Command reference

1. Setup & config
2. Working
3. Team sync
4. Audits (file Beads issues)
5. Release

---

Setup & config

Command	Does
aiflow init [path] [--force] [--no-git] [--no-beads] [--yes] [--no-token-saving]	Bootstrap a project (interactive Q&A → renders everything). --no-token-saving = caveman + rtk off (full, unfiltered output).
aiflow install-deps [--all]	Install missing tools enabled in config (--all = full set).
aiflow change-settings [--no-token-saving]	Re-adjust config, then re-render .mcp.json, hooks, branching, memory. --no-token-saving switches caveman + rtk off.
aiflow doctor	Check prerequisites + print a per-project summary.
aiflow upgrade	Update the bundled toolchain.
aiflow update	Self-update aiflow to the latest release: git pull in AIFLOW_HOME if it’s a git checkout; otherwise checks the GitHub Releases API and downloads + verifies (SHA256) + installs the matching per-OS archive.
aiflow project-update	Refresh THIS project from the installed templates: mechanical scripts (.aiflow/*, .claude/hooks/*, docker/run.*, .github/scripts/*) always; agent definitions (AGENTS.md, CLAUDE.md, .github/copilot-instructions.md, .claude/agents/*, .claude/commands/*, .claude/skills/*) the git hooks (.githooks/*) and the router example (.aiflow/router-config.example.json) too — any of those you customised is kept as *.bak before being replaced, and reported so you can reapply your changes. Nothing is ever deleted: a helper aiflow no longer ships stays put and is listed at the end of the run instead (for the aiflow-owned .aiflow/ and .claude/hooks/ — .github/scripts/ is a shared directory, so your own scripts there are never flagged). Never touches .beads/, .claude/memory/*, .github/workflows/* (yours to extend — a CI helper that no workflow calls yet is advised at the end of the run, never written in), or your .aiflow/config.json project settings (aim, architecture, …) — only meta.aiflowVersion is stamped. You’re prompted for this automatically when a project’s stamped version falls behind the installed CLI.
aiflow version	Print the version.

Working

Command	Does
aiflow shell [--router]	Load .env, launch Claude Code (--router = cheap/local models).
aiflow index	Refresh code memory: graphify (graph) + cocoindex (RAG).
aiflow ralph "<prompt|bead id>"	Run the headless Ralph loop.
aiflow onboard	Learn an existing codebase into memory + AGENTS.md + arc42.
aiflow ollama [pull\|add <m>\|list]	Manage local Ollama models.

Team sync

Command	Does
aiflow sync [pull\|push\|both]	Team sync: git + Beads(dolt) pull/push (default pull at start).
aiflow close-sync <id>	On issue close: prompt to push + Dolt-sync (pulls before pushing).
aiflow next [--after <id>] [--unassigned] [--claim] [--json]	Next ready Beads task, ranked by the AGENTS.md §4b order (priority → unblocks-most → continuation of --after). Exits 3 when the queue holds nothing actionable.

Audits (file Beads issues)

Command	Does
aiflow security-check	Security audit → [security-advisor] issues.
aiflow quality-check	Refactoring/quality audit → [technical issue].
aiflow requirements-check	Advisory grade of issue quality (report only).
aiflow dependency-check	Vulns/outdated/unused/license → [dependency].
aiflow test-gap	Untested critical paths → [test gap].
aiflow perf-check	Performance hotspots → [performance].
aiflow docs-check	Doc/code drift → [docs].
aiflow a11y-check	Strict WCAG 2.2 AA accessibility audit → [accessibility].
aiflow modernize-check	Brownfield modernisation concepts → report for the architect (.aiflow/modernization-report.md).

Release

Command	Does
aiflow hotfix <name>	Branch hotfix/<name> off main and bump VERSION to X.Y.(Z+1)-HOTFIX.
aiflow release [--yes] [--push]	Cut a release per the branching model (version bump + tag). Without --yes, prints a dry run only — releasing always needs explicit confirmation.
aiflow protect	Apply server-side branch protection (GitHub).
aiflow cost [...]	Token/cost baseline via ccusage.

All commands are project-scoped and read .aiflow/config.json + .env in the current project.