## Heavy work in a session sandbox

Give the CLIs briq's MCP server with a key whose budget caps sizes, spend and briqs at once. A
test suite, a build or untrusted code then runs in a [sandbox](https://briq.cloud/cookbook/sandbox) the agent starts
and destroys. No sign-in reaches it:

```text
briq_run({ recipe: "sandbox", stack: "session-42" })
briq_files_put({ briq: "bq_…", path: "/work/app/…", contentBase64: "…" })
briq_exec({ briq: "bq_…", cmd: ["sh", "-c", "cd /work/app && npm ci && npm test"], async: true })
briq_destroy({ stack: "session-42" })
```

## A browser for the agent

A [desktop](https://briq.cloud/cookbook/desktop) in the same stack gives the CLIs a Chromium to drive, by page or by
pixels, and you a view to watch:

```text
briq_run({ recipe: "desktop", stack: "home", expose: "private" })
→ outputs: BROWSER_MCP_URL, DESKTOP_MCP_URL, DESKTOP_TOKEN
```

A session gets the token with `briq_exec`'s `env: { DESKTOP_TOKEN: "…" }`; the CLI's MCP config
reads `${DESKTOP_TOKEN}` ([the config](https://briq.cloud/cookbook/desktop#connect-an-agent)).

## An API key instead of a plan

Add the key as a team secret on the dashboard, with the vendor's host, then pass it by name. The
home holds a placeholder; the credential gateway sends the key to the vendor:

```text
briq_run({ recipe: "agent-home", env: { ANTHROPIC_API_KEY: { secret: "ANTHROPIC_API_KEY", scope: "team" } } })
```

A plain value is refused: it would sit readable in the home and replace the plan.

## A bigger home

```text
briq_resize({ briq: "bq_…", size: "medium" })
briq_resize({ briq: "bq_…", volumeGb: 10 })
```

A new size restarts the home; the sign-ins stay. A volume only grows, without a restart.

## When a sign-in does not work

* **Codex asks to enable device code**: turn it on in ChatGPT's security settings, then run
  `codex login --device-auth` again.
* **Copilot: "Store token in plaintext config file?"**: answer yes. A VM has no keychain; the file
  stays on the home's volume, mode 0600.
* **A CLI says it opened a browser**: the link opens in a terminal window of its own (`link`).
  Open it on your device, then press Enter.
* **Copilot: "Your Copilot subscription does not include this feature"**: your GitHub plan or
  organization does not allow Copilot CLI. See github.com/settings/copilot.

## Good to know

* One home per person: sign-ins are never shared, forked or backed up.
* The CLIs never update themselves; the image is built again each week. Pin a date tag to keep
  versions.
* `small` runs two sessions at once; a browser or a big install belongs in a sandbox.
* Every sign-in counts against your own plan, as on your laptop.