CLI Reference
This page is generated from the --help output of every branchbox subcommand. When CLI arguments change, regenerate it from a fresh build: run branchbox --help, then --help on each subcommand, recursively.
Every command that takes --json prints exactly one JSON document on stdout, with human-readable text on stderr, and never prompts. A failure prints an error envelope with a stable code, except for the few commands that report failure inside their own payload. The JSON contract describes the rules and the payloads.
branchbox
Isolated development environments for every feature
Usage: branchbox <COMMAND>
Commands:
init Initialize project with devcontainer and BranchBox registry
devcontainer Manage devcontainer configuration
agent Agent and control-plane helpers
detect Detect project configuration
name Feature name utilities
feature Manage feature worktrees
prune Tear down all active feature worktrees
tunnel Manage tunnels for existing features
version Show the BranchBox version and, with --json, its contract capabilities
doctor Check the host (and optionally a repository) for BranchBox prerequisites
config Read and change project configuration (.branchbox/config.json)
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
-V, --version Print version
branchbox init
Alias: branchbox bootstrap
branchbox init asks questions only in an interactive terminal without -y/--yes. It can ask about:
- reorganization (
Move to permanent location?,Continue?); - Cloudflare tunnel setup (
Enable Cloudflare tunnels..., prefix, DNS zone, credentials); - provisioning a tunnel for
mainright away (Provision tunnel for 'main' branch now?); - 1Password references for the devcontainer's GitHub token and signing key.
Without a terminal, with -y, or with --json, nothing is asked and the defaults apply. The repository stays where it is unless you pass --reorganize: -y alone never moves it. Pass the 1Password references with --op-github-ref / --op-signing-key-ref, or --skip-1password. --json prints one summary document (see the JSON contract).
Initialize project with devcontainer and BranchBox registry
Usage: branchbox init [OPTIONS] [SOURCE]
Arguments:
[SOURCE] Repository URL or path (defaults to current directory)
Options:
-p, --path <PATH> Target directory for parent worktree
-s, --stack <STACK> Force specific stack (rails, nodejs, rust, generic)
--skip-devcontainer Skip devcontainer setup
--skip-env Skip environment setup
--reorganize Force reorganization into worktree structure
--no-parent-structure Disable parent structure (keep flat layout instead of container/main/)
--update Update existing setup without restructuring
--validate Validate only (no modifications)
--dry-run Dry run (show what would happen)
-y, --yes Non-interactive mode (use defaults, answer yes to prompts)
-v, --verbose Verbose output
--no-coding-agents Disable AI coding agent mounts (.codex, .claude, .gh)
--op-github-ref <OP_REF> 1Password reference for the devcontainer's GitHub token (op://vault/item/field), saved to .devcontainer/.env without prompting
--op-signing-key-ref <OP_REF> 1Password reference for the devcontainer's SSH signing key (with --op-github-ref)
--skip-1password Do not use 1Password for devcontainer credentials (recorded in .devcontainer/.env)
--no-verify-op-refs Save the --op-* references without checking them with `op read`
--json Emit the summary as JSON (implies --yes: nothing is asked)
-h, --help Print help
branchbox devcontainer
Manage devcontainer configuration
Usage: branchbox devcontainer <COMMAND>
Commands:
up Create and run dev container
exec Execute a command on a running dev container
down Stop and remove dev container
build Build a dev container image
read-configuration Read and output devcontainer configuration
sync Sync devcontainer configuration to all feature worktrees
configure Configure devcontainer workspace settings for worktree compatibility
detect Detect main service, container user, and ports from devcontainer
add-tunnel Add cloudflared tunnel service to compose file
inject-agents Inject AI coding agent volume mounts into compose file
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
branchbox devcontainer up
Create and run dev container
Usage: branchbox devcontainer up [OPTIONS] [WORKSPACE_FOLDER]
Arguments:
[WORKSPACE_FOLDER] Workspace folder path (defaults to current directory) [default: .]
Options:
--docker-path <DOCKER_PATH>
Docker CLI path
--docker-compose-path <DOCKER_COMPOSE_PATH>
Docker Compose CLI path
--remove-existing-container
Remove existing container before starting
--build-no-cache
Build with --no-cache
--skip-post-create
Skip post-create commands
--remote-env <REMOTE_ENV>
Remote environment variables for lifecycle commands (name=value)
--json
Output as JSON
-h, --help
Print help
branchbox devcontainer exec
Execute a command on a running dev container
Usage: branchbox devcontainer exec [OPTIONS] -- <CMD>...
Arguments:
<CMD>... Command to execute
Options:
-w, --workspace-folder <WORKSPACE_FOLDER>
Workspace folder path (defaults to current directory) [default: .]
--docker-path <DOCKER_PATH>
Docker CLI path
--docker-compose-path <DOCKER_COMPOSE_PATH>
Docker Compose CLI path
-u, --user <USER>
User to run command as
--workdir <WORKDIR>
Working directory in container
--remote-env <REMOTE_ENV>
Remote environment variables for this command (name=value; overrides remoteEnv)
--json
Output as JSON
-h, --help
Print help
branchbox devcontainer down
Stop and remove dev container
Usage: branchbox devcontainer down [OPTIONS] [WORKSPACE_FOLDER]
Arguments:
[WORKSPACE_FOLDER] Workspace folder path (defaults to current directory) [default: .]
Options:
--docker-path <DOCKER_PATH> Docker CLI path
--docker-compose-path <DOCKER_COMPOSE_PATH> Docker Compose CLI path
-v, --volumes Remove volumes
--remove-orphans Remove orphan containers
--json Output as JSON
-h, --help Print help
branchbox devcontainer build
Build a dev container image
Usage: branchbox devcontainer build [OPTIONS] [WORKSPACE_FOLDER]
Arguments:
[WORKSPACE_FOLDER] Workspace folder path (defaults to current directory) [default: .]
Options:
--docker-path <DOCKER_PATH> Docker CLI path
--docker-compose-path <DOCKER_COMPOSE_PATH> Docker Compose CLI path
--no-cache Build with --no-cache
--image-name <IMAGE_NAME> Image name (for Dockerfile builds)
--json Output as JSON
-h, --help Print help
branchbox devcontainer read-configuration
Read and output devcontainer configuration
Usage: branchbox devcontainer read-configuration [OPTIONS] [WORKSPACE_FOLDER]
Arguments:
[WORKSPACE_FOLDER] Workspace folder path (defaults to current directory) [default: .]
Options:
--json Output as JSON (always JSON for this command)
-h, --help Print help
branchbox devcontainer sync
With --json, the per-worktree results are printed as one document. A failed worktree makes the command exit 1, in text and JSON mode alike. A sync with worktrees to update refuses with devcontainer_source_missing when the main worktree has no .devcontainer/; --dry-run does not need it.
Symlink sync records the exact generated link targets in the feature's sync baseline. Teardown treats an unchanged recorded link to the main configuration as generated work; changed targets and unrecorded links remain user work. For a feature synced with an older CLI, sync it again to record link ownership.
Sync devcontainer configuration to all feature worktrees
Usage: branchbox devcontainer sync [OPTIONS]
Options:
-p, --path <PATH> Project directory (defaults to current directory)
-s, --strategy <STRATEGY> Sync strategy (copy or symlink)
-n, --dry-run Dry run - show what would be synced without making changes
--feature <NAME> Sync only this feature (repeatable). Any registered feature that has not been removed can be named; without it, every active feature is synced
--json Emit the per-worktree results as JSON
-h, --help Print help
branchbox devcontainer configure
Configure devcontainer workspace settings for worktree compatibility
Usage: branchbox devcontainer configure [OPTIONS]
Options:
-p, --path <PATH> Project directory (defaults to current directory)
--json Output as JSON
-h, --help Print help
branchbox devcontainer detect
Detect main service, container user, and ports from devcontainer
Usage: branchbox devcontainer detect [OPTIONS]
Options:
-p, --path <PATH> Project directory (defaults to current directory)
-s, --stack <STACK> Stack hint for port detection (e.g., flask, rails, node)
--json Output as JSON
-h, --help Print help
branchbox devcontainer add-tunnel
Add cloudflared tunnel service to compose file
Usage: branchbox devcontainer add-tunnel [OPTIONS]
Options:
-p, --path <PATH> Project directory (defaults to current directory)
-s, --service <SERVICE> Main service name to add depends_on (auto-detected if not specified)
--json Output as JSON
-h, --help Print help
branchbox devcontainer inject-agents
Inject AI coding agent volume mounts into compose file
Usage: branchbox devcontainer inject-agents [OPTIONS]
Options:
-p, --path <PATH> Project directory (defaults to current directory)
--json Output as JSON
-h, --help Print help
branchbox agent
Agent and control-plane helpers
Usage: branchbox agent <COMMAND>
Commands:
status Show agent/control-plane status
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
branchbox agent status
Show agent/control-plane status
Usage: branchbox agent status [OPTIONS]
Options:
--json Emit JSON output
-h, --help Print help
branchbox detect
--json prints the detected stack, adapter and modules plus whether the folder is a git repository and already initialized.
Detect project configuration
Usage: branchbox detect [OPTIONS]
Options:
-p, --path <PATH> Project directory (defaults to current directory)
--json Emit JSON output instead of human-readable text
-h, --help Print help
branchbox name
Feature name utilities
Usage: branchbox name <COMMAND>
Commands:
generate Generate feature name from title
validate Validate feature name
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
branchbox name generate
Generate feature name from title
Usage: branchbox name generate <TITLE>
Arguments:
<TITLE> Feature title (e.g., "OAuth Integration")
Options:
-h, --help Print help
branchbox name validate
Validate feature name
Usage: branchbox name validate <NAME>
Arguments:
<NAME> Feature name to validate (e.g., "oauth-integration")
Options:
-h, --help Print help
branchbox feature
Alias: branchbox features
Manage feature worktrees
Usage: branchbox feature <COMMAND>
Commands:
start Create a new feature worktree and run module setup
teardown Tear down an existing feature worktree
list List known feature worktrees from the registry
prune Tear down all active feature worktrees
exec Execute a command through a feature's runtime provider
exec-provider Execute an allowlisted coding provider with name-only environment inheritance
dispatch-tool Dispatch one capability-bound request to a trusted managed tool endpoint
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
branchbox feature start
Alias: branchbox feature new
Create a new feature worktree and run module setup
Usage: branchbox feature start [OPTIONS] [NAME]
Arguments:
[NAME]
Dasherized feature name (e.g., oauth-integration)
Options:
--title <TITLE>
Free-form feature title (converted to dasherized name)
--base <BASE>
Base branch to branch from (defaults to current HEAD)
--branch-prefix <BRANCH_PREFIX>
Override branch prefix (defaults to "feature")
--repo <REPO>
Repository path (defaults to current directory)
--reuse
Allow reusing an existing worktree directory
--no-worktree
Check the feature branch out in the repository instead of a worktree.
A worktree lets several features share one clone. A caller that clones per run and discards the clone has nothing to share it with, and pays for the second checkout identity anyway.
--devcontainer-reuse <POLICY>
Copy-mode conflict policy when reusing a worktree (fail, preserve, overwrite, inspect)
[default: fail]
--keep-runtime-on-failure
Retain a failed SBX runtime and its build cache for inspection or retry
--reuse-runtime
Reuse a retained runtime (implies --reuse and --keep-runtime-on-failure)
--telemetry
Emit verbose telemetry (e.g. Cloudflare operations)
--skip-module <MODULE>
Skip specific modules during setup (can be specified multiple times) Available modules: compose, database, tunnel, specs
--minimal
Start feature workflow in minimal mode (skips heavyweight modules)
--prompt <PROMPT>
Provide an optional prompt seed for automation/agent hand-off
--default-prompt
Use the default minimal-mode prompt shortcut (only valid with --minimal/--fast)
--json
Emit JSON summary payload instead of human-readable text
--allow-container
Allow running feature start from inside a containerized environment
--no-summary
Suppress summary output (text mode only)
--runtime <PROVIDER>
Workspace isolation runtime (container, sbx, or Linux/KVM local-vm)
--runtime-manifest <PATH>
Absolute supervisor-authored assignment manifest (required by --runtime in-guest)
-h, --help
Print help (see a summary with '-h')
branchbox feature teardown
Teardown checks reported Git changes and the branch's merge state before removal:
- When the worktree has changes of yours (modified, staged or untracked files), teardown refuses before anything is removed. The refusal lists the files and names
--discard-changes. - When the branch would be deleted but has commits that are not merged, teardown refuses the same way and names
--keep-branchand--force-delete-branch. In a terminal it asks first whenfeature.teardown.prompt_force_delete_unmergedis on, andfeature.teardown.force_delete_unmerged_by_defaultforce-deletes without asking. --discard-changesdiscards the worktree's uncommitted changes. It does not force-delete the branch.--dry-runprints the teardown plan (with--json, the plan document) and changes nothing. It accepts the same flags as a real teardown, so you can preview exactly what a command would do.
Files BranchBox generated itself (such as .devcontainer/.branchbox.env) never count as your changes. Files git ignores are removed with the worktree and are not listed. The feature spec is moved back to the main worktree's docs/features/backlog/ (or completed/ with --complete-spec).
--force keeps its earlier meaning for compatibility: it removes the worktree whatever its state, and when the branch is being deleted it uses git branch -D, so unmerged commits go too (the summary then warns with the commit count). Prefer --discard-changes.
Tear down an existing feature worktree
Usage: branchbox feature teardown [OPTIONS] <NAME>
Arguments:
<NAME> Dasherized feature name to tear down (e.g., oauth-integration)
Options:
--branch-prefix <BRANCH_PREFIX> Override branch prefix (defaults to "feature")
--repo <REPO> Repository path (defaults to current directory)
--keep-branch Keep the git branch after removing the worktree (default is to delete it)
--delete-branch Delete the git branch after removing the worktree
--force Remove the worktree whatever its state: discard uncommitted changes, remove a locked or unreadable worktree (deleting the directory if git cannot), and force-delete the branch (`git branch -D`, even with unmerged commits) when deleting it. Prefer --discard-changes, which keeps unmerged commits safe
--force-delete-branch Force-delete the git branch even if it is not fully merged (`git branch -D`)
--discard-changes Discard the worktree's uncommitted changes (modified and untracked files) instead of refusing. Does not force-delete the branch
--dry-run Print what teardown would do (the teardown plan) and change nothing
--complete-spec Move spec to completed during teardown
--telemetry Emit verbose telemetry (e.g. Cloudflare operations)
--allow-container Allow running feature teardown from inside a containerized environment
--json Emit deterministic teardown and residue evidence as JSON (with --dry-run, the plan)
-h, --help Print help
branchbox feature list
List known feature worktrees from the registry
Usage: branchbox feature list [OPTIONS]
Options:
--repo <REPO> Repository path (defaults to current directory)
--status <STATUS> Filter by status (active, degraded, failed_retained, orphaned, removed)
--all Include removed features (retained and orphaned features are shown by default)
--json Emit JSON output instead of human-readable summary
-h, --help Print help
branchbox feature prune
Prune is the bulk cleanup command, and it is destructive: it discards each feature's uncommitted changes and, when it deletes branches, force-deletes them, unmerged commits included. A feature whose teardown fails is reported and the rest continue; any failure makes the command exit 1. Run --dry-run first: it lists the uncommitted changes and unmerged commits that would be lost. Without a terminal, or with --json, prune refuses with confirmation_required unless you pass --yes.
To remove features one at a time with the safety checks, use branchbox feature teardown (the Mac app's Prune does exactly that, and never runs this command).
Tear down all active feature worktrees
Usage: branchbox feature prune [OPTIONS]
Options:
--repo <REPO> Repository path (defaults to current directory)
--dry-run Show which features would be removed without applying teardown
-y, --yes Skip confirmation prompt
--keep-branch Keep git branches after removing worktrees
--delete-branch Delete git branches after removing worktrees
--complete-spec Move specs to completed during teardown
--telemetry Emit verbose telemetry (e.g. Cloudflare operations)
--allow-container Allow running feature prune from inside a containerized environment
--feature <NAME> Prune only this feature (repeatable); by default every active or retained feature
--json Emit the dry-run candidates, or the prune results, as JSON
-h, --help Print help
branchbox feature exec
Use -- before the command when it has its own flags. With --json, a failing inner command still prints its {exit_code, stdout, stderr} payload, and branchbox exits 1.
Execute a command through a feature's runtime provider
Usage: branchbox feature exec [OPTIONS] <NAME> <COMMAND>...
Arguments:
<NAME> Dasherized feature name
<COMMAND>... Command and arguments to execute
Options:
--repo <REPO> Repository path (defaults to current directory)
--json Emit captured command output as JSON
-h, --help Print help
branchbox feature exec-provider
Execute an allowlisted coding provider with name-only environment inheritance
Usage: branchbox feature exec-provider [OPTIONS] --provider <EXECUTABLE> <NAME> [COMMAND]...
Arguments:
<NAME> Dasherized feature name
[COMMAND]... Arguments passed to the fixed provider executable
Options:
--repo <REPO> Repository path (defaults to current directory)
--provider <EXECUTABLE> Exact provider executable declared by the managed runtime assignment
--inherit-env <NAME> Allowlisted environment name to inherit without transporting its value
-h, --help Print help
branchbox feature dispatch-tool
The dispatcher can run concurrently with the coding provider. Exit status 75 means the exact
atomic request file was not present before --wait-seconds expired; every malformed or failed
request is a terminal non-75 error. With --json, both success and not-pending outcomes are
structured for an orchestrator.
Dispatch one capability-bound request to a trusted managed tool endpoint
Usage: branchbox feature dispatch-tool [OPTIONS] --lease <LEASE_ID> --request-id <REQUEST_ID> <NAME>
Arguments:
<NAME> Dasherized feature name
Options:
--repo <REPO> Repository path (defaults to current directory)
--lease <LEASE_ID> Exact tool-request lease declared by the managed runtime assignment
--request-id <REQUEST_ID> Exact request identifier and spool filename stem
--json Emit the correlated response as JSON
--wait-seconds <SECONDS> Wait up to this many seconds for the atomic request file (maximum 300) [default: 0]
-h, --help Print help
branchbox prune
Same as branchbox feature prune.
Tear down all active feature worktrees
Usage: branchbox prune [OPTIONS]
Options:
--repo <REPO> Repository path (defaults to current directory)
--dry-run Show which features would be removed without applying teardown
-y, --yes Skip confirmation prompt
--keep-branch Keep git branches after removing worktrees
--delete-branch Delete git branches after removing worktrees
--complete-spec Move specs to completed during teardown
--telemetry Emit verbose telemetry (e.g. Cloudflare operations)
--allow-container Allow running feature prune from inside a containerized environment
--feature <NAME> Prune only this feature (repeatable); by default every active or retained feature
--json Emit the dry-run candidates, or the prune results, as JSON
-h, --help Print help
branchbox tunnel
Manage tunnels for existing features
Usage: branchbox tunnel <COMMAND>
Commands:
open Provision (or re-provision) a tunnel for an existing feature
remove Remove tunnel metadata and attempt provider teardown
credentials Manage the Cloudflare API credentials used to provision tunnels
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
branchbox tunnel open
Provision (or re-provision) a tunnel for an existing feature
Usage: branchbox tunnel open [OPTIONS] <NAME>
Arguments:
<NAME> Dasherized feature name (e.g., oauth-integration)
Options:
--repo <REPO> Repository path (defaults to current directory)
--json Emit JSON output instead of human-readable summary
-h, --help Print help
branchbox tunnel remove
Remove tunnel metadata and attempt provider teardown
Usage: branchbox tunnel remove [OPTIONS] <NAME>
Arguments:
<NAME> Dasherized feature name (e.g., oauth-integration)
Options:
--repo <REPO> Repository path (defaults to current directory)
--force Continue even if provider teardown fails
--json Emit JSON output instead of human-readable summary
-h, --help Print help
branchbox tunnel credentials
Manage the Cloudflare API credentials used to provision tunnels
Usage: branchbox tunnel credentials <COMMAND>
Commands:
set Store the Cloudflare account ID and API token (.branchbox/secure/cloudflared.env, owner-only) and enable automatic tunnel provisioning
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
branchbox tunnel credentials set
The token is read from standard input only (--api-token-stdin), so it never appears in your shell history or the process list. It is written to .branchbox/secure/cloudflared.env with mode 0600, and the project config is pointed at it. An empty token is refused and leaves the existing file untouched. --clear removes the stored token and switches tunnels back to manual setup instructions.
printf '%s' "$CLOUDFLARE_API_TOKEN" | branchbox tunnel credentials set --account-id "$ACCOUNT_ID" --api-token-stdin
Store the Cloudflare account ID and API token (.branchbox/secure/cloudflared.env, owner-only) and enable automatic tunnel provisioning
Usage: branchbox tunnel credentials set [OPTIONS]
Options:
--account-id <ID> Cloudflare account ID
--api-token-stdin Read the API token from standard input (it is never accepted as an argument)
--clear Remove the stored API token; tunnels fall back to manual setup instructions
--repo <REPO> Repository path (defaults to current directory)
--json Emit JSON output instead of human-readable summary
-h, --help Print help
branchbox version
branchbox version --json prints {version, contract_version, capabilities[]}. Tools such as the Mac app use it to find out which JSON features this CLI supports; see the JSON contract. CLIs older than this command exit 2 on it, and branchbox --version still works everywhere.
Show the BranchBox version and, with --json, its contract capabilities
Usage: branchbox version [OPTIONS]
Options:
--json Print the version, contract version and capabilities as JSON
-h, --help Print help
branchbox doctor
Doctor checks git, Docker (CLI, daemon and Compose), the Dev Container CLI, the optional runtimes and tools (sbx, local-vm, op, gh) and your PATH. With --repo, it also checks the repository's git state, initialization, config, registry and .gitignore. Each check takes at most about 3 seconds. The command exits 1 when a required check fails; with --json the report is printed either way.
Check the host (and optionally a repository) for BranchBox prerequisites
Usage: branchbox doctor [OPTIONS]
Options:
--repo <REPO> Also check this repository (git, initialization, config, registry, .gitignore)
--check-auth Also check that the tools that need credentials are signed in
--json Emit the check results as JSON
-h, --help Print help
branchbox config
The settings live in .branchbox/config.json. See the configuration reference for every key. Writes keep the file's formatting and unknown keys, are atomic, and refuse a file with comments.
Read and change project configuration (.branchbox/config.json)
Usage: branchbox config <COMMAND>
Commands:
get Show the effective configuration (or one key) with defaults and sources
set Set a configuration key
unset Remove a configuration key so its default applies again
apply Apply a JSON merge patch (RFC 7386) to the configuration; `null` unsets a key
help Print this message or the help of the given subcommand(s)
Options:
-h, --help Print help
branchbox config get
Show the effective configuration (or one key) with defaults and sources
Usage: branchbox config get [OPTIONS] [KEY]
Arguments:
[KEY] Dotted key to show (e.g. runtime.provider); omit to show every key
Options:
--repo <REPO> Repository path (defaults to current directory)
--json Emit JSON output instead of human-readable text
-h, --help Print help
branchbox config set
Set a configuration key
Usage: branchbox config set [OPTIONS] <KEY> <VALUE>
Arguments:
<KEY> Dotted key to set (e.g. feature.branch_prefix)
<VALUE> New value (parsed as the key's type)
Options:
--repo <REPO> Repository path (defaults to current directory)
-h, --help Print help
branchbox config unset
Remove a configuration key so its default applies again
Usage: branchbox config unset [OPTIONS] <KEY>
Arguments:
<KEY> Dotted key to remove (e.g. feature.branch_prefix)
Options:
--repo <REPO> Repository path (defaults to current directory)
-h, --help Print help
branchbox config apply
echo '{"feature": {"branch_prefix": "spike"}, "tunnel": {"enabled": null}}' | branchbox config apply --file - --json
An unknown key is refused with config_unknown_key, and an invalid value with config_invalid, which names the key and the values it accepts.
Apply a JSON merge patch (RFC 7386) to the configuration; `null` unsets a key
Usage: branchbox config apply [OPTIONS] --file <PATH>
Options:
--file <PATH> Merge patch to apply: a JSON file, or `-` to read it from stdin
--dry-run Report what would change without writing the file
--repo <REPO> Repository path (defaults to current directory)
--json Emit JSON output instead of human-readable text
-h, --help Print help