kai-tool

kai is a focused CLI for AI-assisted coding workflows: launching agents, managing git worktrees, assembling source listings, and rotating between enrolled Codex CLI accounts.

Install

cargo install kai-tool

Installed command: kai

Codex credentials

Enroll each Codex account once, then switch without logging the previous account out:

kai cred add personal@example.com
kai cred add work@example.com
kai cred list
kai next

kai next is shorthand for kai cred next. You can also select or remove an account explicitly:

kai cred activate personal@example.com
kai cred remove work@example.com

kai cred add runs codex login with a temporary, isolated CODEX_HOME, verifies that the resulting account has the requested email, and then imports its file-backed credential. The credential currently used by Codex is not replaced or logged out during enrollment. Use --device-auth for Codex's device-code flow and --activate to switch immediately after adding an account.

Before every switch, Kai copies the live auth.json back into the active account's vault entry. This preserves refresh-token changes made by Codex. It then atomically installs the selected credential. Kai never invokes codex logout, so switching does not deliberately revoke the previous credential.

kai cred list --json emits stable, secret-free output for scripts.

Vault location and security

The credential vault is stored at:

~/.kai/credentials/
├── state.json
└── profiles/
    └── <email-derived-id>.json

Override it with KAI_CREDENTIALS_HOME. Kai reads and updates Codex's ${CODEX_HOME:-~/.codex}/auth.json.

The vault is not encrypted; like Codex's own auth.json, it contains bearer credentials. On Unix, Kai enforces mode 0700 on vault directories and 0600 on credential/state files, refuses credential symlinks, uses atomic durable writes, and serializes credential operations with an invocation lock. Protect backups accordingly.

Kai requires Codex to use file-backed CLI credentials. If cli_auth_credentials_store is set to auto or keyring, change it to file in the active Codex config.toml.

Already-running Codex processes may retain their previous credential in memory. Restart them after kai next or kai cred activate.

Other commands

• kai agent (a, or ar for --resume-all) launches Codex or Claude.
• kai worktree (wc, wa, wo, wd) manages git worktrees.
• kai llm-get (lg) produces LLM-friendly file listings.
• kai init writes .kai/config.toml.
• kai bump commits and pushes changed submodule pointers.

Run kai help or kai <command> --help for the complete command surface.

License

AGPL-3.0-only