Command Reference (A–Z)
Every command below appears verbatim, or with only placeholder generalisation
(<sha>, <service>), in deploy/README.md, a script header, the Makefile, or a workflow. Entries are
grouped by executable, alphabetically. Nothing here was executed while writing this page.
- Scope
- Operator, deploy, CI and developer commands. Not a Spring or Next.js manual.
- Deployments
- Self-hosted with Docker Compose (
scripts/vegaduta,make) or Helm (deploy/helm). Do not confuse environments when copying a command. - Verification
- Command text was checked against the cited file. It does not mean the command was run or is safe on your machine.
Careful on a live stack
Avoid host reboots and docker compose down (especially with -v) on a stack people depend on,
unless you mean to take it offline. A hung service is evidence to collect (logs, container states, memory) before you restart anything. Teardown of the ephemeral CI stack in .github/workflows/e2e.yml runs on a throwaway runner, not a real environment.
Jump to: bash / scripts · curl · docker · git · gitleaks · mvn · npm / npx · openssl · powershell · pip / pytest · Conventions
B — make, scripts/vegaduta and repo scripts
| Command | Purpose | Source | Notes |
|---|---|---|---|
make help | List Makefile targets. | Makefile | |
scripts/vegaduta up --lite / up --full [--profile x] (make up-lite, make up PROFILE="temporal observability") | Generate deploy/compose/.env, start the Lite or Full stack, wait for healthy. | deploy/README.md | Windows: scripts egaduta.ps1 with -Lite, -Full, -Profile. |
scripts/vegaduta down|status|logs|doctor|secrets|upgrade|make-admin|compose | Operate the Compose stack. | deploy/README.md | down keeps volumes; do not run it on a production stack unprompted. |
make build · make images | Build core, web and web-admin from source; build the Full-tier images from source. | Makefile | Core needs JDK 21+; one Maven build at a time. |
make test · make lint · make gates | Tests, linters and the static gates CI runs. | Makefile | See Quality Gates. |
make compose-validate · make helm-lint · make shellcheck | Validate deploy artifacts and shell scripts. | Makefile; scripts/ci/compose-validate.sh, helm-validate.sh | helm-lint runs kubeconform (Docker fallback). |
make sbom | SPDX JSON SBOM of the source tree into dist/. | Makefile | Uses syft via Docker. |
make hooks | Point git at .githooks (pre-push static gates). | Makefile | |
bash scripts/dev-up.sh (--app | --all | --env-only) | Local dev spin-up of the compose infra subset. | scripts/dev-up.sh header | Local only; never reuse its .env for a deployment. |
./scripts/run-core-local.sh | Run core with deploy/compose/.env sourced into the environment. | scripts/run-core-local.sh header | Spring Boot does not read .env files; without this core dies on a missing APP_ENCRYPTION_KEY. |
bash scripts/ci/flyway-lint.sh | Flyway lint: applied-migration edit guard and version-collision checks across both migration folders. | scripts/ci/flyway-lint.sh; static-gates.yml | Needs git history (fetch-depth: 0). Versions share one namespace across controlplane and tenant. |
bash scripts/ci/entity-name-lint.sh | Static gate: entity, table, bean and path collisions. | static-gates.yml | |
make spring-wiring | Runs core/app's InjectableConstructorTest and UniqueBeanNamesTest: beans Spring cannot construct, duplicate Spring bean / JPA entity names. No context, no database. | Makefile; ci.yml (mvn verify) | Needs Maven and JDK 21+. |
bash scripts/ci/skip-expiry.sh; sh scripts/ci/check-file-size.sh | Static gates: expired test skips, file-size ratchet. | static-gates.yml | |
bash scripts/ci/secret-scan.sh | Gitleaks scan over the commits being added (not the whole history). | script header; static-gates.yml | Skips locally if gitleaks is absent; fails in CI (CI=true). Base ref via SECRET_SCAN_BASE_REF. |
bash scripts/ci/helm-validate.sh; bash deploy/helm/test-guards.sh | Helm lint, template and kubeconform; render-guard negative tests. | ci.yml job helm | The Helm charts are a preview. |
bash scripts/ci/helm-package.sh <version> dist/charts | Package the Helm charts. | release.yml | Release-time step. |
C — curl
| Command | Purpose | Source | Notes |
|---|---|---|---|
curl -s http://localhost:8080/actuator/health (or https://api.<your-domain>/actuator/health) | Core health. | deploy/compose/docker-compose.yml healthcheck | Add /liveness or /readiness to separate "JVM alive" from "able to serve" (DB, Redis). |
curl -s http://localhost:8180/realms/agentic-ai/.well-known/openid-configuration | Check the Keycloak realm and the issuer it advertises. | deploy/README.md (issuer consistency) | The issuer field must match what core validates. |
D — docker / docker compose
Compose files live in deploy/compose/; scripts/vegaduta compose <args> supplies the right files and profiles.
| Command | Purpose | Source | Notes |
|---|---|---|---|
scripts/vegaduta compose build core; scripts/vegaduta compose up -d core | Rebuild and restart one service (with the build overlay). | deploy/README.md | Prefer restarting a named service over a whole-stack down. |
scripts/vegaduta up --full --domain example.com --build | Build and run with the domain overlay so public URLs are correct. | deploy/README.md | For images built from source, rebuild web after a domain change so the fallback URLs change too. |
docker compose ps; docker compose logs -f core; docker compose logs --since 30m core | grep -i error | Status and logs (or scripts/vegaduta status / logs core). | deploy/README.md | |
docker compose -f docker-compose.yml -f docker-compose.ci.yml down -v | Tear down the ephemeral CI stack. | .github/workflows/e2e.yml | CI runner only. Not for any real environment. |
docker compose up -d postgres --wait | Start Postgres locally for core tests (make test-core). | Makefile | |
docker run -d --name vd-restore-test -e POSTGRES_PASSWORD=… -p 5499:5432 postgres:16; docker rm -f vd-restore-test | Throwaway container for a restore drill (Windows helper scripts). | scripts/backup/verify-restore.ps1 | A stock postgres:16 loses pgvector columns; use the release postgres image (see Backup & Restore). |
G — git
| Command | Purpose | Source | Notes |
|---|---|---|---|
git worktree add --detach "$SCRATCH/build" <sha>; git -C … status --short (must be empty); git worktree remove --force … | Build images from a clean checkout of an exact sha. | Build hygiene practice | Because a build uploads whatever is on disk, including stray .env*.local files. |
git log --remotes -G'sk-ant-api03-[A-Za-z0-9_-]{80,}' | Scan all remote refs for a committed key pattern. | Secret-hygiene practice | Complements scripts/ci/secret-scan.sh. |
G — gitleaks
| Command | Purpose | Source | Notes |
|---|---|---|---|
go install github.com/zricethezav/gitleaks/v8@v8.30.1 | Install the pinned scanner in CI. | .github/workflows/static-gates.yml | Version as pinned in that workflow. |
M — mvn (core, Java)
| Command | Purpose | Source | Notes |
|---|---|---|---|
mvn -B clean verify | Full core build and tests (run from core/). | .github/workflows/ci.yml; make test-core | Context tests need Postgres with pgvector and AGE, else they skip. |
mvn -B -ntp -DskipTests package | Build core without tests (run from core/; make build-core). | Makefile | CI uses JDK 21 (ci.yml). |
mvn spring-boot:run | Run core directly. | scripts/dev-up.sh header; scripts/run-core-local.sh | Env comes from the shell only — use the run-core-local wrapper. |
JDK version
scripts/dev-up.sh says "JDK 21+"; CI and core/Dockerfile use Java 21 images. Some maintainers build locally with JDK 24. Run one Maven build at a time.
N — npm / npx (web, web-admin)
Scripts from web/package.json and web-admin/package.json.
| Command | Purpose | Source | Notes |
|---|---|---|---|
npm run dev | Dev server: web on port 3000, web-admin on port 3001. | web/package.json; web-admin/package.json | web's predev runs the vendor scripts (vendor-webllm, vendor-kokoro, vendor-babel). |
npm run build / npm run start | Production build / serve. | both package.json | NEXT_PUBLIC_* are baked at build time. web's prebuild runs scripts/i18n-route-namespaces.mjs and the vendor scripts. |
npm run lint · npm run typecheck · npm test · npm run test:watch | eslint, tsc --noEmit, vitest run, vitest. | both package.json | CI runs lint, typecheck, test and build for both consoles (ci.yml). |
npm run e2e · e2e:ui · e2e:report · e2e:showcase | Playwright (web only). | web/package.json | The nightly e2e.yml runs the suite in tests/e2e with npx playwright test --project=chromium. |
npm run translate-messages | node scripts/translate-messages.mjs. | web/package.json | Maintainers regenerate message catalogs with this; no workflow runs it. |
npm ci --prefer-offline --no-audit / npm install | Install deps. | Makefile (npm ci); ci.yml | Do not run npm install in a tree while other processes run npx there. |
O — openssl
| Command | Purpose | Source | Notes |
|---|---|---|---|
openssl rand -base64 32 | Generate APP_ENCRYPTION_KEY (base64 of 32 raw bytes). | core/.env.example | Never regenerate once encrypted rows exist. See Environment Variables. |
openssl rand -hex 32 / -hex 24 | Generate shared secrets (sidecar, Langfuse) / CODE_INTEL_INTERNAL_TOKEN. | core/.env.example; deploy/compose/.env.example |
P — powershell (Windows)
| Command | Purpose | Source | Notes |
|---|---|---|---|
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\backup\register-backup-task.ps1 | Register a nightly backup scheduled task on a Windows Docker host (optional helper). | scripts/backup/register-backup-task.ps1 | Runs scripts/backup/pg-backup.ps1 (dumps main Postgres and Keycloak DB to a backups directory beside the repo). |
powershell -NoProfile -ExecutionPolicy Bypass -File scripts\backup\verify-restore.ps1 | Monthly restore drill against a throwaway Postgres. | script header | The script starts nothing itself; the operator starts and removes the container. |
.\scripts\dev\validate-platform.ps1 -Username … -Password … | Read-only platform validation (admin API, login, roles, tenant resolution). | scripts/dev/validate-platform.ps1 header | Uses a real tenant-admin login; do not paste credentials into shared logs. |
scripts/dev/reset-full.ps1 | Full local reset — wipes all tenant data and all Keycloak realm users. | script header | Irreversible, no backup taken. Local dev only. |
scripts/keycloak/*.ps1 | Keycloak diagnostics and fixes. | files exist in repo | Usage text not read for this page; open the script header before running. |
P — pip / pytest (sidecar and Python services)
| Command | Purpose | Source | Notes |
|---|---|---|---|
pip install -r requirements.txt; python -m pytest tests/ -q | Python service tests (make test-python). | Makefile; .github/workflows/ci.yml | Run from services/sidecar; code-intel uses a script harness. |
Conventions and cross-links
- Pull requests run
CI(CI OK) andStatic gates; tags runrelease.yml. See CI/CD Pipelines. - Pin release versions (
VEGADUTA_VERSION), neverlatest; upgrade withscripts/vegaduta upgrade --version X.Y.Z. - Ports and service names: Ports & Service Matrix. Variables: Environment Variables.
- Not documented in the repository: a single canonical list of Maven module goals.
Evidence & references
- Deployment Guide, Observability,
deploy/README.md .github/workflows/ci.yml,static-gates.yml,e2e.yml,release.yml;Makefileweb/package.json,web-admin/package.json,scripts/**(headers ofdev-up.sh,run-core-local.*,ci/secret-scan.sh,backup/*.ps1)