Halo Manager#

Manage Halo blogs through the official API.

First-Time Setup#

When this skill is first used, ask the user for:

1. Blog URL (e.g., https://blog.example.com)
2. Username
3. Password

Then save credentials to ~/halo-manager/config.json:

json

{
  "blog_url": "https://blog.example.com",
  "username": "your-username",
  "password": "your-password"
}

Security Note: Never expose credentials in logs, responses, or shared channels.

Authentication#

Halo uses RSA-encrypted password + CSRF token + Session cookie.

Login Flow#

1. GET /login - Extract CSRF token and RSA public key
2. Encrypt password with RSA public key (JSEncrypt)
3. POST /login with form data (username, encrypted password, CSRF token)
4. Receive SESSION cookie for subsequent requests

Session Management#

• Use SESSION cookie for all authenticated requests
• If session expires, re-login automatically
• Store session state in ~/halo-manager/session.json

API Endpoints#

Console API Base#

text

{blog_url}/apis/api.console.halo.run/v1alpha1/

Posts#

OperationMethodEndpointList postsGET/postsGet postGET/posts/{name}Create postPOST/postsUpdate postPUT/posts/{name}Delete postDELETE/posts/{name}

Categories#

OperationMethodEndpointList categoriesGET/categoriesCreate categoryPOST/categoriesUpdate categoryPUT/categories/{name}Delete categoryDELETE/categories/{name}

Tags#

OperationMethodEndpointList tagsGET/tagsCreate tagPOST/tagsUpdate tagPUT/tags/{name}Delete tagDELETE/tags/{name}

Users#

OperationMethodEndpointList usersGET/usersGet current userGET/users/-

Comments#

OperationMethodEndpointList commentsGET/commentsApprove commentPUT/comments/{name}/approvalDelete commentDELETE/comments/{name}

Media#

OperationMethodEndpointList attachmentsGET/attachmentsUpload attachmentPOST/attachmentsDelete attachmentDELETE/attachments/{name}

Common Workflows#

Create a Post#

1. Login to get session
2. Prepare post data:

json

{
  "post": {
    "spec": {
      "title": "Post Title",
      "slug": "post-slug",
      "content": "Post content in Markdown",
      "rawType": "markdown",
      "categories": ["category-name"],
      "tags": ["tag1", "tag2"],
      "publish": true
    }
  }
}

1. POST to /posts
2. Verify creation

Upload Media#

1. Login to get session
2. Prepare multipart form data
3. POST to /attachments
4. Get attachment URL from response

Error Handling#

StatusMeaningAction401UnauthorizedRe-login403ForbiddenCheck permissions404Not foundVerify resource exists500Server errorRetry or report

Output Format#

text

【操作名称】

请求：{method} {endpoint}
状态：{status_code}
结果：成功/失败

详情：...

Security Best Practices#

1. Never log credentials - Mask passwords in all outputs
2. Use HTTPS - Always prefer secure connections
3. Session timeout - Re-authenticate when session expires
4. Local storage only - Credentials stay on user's machine

References#

• API Reference - Complete API documentation
• Examples - Common usage examples