One binary.
The whole forge.
Repositories, Change Requests, checks — the whole forge at your prompt, with Git that authenticates itself. No tokens to paste.
One line to install.
The installer picks the release for your machine, verifies its SHA-256 checksum, and drops the upstream command onto your path. One update command keeps you current — stable or latest, your call.
- macOS · Apple silicon
- macOS · Intel
- Linux · Arm64 · glibc
- Linux · x64 · glibc
Windows and musl-based Linux aren’t supported yet.
Approve CLI sign-in
Upstream CLI on leo-mbp wants a forge session for leo.
Approved in your browser.
upstream auth login prints a one-time link and waits. Approve it with your existing Coline identity, and the CLI keeps a revocable session in your keychain — never your browser cookie.
When Git runs, the credential helper mints a short-lived credential scoped to one repository and your actual role. Nothing long-lived ever reaches a Git process.
How CLI authentication worksEveryday forge work, scriptable.
Commands running inside a clone infer the repository from origin. Add --json and pipe straight into your scripts and agents.
Open a terminal.
Put your work upstream.
Create an account, install the CLI, and open your first Change Request without leaving the shell.