@hlix/cli 1.0.4 → 1.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +40 -36
- package/THIRD_PARTY_NOTICES +1 -274
- package/dist/index-c5avvnm2.js +410 -0
- package/dist/index.js +2 -5
- package/dist/main-z66m02gb.js +211 -0
- package/dist/{package-vwz9740v.js → package-6n7j36nb.js} +1 -1
- package/package.json +7 -7
- package/skills/hlix/SKILL.md +56 -23
- package/dist/index-bbaj05dk.js +0 -407
- package/dist/main-8zgerqpj.js +0 -206
|
@@ -1,2 +1,2 @@
|
|
|
1
1
|
#!/usr/bin/env node
|
|
2
|
-
var e="@hlix/cli",i="1.0
|
|
2
|
+
var e="@hlix/cli",i="1.2.0",n="SEE LICENSE IN LICENSE",r="Hlix Code and the hlix control-plane CLI.",a=["hlix","cli","agents"],l="https://hlix.ai",p="module",o="./dist/index.js",b={hlix:"./bin/hlix"},c=["bin","install.cjs","dist","skills","LICENSE","THIRD_PARTY_NOTICES"],u={node:">=22.19.0"},d={access:"public"},m={build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --splitting --packages external --minify --banner '#!/usr/bin/env node'",test:'bun test src --path-ignore-patterns "**/*.integration.test.ts" --timeout 20000',typecheck:"tsc --noEmit",prepublishOnly:"bun run typecheck && bun run build && bun run test","test:integration":"NODE_ENV=test bun run ../../apps/backend/scripts/with-aimock.ts -- bun run ../../apps/backend/scripts/with-test-db.ts -- bun test --isolate --preload ../../apps/backend/test/helpers/pool-lifecycle.ts --timeout 60000 .integration.test.ts","build:binary":"bun run scripts/build-binary.ts","test:binary":"bun run build:binary && HLIX_TEST_BINARY=dist-native/hlix bun test src/__tests__/binary.test.ts --timeout 60000 && bun run scripts/smoke-binary.ts","test:integration:binary":"bun run build:binary && HLIX_TEST_BINARY=dist-native/hlix NODE_ENV=test bun run ../../apps/backend/scripts/with-aimock.ts -- bun run ../../apps/backend/scripts/with-test-db.ts -- bun test --isolate --preload ../../apps/backend/test/helpers/pool-lifecycle.ts --timeout 60000 src/__tests__/auth.integration.test.ts"},h={"@agentclientprotocol/sdk":"1.8.0","@earendil-works/pi-tui":"1.3.0","@mastra/acp":"^0.4.2","@mastra/core":"1.79.0","@mastra/docker":"^0.11.0","@mastra/libsql":"1.26.2","@mastra/mcp":"2.4.1","@mastra/memory":"1.38.0","dinero.js":"2.0.2",ignore:"7.0.12","jsonc-parser":"3.3.1","openapi-fetch":"^0.17.0","smol-toml":"1.9.1",yaml:"2.9.1",zod:"4.6.7"},y={"@hlix/sdk":"^2.1.0","@hlix/shared":"*","@types/bun":"latest",typescript:"^7.0.2"},k={name:e,version:i,license:n,description:r,keywords:a,homepage:l,type:p,main:o,bin:b,files:c,engines:u,publishConfig:d,scripts:m,dependencies:h,devDependencies:y};export{b as bin,k as default,h as dependencies,r as description,y as devDependencies,u as engines,c as files,l as homepage,a as keywords,n as license,o as main,e as name,d as publishConfig,m as scripts,p as type,i as version};
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@hlix/cli",
|
|
3
|
-
"version": "1.0
|
|
3
|
+
"version": "1.2.0",
|
|
4
4
|
"license": "SEE LICENSE IN LICENSE",
|
|
5
5
|
"description": "Hlix Code and the hlix control-plane CLI.",
|
|
6
6
|
"keywords": [
|
|
@@ -43,7 +43,7 @@
|
|
|
43
43
|
"@agentclientprotocol/sdk": "1.8.0",
|
|
44
44
|
"@earendil-works/pi-tui": "1.3.0",
|
|
45
45
|
"@mastra/acp": "^0.4.2",
|
|
46
|
-
"@mastra/core": "1.
|
|
46
|
+
"@mastra/core": "1.79.0",
|
|
47
47
|
"@mastra/docker": "^0.11.0",
|
|
48
48
|
"@mastra/libsql": "1.26.2",
|
|
49
49
|
"@mastra/mcp": "2.4.1",
|
|
@@ -57,15 +57,15 @@
|
|
|
57
57
|
"zod": "4.6.7"
|
|
58
58
|
},
|
|
59
59
|
"devDependencies": {
|
|
60
|
-
"@hlix/sdk": "^1.0
|
|
60
|
+
"@hlix/sdk": "^2.1.0",
|
|
61
61
|
"@hlix/shared": "*",
|
|
62
62
|
"@types/bun": "latest",
|
|
63
63
|
"typescript": "^7.0.2"
|
|
64
64
|
},
|
|
65
65
|
"optionalDependencies": {
|
|
66
|
-
"@hlix/cli-darwin-arm64": "1.0
|
|
67
|
-
"@hlix/cli-darwin-x64": "1.0
|
|
68
|
-
"@hlix/cli-linux-x64": "1.0
|
|
69
|
-
"@hlix/cli-linux-arm64": "1.0
|
|
66
|
+
"@hlix/cli-darwin-arm64": "1.2.0",
|
|
67
|
+
"@hlix/cli-darwin-x64": "1.2.0",
|
|
68
|
+
"@hlix/cli-linux-x64": "1.2.0",
|
|
69
|
+
"@hlix/cli-linux-arm64": "1.2.0"
|
|
70
70
|
}
|
|
71
71
|
}
|
package/skills/hlix/SKILL.md
CHANGED
|
@@ -12,29 +12,49 @@ if they disagree, so this file cannot advertise something that does not exist.
|
|
|
12
12
|
## Authentication
|
|
13
13
|
|
|
14
14
|
```bash
|
|
15
|
-
hlix auth login [--workspace <id>] [--base-url <url>]
|
|
15
|
+
hlix auth login [--workspace <id>] [--base-url <url>] [--api-key]
|
|
16
|
+
hlix login # the same as hlix auth login
|
|
16
17
|
hlix auth status [--json] # which credential, from where, does it work
|
|
17
18
|
hlix auth logout [--yes] [--json] # remove the stored credential file
|
|
19
|
+
hlix logout # the same as hlix auth logout
|
|
18
20
|
```
|
|
19
21
|
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
22
|
+
Login opens your browser: it prints a verification URL and a one-time code,
|
|
23
|
+
opens the page, and waits while you approve the code there (signed in with
|
|
24
|
+
Google, GitHub, a passkey or a password). The session token that comes back is
|
|
25
|
+
verified against the API **before** it is stored, then written atomically to
|
|
26
|
+
`~/.config/hlix/credentials.json` with mode 0600. It is never printed back.
|
|
27
|
+
Denying the code in the browser exits `login_denied`; letting it run out exits
|
|
28
|
+
`login_expired`; a server that will not start the login exits `login_failed`.
|
|
29
|
+
A browser login needs a person at a terminal: without one (`--json`, a pipe,
|
|
30
|
+
CI) it exits `missing_credential` at once instead of waiting.
|
|
31
|
+
|
|
32
|
+
`--api-key` signs in with an API key instead. The key is read from a hidden
|
|
33
|
+
prompt at a terminal, or from stdin when piped
|
|
34
|
+
(`printf %s "$KEY" | hlix auth login --api-key`); a key given as an argument
|
|
35
|
+
value is refused before anything runs.
|
|
23
36
|
|
|
24
37
|
`HLIX_API_KEY` overrides the stored file; `HLIX_BASE_URL` and
|
|
25
38
|
`HLIX_WORKSPACE_ID` set the target and workspace. Use those in CI rather than
|
|
26
39
|
running a login step.
|
|
27
40
|
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
41
|
+
Every command that talks to the API checks for a credential **before** it does
|
|
42
|
+
any work. At a terminal with none stored, it starts the browser login and then
|
|
43
|
+
carries on in the same run; without a terminal it exits `unauthenticated`
|
|
44
|
+
(exit code 3) straight away. `hlix import` also checks that the stored credential still works
|
|
45
|
+
before it scans the folder, and signs in again when it was rejected.
|
|
46
|
+
|
|
47
|
+
`--workspace` is **optional** at login. A credential authenticates a user and
|
|
48
|
+
names no workspace, so you sign in first and the credential is then used to
|
|
49
|
+
list the workspaces you belong to (`GET /v1/api/workspaces`, the one endpoint that
|
|
31
50
|
needs no `X-Organization-Id`). With exactly one, that one is used and named on
|
|
32
51
|
stderr; with several, a terminal gets a numbered list to pick from and a
|
|
33
52
|
non-interactive run (`--json`, or no TTY) exits `missing_argument` listing the
|
|
34
53
|
ids so it can be re-run with `--workspace`. A `--workspace` that is not one of
|
|
35
54
|
them exits `workspace_mismatch` naming the ones that are, instead of storing a
|
|
36
|
-
credential that 403s later. `hlix auth login` then verifies the
|
|
37
|
-
real call **before** writing it, so
|
|
55
|
+
credential that 403s later. `hlix auth login` then verifies the credential
|
|
56
|
+
against a real call **before** writing it, so one that does not work is never
|
|
57
|
+
stored.
|
|
38
58
|
|
|
39
59
|
`auth status` names the credential's **source** and probes it against the API.
|
|
40
60
|
`--json` reports it as `credentialSource`: `"file"` for the stored credential,
|
|
@@ -53,11 +73,18 @@ Every command resolves its workspace and API through one chain, highest first:
|
|
|
53
73
|
|
|
54
74
|
1. an explicit flag (`--workspace`, `--base-url`)
|
|
55
75
|
2. the `HLIX_*` environment
|
|
56
|
-
3. the nearest
|
|
76
|
+
3. the nearest `hlix.yml`, walking up from the working directory
|
|
57
77
|
4. the stored credential
|
|
58
78
|
5. the built-in default (`https://server.hlix.ai`)
|
|
59
79
|
|
|
60
|
-
The folder's binding
|
|
80
|
+
The folder's binding is the `hlix:` block in that file: workspace and project
|
|
81
|
+
id. `hlix.api` is optional. When it is absent, the folder uses
|
|
82
|
+
`https://server.hlix.ai`, and that host outranks the stored credential. `init`
|
|
83
|
+
and `import` write `hlix.api` only when the server is a different host. A file
|
|
84
|
+
that already names the production server keeps that line. Commands read
|
|
85
|
+
`hlix.yml` only. A folder that still has just `.hlix/config.json` is not bound;
|
|
86
|
+
`hlix init` copies that binding into `hlix.yml`. The binding outranks the
|
|
87
|
+
machine-wide credential: a folder
|
|
61
88
|
bound to workspace A is queried against workspace A even when the last login
|
|
62
89
|
named workspace B. A flag or environment variable that **contradicts** the
|
|
63
90
|
folder's binding is not resolved by precedence — it exits `workspace_mismatch`
|
|
@@ -73,12 +100,12 @@ decided it.
|
|
|
73
100
|
|
|
74
101
|
```bash
|
|
75
102
|
hlix config list [--json] # every setting in effect, and which file set it
|
|
76
|
-
hlix config get <dockerImage|harness|memoryTokens|model|sandbox|yolo> [--json]
|
|
77
|
-
hlix config set <dockerImage|harness|memoryTokens|model|sandbox|yolo> <value> [--global] [--json]
|
|
103
|
+
hlix config get <dockerImage|harness|maskToolOutputs|memoryTokens|model|sandbox|yolo> [--json]
|
|
104
|
+
hlix config set <dockerImage|harness|maskToolOutputs|memoryTokens|model|sandbox|yolo> <value> [--global] [--json]
|
|
78
105
|
```
|
|
79
106
|
|
|
80
|
-
|
|
81
|
-
`~/.hlix/
|
|
107
|
+
`hlix.yml` sets `coder` and `local` for this folder. A field it leaves out comes
|
|
108
|
+
from the machine-wide `~/.hlix/hlix.yml`. The folder wins per field. `config list`
|
|
82
109
|
names the source of every value — `project`, `global`, or `default` when no
|
|
83
110
|
file sets it — and where it applies. The stored credential stays at
|
|
84
111
|
`~/.config/hlix/credentials.json` and is not part of this cascade.
|
|
@@ -92,12 +119,17 @@ the Docker container runs (default `node:22-bookworm`, which carries git, node
|
|
|
92
119
|
and python3 but no bun) and `--docker-image <ref>` sets it for one session.
|
|
93
120
|
`memoryTokens` is how much of a thread the agent's observational memory holds
|
|
94
121
|
before summarizing — the number the session footer counts against, 200000 by
|
|
95
|
-
default. `
|
|
122
|
+
default. `maskToolOutputs` is `false` (the default), `true`, or a number of
|
|
123
|
+
tokens: when on, a request to the model that grows past that size (100000 for
|
|
124
|
+
`true`) has its tool outputs older than the newest eight replaced by a one-line
|
|
125
|
+
placeholder in one go; stored threads keep them whole. `yolo` is
|
|
126
|
+
`true` or `false`: `true` runs every tool — writes, shell
|
|
96
127
|
commands, `hlix_*` calls, MCP tools — without asking for approval, and the
|
|
97
|
-
session footer says `yolo` while it is on. `config set` writes this folder unless
|
|
98
|
-
|
|
99
|
-
refuses `projectId`, `workspaceId` and `apiUrl
|
|
100
|
-
|
|
128
|
+
session footer says `yolo` while it is on. `config set` writes this folder's `hlix.yml` unless `--global` is given, and
|
|
129
|
+
leaves every other field in the file untouched. `--global` writes
|
|
130
|
+
`~/.hlix/hlix.yml`. It refuses `projectId`, `workspaceId` and `apiUrl`.
|
|
131
|
+
Those live in the `hlix:` block of `hlix.yml`, which `init` and `import` write.
|
|
132
|
+
`hlix.api` is omitted when the server is `https://server.hlix.ai`.
|
|
101
133
|
|
|
102
134
|
## Project secrets
|
|
103
135
|
|
|
@@ -149,7 +181,7 @@ tracks**, because an exported file is plaintext and must not become a commit.
|
|
|
149
181
|
`--format` re-renders a source as another shape; omitted, it keeps the shape
|
|
150
182
|
the values were parsed as.
|
|
151
183
|
|
|
152
|
-
Secrets are agency-only on every route. A client
|
|
184
|
+
Secrets are agency-only on every route. A portal client gets `forbidden`.
|
|
153
185
|
|
|
154
186
|
## Dispatching work
|
|
155
187
|
|
|
@@ -266,8 +298,9 @@ Branch on `error.code`, never on `error.message`. Codes: `unauthenticated`,
|
|
|
266
298
|
`forbidden`, `not_found`, `conflict`, `invalid_request`, `bad_request`,
|
|
267
299
|
`rate_limited`, `not_implemented`, `server_error`, `unreachable`,
|
|
268
300
|
`missing_argument`, `invalid_usage`, `approval_required`, `cancelled`, `unknown_command`,
|
|
269
|
-
`workspace_mismatch`, `not_initialized`, `scan_blocked`,
|
|
270
|
-
`workspace_required`, `invalid_base_url`, `missing_credential`, `
|
|
301
|
+
`workspace_mismatch`, `not_initialized`, `invalid_project_file`, `scan_blocked`,
|
|
302
|
+
`workspace_required`, `invalid_base_url`, `missing_credential`, `login_denied`,
|
|
303
|
+
`login_expired`, `login_failed`, `unknown`.
|
|
271
304
|
|
|
272
305
|
That list is the complete set — `skill.test.ts` compares it against every code
|
|
273
306
|
the sources can emit in BOTH directions, so a code the CLI can return cannot go
|