The CLI

There is a Fwozen CLI. It talks to the same REST API the dashboard does, so it can do what the dashboard does: ask whether you are frozen, freeze, thaw, read the per-branch enforcement state, and gate a deploy from any pipeline.

curl -fsSL https://fwozen.com/install | sh

One file, no package manager, and nothing added to your shell profile. It needs Node 24 or newer. The script is plain text at that URL, so you can read it before you run it. It verifies a published sha256 before it writes anything, and https://fwozen.com/cli/release.json restates the same digest next to the current version, its size, and the Node floor. Re-run the same line to upgrade; it replaces the payload in place and leaves you logged in.

If you are working in the repository, build it from source instead. Same binary, no download:

pnpm --filter fwozen build     # emits apps/cli/dist/index.js
pnpm exec fwozen status

Signing in

fwozen login runs a device flow: it prints a code, you confirm it in the browser, and the credentials land in $XDG_CONFIG_HOME/fwozen/credentials.json at mode 0600. The access token is short-lived and re-minted for you. The session behind it is fixed at 30 days and does not slide. Using the CLI does not extend it. After that, commands exit 4 and you log in again. fwozen whoami says who you are.

The session token in that file is the one long-lived secret on your machine, and it stays valid for its full 30 days until somebody revokes it. Deleting the file does not. fwozen logout revokes the session server-side and then removes the file, and exits non-zero if the revocation failed. So if a laptop or a credentials file is lost, run fwozen logout, or end that session from your account settings, rather than waiting for it to lapse.

For CI, agents, and anything non-interactive, use an API key instead. Create one at Settings → API keys in the dashboard (the steps). It overrides the stored credentials and is never refreshed:

export FWOZEN_TOKEN=fwz_live_…

Key auth is organisation-wide, so org switch is unavailable. A command whose key lacks a scope degrades to a narrower answer and names the missing scope rather than failing silently. For the full CLI, a key with freeze:read freeze:write repo:read schedule:read covers everything except refreshing the enforcement probe, which needs repo:write.

The commands

• fwozen status — freeze state, schedules, enforcement health, reconciler lag.
• fwozen freeze <scope…> --reason "…" — freeze all (every enabled repository’s default branch) or repository globs. --branch, --all-branches, --duration 4h, --until, --block-deploys, --allow-deploys, and --dry-run, which resolves the scope and writes nothing.
• fwozen thaw [freezeId] — lift the active freeze, or --all of them.
• fwozen verify [--strict] — the per-branch enforcement reading, worst first. --strict exits 3 when any branch is red, which is what makes it usable as a pre-release check.
• fwozen gate — the deploy gate, with the same fail-closed decision table as the fwozen/gate-action composite action.
• fwozen org list / fwozen org switch <slug>, fwozen whoami, fwozen login, fwozen logout.
• fwozen skill install — copies the bundled agent skill into .claude/skills/fwozen, or --global into your home directory.

Global flags are --json, --api-url, and --no-color. --json writes machine-clean JSON to stdout with no ANSI and no spinner; progress and errors always go to stderr. --reason on a freeze is mandatory and must be at least eight characters, because a freeze with no reason is the thing the audit log exists to prevent.

Gating a deploy from any CI system

fwozen gate asks GET /v1/freeze-state with a 10 second timeout and three attempts, then reads the decision from the Fwozen-Frozen response header, which tracks the deploy decision rather than the merge one. A transport failure, a non-2xx response, or a missing header is indeterminate, and the gate treats indeterminate as frozen. It refuses the deploy when your job calls it; a job that never calls it is never gated.

export FWOZEN_TOKEN=fwz_live_…
export FWOZEN_REPO=acme/api-server     # default: the origin remote
fwozen gate || exit 1

Exit codes

• 0 — success; for gate, thawed.
• 1 — gate frozen or indeterminate; or the operation failed or was refused.
• 2 — gate only: no token, so no request was made.
• 3 — verify --strict found red branches.
• 4 — not authenticated, or the session expired.
• 64 — usage error.

fwozen <command> --help prints the full flag reference for any command. The REST API is the authority for anything the CLI wraps.