TILLFORGE · CLI

tilldev forge — the full command surface.

TillForge lives inside the one tilldev CLI. Every group takes --json, token secrets are shown once and stored hash-only, and role governs what a command can do. The CLI talks to the dashboard API over HTTPS only.

01Shape

Command groups

text

tilldev forge <group> <verb> [flags]

  repos        create / list / get / remove repositories
  tokens       tfp_ tokens — the git password + API credential
  keys         SSH public keys (scoped, expiring)
  tree|blob|log|refs|blame   browse code, history, and blame
  policy       branch protection rules
  reflog|recover   ref-change history + one-click restore
  findings|allowlist   secrets rejected at the push boundary
  pr           pull requests, reviews, and the merge gate
  checks|check status checks (external CI gates merges)
  correlation  release-granular commit → crash
  search       literal, line-numbered search at a revision
  release|asset  tagged releases, generated changelog, builds
  env|deploy   environments + deployments (preview → prod)
  webhook      subscribe endpoints to repo events (signed)
  egress       AI egress policy + audit  (default-deny)
  mirror       pull / push mirror a repo  (SSRF-guarded)
  codeowners   the CODEOWNERS map for a repo
  audit        the append-only privileged-action trail

  --json everywhere · login with 'tilldev login'

Reads work for any org member; writes need developer or above; managing policy, tokens, keys, mirrors, and egress needs admin. Authenticate the CLI with a tfp_ token via tilldev login or the TILLDEV_TOKEN environment variable.

02repos

Repositories

bash

tilldev forge repos ls
tilldev forge repos create --name <n> [--slug <s>] [--visibility private|internal|public]
tilldev forge repos get <slug>
tilldev forge repos rm <slug>

A new repo is seeded with a protected default branch and secret scanning on. Push to it over HTTPS or SSH — see Repositories.

03tokens · keys

Tokens and SSH keys

bash

tilldev forge tokens ls
tilldev forge tokens create [--scope read|write|admin] [--repo <slug>] [--expires <days>]
tilldev forge tokens revoke <token-id>

tilldev forge keys ls <repo>
tilldev forge keys add <repo> --name <n> --key "<ssh pubkey>" [--scope read|write] [--expires <days>]
tilldev forge keys revoke <repo> <key-id>

Flag	Meaning
`--scope`	read < write < admin — never above the minter’s own role.
`--repo`	Pin a token to a single repository (least authority).
`--expires`	Token / key lifetime in days. Keys require an expiry.
`--key`	An OpenSSH public key — validated, fingerprinted, dupe / leak refused.

tokens create is shown once

forge tokens create prints the tfp_ secret one time and stores it hash-only. Minting can require MFA and is audited.

04tree · blob · log

Browse code and history

bash

tilldev forge tree  <repo> [--rev <r>] [--path <p>]
tilldev forge blob  <repo> --path <p> [--rev <r>]
tilldev forge log   <repo> [--rev <r>] [--limit <n>]
tilldev forge refs  <repo>
tilldev forge blame <repo> --path <p> [--rev <r>]

Every --rev is resolved to a commit before anything runs — reads are argument-injection-safe by construction. These are the same reads the dashboard renders.

05policy · reflog · findings

Protection, recovery, findings

bash

tilldev forge policy ls <repo>
tilldev forge policy set <repo> --pattern <p> \
    [--require-signed] [--require-linear] [--approvals <n>] [--checks a,b] \
    [--require-mfa] [--allow-force] [--allow-delete]

tilldev forge reflog  <repo>                     # ref-change history
tilldev forge recover <repo> <reflog-id>         # one-click restore a ref

tilldev forge findings  <repo>                   # secrets rejected at push
tilldev forge allowlist <repo> <finding-id> --reason <r>

policy set tunes branch protection; recover restores a ref to a prior OID with a safe compare-and-swap; allowlist clears a secret-scan false positive with a reason (audited).

06pr · checks

Pull requests, checks, correlation

bash

tilldev forge pr ls     <repo> [--state open|merged|closed]
tilldev forge pr create <repo> --title <t> --source <ref> [--target <ref>] [--draft]
tilldev forge pr get    <repo> <number>
tilldev forge pr review <repo> <number> --state approved|changes_requested|commented
tilldev forge pr merge  <repo> <number> [--strategy merge|squash|rebase]

tilldev forge checks <repo> [--sha <s>]
tilldev forge check  <repo> --sha <s> --context <c> --state <st> [--url <u>]
tilldev forge correlation <repo> [--rev <r>]
tilldev forge codeowners  <repo> [--rev <r>]

pr merge enforces required approvals of the current head and required checks; check is how external CI reports status. See Pull requests.

07search · release · deploy · webhook

Search, ship, and fan out

bash

# Search — literal, line-numbered, at any revision.
tilldev forge search <repo> <query> [--rev <r>]

# Releases + a build per platform (each with a published sha256).
tilldev forge release ls <repo> | get <repo> <tag> | rm <repo> <tag>
tilldev forge release create <repo> --tag <t> [--name <n>] [--target <ref>] \
    [--generate | --notes <md>] [--prerelease] [--draft]      # --generate = auto-changelog
tilldev forge asset add <repo> <tag> --name <n> \
    --platform linux|darwin|windows|android|ios --url <u> [--arch <a>] [--sha256 <h>]

# Deployments — preview freely, gate production with --approvals.
tilldev forge env ls <repo> | set <repo> --name <n> [--production] [--url <u>] [--approvals <n>]
tilldev forge deploy ls <repo> [--env <e>]
tilldev forge deploy create <repo> --env <e> --ref <r> [--url <u>]
tilldev forge deploy status <repo> <id> --state <s>

# Webhooks — subscribe endpoints to repo events (HMAC-signed).
tilldev forge webhook ls
tilldev forge webhook add --url <u> --events push,pull_request,release,deployment [--repo <slug>] [--secret <s>]
tilldev forge webhook ping <id> | deliveries <id> | rm <id>

search is literal — the query is matched as fixed text, never a pattern. release create --generate drafts the changelog from the commits since your last tag; asset add attaches a checksummed build per platform. deploy ships a commit to an environment — preview before production, with an approval gate on the environments you mark --production. webhook subscribes an endpoint to signed events; verify the X-TillForge-Signature before you trust a delivery.

08egress · mirror · audit

AI egress, mirroring, and audit

bash

tilldev forge egress policy <repo>
tilldev forge egress set    <repo> [--allow] [--sensitive] [--providers a,b] [--max-bytes <n>] [--no-redact]
tilldev forge egress audit

tilldev forge mirror <repo> --url <u> [--direction pull|push]
tilldev forge mirror <repo> --remove
tilldev forge audit [--limit <n>]

egress governs whether a repo’s code may leave to a model — default-deny, provider-allowlisted, size-capped, and secret-redacted, with every decision audited (Security). mirror pulls from or pushes to another host over an SSRF-guarded, encrypted URL. audit reads the append-only privileged-action trail.

See the Quickstart for these commands in sequence, or the Security posture behind them. Back to the TillForge overview.