Command reference

Every command has --help. Analyses read the build directory: the current directory when it is one, else --build-dir DIR (remembered for the next commands). Project commands read the Yocman project around the current directory, or --project DIR.

Diagnose and fix

Command	What it does	Example
fix	Diagnoses the failed task, shows a patch for your layer, applies it after confirmation and re-runs the task. A failure already solved for you is answered from your history; --fresh asks the AI again.	yocman fix
explain	Explains the last build failure without changing anything.	yocman explain
ask	Answers a question with your release, machine and layers as context.	yocman ask "how do I add a systemd service?"
context	Shows the release, machine, distro and layers Yocman detected. Offline.	yocman context
login	Stores your API key and checks it against the service.	yocman login

When ask or explain finds a concrete change in one of your layers (a wrong path in CONFFILES, a missing dependency), it is kept for this build directory for 14 days and the answer ends with Run yocman fix to apply it. With no failed task, yocman fix applies it: the saved diff first, without a new AI call, then a verification (the task it names, after you confirm, or bitbake -e on the recipe). yocman fix --list shows the pending changes, --proposal ID picks one, --discard ID forgets one, and yocman fix RECIPE limits everything to a recipe. A failed task always comes first.

fix, explain and ask accept --dry-run, which prints the masked payload and sends nothing.

Analyse the build

Command	What it does	Example
doctor	Lists the data sources found in the build directory and how to enable the missing ones.	yocman doctor
rules	Lists the analysis rules with their id, category and severity.	yocman rules --category size
conf	Checks local.conf, bblayers.conf, auto.conf and site.conf.	yocman conf
layers check	Checks the layers of bblayers.conf: missing, listed twice, incompatible with the release, orphan .bbappend.	yocman layers check
deps	Dependency tree of a package, runtime or build time; --reverse shows who depends on it.	yocman deps openssl --reverse
why	Why a package is in the image: the chains from IMAGE_INSTALL.	yocman why busybox
provides	Which package installs a file in the image.	yocman provides /usr/bin/scp
unused	Packages that are candidates for removal, to review.	yocman unused
orphans	Recipes that are built but never reach the image.	yocman orphans
duplicates	Duplicate functionality in the image, such as two SSH servers.	yocman duplicates
size	Image size by package, file and category; size diff compares two builds or buildhistory revisions.	yocman size diff ../build-old
buildtime	Longest tasks and recipes from buildstats, and the effective parallelism.	yocman buildtime
sstate	Shared-state reuse, and the recipes rebuilt at every build.	yocman sstate
boot	Boot time from a systemd-analyze blame or critical-chain file taken on the target.	yocman boot --log blame.txt

Security and compliance

Command	What it does	Example
audit	Runs every check below and gives a score per category.	yocman audit --fail-on high
cve	Unpatched CVEs from the cve-check report, by CVSS; cve diff shows what an update fixed or introduced.	yocman cve diff old.json
secrets	Keys, tokens and passwords in the rootfs and the layers, reported by location and type, never displayed.	yocman secrets
users	Empty passwords, extra UID 0 accounts, weak hashes, login shells.	yocman users
perms	setuid files, world-writable paths, sensitive files, unknown owners.	yocman perms
services	Services enabled at boot, insecure network services, SSH and debug settings.	yocman services
kernel-audit	The kernel .config against a hardening checklist.	yocman kernel-audit
licenses	GPLv3, proprietary and unclear licenses, and source obligations.	yocman licenses
sbom	SPDX SBOM presence and consistency with the image.	yocman sbom
cra report	Cyber Resilience Act readiness: reuses cve, secrets, sbom, licenses and kernel-audit and maps their findings to CRA requirement areas, with the build-side evidence and the gaps.	yocman cra report --format md -o cra.md

Start a project

Command	What it does	Example
init	Creates a kas project for a verified board and release, built on the host or in a container. --describe lets the AI fill in the choices; --board-search looks up other boards in the OpenEmbedded layer index.	yocman init --board rpi4-64 --release scarthgap
add	Adds a feature (SSH, Wi-Fi, Qt 6, Docker…) with a diff to confirm and a commit.	yocman add qt6
remove	Removes a feature, refused while another feature still needs it.	yocman remove wifi
build	Builds the image with live progress: phase, running tasks, time left.	yocman build
shell	Opens a shell with the bitbake environment, on the host or in the container.	yocman shell
env	env check verifies the environments, env use switches between host and container, env update-image proposes the latest kas image.	yocman env use container
flash	Writes the image to an SD card or USB drive. Only removable disks are listed and you type the device name to confirm.	yocman flash --device /dev/sdb

Output and CI

Every analysis takes --format terminal|json|md, -o FILE, --fail-on LEVEL (exit 1 when a finding reaches that level) and --no-ai (no network call). Exit codes: 0 ok, 1 finding at or above --fail-on, 2 missing data source or error.