surgesurge

Command reference

Every subcommand, and the flags that matter. surge help prints the short form; this is the long one.

CommandWhat it does
surge run <file.yaml>run a scenario
surge quick <url>an ad-hoc run with no file
surge validate <file.yaml>check the file — syntax, feeders, regexes, thresholds. Sends nothing
surge preflight <file.yaml>check the live target, the data, the monitors, the fleet and this machine
surge verify <file.yaml>one real pass of every role, every step and check reported
surge discover <file.yaml>find the highest load that still meets an SLO
surge compare <summary.json>a regression check against stored baselines
surge baseline save/list/prunemanage reference runs
surge trend -baseline Nhow the metrics moved across stored runs
surge analyze <summary.json>explain a finished run, later
surge merge <snapshot.json…>combine runs measured by separate processes
surge agentrun as a worker node for a coordinator
surge weba local page that starts and stops runs
surge import har/openapi <file>generate a scenario, with auto-correlation
surge init [file]write a commented starter scenario
surge versionthe version this binary was built from

Exit codes: 0 pass · 1 a breached threshold or a real regression · 2 a setup error, reported before any traffic is sent. A CI job needs no output parsing.

Before the load, in order

Each of these answers something the one before it cannot.

bash
surge validate  perf/checkout.yaml   # the file
surge preflight perf/checkout.yaml   # the world
surge verify    perf/checkout.yaml   # the scenario

validate sends nothing — no request, no connection. Run it after every edit, including when the target is not up. It prints the kind of test, what the run will be judged on, and every step as the engine will see it, so a WebSocket step reads as ws send+receive on live rather than as a line of YAML you hope is right.

preflight costs one request per target, monitor and agent, and ends in GO or NO-GO. It answers what nobody writes down: does the name resolve, is the certificate about to expire, is the "staging" URL actually this laptop, are there enough rows in the CSV for the peak, is the monitor endpoint serving a dashboard instead of metrics, do the agents agree on the time, does this machine have the file descriptors for the plan.

FlagDefaultMeaning
-agents a:7777,b:7777—check these workers too
-token—the shared secret the agents require
-target URL—override base_url, as surge run would
-timeout10sgive up on the whole check after this
-jsonoffthe report as JSON, for a pipeline

verify runs one iteration of every role against the real system and prints every step, every extract and every check — WebSocket steps included, one line per message with the repeat numbered. The failure it catches: an extract that stopped matching, so every later step sends the literal ${token} and five thousand users spend two hours getting 401s you read as the system being broken.

surge run

Load

Before the load

Reports

Diagnosis

Safety

Across machines

surge quick

A run with no file: surge builds the scenario in memory from the flags.

bash
surge quick https://api.example.com/health \
  -vus 50 -duration 30s -threshold "p95 < 200ms"

It takes the run flags that make sense without a scenario. Good for "is this endpoint alive under any load at all"; past that, write a file, because a journey is not one URL.

surge discover

bash
surge discover perf/checkout.yaml -slo "p95 < 500ms, error_rate < 1%" -max-rate 5000
FlagMeaning
-slowhat healthy means, comma separated. Overrides the scenario
-start-ratearrivals a second to begin at
-max-ratea safety cap
-stephow long each load level is held
-refinebisection rounds after the first breach
-confirmhow long to hold the answer to confirm it

An SLO expression can name a request or a group: action, not only the totals. Finding capacity has the rest.

surge web

bash
surge web -dir perf            # http://127.0.0.1:8099
surge web -dir perf -open      # and open a browser

See the live dashboard and the control UI.

surge agent

bash
surge agent -listen 0.0.0.0:7777 -token "$SURGE_TOKEN"

Serves one run at a time to a coordinator. A second run while one is going is refused rather than queued.

FlagDefaultMeaning
-listen127.0.0.1:7777anything the network can reach requires -token
-token$SURGE_TOKENthe secret the coordinator must present
-nodethe hostnamethe name this node has in the report
-allow-execoffpermit scenarios that run shell commands on this machine

An agent runs whatever scenario it is sent, so both refusals are deliberate: see the security contract.