highhxcli 0.1.0__tar.gz

highhxcli-0.1.0/.gitignore

@@ -0,0 +1,32 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+/build/
+/dist/
+/.venv/
+/venv/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+coverage.xml
+htmlcov/
+
+# HighhX local state (never commit)
+.highhx/state/
+.highhx/logs/
+.highhx/backups/
+.highhx/cache/
+
+# Environment files
+.env
+.env.*
+!.env.example
+
+# Editors / OS
+.idea/
+.vscode/
+.DS_Store
+Thumbs.db

highhxcli-0.1.0/CHANGELOG.md

@@ -0,0 +1,42 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+The format follows [Keep a Changelog](https://keepachangelog.com/) and the
+project uses [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-09-26
+
+### Features
+
+- Project detection for Python, Node.js, React, Next.js, Flutter/Dart, Java, C/C++, Go, Rust, Docker, databases and monorepos.
+- `highhx init` with per-stack templates for config, environment, policies and workflows.
+- Execution engine: streaming output, timeouts, cancellation, retries with exponential backoff, parallel execution, graceful shutdown.
+- Workflow engine: dependency graphs, parallel stages, conditions, variables, outputs, approvals, retries, timeouts, reusable workflows, dry-run, validation and graphs.
+- Risk classification and approvals with non-bypassable rules; project policies.
+- Environment profiles with `.env` files, validation and masked secrets.
+- Dependencies, testing (with coverage/changed/watch), building, artifacts and cleanup.
+- Git helpers, semantic versioning, changelog generation from Conventional Commits, releases and publishing.
+- Deployment targets (local, Docker, SSH, Kubernetes, Terraform, plugins) with preflight, health checks, state tracking and rollback.
+- Local security checks: secrets, permissions, configuration, workflows, policies and dependency audits.
+- Services, ports, Docker Compose and database (SQLite, PostgreSQL, MySQL) management.
+- Plugins with manifests, declarative contributions and integrity-checked code.
+- Execution history, redacted logs, tracing, reports, doctor, diagnose and repair.
+
+### Security
+
+- Plugin code runs only for contents trusted per user (`highhx plugin trust`); a repository cannot enable its own plugin code. Plugins containing symlinks are rejected and plugin names are validated.
+- All output — including `--json` documents and captured command output — is redacted.
+- Isolated plugin commands never receive environment-profile values.
+- Values substituted into deploy commands are restricted to a safe character set.
+- Hardened risk rules (wrapped shells, split `rm` flags, fork bombs, raw device writes, `find -delete`, `docker rm`, `shred`/`truncate`).
+- Duplicate YAML keys are rejected.
+
+### Reliability
+
+- Workflow step output is written to execution logs; retries, step transitions and approval decisions are logged.
+- `--json` always emits exactly one JSON document.
+- An unreadable state database is diagnosed and can be repaired (`highhx repair`).
+- `mysqldump` runs with `--no-tablespaces`, so backups work without the PROCESS privilege.
+- Global `--profile` was renamed `--config-profile` so it no longer collides with `env --profile`.

highhxcli-0.1.0/CODE_OF_CONDUCT.md

@@ -0,0 +1,32 @@
+# Code of Conduct
+
+## Our pledge
+
+We want HighhX to be a welcoming project for everyone, regardless of age, body size,
+disability, ethnicity, gender identity and expression, level of experience,
+nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our standards
+
+Examples of behaviour that contributes to a positive environment:
+
+- being respectful of differing viewpoints and experiences,
+- giving and gracefully accepting constructive feedback,
+- focusing on what is best for the community,
+- showing empathy towards other community members.
+
+Examples of unacceptable behaviour:
+
+- harassment, insults or derogatory comments, public or private,
+- sexualised language or imagery,
+- publishing others' private information without permission,
+- other conduct that could reasonably be considered inappropriate in a professional setting.
+
+## Enforcement
+
+Maintainers are responsible for clarifying and enforcing these standards and may
+remove, edit or reject contributions that do not align with this Code of Conduct.
+Report unacceptable behaviour privately to the maintainers through the repository's
+contact options; all reports are reviewed and kept confidential.
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1.

highhxcli-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,45 @@
+# Contributing to HighhX
+
+Thanks for helping! This guide covers the practical bits.
+
+## Getting set up
+
+```bash
+# from a checkout of this repository
+python -m venv .venv && . .venv/bin/activate
+pip install -e ".[dev]"
+pytest && ruff check . && mypy
+```
+
+## Ground rules
+
+- **No placeholders.** Every feature must work end to end and have tests. No `pass`,
+  `TODO` or dummy return values outside abstract interfaces.
+- **Local-first.** No mandatory network access, cloud services, accounts, API keys or AI features.
+- **Safe by default.** Anything that changes shared state, deletes data or publishes must go
+  through `Engine.approve()` / `Engine.run()` with an honest `RiskLevel`, and must honour `--dry-run`.
+- **Never print secrets.** Use `mask()` for display and make sure logs go through the redactor.
+- **Cross-platform.** Don't assume bash, `/usr/bin` or GNU tools; prefer Python APIs and
+  `highhx.utils.platform` for platform differences.
+- **Thin commands.** CLI modules in `highhx/commands/` parse arguments and render results;
+  logic belongs in the domain packages (see [docs/architecture.md](docs/architecture.md)).
+
+## Tests
+
+- Unit tests live in `tests/unit/<area>/`, integration tests in `tests/integration/`,
+  end-to-end tests (real subprocess) in `tests/e2e/`, security guarantees in `tests/security/`.
+- Use the fixtures in `tests/conftest.py` (`cli`, `make_engine`, `python_project`,
+  `git_python_project`). They isolate user directories and git identity, so tests never
+  depend on your machine's configuration.
+- External systems (Docker, SSH, Kubernetes, registries) are faked; SQLite, git and
+  subprocesses are real.
+
+## Commits and pull requests
+
+- Use [Conventional Commits](https://www.conventionalcommits.org/) (`feat:`, `fix:`, `docs:` …);
+  HighhX's own changelog is generated from them.
+- Keep pull requests focused; include tests and update `docs/` when behaviour changes.
+  `docs/commands.md` is generated from the CLI — regenerate it with
+  `python scripts/generate_docs.py` when you change commands and `schemas/` with
+  `python scripts/generate_schemas.py` when you change a schema (the test suite fails
+  when either drifts).

highhxcli-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 HighhX contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

highhxcli-0.1.0/PKG-INFO

@@ -0,0 +1,329 @@
+Metadata-Version: 2.5
+Name: highhxcli
+Version: 0.1.0
+Summary: HighhX — a local-first, offline-first developer operations command center.
+Author: HighhX contributors
+License-Expression: MIT
+License-File: LICENSE
+Keywords: automation,cli,developer-tools,devops,workflow
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Software Development :: Build Tools
+Requires-Python: >=3.11
+Requires-Dist: click>=8.1
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.7
+Provides-Extra: dev
+Requires-Dist: coverage[toml]>=7.4; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.5; extra == 'dev'
+Requires-Dist: types-pyyaml; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# HighhX
+
+**HighhX is a local-first developer command center.** One CLI — `highhx` — detects
+your project, runs your workflows, manages environments, dependencies, tests,
+builds, git, releases, deployments, services and databases, and keeps a searchable
+history of everything it did. Every risky action is classified and needs approval.
+
+```text
+$ highhx doctor
+
+HighhX Doctor
+
+✓ macOS 15.2 arm64
+✓ HighhX on Python 3.13.1
+✓ git 2.47.1
+✓ node 22.12.0
+✓ python satisfies >=3.11 — declared in pyproject.toml
+✓ Configuration valid
+✓ Workflows valid — 7 workflow(s)
+⚠ docker unavailable — required by this project
+✗ Missing DATABASE_URL — profile development
+
+Suggested actions
+  → Install docker and make sure it is on PATH.
+  → Set it with `highhx env set DATABASE_URL --profile development` or export it in your shell.
+```
+
+- [Why HighhX](#why-highhx)
+- [Installation](#installation)
+- [Quick start](#quick-start)
+- [Commands](#commands)
+- [Workflows](#workflows)
+- [Configuration](#configuration)
+- [Plugins](#plugins)
+- [Security model](#security-model)
+- [Development](#development)
+- [Contributing](#contributing)
+
+## Why HighhX
+
+Most projects accumulate a pile of scripts, Makefile targets, README snippets and
+CI YAML that only half the team remembers. HighhX gives every project the same
+front door:
+
+- **Local-first and offline-first.** No cloud backend, no account, no API keys, no AI.
+  Everything — history, logs, deployment state — lives in `.highhx/` on your machine.
+- **Detects instead of asking.** Python (pip/uv/poetry/pdm/pipenv), Node (npm/pnpm/yarn/bun),
+  React, Next.js, Flutter/Dart, Java (Maven/Gradle), C/C++ (CMake/Make), Go, Rust, Docker,
+  common databases and monorepos — from real manifests and lockfiles, not file extensions.
+- **Safe by default.** Commands are classified as safe, normal, dangerous or critical.
+  `git push`, `rm -rf`, `DROP TABLE`, production deploys and restores need approval;
+  `--dry-run` previews anything; policies can make approvals non-bypassable even with `--yes`.
+- **A real workflow engine.** YAML workflows with dependency graphs, parallel execution,
+  conditions, variables, retries with backoff, timeouts, approvals and reusable workflows —
+  validated before anything runs.
+- **Scriptable.** Every command supports `--json` and meaningful exit codes.
+
+## Installation
+
+HighhX needs Python 3.11+. It is developed and tested on macOS; Linux and Windows
+support is designed in (see [docs/development.md](docs/development.md#platform-support))
+but not yet verified on those systems.
+
+> HighhXcli is **not yet published on PyPI**. Install it from a built wheel or from source.
+
+```bash
+# from a checkout of this repository
+python -m pip install build && python -m build          # creates dist/highhxcli-*.whl
+pipx install dist/highhxcli-*.whl                       # or: pip install dist/highhxcli-*.whl
+
+# development install
+python -m venv .venv && . .venv/bin/activate            # Windows: .venv\Scripts\activate
+pip install -e ".[dev]"
+```
+
+Both `highhx` and `highhxcli` are installed as commands, and `python -m highhx` works too.
+
+Runtime dependencies are deliberately small: `click`, `rich` and `PyYAML`.
+External tools (git, docker, kubectl, psql …) are used only when a feature needs them.
+
+## Quick start
+
+```bash
+cd your-project
+highhx init            # detect the project, create .highhx/ (never overwrites without --force)
+highhx doctor          # check tools, config, env vars, ports
+highhx status          # dashboard: git, environment, services, recent runs
+highhx test            # auto-detected test runner (pytest, vitest, jest, flutter, mvn, …)
+highhx run ci          # run a workflow; parallel where dependencies allow
+highhx run ci --dry-run
+highhx history         # what ran, when, how long, exit codes
+highhx logs            # output of the last execution (secrets redacted)
+```
+
+`highhx init` creates:
+
+```text
+.highhx/
+├── config.yaml          # commands, services, deploy targets, approvals …
+├── environment.yaml     # declared variables and profiles (values live in .env files)
+├── policies.yaml        # protected branches, forbidden files, rules
+├── workflows/           # dev, test, build, ci, release, deploy, rollback
+├── hooks/               # scripts for git hooks
+├── state/               # local database (git-ignored)
+└── logs/                # execution logs (git-ignored)
+```
+
+## Commands
+
+Full reference with every option: [docs/commands.md](docs/commands.md).
+
+| Area | Commands |
+|---|---|
+| Project | `init` `status` `info` `dev` `start` `stop` `restart` `check` |
+| Code & tasks | `run <workflow>` `exec <command>` `script <name>` `task <name>` `watch` `fix` |
+| Dependencies | `deps` `deps install` `deps update` `deps outdated` `deps audit` `deps clean` |
+| Testing & build | `test [--watch] [--coverage] [--changed]` `benchmark` `build` `clean` `package` `artifacts` |
+| Environment | `env` `env check` `env set` `env profile` `env diff` |
+| Git & releases | `git status/diff/branch/commit/sync/tag/history` `version` `changelog` `release` `publish` |
+| Deployment | `deploy [target]` `deploy status` `deploy logs` `rollback` `environments` |
+| Security | `security` `security scan/secrets/deps/config/report` |
+| Containers & data | `docker up/down/logs` `services` `ports` `db status/migrate/seed/backup/restore` |
+| Workflows & automation | `workflow list/validate/create/graph` `schedule` `hook` `trigger` `watchers` |
+| Observability | `logs [--follow]` `history [id]` `report` `trace` |
+| Extensibility & team | `plugin list/install/remove/update/search/trust` `config` `policy` `workspace` `profile` |
+| Diagnostics | `doctor` `diagnose` `repair` `debug` |
+
+Global options (work before or after the command): `--json`, `--dry-run`, `--yes/-y`,
+`--force`, `--quiet/-q`, `--verbose/-v`, `--debug`, `--no-color`, `--cwd/-C DIR`,
+`--config-profile NAME`, `--version`, `--help`.
+
+A few examples:
+
+```bash
+highhx exec -- pytest -q                 # run anything with env profile, risk check, history
+highhx exec --timeout 30s --retry 3 -- ./flaky.sh
+highhx test --changed                    # only tests related to files changed since HEAD
+highhx deps update                       # shows what will change, then asks
+highhx env set DATABASE_URL              # prompts without echo; value never printed again
+highhx release                           # version from Conventional Commits, changelog, tag
+highhx deploy staging --version 1.4.0    # preflight → approval → deploy → health check
+highhx rollback staging                  # restore the previous successful deployment
+highhx security --fail-on high           # exit 9 if high/critical findings
+highhx workflow graph ci --format mermaid
+highhx status --json | jq .git.branch
+```
+
+## Workflows
+
+Workflows are YAML files in `.highhx/workflows/`. Full reference:
+[docs/workflows.md](docs/workflows.md) · JSON Schema: [schemas/workflow.schema.json](schemas/workflow.schema.json).
+
+```yaml
+name: production
+
+settings:
+  fail_fast: true
+  max_parallel: 4
+  timeout: 30m
+
+steps:
+  - id: test
+    run: pytest
+
+  - id: lint
+    run: ruff check .
+
+  - id: build
+    run: docker build -t myapp .
+    depends_on: [test, lint]          # test and lint run in parallel first
+
+  - id: deploy
+    run: ./deploy.sh ${{ steps.build.outputs.tag }}
+    depends_on: [build]
+    approval: true                    # asks before running
+    retry:
+      attempts: 3
+      delay: 10s                      # exponential backoff: 10s, 20s …
+
+  - id: notify
+    run: ./notify.sh "deploy failed"
+    depends_on: [deploy]
+    if: failure()
+```
+
+A step never starts before every step in its `depends_on` succeeded. Steps whose
+dependencies are satisfied run in parallel (up to `max_parallel`). Also supported:
+`if:` conditions, `${{ }}` variables (`env`, `vars`, `inputs`, `steps.<id>.outputs`),
+step outputs, `continue_on_error`, per-step `timeout`/`cwd`/`env`, reusable workflows
+(`uses: other-workflow` with `with:` inputs), and `on:` event triggers.
+
+`highhx workflow validate` catches circular and missing dependencies, duplicate ids,
+unknown fields, bad expressions, references to steps that are not dependencies,
+unparsable commands, impossible steps and risky commands without `approval` —
+before anything runs.
+
+## Configuration
+
+`.highhx/config.yaml` is validated strictly (unknown keys are errors with
+"did you mean" suggestions). Reference: [docs/configuration.md](docs/configuration.md) ·
+JSON Schema: [schemas/config.schema.json](schemas/config.schema.json).
+
+```yaml
+version: 1
+project:
+  name: shop
+commands:              # override anything HighhX detected
+  test: uv run pytest
+  dev: uv run uvicorn app.main:app --reload
+services:              # highhx start / stop / services
+  api:
+    command: uv run uvicorn app.main:app --port 8000
+    port: 8000
+    health: {url: http://127.0.0.1:8000/health}
+deploy:
+  default: staging
+  targets:
+    staging:
+      type: ssh                       # local | docker | ssh | kubernetes | terraform | plugin:<name>
+      host: deploy@staging.example.com
+      command: ./deploy.sh {{ version }}
+      rollback_command: ./deploy.sh {{ previous_version }}
+      health_check: {url: https://staging.example.com/health}
+approvals:
+  auto_approve: normal                # never prompt at or below this risk
+  yes_max_risk: critical              # the highest risk --yes may approve
+```
+
+Config profiles (`.highhx/profiles/ci.yaml`) overlay the config with `--config-profile ci`.
+Environment profiles (development/staging/production) are separate and live in
+`.highhx/environment.yaml` plus your `.env` files — see `highhx env --help`.
+
+## Plugins
+
+Plugins add commands, workflows, templates, detectors and deployment backends.
+Guide: [docs/plugins.md](docs/plugins.md).
+
+```yaml
+# my-plugin/highhx-plugin.yaml
+name: greet
+version: 1.0.0
+api_version: 1
+permissions: [commands]
+contributes:
+  commands:
+    - name: greet
+      run: echo "hello"
+  workflows: [workflows]
+```
+
+```bash
+highhx plugin install ./my-plugin      # or a git URL, or a name from plugins.index
+highhx greet
+```
+
+Declarative contributions run as subprocesses with an isolated environment.
+Python code plugins run only when `plugins.allow_code: true` **and** you trusted those
+exact files (by SHA-256) with `highhx plugin install` or `highhx plugin trust`. Trust is
+stored in your user data directory, so a cloned repository cannot enable its own plugin code.
+
+## Security model
+
+Details: [docs/security.md](docs/security.md).
+
+- **Approvals.** Every command is classified (safe / normal / dangerous / critical).
+  Anything above `approvals.auto_approve` asks; critical actions require typing a word.
+  Without a terminal, HighhX denies instead of guessing. `--yes` approves up to
+  `approvals.yes_max_risk`, never beyond, and never for non-bypassable rules
+  (e.g. `rm -rf /`, `terraform destroy`, policy rules with `bypassable: false`).
+- **Policies.** `.highhx/policies.yaml` can deny commands/actions, require approval,
+  protect branches, forbid committed files and require a clean tree for releases/deploys.
+- **Secrets.** Secret values are never printed: `env` masks them, logs and history are
+  redacted (known secret values plus token patterns), and `security secrets` reports
+  file/line/type only. New `.env` files get owner-only permissions and are git-ignored.
+- **No claims.** `highhx security` reports concrete findings from local checks. An empty
+  report does not mean a project is secure, and HighhX never says it is.
+
+Report vulnerabilities in HighhX itself as described in [SECURITY.md](SECURITY.md).
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest                 # unit, integration, security and end-to-end tests
+ruff check . && ruff format --check .
+mypy                   # strict typing of src/highhx
+```
+
+Architecture: [docs/architecture.md](docs/architecture.md) · Development guide:
+[docs/development.md](docs/development.md) · Troubleshooting: [docs/troubleshooting.md](docs/troubleshooting.md).
+
+## Contributing
+
+Contributions are welcome — see [CONTRIBUTING.md](CONTRIBUTING.md) and the
+[Code of Conduct](CODE_OF_CONDUCT.md). Please open an issue before large changes.
+
+## License
+
+MIT — see [LICENSE](LICENSE).