You already solved this command once.

One entry covers every server, cluster, and client

kubectl logs -f {pod} -n {namespace} --tail={lines:number=200}
# Ignored by parser: ${PORT} (shell), {{.Names}} (Go template), {{port}} (literal)

Variables defined as blanks trigger interactive fill prompts upon copying across seven supported types (text, number, choice, path, url, boolean, secret). Reusing identifiers maps to a single prompt form. The parser strictly restricts fields to single-brace syntax, leaving shell variables and templates untouched.

Secret values are never written to the bin file

PGPASSWORD={dbpass:secret} pg_restore -h {host} -d {database}

Fields marked :secret construct the command payload during copy actions and are immediately discarded from memory, excluding them from bin persistence, usage logs, and exports. (Note: clipboard caching and default fallback values remain subject to OS behaviors).

The command, and everything you knew about it

What it does  Load a .dump into an existing database
Prerequisites  Target database must exist and be empty
Example usage  the real invocation, not a synopsis
Notes  anything that bit you the first time

Every entry carries a description, prerequisites, a real example, notes, a shell, and a platform — all searchable alongside the command text. Description and example are weighted differently by the search, which is why they are separate fields rather than one long box.

A destructive marker that admits what it is

Marked destructive  Deletes named volumes too. Any database
 running in Docker loses its data.

You tick a box in the editor and write a note in your own words. From then on the note sits above the command every time you open it. There is no detector, no pattern list, and no rescan on save, so there is exactly one source for that flag: you.

Which cuts both ways, and the app says so where the marker appears. An unmarked command has not been checked and found harmless. It has not been checked at all. Nothing in cmdbin reads command text and forms an opinion about it.

Find it however you happen to remember it

k8s  →  finds everything tagged kubernetes
docekr  →  finds docker, through the fuzzy fallback
--force-with-lease  →  matched whole, not split at the dashes
Clients / Northwind  →  nested projects, still in global search

Four stages: recall by weighted token match unioned with trigram substring match, a structural filter, a fuzzy rescore, then a blended score. Recall is OR rather than AND, so "see running containers" doesn't require the word "see" to appear anywhere. When recall comes up empty the search falls back to a bounded scan and lets the fuzzy cutoff do the filtering, which is how a typo like docekr still lands.

The tokenizer keeps - _ . : / @ inside tokens, so docker-compose and node_modules survive whole. Ranking decays on a fourteen-day half-life, and it decays when read as well as when written — a score that only decays when you touch it leaves stale entries sitting at the top.

Your bin is a file, and import can't damage it

~/.cmdbin/bin.json
Import: 14 added, 5 skipped — nothing modified, nothing replaced

Import only ever adds. It cannot modify, replace, or delete a command already in your bin, and there is no flag that makes it. An incoming entry is skipped if its UUID is already present, or if its command text hashes to something already in the same project. Re-import last week's export and you get nothing new; if you edited one of those commands since, your edit stands.

Import runs in two steps. The file is summarized first — projects, tags, counts, with nothing written — and that summary becomes the filter list, so you can take a colleague's whole bin and pull in only their Kubernetes commands. Export mirrors it: project and tag checkboxes, a live "N of M commands" count, and toggles for sub-projects, ALL-versus-ANY tag matching, favorites only, and whether usage statistics travel with it.

The same bin on your phone, without a server

Share on this network  →  https://192.168.1.24:7718
Then enter this PIN  →  418 302

Flip the switch in the header and a second listener starts on your local network over TLS, using a certificate the machine generates for itself. Your phone opens the address, accepts the certificate warning once, enters the six-digit PIN, and is looking at the same bin. Ten wrong guesses locks pairing until you reset it.

Off means no listener exists, not a listener refusing connections. Turning sharing off stops it and ends every paired session, so switching it back on doesn't silently re-admit a device you disconnected. The certificate is self-signed, which defeats passive listening on the network and does not defeat someone already positioned to intercept traffic between your two devices.

Point a feed reader at this URL

New cmdbin versions and any change to the published checksums go out here, along with the occasional note. If you verify a hash before you run a binary, this is how you find out there is a new one to verify.

No signup, no email address, no confirmation link, no per-reader link. We can count how many machines ask for the file. We cannot tell which one is you, and there is nothing to unsubscribe from — you remove it in your own reader and we never find out.