sdods users, tokens, schedule, integrations

usersCopy Anchor Link

sdods users create --username <name> --password <password> [--admin] [--role viewer|editor|admin] [--email <email>] [--org-owner]
sdods users list
sdods users set-role <username> <viewer|editor|admin>
sdods users grant <username> --org <slug> --role owner|admin|member
sdods users grant <username> --workspace <slug> --role admin|editor|viewer
sdods users deactivate <username>
sdods users set-password <username> --password <password> [--activate]
sdods users reset --yes

--admin creates a platform admin who also becomes owner of every organization without an owner. grant manages membership roles; a user's effective role in a workspace is the stronger of the explicit workspace role and the one implied by the organization role (member → viewer, admin/owner → admin).

deactivate takes effect immediately: the account can no longer sign in, and sessions and API tokens it already holds stop working on the next request — a browser with the app open is returned to the login screen rather than left on a stale page. Single accounts are never deleted: deactivated accounts stay in users list with active false, so the audit trail keeps pointing at a real user.

set-password replaces the password and signs the user out of every browser; --activate also re-enables a deactivated account, which is how a sole admin gets back in. reset --yes is the deliberate wipe: it removes every user with their sessions, API tokens and memberships, and keeps organizations, workspaces, projects, runs and schedules. With no users left, the next sdods serve prints a one-time /setup link. Both are recorded in the audit log. See Reinstall or reset.

Every one of these commands resolves the platform database from the workspace root, so they can be run from any directory inside the workspace and always reach the same database the server uses.

tokensCopy Anchor Link

sdods tokens create --user <username> --name <label> [--scopes <list>] [--expires <days>]
sdods tokens list [--user <username>]
sdods tokens revoke <id>

Tokens are free, unlimited, scoped and revocable. create prints the value once; scopes default to every scope of the owner's role and may only be a subset of it. Tokens authenticate MCP over HTTP and CI ingest. revoke reports whether it actually revoked anything: an unknown id, or one already revoked, is a warning rather than a success, so revoking a leaked token cannot be silently mistaken for done.

scheduleCopy Anchor Link

sdods schedule add -p <slug> --name <name> --cron <expr> [--tz <timezone>] [-e <env>] [-t <expr>] [-l <layer>]... [-b <browser>]...
                     [--process <name>] [--overlap skip|queue|cancel-previous] [--jitter <seconds>] [--notify <list>] [--disabled]
sdods schedule list [-p <slug>]
sdods schedule next --cron <expr> [--tz <timezone>] [--count <n>]
sdods schedule pause|resume|remove <name> -p <slug>
sdods schedule run-now <name> -p <slug>
sdods schedule history <name> -p <slug>
sdods schedule sync
sdods schedule install --target crontab|launchd|systemd|github [-p <slug>] [--out <dir>]
sdods schedule export

Schedules live in the project YAML (schedules[] and processes with a schedule) and in the database; sync mirrors YAML into the database, the server executes them, and install writes OS or GitHub Actions entries for server-less setups.

integrationsCopy Anchor Link

sdods integrations test -p <slug> [--provider github|jira] [--create-labels]
sdods integrations notify --run-id <id> [-p <slug>] [--from-files] [--provider <name>] [--dry-run] [--report-url <url>] [--artifacts-dir <dir>]
sdods integrations sync -p <slug> [--provider <name>]
sdods integrations links -p <slug> [--provider <name>]
sdods integrations evidence prune -p <slug> [--older-than <age>] [--dry-run]

test checks credentials and reachability; for GitHub it also checks that every configured label exists in the repository, failing with the missing names, and --create-labels creates them (needs issues: write). notify publishes a run to the enabled providers (GitHub check run and PR comment, GitHub or Jira issues deduplicated by scenario fingerprint); sdods run does the same at the end of a run unless --no-notify is passed. --from-files builds the summary from the run directory so it works without a database. sync scans features for @jira:KEY and @github:N tags, creates links and refreshes their status. With integrations.github.evidence.host: branch, test also checks that the token can push to the evidence repository, and evidence prune rewrites the evidence branch without the runs uploaded more than --older-than ago (90min, 36h, 14d, 2w; a bare number is days; m is refused as ambiguous; default evidence.retainDays). See Evidence that renders in private repositories.