@hlix/cli 1.1.0 → 1.2.1

package/dist/{package-ctda701x.js → package-wqp10n7m.js}

@@ -1,2 +1,2 @@
 #!/usr/bin/env node
-var e="@hlix/cli",i="1.1.0",n="SEE LICENSE IN LICENSE",r="Hlix Code and the hlix control-plane CLI.",a=["hlix","cli","agents"],l="https://hlix.ai",p="module",o="./dist/index.js",b={hlix:"./bin/hlix"},c=["bin","install.cjs","dist","skills","LICENSE","THIRD_PARTY_NOTICES"],u={node:">=22.19.0"},d={access:"public"},m={build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --splitting --packages external --minify --banner '#!/usr/bin/env node'",test:'bun test src --path-ignore-patterns "**/*.integration.test.ts" --timeout 20000',typecheck:"tsc --noEmit",prepublishOnly:"bun run typecheck && bun run build && bun run test","test:integration":"NODE_ENV=test bun run ../../apps/backend/scripts/with-aimock.ts -- bun run ../../apps/backend/scripts/with-test-db.ts -- bun test --isolate --preload ../../apps/backend/test/helpers/pool-lifecycle.ts --timeout 60000 .integration.test.ts","build:binary":"bun run scripts/build-binary.ts","test:binary":"bun run build:binary && HLIX_TEST_BINARY=dist-native/hlix bun test src/__tests__/binary.test.ts --timeout 60000 && bun run scripts/smoke-binary.ts","test:integration:binary":"bun run build:binary && HLIX_TEST_BINARY=dist-native/hlix NODE_ENV=test bun run ../../apps/backend/scripts/with-aimock.ts -- bun run ../../apps/backend/scripts/with-test-db.ts -- bun test --isolate --preload ../../apps/backend/test/helpers/pool-lifecycle.ts --timeout 60000 src/__tests__/auth.integration.test.ts"},h={"@agentclientprotocol/sdk":"1.8.0","@earendil-works/pi-tui":"1.3.0","@mastra/acp":"^0.4.2","@mastra/core":"1.79.0","@mastra/docker":"^0.11.0","@mastra/libsql":"1.26.2","@mastra/mcp":"2.4.1","@mastra/memory":"1.38.0","dinero.js":"2.0.2",ignore:"7.0.12","jsonc-parser":"3.3.1","openapi-fetch":"^0.17.0","smol-toml":"1.9.1",yaml:"2.9.1",zod:"4.6.7"},y={"@hlix/sdk":"^2.0.0","@hlix/shared":"*","@types/bun":"latest",typescript:"^7.0.2"},k={name:e,version:i,license:n,description:r,keywords:a,homepage:l,type:p,main:o,bin:b,files:c,engines:u,publishConfig:d,scripts:m,dependencies:h,devDependencies:y};export{b as bin,k as default,h as dependencies,r as description,y as devDependencies,u as engines,c as files,l as homepage,a as keywords,n as license,o as main,e as name,d as publishConfig,m as scripts,p as type,i as version};
+var e="@hlix/cli",i="1.2.1",n="SEE LICENSE IN LICENSE",r="Hlix Code and the hlix control-plane CLI.",a=["hlix","cli","agents"],l="https://hlix.ai",p="module",o="./dist/index.js",b={hlix:"./bin/hlix"},c=["bin","install.cjs","dist","skills","LICENSE","THIRD_PARTY_NOTICES"],u={node:">=22.19.0"},d={access:"public"},m={build:"rm -rf dist && bun build src/index.ts --outdir dist --target node --format esm --splitting --packages external --minify --banner '#!/usr/bin/env node'",test:'bun test src --path-ignore-patterns "**/*.integration.test.ts" --timeout 20000',typecheck:"tsc --noEmit",prepublishOnly:"bun run typecheck && bun run build && bun run test","test:integration":"NODE_ENV=test bun run ../../apps/backend/scripts/with-aimock.ts -- bun run ../../apps/backend/scripts/with-test-db.ts -- bun test --isolate --preload ../../apps/backend/test/helpers/pool-lifecycle.ts --timeout 60000 .integration.test.ts","build:binary":"bun run scripts/build-binary.ts","test:binary":"bun run build:binary && HLIX_TEST_BINARY=dist-native/hlix bun test src/__tests__/binary.test.ts --timeout 60000 && bun run scripts/smoke-binary.ts","test:integration:binary":"bun run build:binary && HLIX_TEST_BINARY=dist-native/hlix NODE_ENV=test bun run ../../apps/backend/scripts/with-aimock.ts -- bun run ../../apps/backend/scripts/with-test-db.ts -- bun test --isolate --preload ../../apps/backend/test/helpers/pool-lifecycle.ts --timeout 60000 src/__tests__/auth.integration.test.ts"},h={"@agentclientprotocol/sdk":"1.8.0","@earendil-works/pi-tui":"1.3.0","@mastra/acp":"^0.4.2","@mastra/core":"1.79.0","@mastra/docker":"^0.11.0","@mastra/libsql":"1.26.2","@mastra/mcp":"2.4.1","@mastra/memory":"1.38.0","dinero.js":"2.0.2",ignore:"7.0.12","jsonc-parser":"3.3.1","openapi-fetch":"^0.17.0","smol-toml":"1.9.1",yaml:"2.9.1",zod:"4.6.7"},y={"@hlix/sdk":"^2.1.1","@hlix/shared":"*","@types/bun":"latest",typescript:"^7.0.2"},k={name:e,version:i,license:n,description:r,keywords:a,homepage:l,type:p,main:o,bin:b,files:c,engines:u,publishConfig:d,scripts:m,dependencies:h,devDependencies:y};export{b as bin,k as default,h as dependencies,r as description,y as devDependencies,u as engines,c as files,l as homepage,a as keywords,n as license,o as main,e as name,d as publishConfig,m as scripts,p as type,i as version};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hlix/cli",
-  "version": "1.1.0",
+  "version": "1.2.1",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Hlix Code and the hlix control-plane CLI.",
   "keywords": [
@@ -57,15 +57,15 @@
     "zod": "4.6.7"
   },
   "devDependencies": {
-    "@hlix/sdk": "^2.0.0",
+    "@hlix/sdk": "^2.1.1",
     "@hlix/shared": "*",
     "@types/bun": "latest",
     "typescript": "^7.0.2"
   },
   "optionalDependencies": {
-    "@hlix/cli-darwin-arm64": "1.1.0",
-    "@hlix/cli-darwin-x64": "1.1.0",
-    "@hlix/cli-linux-x64": "1.1.0",
-    "@hlix/cli-linux-arm64": "1.1.0"
+    "@hlix/cli-darwin-arm64": "1.2.1",
+    "@hlix/cli-darwin-x64": "1.2.1",
+    "@hlix/cli-linux-x64": "1.2.1",
+    "@hlix/cli-linux-arm64": "1.2.1"
   }
 }

package/skills/hlix/SKILL.md

@@ -12,29 +12,49 @@ if they disagree, so this file cannot advertise something that does not exist.
 ## Authentication
 
 ```bash
-hlix auth login [--workspace <id>] [--base-url <url>]
+hlix auth login [--workspace <id>] [--base-url <url>] [--api-key]
+hlix login                           # the same as hlix auth login
 hlix auth status [--json]            # which credential, from where, does it work
 hlix auth logout [--yes] [--json]    # remove the stored credential file
+hlix logout                          # the same as hlix auth logout
 ```
 
-Reads the key from a hidden terminal prompt, verifies it against the API
-**before** storing it, then writes it atomically to
-`~/.config/hlix/credentials.json` with mode 0600. The key is never printed back.
+Login opens your browser: it prints a verification URL and a one-time code,
+opens the page, and waits while you approve the code there (signed in with
+Google, GitHub, a passkey or a password). The session token that comes back is
+verified against the API **before** it is stored, then written atomically to
+`~/.config/hlix/credentials.json` with mode 0600. It is never printed back.
+Denying the code in the browser exits `login_denied`; letting it run out exits
+`login_expired`; a server that will not start the login exits `login_failed`.
+A browser login needs a person at a terminal: without one (`--json`, a pipe,
+CI) it exits `missing_credential` at once instead of waiting.
+
+`--api-key` signs in with an API key instead. The key is read from a hidden
+prompt at a terminal, or from stdin when piped
+(`printf %s "$KEY" | hlix auth login --api-key`); a key given as an argument
+value is refused before anything runs.
 
 `HLIX_API_KEY` overrides the stored file; `HLIX_BASE_URL` and
 `HLIX_WORKSPACE_ID` set the target and workspace. Use those in CI rather than
 running a login step.
 
-`--workspace` is **optional** at login. An API key authenticates a user and
-names no workspace, so the key is read first and then used to list the
-workspaces its owner belongs to (`GET /v1/api/workspaces`, the one endpoint that
+Every command that talks to the API checks for a credential **before** it does
+any work. At a terminal with none stored, it starts the browser login and then
+carries on in the same run; without a terminal it exits `unauthenticated`
+(exit code 3) straight away. `hlix import` also checks that the stored credential still works
+before it scans the folder, and signs in again when it was rejected.
+
+`--workspace` is **optional** at login. A credential authenticates a user and
+names no workspace, so you sign in first and the credential is then used to
+list the workspaces you belong to (`GET /v1/api/workspaces`, the one endpoint that
 needs no `X-Organization-Id`). With exactly one, that one is used and named on
 stderr; with several, a terminal gets a numbered list to pick from and a
 non-interactive run (`--json`, or no TTY) exits `missing_argument` listing the
 ids so it can be re-run with `--workspace`. A `--workspace` that is not one of
 them exits `workspace_mismatch` naming the ones that are, instead of storing a
-credential that 403s later. `hlix auth login` then verifies the key against a
-real call **before** writing it, so a key that does not work is never stored.
+credential that 403s later. `hlix auth login` then verifies the credential
+against a real call **before** writing it, so one that does not work is never
+stored.
 
 `auth status` names the credential's **source** and probes it against the API.
 `--json` reports it as `credentialSource`: `"file"` for the stored credential,
@@ -80,8 +100,8 @@ decided it.
 
 ```bash
 hlix config list [--json]            # every setting in effect, and which file set it
-hlix config get <dockerImage|harness|memoryTokens|model|sandbox|yolo> [--json]
-hlix config set <dockerImage|harness|memoryTokens|model|sandbox|yolo> <value> [--global] [--json]
+hlix config get <dockerImage|harness|maskToolOutputs|memoryTokens|model|sandbox|yolo> [--json]
+hlix config set <dockerImage|harness|maskToolOutputs|memoryTokens|model|sandbox|yolo> <value> [--global] [--json]
 ```
 
 `hlix.yml` sets `coder` and `local` for this folder. A field it leaves out comes
@@ -99,7 +119,11 @@ the Docker container runs (default `node:22-bookworm`, which carries git, node
 and python3 but no bun) and `--docker-image <ref>` sets it for one session.
 `memoryTokens` is how much of a thread the agent's observational memory holds
 before summarizing — the number the session footer counts against, 200000 by
-default. `yolo` is `true` or `false`: `true` runs every tool — writes, shell
+default. `maskToolOutputs` is `false` (the default), `true`, or a number of
+tokens: when on, a request to the model that grows past that size (100000 for
+`true`) has its tool outputs older than the newest eight replaced by a one-line
+placeholder in one go; stored threads keep them whole. `yolo` is
+`true` or `false`: `true` runs every tool — writes, shell
 commands, `hlix_*` calls, MCP tools — without asking for approval, and the
 session footer says `yolo` while it is on. `config set` writes this folder's `hlix.yml` unless `--global` is given, and
 leaves every other field in the file untouched. `--global` writes
@@ -275,7 +299,8 @@ Branch on `error.code`, never on `error.message`. Codes: `unauthenticated`,
 `rate_limited`, `not_implemented`, `server_error`, `unreachable`,
 `missing_argument`, `invalid_usage`, `approval_required`, `cancelled`, `unknown_command`,
 `workspace_mismatch`, `not_initialized`, `invalid_project_file`, `scan_blocked`,
-`workspace_required`, `invalid_base_url`, `missing_credential`, `unknown`.
+`workspace_required`, `invalid_base_url`, `missing_credential`, `login_denied`,
+`login_expired`, `login_failed`, `unknown`.
 
 That list is the complete set — `skill.test.ts` compares it against every code
 the sources can emit in BOTH directions, so a code the CLI can return cannot go