Native and npm CLI

Find a Lispex command by task, see what it reads and produces, and interpret its exit status.

Choose a Lispex command for your task, then check its inputs, results, and exit status. Native and npm both run source files; Native also provides the compilation and engine commands listed below.

Install Lispex using First Program or Downloads. See the Product Catalog for platform availability.

Run a file

Save this complete program as answer.lspx.

LISPEX
(+ 20 22)

Run it with Native or npm.

SH
lispex answer.lspx

Output

OUTPUT
42

The command exits with status 0 and creates no files. For the installed version's commands and flags, lispex --help prints the command list. A command family's help, such as lispex vouch --help, describes that family's options.

Connect an editor

Install the native binary and put lispex on your PATH. Start the language server with lispex lsp. It provides syntax diagnostics, formatting, document symbols, go to definition, completion, and built-in procedure descriptions. The language server reads only documents sent by the editor and does not run them.

The npm CLI prints the native installation address for lispex lsp and exits with status 2.

Helix

Add this to ~/.config/helix/languages.toml, then open a .lspx file. Run hx --health lispex to check that Helix finds the server.

TOML
[language-server.lispex]
command = "lispex"
args = ["lsp"]

[[language]]
name = "lispex"
scope = "source.lispex"
file-types = ["lspx"]
roots = []
language-servers = ["lispex"]
indent = { tab-width = 2, unit = "  " }

Neovim

Add this to init.lua, then open a .lspx file with Neovim's built-in LSP client.

LUA
vim.api.nvim_create_autocmd({ 'BufRead', 'BufNewFile' }, {
  pattern = '*.lspx',
  callback = function()
    vim.bo.filetype = 'lispex'
    vim.lsp.start({
      name = 'lispex',
      cmd = { 'lispex', 'lsp' },
      root_dir = vim.fn.getcwd(),
      capabilities = vim.lsp.protocol.make_client_capabilities(),
    })
  end,
})

Reading the command tables

The tables show command syntax and expected results. Linked guides provide complete workflows. Uppercase names such as SOURCE, IR, and ROOT stand for paths you supply. Brackets mark optional arguments, | separates alternatives, and ... stands for additional required or optional flags. An input datum is one Lispex value read from a file.

Source and authoring

CommandReadsProducesProduct
lispex [FILE|-]Lispex sourceValues, standard output, warnings, and diagnosticsNative, npm
lispex sicp run <file.scm|->One SICP source up to 1 MiBSICP standard output and final valueNative, npm
lispex fmt [--check|--write] [FILE|-]UTF-8 sourceFormatted source, check status, or replacement of the original fileNative
lispex lspDocuments sent by the editor over standard inputDiagnostics, formatting, symbols, definitions, completion, and procedure descriptions over standard outputNative
lispex mcp serveFramed requests over local standard input and outputLanguage and procedure reference, evaluation, diagnostics, and fixed engine comparisonsNative

The MCP service evaluates trusted source under declared byte and time limits. The calling application controls workspace paths, network access, and external actions. See MCP for its request protocol. Formatting replaces a file atomically, so a completed replacement appears as one operation.

Meaning Graph and Core IR — Native

Core IR is an intermediate representation that resolves name references. Meaning Graph represents program operations as nodes that the Meaning evaluator can execute. Canonical files use one prescribed byte representation.

CommandReadsProduces
lispex lower --graph-version v1 SOURCEExact source, converted through validated Core IRCanonical Meaning Graph v1 with resolved name references
lispex eval-graph [--steps N] [--trace] GRAPHMeaning Graph v0 or v1 and optional inputA report selected by the graph's version tag, with terminal status and optional trace
lispex meaning-diff [--input I] SOURCESource and optional input datumCurrent Lispex Interpreter and Meaning results in csk.meaning-differential-report/v1
lispex core-ir build --source S --out OExact sourceCanonical lispex.core-ir/v1 file and summary
lispex core-ir inspect --ir IRCore IRVariable cells, captured variables, requirements, source locations, and identifiers
lispex core-ir validate --ir IRCore IRStrict validation, including re-encoding in the prescribed format

Core IR build, inspect, and validate do not run the rule. The build and inspection reports show execution: "not-run" and authority: "integrity-only". The validation report shows core_ir_validation: "lispex.core-ir-validation/v1" and valid: true. These commands create or check a representation. Select a runtime, Meaning, bytecode, or Vouch execution command to run the program. Compile a Rule to Bytecode shows a complete source-to-file example.

Bytecode and engine comparisons — Native

A virtual machine, or VM, executes prepared instructions called bytecode.

CommandReadsProduces
lispex bytecode build --ir IR --out OValidated Core IRVerified canonical .lpxbc file and summary
lispex bytecode inspect --bytecode BCVerified bytecodeIdentifiers, counts, requirements, instructions, entry points, and source-map coverage
lispex bytecode validate --bytecode BCBytecodeStrict decoding, verification, and canonical re-encoding result
lispex bytecode run --bytecode BC [--input I]Verified bytecode and optional input datumLispex VM result, output, and diagnostics
lispex run --backend rust --engine tree|vm FILELispex sourceResult from the selected Lispex Interpreter or VM
lispex compare-engines --receipt R FILELispex sourceComparison report for the Lispex Interpreter and VM implementations

Each execution method retains its own error and resource status. Reports record program behavior, resource usage, and source and producer information separately. Comparison reports are written atomically to a new path. Compile a Rule to Bytecode supplies complete commands and output.

Resource-controlled evaluation — Native

The decision evaluator and full evaluator are separate products. Preparation reads source and limits to create a prepared file. Evaluation reads that file, a binary input value, and evaluation limits to create a result file.

Command familyResult and follow-up operations
lispex embed prepare, evaluate, inspect, verifyDecision-profile preparation and evaluation files; JSON inspection and integrity checks
lispex embed full prepare, evaluate, inspect, verify, replayFull-profile files; JSON inspection, integrity checks, and fresh-instance replay
lispex rule run, inspect, verify, replayA five-file decision directory and operations on that directory
lispex rule issue, policy create|check, authenticateIssuer record, recipient policy, and authentication result for a decision directory. The rule is not run

To rerun a decision-profile evaluation, supply the same inputs to embed evaluate again, or use rule replay on a decision directory. Run a Rule Within Set Limits includes every input file, command, and result.

Keys and decision exchange

Decision exchange delivers the result of a decision directory to a recipient as a signed bundle. The bundle contains no source and no private key.

CommandProducesProduct
lispex key generate --out-dir DIRA new directory with the Ed25519 private key private.pkcs8.der and public key public.spki.derNative
lispex key inspect --public-key KEYOne public key and its decision-exchange and Vouch key identifiersNative, npm
lispex decision issue --dir DIR --private-key KEY --issuer-label TEXT --out BA source-free signed decision bundle .lpxdecisionNative
lispex decision policy create --public-key KEY ... --out PA recipient policy built from a reviewed public key, rule, and evaluator identifiersNative, npm
lispex decision policy check --policy PValidation result for a recipient policyNative, npm
lispex decision inspect --bundle BBundle integrity and decision summary. The rule is not runNative, npm
lispex decision authenticate --bundle B --policy PIssuer authentication result under the recipient policyNative, npm
lispex decision replay --bundle B --policy PResult of authenticating, then running once in a fresh evaluator instanceNative

The calling application keeps the private key and checks where a public key came from. Typesetting Rule Workspace walks through the whole process from key generation to replay.

Images — Native and npm

CommandProduces
lispex image encode --source SOURCE --out IMAGECanonical .lspx.png or .lspx-images.zip
lispex image inspect --image IMAGESummary of format, profile, pages, source identifiers, and integrity bindings
lispex image decode --image IMAGE --out SOURCEExact recovered source
lispex run --image IMAGEReference-interpreter result, output, and diagnostics for the recovered source

Create and Restore Lispex Images shows encoding and recovery. Vouch commands with source context accept exactly one of --source RULE and --source-image IMAGE. Re-execution and local approval use that source with the separately supplied --input INPUT.

Comparison records and Lispex Vouch

A differential receipt records a comparison. Lispex Vouch adds authentication of signed records. Native provides the full Vouch workflow. npm provides record inspection, offline authentication, recipient-policy tools, and comparison of recorded cases.

CommandProducesProduct
lispex diff-receipt --input I RULEComparison record in csk.differential-receipt/v0Native
lispex vouch inspect --receipt R --input I --report-out O ...Report of a structural record check without signature authenticationNative
lispex vouch inspect RECEIPT [--source RULE]Offline structural consistency verdict as JSONnpm
lispex verify RECEIPT [--source RULE]The same offline structural consistency verdict as vouch inspectnpm
lispex vouch replay CORPUS --against BASELINEReport comparing recorded decisions against a version or record directorynpm
lispex replay CORPUS --against BASELINEThe same report as vouch replaynpm
lispex vouch source-id|key-id|engine-id|input-id ...Source, key, executable, or input identifier for a trust policyNative, npm
lispex vouch policy create|check ...Canonical recipient trust policy or validation reportNative, npm
lispex vouch issue ...Signed data, a DSSE signed-record container, and issue reportNative
lispex vouch verify ...Authentication report for the exact signed contextNative, npm
lispex vouch verify --reexecute ...Authentication and current Lispex Interpreter and Meaning agreementNative
lispex vouch gate --require-decision ...Live local grant or denial and gate reportNative
lispex vouch compiled build ... --out ASource-bound lispex.vouch-compiled-artifact/v1 and summaryNative
lispex vouch compiled inspect --artifact AIntegrity summary for the container and embedded bytecodeNative
lispex vouch compiled validate ...Check that exact source derives the recorded Core IR and bytecodeNative
lispex vouch verify --reexecute --compiled-artifact ACurrent tree, Meaning, and verified Lispex VM agreementNative
lispex verify-bridge --report REPORT --profile ID ... --report-out OReport on whether a Bridge report binds to the receiver-selected profile, engine, source, and inputNative
lispex verify-bridge [--expect-context M] REPORTBridge report structure verdict as JSON. With --expect-context, the subject, profile, and route are checked against the receiver's intentnpm

On Native, issue-native, verify-native, and verify-structure are compatibility names for vouch issue, vouch verify, and vouch inspect. On npm, the top-level verify and replay are compatibility names for vouch inspect and vouch replay. Native receipt also keeps its published record format and behavior. Comparison of recorded cases exists only in npm. Running lispex vouch replay on Native points to npm and exits with status 2. The vouch command family provides the authenticated workflow. See Lispex Vouch for the complete process.

Exit status and saved files

Interpret the exit status together with the command's result.

Command or outcomeStatus
Requested operation succeeded0
Validation, execution, comparison, or authentication rejectedUsually 1; inspect the diagnostic
fmt --check found formatting changes1, with no formatted output
Invalid usage, unavailable selected engine, a command this product does not provide, or ordinary source execution reaching a resource limit2
Input/output or named-report publication failed3 on commands that use this code
Authenticated Vouch request withheld at the local gate or diagnostic-promotion step10

Diagnostic promotion determines whether an authenticated record qualifies for the next approval step. Authentication has succeeded when these Vouch commands return 10.

Embed evaluation reports success, a program fault, or resource exhaustion inside its saved result. When that result is saved successfully, these outcomes return 0. Read inspect to distinguish them. Rejected requests can return 3, and evaluator or record-construction failures can return 4. See Evaluator Reference for the separate category names.

Commands that publish a named new record or report write it atomically and refuse to overwrite an existing path. For JSON output, diagnostics are kept separate from the JSON bytes on standard output. The calling application reads a local gate result, then decides and performs any external action.

If you find a problem, please report it as a GitHub issue with a rule and an input that reproduce it.