pixee-shared
starsforks
How to install pixee-shared?
pixee/pixee-cli/pixee-shared
$npx -y skills add pixee/pixee-cli --skill pixee-sharedDescribe the global flags, output format, exit codes, error handling, and TLS trust troubleshooting used by every Pixee CLI subcommand.
SKILL.md
| 1 | # Pixee CLI — Shared Reference |
| 2 | |
| 3 | Conventions shared by every `pixee` subcommand. Read this before using any command-group skill |
| 4 | (`pixee-api`, `pixee-repo`, `pixee-workflow`, `pixee-auth`). |
| 5 | |
| 6 | ## Installation |
| 7 | |
| 8 | ```bash |
| 9 | brew tap pixee/pixee |
| 10 | brew install pixee |
| 11 | # or grab the archive for your platform from: |
| 12 | # https://github.com/pixee/pixee-cli/releases/latest |
| 13 | |
| 14 | pixee --version # prints the release version baked into the binary |
| 15 | ``` |
| 16 | |
| 17 | When downloading an archive directly, verify it against the `SHA256SUMS` manifest published on the |
| 18 | release before extracting the binary. Download the manifest into the same directory as the archive, |
| 19 | then check it (`--ignore-missing` limits the check to the archives actually downloaded): |
| 20 | |
| 21 | ```bash |
| 22 | sha256sum --ignore-missing -c SHA256SUMS # Linux |
| 23 | shasum -a 256 --ignore-missing -c SHA256SUMS # macOS |
| 24 | ``` |
| 25 | |
| 26 | ## Credentials at a glance |
| 27 | |
| 28 | `pixee` reads an API token and server URL from environment variables (`PIXEE_TOKEN`, |
| 29 | `PIXEE_SERVER`) or from a config file written by `pixee auth login`. Env vars take precedence over |
| 30 | stored config. |
| 31 | |
| 32 | When credentials are missing, invalid, or point at the wrong server, commands exit with code 2 and |
| 33 | a message like: |
| 34 | |
| 35 | ``` |
| 36 | Authentication failed. Run `pixee auth login` to reconfigure. |
| 37 | ``` |
| 38 | |
| 39 | For the *fix* — storing a token, the `--token -` stdin pattern, config file locations, |
| 40 | server-precedence rules, and `pixee auth status` — see `pixee-auth`. |
| 41 | |
| 42 | ## Global flags |
| 43 | |
| 44 | - `--server <url>` — override the configured server for a single invocation. |
| 45 | - `--output text|json` — choose the output format. Default is `text` (flat, line-oriented output |
| 46 | suitable for `grep`/`awk`). Use `json` for machine-readable output and pipe to `jq` for |
| 47 | filtering; `pixee` does not embed a jq implementation. |
| 48 | - `--json` — shorthand for `--output json`. |
| 49 | - `--insecure` — skip TLS certificate verification for the invocation (also enabled by |
| 50 | `PIXEE_INSECURE_TLS=true`). Prints a warning to stderr. Last resort for connecting to a Pixee |
| 51 | Enterprise Server with a privately signed certificate — see **TLS trust failures** below for the |
| 52 | preferred fix. |
| 53 | |
| 54 | ## Exit codes |
| 55 | |
| 56 | | Code | Meaning | |
| 57 | | ---- | ------- | |
| 58 | | 0 | Success | |
| 59 | | 1 | General error | |
| 60 | | 2 | Authentication failure — token missing, expired, invalid, or wrong server. Fix via `pixee-auth`. | |
| 61 | | 3 | Resource not found | |
| 62 | |
| 63 | Scripts and agents can branch on these codes without parsing stderr. |
| 64 | |
| 65 | ## Token security |
| 66 | |
| 67 | - Never log token values. Never commit them to source control. |
| 68 | - Prefer `PIXEE_TOKEN` (env var) or `pixee auth login --token -` (stdin) over passing a token as a |
| 69 | flag argument; flag arguments land in shell history. See `pixee-auth` for the full stdin |
| 70 | pattern. |
| 71 | |
| 72 | ## Error responses |
| 73 | |
| 74 | The Pixee API returns errors as `application/problem+json`. With `--output text`, `pixee` renders |
| 75 | the problem document's `title`, `detail`, and `instance` fields in a compact, human-readable form. |
| 76 | With `--output json`, the raw document is passed through unchanged. |
| 77 | |
| 78 | Authentication failures exit with code 2. Not-found responses exit with code 3. Other problem |
| 79 | responses exit with code 1. |
| 80 | |
| 81 | ## TLS trust failures |
| 82 | |
| 83 | `pixee` verifies certificates against its bundled Mozilla CA list, not the operating system's |
| 84 | trust store. When the user reports that `pixee` cannot reach an internal or enterprise Pixee |
| 85 | Server and the generic "Connection to ... failed" message looks like it might be a certificate |
| 86 | problem, read [`references/tls-troubleshooting.md`](./references/tls-troubleshooting.md). It |
| 87 | covers: confirming with `curl` that it's a trust failure (not DNS or a wrong URL), the preferred |
| 88 | fix (`NODE_EXTRA_CA_CERTS` pointing at the internal CA PEM), and `--insecure` as a last resort |
| 89 | with the security tradeoff to surface to the user. |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
