Flags beat environment variables beat saved config. For the full token resolution order and the global flags themselves, see auth and global flags.
Auth
Auth token presented as
Authorization: Bearer. Sits third in the resolution order: --token > --token-file > ISH_TOKEN > saved OAuth login (~/.ish/config.json) > legacy saved token. Use it for CI and other non-interactive runs.Pre-authorize the confirmation gate for the whole session. Mirrors
--yes exactly and applies to billable verbs (study run, study analyze, ask run, and the like) and destructive deletes. Truthy values: 1, true, yes, on. Never persisted to config. Default: unset (gate active).Active context
When a command needs a workspace, study, ask, or chat endpoint and you do not pass it, the CLI falls back to these env vars, then to the active context saved byish <noun> use. The explicit flag or positional argument always wins. Each accepts an id or an alias (for example w-, s-).
Default workspace. Overridden by
--workspace and by the saved active workspace order described above. See study and run vs ask for how context flows through commands.Default ask. Overridden by the positional ask id.
Default chat endpoint id. Overridden by the positional id or
--endpoint.Endpoints
Backend API base URL. The internal
--api-url flag takes precedence; --dev forces http://localhost:8000 and overrides both.Web app base URL used to compose the links the CLI prints (for example the
url returned by ish study run). Set it for a staging or self-hosted UI. Under --dev the base is http://localhost:3000.ish MCP server URL written by
ish mcp add. Point it at a local server for dev workflows. See the MCP overview.Paths
Config directory root. Holds
config.json (saved login, active context), aliases.json, downloaded binaries, and logs. Set it to relocate ish state, mirroring GH_CONFIG_DIR / AWS_CONFIG_FILE.Dev login overrides
These pointish login at a non-production Supabase project. Set both together. Equivalent to --dev, which targets the built-in dev project.
Supabase project URL used to mint the login session. Default: the production project.
Supabase publishable (anon) key matching
ISH_SUPABASE_URL.Output and observability
Disable colored output. Equivalent to
--no-color. Honors the NO_COLOR convention.Force colored output even when stdout is not a TTY.
0 or false disables; any other non-empty value enables. NO_COLOR wins when both are set.Opt in to Sentry error and trace reporting by setting a DSN. Unset, the CLI runs untraced. Default: unset.
Print observability init failures to stderr. Diagnostic only. Default: unset (silent).
Installer
Read by theinstall.sh and install.ps1 scripts, not by the ish binary itself.
Install directory for the
ish binary. Default: $HOME/.ish/bin (%USERPROFILE%\.ish\bin on Windows).PowerShell
install.ps1 only. Pin a specific version to install. Default: the latest release. On POSIX install.sh, pin a version with the --version=<v> argument instead, for example curl -fsSL https://ishlabs.io/install.sh | sh -s -- --version=1.2.3.Set to
1 (POSIX install.sh only) to skip editing your shell rc file. Use for ephemeral or sandbox installs.Internal
Reserved for ish development and internal tooling. Not part of the supported surface; documented so you can recognize them.Set to
1 to allow the internal-only --sim-config flag on ish study run.Override the
adb binary path for native Android local simulation. Also honors ADB.Override the Android
emulator binary path.Override the iOS WebDriverAgent runner bundle path.
WebDriverAgent port for native iOS local simulation.