Install and run
npx rigorrunThat is the whole install. It prints a URL containing a single-use pairing code and opens your browser; on a headless machine, the printed URL is the interface.
What you need
Section titled “What you need”| Node | 20.11 or newer. rigorrun refuses to start on anything older and says so rather than crashing. |
| A system it is safe to change | Staging, a scratch instance, or a local copy. RigorRun refuses to write to a project marked production. |
| A way to read that system back | One operation RigorRun can call afterwards to see what changed. Without one it can still watch, but every verdict says OBSERVATIONAL. |
| Docker | Only for rigorrun verify. Nothing else needs it. |
Check the machine
Section titled “Check the machine”npx rigorrun doctorReports the Node version, whether a container runtime is present and whether it is rootless, which
credential store you got, and the state of every project on this machine. Exit 0 when everything
it needs is present, 2 when something is not.
Verify what you installed
Section titled “Verify what you installed”The package is published from a GitHub Actions workflow that holds no npm token, using npm trusted publishing, and carries a SLSA build provenance attestation.
npm audit signaturesnpm view rigorrun dist.integrityWhere things are kept
Section titled “Where things are kept”Everything lives under ~/.rigorrun: projects, recordings, generated suites, run history and
verification records. Credentials go to the operating system’s credential store — Keychain,
libsecret or DPAPI — and never into a project file. Nothing is uploaded, because there is no
service to upload to.