@hlix/cli 0.6.0 → 0.7.0

package/dist/package-d2qfdjga.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+var s="@hlix/cli",i="0.7.0",n="SEE LICENSE IN LICENSE",a="Hlix Code and the hlix control-plane CLI.",r=["hlix","cli","agents"],l="https://hlix.ai",p="module",o="./dist/index.js",c={hlix:"./dist/index.js"},d=["dist","skills","LICENSE","THIRD_PARTY_NOTICES"],u={node:">=22.19.0"},m={access:"public"},b={build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --splitting --packages external --minify --banner '#!/usr/bin/env node'",test:'bun test src --path-ignore-patterns "**/*.integration.test.ts" --timeout 20000',typecheck:"tsc --noEmit",prepublishOnly:"bun run typecheck && bun run build && bun run test","test:integration":"NODE_ENV=test bun run ../../apps/backend/scripts/with-aimock.ts -- bun run ../../apps/backend/scripts/with-test-db.ts -- bun test --isolate --preload ../../apps/backend/test/helpers/pool-lifecycle.ts --timeout 60000 .integration.test.ts"},h={"@earendil-works/pi-tui":"0.85.1","@mastra/acp":"^0.4.1","@mastra/core":"1.71.0","@mastra/docker":"^0.9.0","@mastra/libsql":"1.23.0","@mastra/mcp":"2.1.0","@mastra/memory":"1.30.0",ignore:"7.0.8","jsonc-parser":"3.3.1","openapi-fetch":"^0.17.0","smol-toml":"1.8.0",yaml:"2.9.0",zod:"4.5.4"},g={"@hlix/sdk":"^0.2.0","@hlix/shared":"*","@types/bun":"latest",typescript:"^7.0.2"},k={name:s,version:i,license:n,description:a,keywords:r,homepage:l,type:p,main:o,bin:c,files:d,engines:u,publishConfig:m,scripts:b,dependencies:h,devDependencies:g};export{c as bin,k as default,h as dependencies,a as description,g as devDependencies,u as engines,d as files,l as homepage,r as keywords,n as license,o as main,s as name,m as publishConfig,b as scripts,p as type,i as version};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hlix/cli",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Hlix Code and the hlix control-plane CLI.",
   "keywords": [
@@ -36,13 +36,16 @@
   "dependencies": {
     "@earendil-works/pi-tui": "0.85.1",
     "@mastra/acp": "^0.4.1",
-    "@mastra/core": "1.67.0",
-    "@mastra/docker": "^0.8.0",
+    "@mastra/core": "1.71.0",
+    "@mastra/docker": "^0.9.0",
     "@mastra/libsql": "1.23.0",
-    "@mastra/mcp": "1.18.0",
+    "@mastra/mcp": "2.1.0",
     "@mastra/memory": "1.30.0",
     "ignore": "7.0.8",
+    "jsonc-parser": "3.3.1",
     "openapi-fetch": "^0.17.0",
+    "smol-toml": "1.8.0",
+    "yaml": "2.9.0",
     "zod": "4.5.4"
   },
   "devDependencies": {

package/skills/hlix/SKILL.md

@@ -187,9 +187,10 @@ hlix standards [--json]              # instruction files, skills, commands, MCP
 hlix rules [--edit] [--global] [--json]   # the rules files the coding agent reads; --edit opens one in $EDITOR
 hlix projects list [--json]          # projects in the workspace
 hlix projects get [project-id] [--json]
+hlix projects delete <id|name> [--yes] [--json]
 hlix init [folder] [--project <id>] [--json]   # create committed project configuration; --project binds an existing cloud project
 hlix terminal [project-id] [--print] [--web] [--json]   # shell into the project's Coding Workspace (ssh here, or the browser terminal)
-hlix import [folder] [--dry-run] [--env-file <path>] [--history preserve] [--no-connect-origin] [--attach] [--yes] [--json]
+hlix import [folder] [--dry-run] [--env-file <path>] [--history preserve|sanitize] [--include <path>] [--no-connect-origin] [--attach] [--yes] [--json]
 hlix sync [--dry-run] [--json]       # push or pull when only one side changed
 hlix pull [--force] [--yes] [--dry-run] [--json]
 hlix push [--dry-run] [--json]       # compare-and-swap a new immutable revision
@@ -223,14 +224,24 @@ agent/skill/MCP resources, and Git-history findings, but never secret values.
 Hlix collects every project-local dotenv and credential file. It applies the
 standard development dotenv precedence automatically and preserves every other
 profile encrypted; `--env-file` is an explicit override.
-The default history policy aborts on possible historical secrets. Explicit
-`--history preserve` keeps the full Git history after showing the risk. An
-example file (`.env.example` and its family) is never a finding, and a registry
-config such as `.npmrc` is one only when the committed blob held a real value
-rather than a `${VAR}` placeholder. A pattern matched inside a test, fixture or
-snapshot file, in documentation, on a line that defines a detector's own
-pattern, or whose value spells out that it is fake, is listed as a warning and
-does not block, so `--history preserve` is not the answer to it.
+Git history is preserved by default. Possible historical secrets are warnings,
+with at most five redacted commit-and-file findings. To leave old commits out,
+use `--history sanitize` to upload a current-tree snapshot without changing local Git history. `--history preserve`
+and the legacy `--history abort-on-findings` remain accepted; neither blocks on
+historical findings. Nested repositories and declared submodules import their
+working files without their own Git metadata or history. Ignored nested
+repositories are skipped silently.
+
+Ordinary files over the upload limit are skipped with a named hint. If needed, history is omitted, then the largest folders are skipped until the snapshot fits. Import, init, and push refresh a marked Hlix-managed block in `.hlixignore` from shared stack detection and verified local generated paths. Personal lines outside the block are preserved byte-for-byte; `!` overrides outside the block take precedence even above it. Automatic rules never cover tracked files or secrets. Declared tools identify untracked build output without generation comments: Vite literal build.outDir or dist, Next .next (plus out for a default static export), Nuxt .nuxt/.output, Astro dist, Turbo .turbo, TypeScript literal tsconfig outDir, Webpack/Parcel dist defaults, and Rollup configured output.dir. Python build/dist/egg-info needs a declared build backend. Resolve output paths per package and configured root, applying recognized build-command output flags first. Unresolved root/config/CLI overrides disable inference for that tool rather than reverting to a default; configuration code is never executed. Track authored files in declared output directories or use ! overrides to keep them visible. Composer vendor requires a valid lockfile; local path dependencies stay visible. Untracked agent scratch and external nested repos are eligible only when they are not project source. Unknown paths stay visible. A refresh removes broad rules for folders that acquired tracked files or secrets; source outside declared build outputs stays visible. Human output adds one line: `Hlix ignored 6 generated folders — see .hlixignore`. Dry runs do not refresh files, and linked ignore targets or malformed blocks are left untouched. Folders with a managed block use these rules instead of blanket generated-directory exclusions. `--include <path>` restores one ignored path and persists it for later push/sync scans, subject to upload limits; it never includes Git metadata or bypasses secret protection. Push leaves the cloud unchanged when skipping would remove an existing cloud file. Symlinked `.hlixignore` files are read from their targets; an unreadable target leaves uploads unchanged with a permission warning.
+
+Never delete .git folders or files to get past this; use .hlixignore instead.
+
+The human scan report is ordered: uploaded / skipped / secrets / warnings /
+blocked. The secrets line says files move encrypted. Protected working-tree files are named individually; their values are
+never printed. The JSON dry run retains the full environment and file report.
+The upload manifest summarizes skip lists longer than 5,000 entries; local
+reports and push protection retain every skipped path.
+
 Current environment values are sent only in the authenticated finalization
 request and stored encrypted; they are never placed in the Git bundle.
 
@@ -271,8 +282,7 @@ the project already has cloud files, `hlix pull` brings them down and becomes
 that base. If it has none — a project created in the dashboard — `hlix push`
 (or `hlix sync`) uploads the folder as revision 1 and builds the project's
 Coding Workspace from it. Only a project with no revision at all can be
-bootstrapped that way: a second bootstrap push exits `conflict`, and so does a
-folder with no base whose project does have a revision (pull first). `hlix
+bootstrapped that way: if the cloud already has a revision but this folder has no base, push leaves both copies unchanged and reports that it needs a pull first. `hlix
 pull` on a project with no cloud files exits `not_found` and names the way
 forward.
 
@@ -326,7 +336,7 @@ Branch on `error.code`, never on `error.message`. Codes: `unauthenticated`,
 `forbidden`, `not_found`, `conflict`, `invalid_request`, `bad_request`,
 `rate_limited`, `not_implemented`, `server_error`, `unreachable`,
 `missing_argument`, `invalid_usage`, `approval_required`, `cancelled`, `unknown_command`,
-`workspace_mismatch`, `not_initialized`, `scan_blocked`, `already_imported`,
+`workspace_mismatch`, `not_initialized`, `scan_blocked`,
 `workspace_required`, `invalid_base_url`, `missing_credential`, `unknown`.
 
 That list is the complete set — `skill.test.ts` compares it against every code
@@ -391,3 +401,23 @@ of yours.
 - **No `tasks logs`.** The log endpoint is not part of the published API
   contract, and there is no log stream to follow. `tasks watch` streams task
   *status*, which is a different thing and is named accordingly.
+
+### Import recovery and project deletion
+
+An interrupted import resumes the saved session in `.hlix/import.json` on the
+next `hlix import` in that folder. Keep that file and `.hlix/import.bundle`
+until it succeeds. A finalize timeout polls the same import for up to ten
+minutes; rerun the command if the wait ends. Secret values are re-read from
+local files only if finalization has not started. Restore changed files before
+resuming an upload; completed imports bind without rescanning. If the server
+confirms an unfinished session has expired, the CLI discards its saved recovery
+files, reports it, and starts a fresh import. A completed or still-finalizing
+session is never replaced just because its upload deadline passed.
+
+`hlix projects delete <id|name>` prints the selected project's name
+before deleting it. Names must match exactly and be unique; otherwise use the
+ID. Interactive deletion asks for confirmation. Non-interactive deletion,
+`--json`, and deletion of this folder's bound project require `--yes`.
+Deletion removes the cloud project; local files are kept.
+
+`push --dry-run` reports conflicts with exit 0 and makes no changes. The nonzero conflict verdict described above applies to `pull` and `sync`. Missing local push bindings and unreadable import recovery records likewise produce explicit no-op reports; no replacement project or upload is created.