Halo Manager

Manage Halo blogs through the official API.

First-Time Setup

When this skill is first used, ask the user for:

1. Blog URL (e.g., https://blog.example.com)
2. Username
3. Password

Then save credentials to ~/halo-manager/config.json:

{
  "blog_url": "https://blog.example.com",
  "username": "your-username",
  "password": "your-password"
}

Security Note: Never expose credentials in logs, responses, or shared channels.

Authentication

Halo uses RSA-encrypted password + CSRF token + Session cookie.

Login Flow

1. GET /login - Extract CSRF token and RSA public key
2. Encrypt password with RSA public key (JSEncrypt)
3. POST /login with form data (username, encrypted password, CSRF token)
4. Receive SESSION cookie for subsequent requests

Session Management

• Use SESSION cookie for all authenticated requests
• If session expires, re-login automatically
• Store session state in ~/halo-manager/session.json

API Endpoints

Console API Base

{blog_url}/apis/api.console.halo.run/v1alpha1/

Posts

Categories

Tags

Users

Comments

Media

Common Workflows

Create a Post

1. Login to get session
2. Prepare post data:

{
  "post": {
    "spec": {
      "title": "Post Title",
      "slug": "post-slug",
      "content": "Post content in Markdown",
      "rawType": "markdown",
      "categories": ["category-name"],
      "tags": ["tag1", "tag2"],
      "publish": true
    }
  }
}

3. POST to /posts
4. Verify creation

Upload Media

1. Login to get session
2. Prepare multipart form data
3. POST to /attachments
4. Get attachment URL from response

Error Handling

Output Format

【操作名称】

请求：{method} {endpoint}
状态：{status_code}
结果：成功/失败

详情：...

Security Best Practices

1. Never log credentials - Mask passwords in all outputs
2. Use HTTPS - Always prefer secure connections
3. Session timeout - Re-authenticate when session expires
4. Local storage only - Credentials stay on user's machine

References

• API Reference - Complete API documentation
• Examples - Common usage examples