Provider installation and credentials#
OpenCode is built into the image. The other ten CLIs are not: each is downloaded into this installation's private provider volume the first time you use it, or ahead of time with provider install. Versions are pinned per SpaceApp release; this table shows launcher 1.1.1.
| Provider ID | CLI | Package in 1.1.1 | Installed | How to sign in |
|---|---|---|---|---|
opencode |
OpenCode | opencode-ai@1.18.4 |
Built into the image | No sign-in for free models; /connect inside OpenCode for your own provider, or an API key |
codex |
Codex CLI | @openai/codex@0.145.0 |
On demand | Device-code login, or an API key |
claude |
Claude Code | @anthropic-ai/claude-code@2.1.206 |
On demand, from npm (never in the image) | Provider login, or an API key |
gemini |
Gemini CLI | @google/gemini-cli@0.52.0 |
On demand | Sign in inside the CLI, or an API key |
qwen |
Qwen Code | @qwen-code/qwen-code@0.20.1 |
On demand | Sign in inside the CLI, or an API key |
kimi |
Kimi Code | @moonshot-ai/kimi-code@0.29.0 |
On demand | Provider login, or an API key |
grok |
Grok Build | @xai-official/grok@0.2.111 |
On demand | Provider login, or an API key |
deepseek |
DeepSeek CLI (community, experimental) | run-deepseek-cli@0.1.1 |
On demand | API key only |
autohand |
Autohand Code | autohand-cli@0.9.3 |
On demand | API key only |
cursor |
Cursor Agent | Cursor's agent CLI archive, pinned build | On demand, from Cursor's download server | Provider login only |
copilot |
GitHub Copilot CLI | @github/copilot@1.0.78 |
On demand | Provider login only |
The SpaceApp application catalog recognizes 16 CLI identifiers, but the launcher's provider and credentials commands accept only the IDs above (provider install takes the ten besides OpenCode); do not assume the others work through these commands. Each provider's account, subscription, usage limits and terms are separate from SpaceApp.
Install a CLI ahead of time#
Each optional CLI downloads the first time you open it. To install one in advance, so the first pane starts without that wait:
npx --yes run-spaceapp@latest provider install codex
npx --yes run-spaceapp@latest provider install claudeClaude Code is never included in the published images, because its package does not come with a license that lets SpaceApp redistribute it. Opening a Claude Code pane for the first time, or running provider install claude, downloads the reviewed version from npm as your own action, and its use is subject to Anthropic's terms.
Sign in with the provider's own flow#
This is the preferred way. In SpaceApp, open Setup & connections (Help → Setup wizard), go to Tools, select Show all tools, and use the login action next to the CLI. It opens that CLI's official login, device-code or OAuth flow in a protected terminal. Connect one provider at a time and confirm it reports ready before adding the next.
Or store an API key#
For the providers that accept a key, the launcher reads it with masked input:
npx --yes run-spaceapp@latest credentials set geminiThe launcher prompts Enter gemini credential: and reads the value without echoing it; keys are never accepted as command-line arguments. It writes the key to secrets/providers/gemini.key in the installation root with owner-only permissions, recreates the CLI service so the key is imported, and prints Credential stored and applied for gemini. The CLI receives it as its usual environment variable (for example GEMINI_API_KEY, OPENAI_API_KEY for Codex, ANTHROPIC_API_KEY for Claude Code). Cursor and Copilot do not read an imported key; use their login.
npx --yes run-spaceapp@latest credentials list
npx --yes run-spaceapp@latest credentials remove geminiIn 1.1.1, credentials list prints the provider IDs the launcher accepts, grouped as bundled, ownerInstalled and experimental; it does not show which keys are stored. credentials remove deletes the local key file and prints Credential removed and applied for gemini.; it does not revoke the key upstream, so revoke or rotate it in the provider account when necessary.
Where credentials are kept#
Never paste credentials into room chat, prompts, project files or canonical memory. Provider OAuth/device state lives in an isolated Docker volume; the core service does not mount raw provider-key files or the provider-state volume. Setting or removing a key recreates the CLI service, so finish or coordinate active sessions first. Portable backups intentionally do not carry provider credentials.
The public community DeepSeek CLI is experimental and not an official DeepSeek CLI. Other operator-configured DeepSeek/Harness/Reasonix environments can differ; do not infer their behavior from this adapter.