Vollständiger CLI-Befehlsindex

Die Einträge werden aus dem ausgelieferten Befehlsbaum erzeugt. Kurzbeschreibung und Syntax geben die englischsprachige CLI-Hilfe unverändert wieder; die verlinkten Aufgabenanleitungen erklären den menschlichen Ablauf auf Deutsch.

Der normale Einstieg ist baha new oder baha init. Explizite app-Befehle bleiben für Administration und Automation sichtbar. baha update betrifft BaseHarbor/Core; baha app update betrifft die Application-Source.

Exakte Optionen stehen in baha COMMAND --help. Globale Optionen und JSON/MCP-Zuordnung ergänzen jeden Eintrag. Entfernte, fehlende oder geänderte Befehle lassen den Dokumentations-Test scheitern.

Befehl	CLI-Kurzbeschreibung (verifiziert)	CLI-Syntax (verifiziert)	Aufgabenanleitung
baha	BaseHarbor command-line interface	baha <command> [options]	↗
baha agent	Discover the stable BaseHarbor machine interface	baha agent describe [-o json\|--output json]	↗
baha agent describe	Describe supported machine operations and contracts	baha agent describe [-o json\|--output json]	↗
baha app	Manage declarative application backend runtimes	baha app <command> [options]	↗
baha app apply	Converge and verify an application's backend runtime	baha app apply [NAME] [--skip-memory-preflight]	↗
baha app backup	Create one encrypted recovery unit for an application	baha app backup [NAME] [--output FILE] [--password-file FILE] [--include-state CLASS] [--exclude-state CLASS]	↗
baha app cache	Open the managed cache console for the current application	baha app cache [INSTANCE] [--app NAME]	↗
baha app create	Create an application manifest in BaseHarbor state	baha app create NAME [--environment ENV] [--sql\|--sql-instance NAME] [--cache\|--cache-instance NAME] [--key-value\|--key-value-instance NAME] [--document-db\|--document-db-instance NAME] [--messaging-queue\|--messaging-queue-instance NAME] [--messaging-pubsub\|--messaging-pubsub-instance NAME] [--messaging-stream\|--messaging-stream-instance NAME] [--s3\|--s3-bucket NAME] [--secrets\|--require-secret NAME]...	↗
baha app creds	Show connection metadata without revealing credentials by default	baha app creds postgres\|valkey [INSTANCE] [--app NAME] [--reveal]	↗
baha app destroy	Retire owned application runtime while retaining data and recovery state	baha app destroy [NAME] [--yes] [--full-reset]	↗
baha app doctor	Diagnose and safely repair an application's runtime	baha app doctor [NAME] [--fix --yes]	↗
baha app down	Stop an application runtime while preserving persistent data	baha app down [NAME]	↗
baha app edit	Edit current application needs with preview and impact consent	baha app edit [NAME] [-e ENV\|--environment ENV]	↗
baha app env	Show the standard environment contract for an application	baha app env [NAME] [--format dotenv\|shell\|json\|yaml] [--reveal] [--path]	↗
baha app evidence	Export secret-safe application lifecycle and verification evidence	baha app evidence [NAME] [-e ENV\|--environment ENV] [-o json\|--output json]	↗
baha app exec	Execute a command in an application workload service	baha app exec SERVICE COMMAND [ARG...] [--app NAME]	↗
baha app footprint	Read the current application footprint	baha app footprint show [NAME] [-o json\|--output json] [--details]	↗
baha app footprint show	Display the authoritative Target footprint without mutation	baha app footprint show [NAME] [-o json\|--output json] [--details]	↗
baha app init	Create the application contract or initialize deployment settings	baha app init --agents [--json] \| baha app init [--quick] [--json] \| baha app init [--input NAME=VALUE]... [--hostname HOST] [--tls acme\|existing\|local] [--cert-dir DIR] [--yes] \| baha app init [NAME] [-e ENV\|--environment ENV] [--sql\|--sql-instance NAME] [--cache\|--cache-instance NAME] [--key-value\|--key-value-instance NAME] [--document-db\|--document-db-instance NAME] [--messaging-queue\|--messaging-queue-instance NAME] [--messaging-pubsub\|--messaging-pubsub-instance NAME] [--messaging-stream\|--messaging-stream-instance NAME] [--s3\|--s3-bucket NAME] [--secrets\|--require-secret NAME] [--workload-component NAME]... [--workload-source KIND:PATH]	↗
baha app inspect	Inspect a repository without changing it	baha app inspect [PATH] [--verbose] [-o json\|--output json\|--json]	↗
baha app list	List registered deployments for the effective target	baha app list [--all-targets]	↗
baha app logs	Show logs for the current application workload	baha app logs [SERVICE] [--follow] [--app NAME]	↗
baha app new	Create a new ecosystem-native application from a BaseHarbor contract	baha app new [NAME] [--directory PARENT] [--stack go\|nextjs\|python\|quarkus \| --stack-profile NAME] [--emit-backstage --backstage-owner OWNER [--backstage-lifecycle LIFECYCLE]] [-e ENV\|--environment ENV] [--http] [--sql] [--cache] [--key-value] [--document-db] [--queue] [--pubsub] [--stream] [--s3] [--secrets] [--require-secret NAME]... [--telemetry] [--all] [-o json\|--output json]	↗
baha app plan	Show desired resources without changing anything	baha app plan [NAME] [-o json\|--output json]	↗
baha app preflight	Validate an application before mutation	baha app preflight [NAME]	↗
baha app restore	Restore and verify an encrypted application recovery unit	baha app restore [BACKUP] [NAME] [--password-file FILE] [--json]	↗
baha app runtime-identity	Manage the app-scoped credential used for dynamic secret references	baha app runtime-identity <rotate\|revoke> [NAME] [--yes]	↗
baha app runtime-identity revoke	Immediately revoke the application runtime credential	baha app runtime-identity revoke [NAME] [--yes]	↗
baha app runtime-identity rotate	Rotate the application runtime credential	baha app runtime-identity rotate [NAME] [--yes]	↗
baha app secret	Manage application secret values without printing them	baha app secret <command> [options]	↗
baha app secret delete	Permanently delete one secret and all of its KV versions	baha app secret delete [NAME] KEY [--yes]	↗
baha app secret list	List secret key names without values	baha app secret list [NAME]	↗
baha app secret set	Create or replace one secret value from stdin or a file	baha app secret set [NAME] KEY [--stdin \| --file PATH]	↗
baha app secret tls-set	Validate and store a TLS certificate chain and private key	baha app secret tls-set [NAME] --cert-file PATH --key-file PATH [--chain-file PATH]	↗
baha app shell	Open a shell in an application workload service	baha app shell SERVICE [--app NAME]	↗
baha app show	Show a coherent application overview	baha app show [NAME]	↗
baha app sql	Open the managed SQL console for the current application	baha app sql [INSTANCE] [--app NAME]	↗
baha app status	Show application runtime and readiness status	baha app status [NAME] [-o json\|--output json]	↗
baha app tls	Inspect and maintain application TLS certificates	baha app tls <command>	↗
baha app tls update	Check for or install a newer existing TLS certificate	baha app tls update [--check]	↗
baha app up	Start an existing application runtime and verify readiness	baha app up [NAME] [--yes\|-y] [--skip-memory-preflight]	↗
baha app update	Safely inspect or update a Git-backed application	baha app update [--check] [--backup-password-file FILE \| --no-backup]	↗
baha app workspace	Manage local multi-repository workspace mappings	baha app workspace [<init\|map\|show\|resolve\|status\|update> [options]]	↗
baha app workspace init	Create versioned source identity metadata for a multi-repository application	baha app workspace init [--manifest PATH] --source ID=REPOSITORY [--source ...] [--oci ID=IMAGE] [--component COMPONENT=SOURCE[@SUBPATH]]... [-o json]	↗
baha app workspace map	Map one repository source identity to an existing local checkout/worktree	baha app workspace map SOURCE PATH [--manifest PATH] [-o json]	↗
baha app workspace resolve	Resolve component source identity to local worktrees without using the current working directory	baha app workspace resolve [--manifest PATH] [-o json\|--output json]	↗
baha app workspace show	Show canonical source identities and local workspace mappings	baha app workspace show [--manifest PATH] [-o json\|--output json]	↗
baha app workspace status	Inspect Git state for all mapped repository sources	baha app workspace status [--manifest PATH] [--fetch] [-o json\|--output json]	↗
baha app workspace update	Safely fast-forward mapped Git repositories	baha app workspace update [--manifest PATH] [--check] [-o json\|--output json]	↗
baha backup	Back up the current application through its managed lifecycle	baha backup [options]	↗
baha completion	Generate shell completion for Bash, Zsh or Fish	baha completion bash\|zsh\|fish	↗
baha config	Configure BaseHarbor user preferences	baha config prompt [options]	↗
baha config organization	Configure versioned organization/platform defaults and references	baha config organization set\|show\|check\|update [options]	↗
baha config organization check	Resolve the configured source without changing the active organization configuration	baha config organization check [-o json]	↗
baha config organization set	Resolve and activate an organization configuration source	baha config organization set --source oci\|git\|local\|system [--location LOCATION] [--requested TAG\|REF] [--environment ENV] [-o json]	↗
baha config organization show	Show the active organization configuration and effective defaults	baha config organization show [--environment ENV] [--preferences FILE] [-o json]	↗
baha config organization update	Explicitly activate the currently configured source at its newly resolved immutable version	baha config organization update --yes [--environment ENV] [-o json]	↗
baha config prompt	Configure the optional BaseHarbor shell prompt segment	baha config prompt [--enable\|--disable] [--preset minimal\|compact\|accessible\|detailed\|none] [--position before-path\|after-path\|right] [--environment never\|critical-only\|always] [--show-application\|--hide-application] [--text-only\|--color-output] [--prod-indicator TEXT] [--label TARGET=LABEL] [--color KEY=VALUE]	↗
baha connect	Allow one explicit application service to reach another	baha connect SOURCE TARGET	↗
baha connections	List explicit cross-application connectivity policy	baha connections	↗
baha destroy	Remove owned runtime resources with explicit consequence consent	baha destroy [--yes] [--delete-data] \| baha destroy --all [--yes]	↗
baha dev	Manage local development conveniences	baha dev <credentials\|domain>	↗
baha dev credentials	Show or rotate the target-scoped development management login	baha dev credentials [--reset] [--username USER] [--password-file FILE]	↗
baha dev domain	Show or configure the target-scoped development domain	baha dev domain [DOMAIN]	↗
baha disconnect	Remove one explicit cross-application connectivity exception	baha disconnect SOURCE TARGET	↗
baha doctor	Diagnose the current application repository, otherwise the control plane	baha doctor [--fix --yes] [-o json\|--output json]	↗
baha down	Stop the current application, or the local control plane outside a repository	baha down [options]	↗
baha init	Initialize or adopt the application in the current repository	baha init --agents [--json] \| baha init [--quick] [--json] [--input NAME=VALUE]... [--yes]	↗
baha inspect	Inspect the current repository and its application requirements	baha inspect [options]	↗
baha list	List managed applications on the selected Target	baha list [options]	↗
baha login	Authenticate the BaseHarbor operator through OIDC	baha login -e ENV\|--environment ENV	↗
baha logout	Remove a local BaseHarbor operator session	baha logout -e ENV\|--environment ENV	↗
baha mcp	Expose BaseHarbor semantic operations over MCP	baha mcp serve	↗
baha mcp serve	Run the local stdio MCP server	baha mcp serve	↗
baha new	Create an application, stack, target, provider, or workspace	baha new [application\|stack\|target\|provider\|workspace] [options]	↗
baha node	Enroll and manage remote Docker or Podman nodes	baha node [add\|connect\|list\|status\|disconnect]	↗
baha node add	Create a remote Target and one-use enrollment bundle	baha node add [NODE] [--target NAME] --runtime docker\|podman --tenant-id UUID --core-url https://HOST:PORT --core-address HOST:PORT --ca-file FILE [--environment ENV] [--output FILE] [--json]	↗
baha node connect	Enroll this host and start the rootless connector service	baha node connect [ENROLLMENT-FILE] [--connector-bin FILE] [--json]	↗
baha node disconnect	Revoke node access after impact acknowledgement and retain recovery owners	baha node disconnect TARGET --yes [--json]	↗
baha node list	List configured remote connector nodes	baha node list [--json]	↗
baha node status	Inspect Core enrollment state for a remote node	baha node status TARGET [--json]	↗
baha open	Open a verified HTTPS application endpoint	baha open [--print] [--json]	↗
baha openbao	Bootstrap and operate the BaseHarbor OpenBao trust plane	baha openbao <command> [options]	↗
baha openbao bootstrap	Initialize OpenBao and establish the BaseHarbor manager identity	baha openbao bootstrap --recovery-file PATH	↗
baha openbao rotate	Rotate OpenBao/control-plane credentials and managed service PKI	baha openbao rotate --recovery-file PATH	↗
baha openbao status	Show OpenBao initialization, seal and manager-auth state	baha openbao status	↗
baha openbao unseal	Unseal OpenBao from an operator-held recovery file	baha openbao unseal --recovery-file PATH	↗
baha plan	Show the application plan in the current repository	baha plan [NAME] [-o json\|--output json]	↗
baha policy	Inspect the effective BaseHarbor policy for an application environment	baha policy <check\|explain> [NAME] [-e ENV\|--environment ENV] [-o json\|--output json]	↗
baha policy check	Evaluate effective policy against the selected application	baha policy check [NAME] [-e ENV\|--environment ENV] [-o json\|--output json]	↗
baha policy explain	Explain effective policy, defaults and bounded overrides	baha policy explain [NAME] [-e ENV\|--environment ENV] [-o json\|--output json]	↗
baha provider	Author and validate Capability Provider extensions	baha provider <command> [options]	↗
baha provider add	Register an externally owned Capability Provider	baha provider add ID [--descriptor DIR \| --provider-id ID --kind KIND --capability NAME] --endpoint URL [trust options] [-o json]	↗
baha provider init	Create a minimal Capability Provider authoring skeleton	baha provider init ID [--path DIR] [-o json\|--output json]	↗
baha provider inspect	Inspect one registered external Capability Provider	baha provider inspect ID [-o json]	↗
baha provider list	List registered external Capability Providers	baha provider list [-o json]	↗
baha provider remove	Remove an external provider registration without destroying foreign infrastructure	baha provider remove ID --yes [-o json]	↗
baha provider test	Run provider contract conformance checks	baha provider test [PATH] [-o json\|--output json]	↗
baha provider verify	Verify endpoint and trust for an external Capability Provider	baha provider verify ID [-o json]	↗
baha restore	Restore an application through the ownership-safe managed lifecycle	baha restore [options]	↗
baha serve	Run the TLS-protected BaseHarbor runtime/control-plane API	baha serve	↗
baha shell-init	Generate BaseHarbor shell integration for Bash, Zsh or Fish	baha shell-init bash\|zsh\|fish	↗
baha stack	Discover and manage reusable development Stack Profiles	baha stack list\|show\|create	↗
baha stack create	Create a reusable Stack Profile	baha stack create [NAME --component ID:ROLE:STACK ...] [--extends NAME] [--scope user\|repository] [-o json\|--output json]	↗
baha stack list	List built-in, user and repository Stack Profiles	baha stack list [-o json\|--output json]	↗
baha stack show	Show a resolved Stack Profile	baha stack show NAME [-o json\|--output json]	↗
baha status	Show application status in a repository, otherwise control-plane status	baha status [-o json\|--output json]	↗
baha target	Inspect and manage BaseHarbor deployment targets	baha target [list\|show\|create\|delete\|activate\|deactivate] [-o json\|--output json\|--json]	↗
baha target activate	Persist the active deployment target for this user	baha target activate NAME	↗
baha target create	Create a deployment target	baha target create NAME --runtime-provider PROVIDER --access ACCESS --access-provider PROVIDER --reference REFERENCE [--scope SCOPE] [--default] [--docker-endpoint SOCKET \| --docker-context CONTEXT] [--docker-mode rootless\|rootful]; baha target create NAME --from-recovery PATH	↗
baha target deactivate	Clear persisted active deployment target	baha target deactivate	↗
baha target delete	Detach target configuration with protected recovery; preserve runtime and data	baha target delete NAME	↗
baha target list	List configured targets	baha target list [-o json\|--output json\|--json]	↗
baha target show	Show one target	baha target show [NAME] [-o json\|--output json\|--json]	↗
baha trust	Inspect, export or explicitly install the managed local BaseHarbor CA	baha trust <status\|export\|install\|uninstall> [options]	↗
baha trust export	Export only the public managed-local CA certificate	baha trust export --output PATH	↗
baha trust install	Explicitly install the managed-local CA into the host trust store	baha trust install --yes	↗
baha trust status	Show whether the managed-local CA is trusted by this host	baha trust status	↗
baha trust uninstall	Remove only BaseHarbor-owned host trust anchors	baha trust uninstall [--yes] [--json]	↗
baha tui	Open the interactive BaseHarbor status dashboard	baha tui [--json]	↗
baha up	Converge selected application intent, or explicitly start the management Core	baha up [-e ENV\|--environment ENV] [--yes] [--skip-memory-preflight] [--control-plane-only] [--ha] [--trust-host-ca] [--postgres-port PORT] [--openbao-port PORT] [--recovery-file PATH]	↗
baha update	Safely inspect or update BaseHarbor itself	baha update [--check] [--yes] [--channel stable\|rc \| --version VERSION] [--recover]	↗
baha use	Select and persist the active Core or deployment target	baha use [TARGET]	↗
baha version	Print build version	baha version [-o json\|--output json\|--json]	↗
baha whoami	Show the authenticated BaseHarbor operator identity	baha whoami -e ENV\|--environment ENV	↗
baha workspace	Configure local workspace sources and repository mappings	baha workspace [<init\|map\|show\|resolve\|status\|update> [options]]	↗
baha workspace init	Create versioned source identity metadata for a multi-repository application	baha workspace init [--manifest PATH] --source ID=REPOSITORY [--source ...] [--oci ID=IMAGE] [--component COMPONENT=SOURCE[@SUBPATH]]... [-o json]	↗
baha workspace map	Map one repository source identity to an existing local checkout/worktree	baha workspace map SOURCE PATH [--manifest PATH] [-o json]	↗
baha workspace resolve	Resolve component source identity to local worktrees without using the current working directory	baha workspace resolve [--manifest PATH] [-o json\|--output json]	↗
baha workspace show	Show canonical source identities and local workspace mappings	baha workspace show [--manifest PATH] [-o json\|--output json]	↗
baha workspace status	Inspect Git state for all mapped repository sources	baha workspace status [--manifest PATH] [--fetch] [-o json\|--output json]	↗
baha workspace update	Safely fast-forward mapped Git repositories	baha workspace update [--manifest PATH] [--check] [-o json\|--output json]	↗