@hlix/cli 0.7.1 → 0.8.0

package/LICENSE

@@ -1,5 +1,5 @@
 Hlix Code and the hlix CLI
-Copyright (c) 2026 hlix.ai. All rights reserved.
+Copyright (c) 2026 Hlix, Inc. All rights reserved.
 
 This software is proprietary. It is distributed in compiled form so that you
 can install and run it.

package/README.md

@@ -42,12 +42,20 @@ hlix --help          # the commands
 hlix                 # open Hlix Code
 ```
 
+`hlix` runs as one self-contained executable: npm installs the one for your
+platform (`@hlix/cli-darwin-arm64`, `-darwin-x64`, `-linux-x64` or
+`-linux-arm64`) and `hlix` runs it directly. Where there is none (Windows,
+musl-based Linux, `--omit=optional`) the Node build in this package runs
+instead, after one line on stderr. Without npm,
+`curl -fsSL https://staging.hlix.ai/install.sh | bash` installs the same
+executable, and so does `brew install hlix-ai/tap/hlix`.
+
 For CI, and for anything else that must not change underneath you, pin the
 version instead of floating to `latest`:
 
 ```bash
-npm install --global @hlix/cli@0.7.1
-npx @hlix/cli@0.7.1 status --json
+npm install --global @hlix/cli@0.8.0
+npx @hlix/cli@0.8.0 status --json
 ```
 
 ## Authenticate
@@ -102,26 +110,19 @@ hlix status [--json]
 hlix init [folder] [--project <id>] [--json]
 hlix terminal [project-id] [--print] [--web] [--json]
 hlix import [folder] [--dry-run] [--env-file <path>] [--history preserve] [--yes]
-hlix push [--dry-run]  |  hlix pull [--force] [--yes] [--dry-run]  |  hlix sync [--dry-run]
+hlix push [--dry-run]  |  hlix pull [--dry-run]  |  hlix sync [--dry-run]
 hlix projects list [--json]
 hlix projects get [project-id] [--json]
 hlix tasks list [--project <id>] [--status <status>] [--json]
 hlix tasks get <id> [--json]
 hlix tasks review <id> [--json]
-hlix tasks watch <id>          # follows the task's status stream over SSE
+hlix tasks watch <id>          # follows the task's live status until it is over
 ```
 
 `--dry-run` on `push`, `pull` and `sync` prints the divergence and the verdict
-the real command would reach, and changes nothing. `pull --force` replaces local
-files, so it asks first; `--yes` is the documented script bypass.
+the real command would reach, and changes nothing. Sync refuses simultaneous local and remote changes.
 
-`hlix import .` scans the selected root, builds a temporary Git bundle without
-mutating the source repository, uploads it resumably, restores it into the
-project's Coding Workspace, and records the initial immutable revision. Dotenv
-values never enter the bundle: choose one file with `--env-file`, review the
-key-only dry-run, and approve with `--yes`. Agent instructions, skills, and MCP
-configuration are quarantined for separate review instead of being executed
-during import.
+`hlix import .` scans the selected root and pushes source files into **HLIX Repos** through Git. It keeps the local repository and its origin intact. `--history preserve` retains scanned source history; incomplete scans or secret findings require review or `--history sanitize`. Protected files move through the encrypted secrets channel. File browsing does not start the project's Coding Workspace.
 
 ## Hlix Code
 
@@ -136,23 +137,23 @@ hlix -p "what does this repo do" --json # JSONL events instead of prose
 
 Inside the shell:
 
-| | |
-| --- | --- |
-| `/help` | every command this build knows |
-| `/model` | pick the model, from what your workspace serves |
-| `/harness` | pick which coder does the work |
-| `/sandbox` | pick where this session's files and commands run |
-| `/rules` | which rules files the agent loaded, and how big they are |
-| `/standards` | what this folder gave the agent, and which MCP servers connected |
-| `/yolo` | run without being asked for approval — toggles |
-| `/log` | what this session's libraries logged, which the screen never shows |
+|                                           |                                                                                          |
+| ----------------------------------------- | ---------------------------------------------------------------------------------------- |
+| `/help`                                   | every command this build knows                                                           |
+| `/model`                                  | pick the model, from what your workspace serves                                          |
+| `/harness`                                | pick which coder does the work                                                           |
+| `/sandbox`                                | pick where this session's files and commands run                                         |
+| `/rules`                                  | which rules files the agent loaded, and how big they are                                 |
+| `/standards`                              | what this folder gave the agent, and which MCP servers connected                         |
+| `/yolo`                                   | run without being asked for approval — toggles                                           |
+| `/log`                                    | what this session's libraries logged, which the screen never shows                       |
 | `/new`, `/threads`, `/resume`, `/compact` | start a conversation, list this project's, pick an earlier one, condense one into memory |
-| `/<any hlix command>` | `/status`, `/tasks-list`, `/push` — the CLI, inline, as its own panel |
-| `/<your own>` | every `.md` file in `.claude/commands` or `.hlix/commands` |
-| ⇧Tab | switch between `build` and `plan` |
-| Ctrl-O | expand the newest tool, command or subagent panel |
-| ESC | stop the turn that is running |
-| Ctrl-C twice | leave |
+| `/<any hlix command>`                     | `/status`, `/tasks-list`, `/push` — the CLI, inline, as its own panel                    |
+| `/<your own>`                             | every `.md` file in `.claude/commands` or `.hlix/commands`                               |
+| ⇧Tab                                      | switch between `build` and `plan`                                                        |
+| Ctrl-O                                    | expand the newest tool, command or subagent panel                                        |
+| ESC                                       | stop the turn that is running                                                            |
+| Ctrl-C twice                              | leave                                                                                    |
 
 A tool that changes something asks first, as a block above the prompt: allow
 once, decline with a reason, or allow that family for the rest of the session.
@@ -217,9 +218,17 @@ rather than writing a secret into the file.
 {
   "schemaVersion": 1,
   "providers": [
-    { "name": "lab", "url": "http://localhost:1234/v1", "models": ["qwen3-coder"] },
-    { "name": "acme", "url": "https://api.acme.test/v1", "models": ["acme-coder"],
-      "apiKeyEnv": "ACME_API_KEY" }
+    {
+      "name": "lab",
+      "url": "http://localhost:1234/v1",
+      "models": ["qwen3-coder"]
+    },
+    {
+      "name": "acme",
+      "url": "https://api.acme.test/v1",
+      "models": ["acme-coder"],
+      "apiKeyEnv": "ACME_API_KEY"
+    }
   ]
 }
 ```
@@ -245,9 +254,9 @@ always being 1.
 
 - **No execution commands.** Dispatching a run from a dropped connection can
   duplicate work, and the commands to do so are not part of this surface.
-- **No `tasks logs --follow`.** There is no log *stream* on the API — only plain
+- **No `tasks logs --follow`.** There is no log _stream_ on the API — only plain
   reads — so a `--follow` here would be a poll dressed up as a stream. Use
-  `hlix tasks watch` for the real status stream instead.
+  `hlix tasks watch` for the task's live status instead.
 - **No retries on non-idempotent verbs.** A retried POST is a duplicated
   request; the SDK refuses it and this CLI inherits that.
 

package/THIRD_PARTY_NOTICES

@@ -15,7 +15,7 @@ does not carry that entry can reproduce for it, and for a compiled binary it is
 also its own. Where such an entry ships a licence of its OWN, that text is kept
 with this generator instead and the entry is listed under it.
 
-Packages (271)
+Packages (270)
 --------------
 
   @a2a-js/sdk (Apache-2.0)
@@ -261,7 +261,6 @@ Packages (271)
   tar-stream (MIT)
   teex (MIT)
   text-decoder (Apache-2.0)
-  tokenx (MIT)
   trough (MIT)
   tslib (0BSD)
   tweetnacl (Unlicense)
@@ -5148,32 +5147,6 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 
-==============================================================================
-tokenx (MIT)
-==============================================================================
-
-MIT License
-
-Copyright (c) 2023-PRESENT Johann Schopplich
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
 ==============================================================================
 trough (MIT)
 ==============================================================================

package/bin/hlix

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+// `hlix` as npm installs it. After a normal install the postinstall
+// (install.cjs) has replaced this file with the standalone binary itself, so
+// this only runs when that did not happen: scripts off (--ignore-scripts, pnpm)
+// runs the platform package's binary from here; no platform package
+// (--omit=optional, an unsupported platform) runs the Node build, after one line.
+import { spawn } from "node:child_process"
+import { createRequire } from "node:module"
+import { fileURLToPath } from "node:url"
+
+const { nativeBinary } = createRequire(import.meta.url)("../install.cjs")
+const found = nativeBinary()
+let command = found.binary
+let args = process.argv.slice(2)
+if (!command) {
+  process.stderr.write(`hlix: using the Node build (${found.reason})\n`)
+  command = process.execPath
+  args = [fileURLToPath(new URL("../dist/index.js", import.meta.url)), ...args]
+}
+
+// This copy is the one a person installed; the binary runs from the platform
+// package, so it is told which path to report (hlix status).
+// The terminal signals the whole process group; a signal sent to this
+// process alone (a supervisor, `kill`) is passed on instead of orphaning it.
+const forward = (signal) => child.kill(signal)
+const signals = ["SIGINT", "SIGTERM", "SIGHUP"]
+for (const signal of signals) process.on(signal, forward)
+const child = spawn(command, args, { stdio: "inherit", env: { ...process.env, HLIX_SELF: process.argv[1] } })
+child.on("error", (error) => {
+  process.stderr.write(`hlix: ${command}: ${error.message}\n`)
+  process.exit(1)
+})
+child.on("exit", (code, signal) => {
+  for (const name of signals) process.off(name, forward)
+  if (signal) process.kill(process.pid, signal)
+  else process.exit(code ?? 1)
+})