Command reference

This page covers Flog's supported public command-line interface. Run flog help <command> or flog <command> --help for the complete current help for a command.

Help and version#

flog help [command]#

Show top-level help or help for one command. flog --help and flog -h show the same top-level help.

flog version#

Print the installed Flog version. flog --version and flog -v are equivalent.

Resolve and install dependencies#

flog init#

Initialize the current project. If package.json is absent, create it with the current directory basename as name and "type": "module"; invalid npm names fail rather than being rewritten. An existing manifest is left byte-for-byte unchanged. Init then runs the normal lock and install operations. If either step fails, generated files are retained so the project can be repaired and retried.

flog install [options]#

Materialize the exact graph in an existing, matching flog.lock. Common flags include --cwd <directory>, --workspace <selector>, --offline, --prod, --ignore-scripts, --strict, and --json. See dependency installation.

flog lock [options]#

Create or deliberately reconcile flog.lock without installing. Use repeatable --target <os/cpu[/libc]> entries to lock additional targets; --cwd and --json are also supported. See resolution and flog.lock.

flog add [options] <package-specifier ...>#

Add dependencies to the current importer, update the lock, and install the new graph. Use --dev (-D) or --optional (-O) to select a dependency field, and --no-install to stop after updating package.json and flog.lock. It also accepts install controls such as --offline, --cache, --ignore-scripts, and --strict. See deliberate dependency updates.

flog remove [options] <package-name ...>#

Remove declarations from the current importer, update the lock, and install the result. --no-install and the normal install controls are available. See deliberate dependency updates.

flog upgrade [options] [dependency ...]#

Plan direct dependency upgrades, confirm them, publish the manifest and lock changes, and install the exact result. Select importers with --recursive (-r), --workspace, or --cwd; use --latest, --prod, or --dev to control the plan. --dry-run, --no-install, --yes (-y), and --json support review and automation. See deliberate dependency updates.

Run workspace work#

flog build [options]#

Build selected source workspaces once in deterministic dependency-first order. The main controls are --workspace <selector>, --cwd <directory>, --no-bail, --jobs <count|auto>, --stream, and --json. See workspace builds.

flog run [options] <script> [-- arguments]#

Run a package.json script and pass arguments after --. Select workspaces with --recursive (-r), --workspace, or --cwd; expand the graph with --include-dependencies or --include-dependents. Reporting and execution controls include --if-present, --no-bail, --jobs, --stream, and --json. See scripts and binaries.

flog x [options] <binary> [arguments]#

Execute a binary from the nearest installed node_modules/.bin. Flog never downloads a missing binary or falls back to a global executable. Use --cwd <directory> to choose the package context. See scripts and binaries.

flog check peers [options]#

Audit direct dependencies used as required peer providers without changing the project. Narrow the audit with --workspace <selector>, emit --json, or use --fail-on-candidates in CI. See peer-provider auditing.

Inspect and authenticate#

flog view <package-specifier> <field> [--json]#

Print one top-level scalar field from published package metadata. Use --json to preserve the value's JSON type. See registry and authentication.

flog login [--registry <url>]#

Authenticate with an npm registry and store its credential in the user npmrc. See registry and authentication.

flog whoami [--registry <url>]#

Verify the selected registry credential and print the username. See registry and authentication.

flog logout [--registry <url>]#

Remove the exact selected registry credential from the user npmrc. See registry and authentication.

Pack and publish#

flog bump [options]#

Compare public workspace versions with the requested registry tag, then plan the minimum transitive release versions and explicit workspace-range repairs required by Flog's release-set rules. --dry-run and --json are read-only; --yes confirms noninteractive application. The command atomically updates the reviewed package.json files and synchronized flog.lock, but never installs, runs lifecycle scripts, creates artifacts, or mutates registry state. See workspace release sets.

An existing valid multi-target lock is transformed locally for changes limited to workspace versions and workspace: ranges. Unrelated registry snapshots, peer contexts, platform selections, and integrity values are preserved. If that reuse cannot be proven safe, an applying command reports and performs full resolution where possible, or fails closed for an invalid/incompatible lock. A dry run does not start that potentially slow fallback: its text and JSON output report lock validation as pending instead. Publication-baseline checks still read anonymous registry metadata; cold network latency cannot be guaranteed, so human output reports the active baseline and lock phase. Baseline checks have a 30-second phase deadline and a full fallback resolution has a two-minute deadline; either fails with a clear timeout diagnostic instead of waiting indefinitely.

flog pack [options] [directory]#

Create deterministic npm-compatible package tarballs. Use --recursive (-r) or --workspace for workspace selection, --destination to choose the output, and --dry-run or --json for inspection. See package packing.

flog publish [options] [directory]#

Preflight and publish npm packages. Select workspaces with --recursive (-r) or --workspace; control publication with --tag, --access, --dry-run, and --yes (-y). Git and release-set overrides are deliberately explicit. Use --summary <file> or --json for machine-readable outcomes. See publishing and workspace release sets.

Maintain Flog#

flog update [options]#

Securely replace the running Flog executable. Choose --channel <name>, an exact --version <version>, or a compatible --releases-url <url>. See installer and release channels.

Common selection and output flags#

Flags are command-specific; check command help before combining them. Workspace-aware commands generally use --workspace <selector> for a package name, path, owned file, or glob, while --cwd <directory> changes discovery or the default package context. Commands that support --json document whether it changes failure retention or confirmation behavior in their detailed guides.