Remote Commands

Your software runs in the customer's cloud. Commands are how you talk to it — invoke code on remote deployments from your control plane, with zero inbound networking.

This is the primary way your backend communicates with customer deployments. An AI agent sends tool calls to a worker in the customer's VPC. A data connector runs queries against a private database. A dashboard pulls real-time metrics. Each of these is a command — your code defines handlers, your control plane invokes them, results come back. No open ports, no VPN, no firewall changes.

Define a Handler

import { command } from "@alienplatform/sdk"

command("generate-report", async ({ startDate, endDate }) => {
  const data = await fetchData(startDate, endDate)
  return { report: aggregate(data), rowCount: data.length }
})

command("run-migration", async ({ version }) => {
  await migrate(version)
  return { status: "completed" }
})

To enable commands on a function, set .commandsEnabled(true) in your alien.ts:

const agent = new alien.Function("agent")
  .code({ type: "source", src: "./", toolchain: { type: "typescript" } })
  .commandsEnabled(true)
  .build()

Invoke from the CLI

alien commands invoke \
  --deployment acme-corp \
  --command generate-report \
  --params '{"startDate": "2025-01-01"}'

Invoke from Code

import { CommandsClient } from "@alienplatform/sdk/commands"

const commands = new CommandsClient({
  deploymentId: "deployment_123",
  token: "your_api_key",
})

const result = await commands.invoke("generate-report", {
  startDate: "2025-01-01",
  endDate: "2025-03-31",
})

How It Works

You invoke a command (via CLI or SDK).
Alien stores the request.
The command is dispatched to the customer's environment:
- Push model: direct invocation — Lambda invoke, Pub/Sub message, Service Bus message.
- Pull model: the agent picks it up on the next sync cycle.
The handler runs and produces a response.
You read the result.

The entire flow uses outbound connections only. The customer's environment never needs to open a port or allow inbound traffic.

Real-World Examples

AI Agent — remote tool calls

import { command, storage } from "@alienplatform/sdk"

const ws = storage("workspace")

command("read-file", async ({ path }) =>
  ws.get(path)
)

command("write-file", async ({ path, content }) =>
  ws.put(path, content)
)

command("list-files", async ({ directory }) => {
  const safePath = path.resolve("/workspace", directory)
  if (!safePath.startsWith("/workspace")) throw new Error("Invalid path")
  return fs.readdir(safePath)
})

The agent harness runs in your cloud — planning, model calls, orchestration. When it needs to act, it sends commands to the Function in the customer's environment. Code and data never leave their network.

Data Connector — query behind the firewall

import { command, vault } from "@alienplatform/sdk"
import { Pool } from "pg"

const creds = vault("credentials")

command("get-users", async ({ status, limit }) => {
  const config = JSON.parse(await creds.getSecret("warehouse"))
  const pool = new Pool(config)
  const { rows } = await pool.query(
    "SELECT id, name, email FROM users WHERE status = $1 LIMIT $2",
    [status, limit ?? 100]
  )

  return { rows, count: rows.length }
})

Warehouse credentials stay in the customer's vault. Only query results leave.