Commands

Command	What it does
anvil init [url] [--dir] [-p …] [--no-apply]	Full clone (or reuse if origin matches), scaffold if missing, write local config, show plan, confirm then apply
anvil sync [--pull-only]	git pull --rebase --autostash, then apply
anvil apply [-p …] [--packages] [--harden] [--aur-helper]	Plan, link files, optional packages/harden
anvil add <path> [-p profile]	Journal dest, copy into repo, link back, append anvil.toml
anvil status [-p …]	Linked / pending / conflict / broken, packages, harden
anvil doctor	git, manifest, symlink health, AUR helper, secrets, harden
anvil undo [--list] [--id]	Restore a backup journal (latest active, or a specific id)

The default command when none is given is status.

anvil apply --dry-run output:

  Profile: base
  Repo:    /home/you/.dotfiles
  FILES     3 to link, 1 ok, 0 conflict, 0 broken
  AUR helper: paru
  [link] .zshrc → ~/.zshrc
  ✓ Dry-run complete (no changes made)

Global flags

Flag	Meaning
-y, --yes	Accept prompt defaults; does not force overwrites
--force	Overwrite conflicts (after backup). Required for destructive apply
--dry-run	Show plan only
-q, --quiet	Errors only (also when stdout is not a TTY)

Safety model

1. --yes is not --force. Under -y, file conflicts are skipped unless --force.
2. Journal before mutate. Each overwrite writes journal.json immediately under ~/.local/state/anvil/backups/<id>/. Empty applies do not leave a journal. Restored journals are marked restored and skipped by undo unless you pass --id.
3. Hooks cannot be undone. Dry-run lists them; interactive apply confirms; -y still prints the warning. Hooks are repo-relative only (no .., no absolute paths).
4. Packages installed this run are recorded on the same journal. anvil undo restores files, then asks (default No) to sudo pacman -R those names. --yes does not uninstall; --force does. anvil never runs anzen remove.
5. Harden enforce only happens when harden.mode = "enforce" and you pass --harden. The sysctl drop-in is journaled before write. SSH and firewall stay check-only.
6. Prefer anvil apply --dry-run before the first apply on a real home directory.