CLI commands

Every bedrock command that exists today.

General

Command	What it does
`bedrock version`	Shows the CLI's version, commit, and build date. `bedrock --version` is the one-line form of just the version, the same info scripts and CI usually want.
`bedrock --help` / `bedrock <command> --help`	Usage and flags for the CLI, or for any single command.
`bedrock update`	Downloads the latest version, verifies its checksum, and replaces the running binary in place. macOS/Linux only — Windows users reinstall manually.

Auth

Command	What it does
`bedrock login`	Opens your browser to sign in with GitHub, then waits for approval. On success, writes a long-lived credential to `~/.bedrock/credentials`.
`bedrock logout`	Revokes the credential server-side, then clears it locally.
`bedrock whoami`	Shows the signed-in user.

Tokens

Every bedrock login issues a new API token. For non-interactive use — CI included — bedrock token create mints one directly, no browser involved. Revoke a token you don't recognize, or one from a device you no longer have (a leaked CI token, a lost laptop) — you don't need to be signed in from that device to do it.

Command	What it does
`bedrock token create --name "..."`	Creates a token with no pairing step and prints it once — save it as a CI secret (e.g. `BEDROCK_API_TOKEN`).
`bedrock token list`	Lists your API tokens: name, status, created, last used.
`bedrock token revoke <id> [-y]`	Revokes a token immediately. Whatever's using it is signed out right away.

Organizations

Command	What it does
`bedrock org list`	Lists organizations you belong to.
`bedrock org create <name>`	Creates a new organization and makes it the current one.
`bedrock org use <slug>`	Sets the default organization (`~/.bedrock/config.json`) for commands run outside a linked project directory.

Projects & apps

--project is only needed for app commands run outside a directory that bedrock init already linked; inside one, the project is read from bedrock.json automatically.

Command	What it does
`bedrock project create <name>`	Creates a project in the current organization.
`bedrock project list`	Lists projects in the current organization.
`bedrock project delete <id> [-y]`	Deletes a project, and every app and build in it.
`bedrock app create <name> --package <id> [--project <id>]`	Creates an Android app in a project (Android is the only platform bedrock supports today).
`bedrock app list [--project <id>]`	Lists apps in a project.
`bedrock app delete <id> [--project <id>] [-y]`	Deletes an app, and every build, signing credential, and env var in it.
`bedrock init`	Interactive wizard: pick or create an org, project, and app, then write `bedrock.json` to the current directory. This links the directory to that app for every command below. Every project/app-scoped command reads its org, project, and app IDs from this file.

Building

Command	What it does
`bedrock build [--profile release\|debug] [--aab] [--id <id>]`	Packs the current directory (skipping `node_modules`, `.git`, `android`, `ios`), uploads it, and runs a real Android build in the cloud. Opens a full-screen TUI: a sidebar of builds plus a live log pane for whichever one's selected, and prints a dashboard link to watch from the browser instead. If a build for this app is already in progress, attaches to it instead of starting a duplicate. `--id` attaches to a specific build's status/logs directly instead of starting a new one (ignores `--profile`/`--aab`). Remote-only today; local builds (`--local`) are designed but not implemented yet.
`bedrock build list`	This app's full build history, with status and step.
`bedrock build status <id>`	A single build's status/step/error, as a summary block.
`bedrock build logs <id>`	Streams a build's logs live as it runs.
`bedrock build download <id> [-o/--output <path>]`	Downloads a finished build's artifact. Defaults to `<build-id>.apk` (or `.aab`) in the current directory; `--output` picks the path.
`bedrock build share <id> [--revoke]`	Creates a public, no-login-required link anyone can use to download the build's artifact. `--revoke` invalidates a previously created link instead of creating one.
`bedrock build cancel <id> [-y]`	Stops a queued or running build's sandbox. Has no effect on a build that's already finished.
`bedrock build delete <id> [-y]`	Deletes a build and its stored artifact.

Signing

A release keystore is uploaded once per app and reused across builds. See Security for exactly how it's protected at rest and during a build.

Command	What it does
`bedrock signing upload --keystore <path> --alias <alias>`	Uploads a keystore. Prompts interactively for the keystore and key passwords, never accepted as flags or args, so they never land in shell history. Re-uploading under an existing alias rotates it (replaces the stored credential).
`bedrock signing list`	Lists this app's signing credentials: alias, fingerprint, upload date. Passwords and the keystore itself are never returned by any API call once uploaded.

Environment variables & secrets

Command	What it does
`bedrock env set KEY=value [--secret] [--profile release\|debug]`	Sets an env var for this app. Upsert semantics: setting an existing key (and profile) overwrites it. Omitting `--profile` applies to every profile, unless a profile-specific row for the same key exists, which wins. `--secret` prompts for the value interactively instead of taking it from the argument.
`bedrock env list [--profile release\|debug]`	Lists this app's env vars. Secret values always print as `(secret)`, never the real value.
`bedrock env delete KEY [--profile release\|debug] [-y]`	Deletes a single env var.

Audit log

Who created or deleted a project, app, or build, and when.

Command	What it does
`bedrock audit list`	Lists the current organization's most recent events, newest first.

Environment variables (CLI configuration)

Not app config: both point the CLI itself somewhere else. You won't need these unless you're told to.

Variable	Purpose
`BEDROCK_API_URL`	Overrides where the CLI sends requests.
`BEDROCK_DASHBOARD_URL`	Overrides the dashboard link `bedrock build` prints after starting.

Files on disk

Path	Contents
`~/.bedrock/credentials`	The API token from `bedrock login`, mode `0600`.
`~/.bedrock/config.json`	The default org set via `bedrock org use`, consulted when a directory has no `bedrock.json` of its own.
`bedrock.json`	Written by `bedrock init` in a project directory. Links it to a specific org/project/app by ID (same spirit as `app.json`/`eas.json`).