Ciaren

CLI Reference

CLI Reference

Installing Ciaren (pip install ciaren, or pip install -e . from a source checkout) exposes a ciaren command — the setup surface for running and configuring Ciaren. It uses only the standard library, so there's nothing extra to install.

ciaren --help
ciaren --version

ciaren serve

Run the API server and the background scheduler in a single process (no broker, no extra services). This is the recommended way to start Ciaren.

ciaren serve
ciaren serve --port 8001 --reload
ciaren serve --engine pandas --execution-mode process
ciaren serve --no-scheduler
FlagDefaultDescription
--host127.0.0.1Bind host
--port8055Bind port
--reloadoffAuto-reload on code changes (development only)
--db-urlAsync database URL; overrides CIAREN_DATABASE_URL
--data-dirUploads/outputs directory; overrides CIAREN_DATA_DIR
--engineDefault engine polars | pandas; overrides CIAREN_DEFAULT_ENGINE
--execution-modethread | process; overrides CIAREN_EXECUTION_MODE
--log-leveluvicorn log level (criticaltrace)
--no-scheduleroffStart the API without the background scheduler
--no-demooffSkip seeding the built-in Demo project on first boot
--run-seed-flowsoffRun every newly seeded demo flow once after first-boot seeding
--env-fileLoad environment variables from this file before resolving settings

Flags are translated into the matching environment variables before the app is imported, so they take precedence over your .env.

Pointing at a specific env file

By default Ciaren reads ./.env. Use --env-file to load a different file (for example a per-environment config) before settings are resolved:

ciaren serve --env-file /etc/ciaren/production.env

Precedence is flags > existing environment variables > --env-file > defaults, so values already exported in your shell are not overridden by the file. The same flag works on ciaren info and ciaren check, which is handy for inspecting or validating a specific config:

ciaren info  --env-file /etc/ciaren/production.env
ciaren check --env-file /etc/ciaren/production.env

ciaren init

Write a commented starter .env to get going quickly.

ciaren init                 # writes ./.env
ciaren init --path .env.local
ciaren init --force         # overwrite an existing file
ciaren init --no-ml         # skip provisioning the default local MLflow directory

ciaren info

Print the resolved configuration the server would use (the database password is redacted). Handy for confirming which .env / env vars are in effect. Note: values overridden from the Settings page live in the database and take precedence once the server is running; ciaren info shows the environment-level resolution only.

ciaren info
Ciaren resolved configuration:
  environment          development
  database_url         sqlite+aiosqlite:///./ciaren.db
  data_dir             /path/to/.data
  default_engine       polars
  execution_mode       thread
  scheduler_enabled    True
  ...

ciaren check

Validate the environment and exit non-zero on failure — useful in setup scripts and CI. It checks that:

  • the data directory is writable,
  • the database URL uses an async driver,
  • the database is reachable,
  • the dataframe engines are importable, and
  • (Windows) the MLflow tracking path is short enough to log models under the 260-character path limit — see the ml_path line below.
ciaren check
[ok]   data_dir: /path/to/.data
[ok]   async_driver: sqlite+aiosqlite:///./ciaren.db
[ok]   database: reachable
[ok]   engines: pandas, polars
[ok]   ml: enabled, tracking=./mlruns

All checks passed.

Windows MLflow path check

On Windows without long-path support, a deeply nested mlruns directory can push MLflow's model-artifact paths past the legacy 260-character limit, so training runs finish green but the model comes back untracked. When the tracking store is a local folder, ciaren check adds an ml_path line — [ok] when the path has room, or a non-fatal [warn] telling you to enable long paths or set a shorter CIAREN_MLFLOW_TRACKING_URI. See Troubleshooting.

Both info and check accept --output json for scripting and CI:

ciaren info --output json
ciaren check --output json   # {"ok": true, "checks": [...]}; exit 1 on failure

ciaren db

Manage the database schema through Alembic migrations. This is the production-grade path: it versions the schema and applies changes in order, across SQLite, PostgreSQL, and MySQL.

ciaren db upgrade            # apply all migrations up to the latest revision
ciaren db upgrade --revision <id>
ciaren db current            # show the revision the database is stamped at
ciaren db reset --yes        # DROP every table and rebuild from migrations
SubcommandDescription
upgradeApply migrations up to --revision (default head). Safe to re-run.
currentPrint the revision the database is currently at.
resetDestructive. Drop all tables and rebuild. Requires --yes; refuses when CIAREN_ENVIRONMENT=production unless --force.

All three accept --env-file so you can target a specific environment's config.

Upgrading an existing database is safe

ciaren serve creates any missing tables on startup, so an existing Ciaren database has the full schema but no migration history. The first ciaren db upgrade detects this and adopts the schema (records the current revision) instead of trying to re-create existing tables — so adopting Alembic never destroys or rewrites your data. From then on, upgrades apply only the new migrations.

`db reset` deletes all data

reset drops every table. It exists for local development and test environments. It refuses to run in production unless you pass --force.

  1. Set CIAREN_DATABASE_URL to your async Postgres/MySQL URL.
  2. Run ciaren db upgrade as part of each deploy (before starting the app).
  3. Start the server with ciaren serve.

ciaren transformations

Inspect the transformation node types the engine supports — the same set the visual editor exposes.

ciaren transformations list
ciaren transformations list --output json
66 transformation node types:
  assertExpression   inputs=1
  assertNotNull      inputs=1
  assertRowCount     inputs=1
  ...

ciaren flow

Validate and migrate .flow document files — the portable, versioned description of a flow. Useful in CI to catch a malformed or outdated project before importing it.

ciaren flow validate project.flow              # schema + graph structure
ciaren flow validate project.flow --output json
ciaren flow migrate  project.flow              # print the document migrated to the current schema version
ciaren flow migrate  project.flow --to 3       # target a specific schema version instead of the latest
ciaren flow migrate  project.flow --write      # write back (keeps a .bak)
SubcommandDescription
validateValidate document shape and graph structure. Exits non-zero (and prints INVALID) on failure.
migrateMigrate to a newer schema version (default: the latest this build supports; --to VERSION targets a specific one). Prints to stdout unless --write.

`--write` never mutates silently

migrate --write keeps a .bak backup of the original next to the file before writing the migrated version.

ciaren secret

Manage connection secrets in the OS keychain (Windows Credential Manager, macOS Keychain, Secret Service on Linux desktops) — the recommended secret source on a desktop install. Requires the optional extra:

pip install ciaren[keyring]

Then:

ciaren secret set pg-main      # prompts for the value (hidden, confirmed)
ciaren secret unset pg-main    # removes it from the keychain

Headless servers and containers have no keychain daemon — use env: or file: references there.

A stored secret is referenced from a connection's secret field as keyring:pg-main. The value never touches Ciaren's database, the API, or your shell history — see Connections for the full secret-reference model (env:, keyring:, file:).

Plugin tooling: ciaren-plugin

Installing, inspecting, and (for publishers) signing plugins is a separate command — ciaren-plugin, from the same ciaren distribution — so the everyday ciaren CLI doesn't carry the plugin-authoring surface. See the Plugin CLI Reference for every subcommand, and Packaging & Distribution for the full publishing workflow.

ciaren-plugin list                          # discovered plugins + status
ciaren-plugin install my-plugin.ciarenplugin    # verify + install
ciaren-plugin enable acme.myplugin

Running the old ciaren plugin ... form prints a pointer to the new command.

Environment variables

All settings use the CIAREN_ prefix and can be set via the environment or a .env file in the backend directory.

VariableDefaultDescription
CIAREN_DATABASE_URLsqlite+aiosqlite:///./ciaren.dbAsync database URL
CIAREN_DATA_DIR.dataWhere uploads, outputs, and previews are written
CIAREN_DEFAULT_ENGINEpolarsDefault engine for runs (polars | pandas)
CIAREN_EXECUTION_MODEthreadCompute offload mode (thread | process)
CIAREN_RUN_TIMEOUT_SECONDS0Abandon a run after N seconds (0 = no limit)
CIAREN_LOG_FORMATautoLog output format (auto | text | json)
CIAREN_CORS_ORIGINS["http://localhost:5173"]Allowed CORS origins (JSON list); also trusted by the CSRF origin guard
CIAREN_TRUSTED_HOSTS[]Extra hostnames the CSRF origin guard trusts beyond localhost
CIAREN_MAX_UPLOAD_SIZE_MB100Maximum upload size
CIAREN_ENVIRONMENTdevelopmentEnvironment label
CIAREN_DEBUGfalseExtra debug behavior
CIAREN_API_TOKENOptional bearer token required for /api/* requests
CIAREN_WEBHOOK_SECRETEnables POST /api/flows/{id}/trigger webhook auth
CIAREN_PYTHON_TRANSFORM_STRICTfalseEnable stricter static checks for Python Transform scripts
CIAREN_CONNECTOR_BLOCK_PRIVATE_HOSTSfalseBlock connector endpoints that resolve to private/internal addresses
CIAREN_STORAGE_ALLOWED_ROOTS[]Restrict Local Storage connector roots to these directories
CIAREN_SECRET_ENV_ALLOWLIST[]Env vars (or PREFIX* patterns) a connection's env: secret reference may name
CIAREN_SECRET_FILE_DIRS[]Folders file: secret references may read (default: <DATA_DIR>/secrets and /run/secrets)
CIAREN_FRONTEND_DISTExplicit path to a built frontend to serve from ciaren serve
CIAREN_DATASET_RETENTION_DAYS30Days to retain soft-deleted dataset files before purge
CIAREN_SEED_DEMOtrueSeed the built-in Demo project on first boot
CIAREN_SEED_RUN_FLOWSfalseRun newly seeded demo flows once
CIAREN_SCHEDULER_ENABLEDtrueRun the background scheduler
CIAREN_SCHEDULER_POLL_INTERVAL_SECONDS30Scheduler poll interval
CIAREN_SCHEDULER_MAX_CONCURRENT_RUNS1Max simultaneous scheduled runs
CIAREN_NOTIFY_WEBHOOK_URL(unset)POST a JSON alert here when a run fails or a schedule auto-disables
CIAREN_NOTIFY_WEBHOOK_SECRET(unset)Sent as X-Ciaren-Secret so the receiver can verify the sender
CIAREN_SCHEDULER_MAX_CONSECUTIVE_FAILURES5Failures before auto-disable (0 = never)
CIAREN_ML_ENABLEDtrueEnable ML routes/nodes (built in; set false to disable)
CIAREN_MLFLOW_TRACKING_URI./mlrunsDefault MLflow tracking URI
CIAREN_MLFLOW_REGISTRY_URIOptional MLflow registry URI; defaults to tracking URI
CIAREN_ML_ARTIFACT_DIRml_artifactsLocal model artifact root, under DATA_DIR when relative
CIAREN_ML_MAX_MODEL_SIZE_MB500Maximum model artifact size accepted by ML guardrails
CIAREN_ML_MAX_TRAINING_ROWS5000000Maximum rows accepted for one training job
CIAREN_ML_MAX_FEATURE_COLUMNS500Maximum feature columns accepted for one training job
CIAREN_MARKETPLACE_INDEXbundled catalogLocal marketplace index JSON path for Explore catalog; set none to disable
CIAREN_MARKETPLACE_LICENSE_ISSUER_KEYSunsetRegisters a TokenLicenseProvider per configured issuer key, for validating plugin license tokens at startup
CIAREN_REQUIRE_TRUSTED_PLUGINSfalseRequire trusted signatures for marketplace/UI installs
CIAREN_PLUGINS_DIRExtra plugin directories to scan (os.pathsep-separated); see Writing a plugin
CIAREN_PLUGIN_PERMISSION_ENFORCEMENToffRuntime enforcement of plugin permissions: off / warn / enforce — see Advanced Setup

Async driver required

CIAREN_DATABASE_URL must use an async driver: sqlite+aiosqlite://, postgresql+asyncpg://, or mysql+aiomysql://. ciaren check flags a non-async URL.

See also