CLI reference
Commands for workspace setup, configuration, chat, grants, audit verification, and version inspection.
| Command | Purpose |
|---|---|
opendevops init [directory] | scaffold configuration and Kubernetes bootstrap files |
opendevops chat | run the streaming local REPL |
opendevops config check | validate runtime-critical configuration |
opendevops config grants | list control-plane revision and capability proposals |
opendevops config propose-grant | propose a typed, expiring dangerous capability |
opendevops config approve-grant | approve a proposal |
opendevops config activate-grant | activate an approved proposal |
opendevops config revoke-grant | immediately revoke a grant |
opendevops audit verify --dir <dir> | strictly verify audit chain structure and completion |
opendevops audit verify --allow-incomplete | inspect structurally valid crashed or active runs |
opendevops version | print the installed version |
Capability grants
Grants are typed, expiring authority. They cannot override a policy deny. Full lifecycle and limits: capability grants.
opendevops config propose-grant \
--environment prod \
--capability kubernetes_deploy \
--target kind-prod/web \
--reason "Deploy reviewed release 2026.07.26"
opendevops config approve-grant <proposal-id> --actor change-approver
opendevops config activate-grant <proposal-id> --actor platform-admin
opendevops config grants
opendevops config revoke-grant <proposal-id> --actor platform-admin| Flag / arg | Default | Notes |
|---|---|---|
--capability | required | kubernetes_deploy, github_write, aws_deploy, gcp_deploy, azure_deploy, or ssh_mutation |
--target | required | repeatable; explicit only — wildcards (*, all) and duplicates are refused |
--reason | required | 8 to 500 characters |
--environment | staging | staging or prod only |
--ttl | 3600 | seconds; 60 to control_plane.max_grant_ttl_s (default 86400) |
--max-executions | 10 | 1 to 100 |
--actor | OS user | identity used for the role check |
<proposal-id> | — | positional on approve / activate / revoke |
Propose needs operator, approve needs approver, activate and revoke need admin. In
production, approval must come from a different identity than the requester.
Chat options
opendevops chat \
--environment staging \
--profile interactive \
--principal operator@example.com--environment selects the policy overlay. --profile selects stop-losses. --principal
attributes daily spend and audit events.
| Option | Default | Meaning |
|---|---|---|
--environment | staging | policy environment overlay |
--profile | interactive | per-run budget profile |
--principal | OS user | audit and per-principal daily budget attribution |
Inside the REPL:
/costshows current session and day totals;/quit,/exit, or/qexits;Ctrl-Ccancels the active run.
If a rule escalates, the REPL renders an approval panel and prompts approve / edit /
reject; a non-interactive session auto-rejects. See interfaces.
Scripting guidance
Prefer HTTP or registered scheduler jobs for automation. The interactive CLI is designed for a human-in-the-loop terminal and may add presentation or approval behavior unsuitable for parsing. See interfaces.