Commands

Pasteable dora commands. Flags live on --help.

Copy a command, then add flags from --help.

Empty dora prints short --help. Assess this project with dora scan and dora review --quick. Ship a pocket agent as a saved routine. Start it with /ask-dora. Model: Pocket agent. Walkthrough: Run a pocket agent. Apply: Apply and watch.

dora --help                  # first loop + verb list
dora review --help           # one command
dora --help --json           # live map for agents

Exit codes

Code	Meaning
`0`	Clean
`1`	Issues found
`2`	Could not run

Scan

dora                         # short --help
dora scan                    # workspace map
dora scan --json
dora scan --ci
dora scan --cwd "$GITHUB_WORKSPACE"

Read-only. No LLM. No API key. When Entire is already enabled, Dora prints: “Entire is enabled. Dora will use it while it checks this repo.” Details: Entire.

Review

dora review --quick .        # structure + heuristics; Findings first
dora review --quick ./path/to/skill-dir
dora review --all --quick --ci
dora review --deep .         # require Judge; exit 2 if none
dora review --run .          # no-skill then with-skill; exit 2 if no agent or Judge
dora review --sessions .     # require session evidence
dora review CLAUDE.md
dora review --json           # includes sessionHealth (not --quick)

--quick is the first Review. It does not include Session health. A full Review adds a Session health block (token pressure). That block is not a Finding. When Entire is already enabled, Review prints one line: “Entire is enabled. Dora will use it while it checks this repo.”

Review also prints the checkpoint id and the full stored prompt for each file. --quick includes them. A list Review prints them under each row. A full Review counts a slash command, or a SKILL.md path, in that prompt as an invoke.

JSON comes after:

dora review --quick --json

Tiers: Review tiers.

Fix

dora fix . --dry-run
dora fix . --yes             # mechanical; no TTY
dora fix . --brief           # Judgment items; then replace

Re-run dora review --quick until exit 0.

Create

dora skill new --for claude --name review-pr --description "Reviews PRs" --yes
dora rule new --for cursor --name no-default-exports --yes
dora plugin new --for claude --name my-plugin --yes
dora agent new --for claude --name explorer --yes

Always pass --for. Then dora review --quick the new path.

Skill

dora skill                    # Authored + Global Skills
dora skill unused             # this directory
dora skill unused --global    # home Skills
dora skill unused --last 10 --since 30
dora skill remove ghost --dry-run
dora skill remove ghost --yes
dora skill remove ghost --for claude --yes
dora skill restore ghost --yes

dora skill unused lists unused Skills. It writes nothing.

Project unused reads this directory’s Sessions (last 30, 90 days). --global reads last 30 Sessions per agent, any project, and lists home Skills only. Do not mix the two. --last and --since override one run.

A Recent install is younger than Install age (default 90 days). Unused names it as never invoked. It is not a Remove candidate. Imported cache is a count, not a name dump. Config: review_window.last, review_window.max_age_days, install_age_days.

A Plugin with some unused children lists those children. A Plugin with none invoked lists the Plugin only. Next on a standalone unused Skill is dora skill remove <name> --dry-run. Next on a Plugin row or a Plugin-owned Skill is dora review --quick <plugin-root>. Next is never Review of $HOME. Home is never a Plugin root. An Owned child may still be removed by name.

Deletes an Authored Skill. Quarantines a Global Skill (home copy). An Owned Plugin child may be deleted. Restore puts a Quarantined Global Skill back. dora skill remove <plugin-name> does not uninstall a Plugin.

A detected agent needs --yes or --dry-run. A name clash needs --for, --global, or a path.

Scan and Review mark an Authored Skill that was never invoked in the Review window, and is not a Recent install, as R034. That is a Remove candidate. A Global Skill is never a Remove candidate from one project’s Sessions. Use dora skill unused --global for home Skills.

Memory

dora memory add "Never use default exports" --weight 8
dora memory add "Prefer named exports" --global
dora memory list
dora memory promote          # hard rules → AGENTS.md
dora memory promote --dry-run
dora memory context --json --quiet
dora memory stash path/to/notes.md
dora memory restore path/to/notes.md
dora memory sync

Weights: 8+ hard · 5 default · 1–3 soft. Memory.

Conflicts

dora conflicts --dry-run
dora conflicts --yes

Settles Claude-vs-Cursor contradictions into AGENTS.md.

Session

dora session
dora session --agent claude --limit 20
dora session show <sessionId>
dora session open
dora session --json

Read-only. Adapters: Claude, Grok, Cursor, Codex, Copilot. dora session open serves a local page for those logs, plus Gemini CLI, and opens it in the browser. Leave that process running. Ctrl+C stops it.

The same reader is at /inspect-traces. That page opens with two example traces, then asks for your home folder, or one agent folder. Choosing a folder replaces the examples. When the list has more than one agent, buttons filter it to one agent. The logs stay on the computer.

The table shortens the id. show accepts that short id when it is unique. --json has the full sessionId. show prints token totals when the log has them. It says unavailable when it does not.

Wire

dora wire --for claude --run
dora wire --for codex --run --chatgpt
dora wire --for codex --run --api-key

Starts a proxy on port 8787, then starts that agent in this terminal. Ctrl+C stops both. Dora waits until the agent has exited.

Claude starts with ANTHROPIC_BASE_URL and ENABLE_TOOL_SEARCH=true. Codex gets one -c openai_base_url=... for that run. Dora does not edit ~/.codex/config.toml. ChatGPT uses /backend-api/codex. An API key uses /v1.

Each POST, except a token-count call, writes three files under ~/.doraval/wire/: a readable .md, the raw .request.txt, and the raw .response.txt. A second turn in the same millisecond gets its own files. The same call more than 20 times in 2 seconds stops new files. The .md redacts authorization, x-api-key, api-key, and cookie. The text files keep the raw body. Token-count calls are forwarded and not saved. The logs stay on this computer.

dora wire --for cursor exits 2. Cursor builds the system prompt on its servers. dora session open still reads those logs.

Exit	When
0	The agent exits 0.
2	The flags are wrong, port 8787 is taken, or the agent binary is missing.
130	Ctrl+C.
other	The agent exited with that code.

Search

dora search "add login"

Read-only. Dora runs entire search and prints that text.

Exit	When
0	Entire returns text, or Entire is not enabled. Not enabled prints nothing.
2	`entire` is missing, the query is empty, or the search fails. A missing binary says `entire is not installed`.

Pocket agent

A routine is a saved use case at ~/.dora/harness/<slug>/. dora harness is the front desk. The Runtime runs the Loop. Today that Runtime is Hermes. Full flow: dora harness. dora harness new starts ask-dora / grilling-for-routine. After one good one-pass the grill may add a Fixed step. Human-visible messages end with Sent by pocket agent <slug>. Apply stamps that last line on the GitHub review and Slack post. A Run has no last chat. When the destination cannot tell, the night prompt uses a run handoff (handoff.md). boot is the apply alias. After apply, boot, list, pause, and resume, Dora prints Runtime watch commands. The family is ask-dora, review-with-dora, grilling-for-routine, and writing-for-routine.

Type this in the agent:

/ask-dora turn this loop-able check into a routine

Then use the CLI verbs:

dora harness
dora harness list
dora harness new
dora harness apply <slug>
dora harness apply <slug> --keep-copies
dora harness apply <slug> --from <path-or-url>
dora harness boot <slug>
dora harness show <slug>
dora harness models
dora harness logs <slug>
dora harness pause <slug>
dora harness resume <slug>
dora harness rm <slug>
dora harness open <slug>

Probe

dora probe --dry-run
dora probe --yes
dora probe --yes --json

Sends hello to doraval.dev and waits for ack. Needs identity.api_key. Stay logged in on /account and click ack within 60 seconds. A detected agent must pass --yes or --dry-run.

Exit 0 acked · 1 timeout or bad key · 2 no key or missing write flag.

Mint and store the key first: Connect the CLI.

Config

dora config                  # list keys
dora config setup            # Judge wizard
dora config get eval.model
dora config set eval.model gpt-4.1
dora config set eval.judge auto
dora config set identity.api_key <token> --yes

identity.api_key is the token from doraval.dev/account. A detected agent must pass --yes or --dry-run to set a secret. --deep needs a Judge. Do not paste API keys into chat.

Plugin bump

dora plugin bump patch
dora plugin bump minor ./plugins
dora plugin bump 1.2.3 --yes

Also bumps marketplace manifests. Who is installed is dora scan. Judge keys are dora config setup.

Update

dora update
dora update --check
dora update --via npm

Help map

dora --help                  # short first page
dora --help --json           # live map (read-only vs writes)
dora review --help           # one verb

Completions

dora --completion bash
dora --completion zsh
dora --completion fish

Common mistakes

Empty dora is --help, not Scan. Use dora scan for the workspace map.
dora new, dora sessions, dora rules, dora reconcile, dora bump, dora providers, and dora agent-help exit 2. Each prints a Next line with the new name.
dora conflicts applies with --yes. There is no --apply.
Judge keys live on dora config setup, not a providers command.
dora probe without identity.api_key exits 2. Mint the key on /account first.
Empty dora harness new starts ask-dora / grilling-for-routine. It does not write a routine folder.
Laptop close is host sleep, not dora harness pause. See dora harness.