Integrations and analysis

GitHub sync, strategic initiatives, UI evaluation, security auditing and codebase mapping.

Command	Arguments	What it does
`/devflow:gh-sync`	`[objectives\|release <tag>\|status\|<objective_id>]`	Sync DevFlow planning state to GitHub — create/update objective issues, generate release notes, or push a single objective's state (body + sticky comment + Project v2 fields).
`/devflow:initiatives`	`[sync [--initiative <slug>] [--project-id <id>] [--force]] \| [list [--home <path>]] \| [show <slug>]`	Manage strategic initiative context — sync GitHub Epics to disk, list cached initiatives, or show a single initiative body. Planner reads these at plan time.
`/devflow:ui-eval`	`[objective number or manifest path]`	Run the UI visual-evaluation pipeline on a Flutter surface or objective: capture each declared UI state, score it through the offline visual-eval engine, and write machine-judged evidence the verifier consumes.
`/devflow:security-audit`	`[optional: path scope like 'src/api' or focus filter like 'secrets-only', 'auth-only', 'deps-only']`	Scan the codebase for security vulnerabilities — checks for secrets, auth flaws, dependency risks, and OWASP Top 10 issues.
`/devflow:map-codebase`	`[optional: specific area to map, e.g., 'api' or 'auth']`	Analyze an existing codebase to understand its stack, architecture, conventions, and concerns before starting new work.

/devflow:gh-sync

Pushes planning state to GitHub. One-way: planning files stay authoritative, GitHub is derivative.

/devflow:gh-sync status              # is the integration reachable?
/devflow:gh-sync objectives          # create/update one issue per objective
/devflow:gh-sync release v2.5.0      # generate release notes from SUMMARY files
/devflow:gh-sync 4                   # push one objective's full state

Opt in via .planning/config.json:

{
  "github": {
    "enabled": true,
    "repo": "owner/name",
    "milestone_prefix": "v",
    "labels": {
      "objective": "devflow:objective",
      "in_progress": "devflow:in-progress",
      "gaps": "devflow:gaps"
    }
  }
}

Requires the gh CLI, authenticated. Every operation is a no-op when the integration is disabled, gh is missing, or auth expired — failures never block your workflow. Full detail in the GitHub integration guide.

/devflow:initiatives

Syncs GitHub Epics into local strategic context that the planner reads at plan time.

/devflow:initiatives sync
/devflow:initiatives sync --initiative payments-v2 --force
/devflow:initiatives list
/devflow:initiatives show payments-v2

The point is grounding: an objective planned with the parent initiative in context makes different trade-offs than one planned in isolation.

/devflow:ui-eval

Machine-judges the visual correctness of UI states.

/devflow:ui-eval 6
/devflow:ui-eval path/to/manifest.json

The ui-evaluator agent captures every declared UI surface, scores each through the offline visual-eval engine, and writes evidence the verifier consumes. It is not “take a screenshot and hope” — the scores are machine-produced and the verifier gates on them.

See the UI evaluation guide.

/devflow:security-audit

/devflow:security-audit
/devflow:security-audit src/api
/devflow:security-audit secrets-only
/devflow:security-audit auth-only
/devflow:security-audit deps-only

Standalone — works without .planning/. Fans out security-auditor agents across three domains (secrets, auth flows, dependency risk) plus code-level OWASP Top 10 checks.

Every finding carries Confidence: VERIFIED | SUSPECTED. Only VERIFIED findings are acted on downstream, because an agent that speculates confidently produces remediation work for imaginary problems.

/devflow:map-codebase

/devflow:map-codebase
/devflow:map-codebase api

Parallel codebase-mapper agents analyse stack, architecture, quality and concerns, writing findings to .planning/codebase/. Run this before /devflow:new-project on an existing codebase so the roadmap is grounded in what exists. Same VERIFIED / SUSPECTED confidence tagging as the security audit.