# CLI
The `tanxium` executable runs one JavaScript or TypeScript entrypoint:
```sh
tanxium run script.ts
tanxium run script.ts --workspace ./workspace --resources ./resources
tanxium --no-sandbox run script.ts
```
The CLI sandboxes its main worker by default, so permissions are not
granted until the runtime prompts for them. In an interactive
terminal, Tanxium offers allow-once, allow-all, and deny choices.
Non-interactive runs deny prompts deterministically. Pass
`--sandbox false` or the shorter `--no-sandbox` to grant the main
worker all permissions. Web workers remain sandboxed in either mode.
Both flags default to the process working directory. The CLI uses the
same Yasumu bootstrap as library embedders. Runtime failures are
written to standard error.
Pass `--verbose` to `run` or `repl` to print runtime renderer events
(for example, structured console and notification events). They are
suppressed by default so normal script output stays readable.
## REPL
Run `tanxium repl` (or simply `tanxium`) for an interactive session.
The REPL accepts multiline input: press Enter on a blank line to
evaluate. Top-level `await` is supported.
```text
> const answer = await Promise.resolve(
… 42,
… );
…
42
```
Commands: `.help`, `.clear`, `.exit`, and `.quit`.