Skip to content

SETUP.md

Latest commit

 

History

History
107 lines (80 loc) · 3.87 KB

SETUP.md

File metadata and controls

107 lines (80 loc) · 3.87 KB
Raw

CLI setup and operation

This guide covers Engine authentication, configuration precedence, safe automation, and the operational commands intentionally omitted from the main README.

Connect to an Engine

The CLI needs an Engine URL and credential. A small workspace can use its FUSED_LICENSE_KEY as the bootstrap Owner credential. Workspaces with multiple people should use individually attributable CLI credentials.

fused-cli --engine-url "http://localhost:8081" login

The browser flow creates the resulting fsk_ key locally; the Engine stores only its hash and binds it to the authenticated subject. Use --no-browser to print the approval URL for an interactive remote session. login --no-input is valid because browser approval does not require terminal input; combine it with --no-browser to print the URL for approval elsewhere. Unattended automation should use --key, FUSED_API_KEY, or FUSED_LICENSE_KEY instead.

Inspect or revoke the saved login without revealing its credential:

fused-cli whoami
fused-cli logout

logout removes the saved credential and expiry metadata while preserving the Engine URL. It does not unset credential environment variables.

You can also configure values directly:

fused-cli config set engine-url http://localhost:8081
fused-cli config set api-key "$FUSED_API_KEY"
fused-cli config list
fused-cli workspace services list

If you do not have an Engine yet, use a release from the Fused Engine repository.

Configuration precedence

The CLI resolves configuration in this order:

  1. Command-line flags: --key and --engine-url.
  2. Saved login/config values.
  3. FUSED_API_KEY.
  4. FUSED_LICENSE_KEY.

A saved login wins over ambient credential variables so the attributable user identity remains active after login.

Automation-safe execution

Engine requests time out after one minute by default. Reviewed import plan and import apply requests use a 20-minute default because large contracts can require longer bounded parser and persistence work. Override either default with --timeout; use --request-id for an audit correlation ID. SIGINT and SIGTERM cancel outstanding requests.

Use --no-input in scripts and agent runs. CI=true enables the same non-interactive behaviour and disables release update checks; FUSED_NO_UPDATE_CHECK=1 disables only the update check.

Agent-readable commands expose --json, including reads, plans, SDK apply and download, token generation, invocation, and activity. Paginated output contains items, total, limit, and offset. A command using --json writes a structured error to stderr on failure and exits non-zero.

Credentials and buckets

fused-cli bucket list
printf '%s' "$GITHUB_TOKEN" | fused-cli secret set github --value-stdin

Use fused-cli service show <slug> --json to inspect a service's available authentication schemes before setting credentials. OAuth/OIDC app credentials use fused-cli secret set <slug> --bucket <bucket> --type oauth|oidc --auth-name <scheme> --value-stdin with client_id=...;client_secret=.... They remain separate from connected-user tokens and workspace configuration.

Teams, people, and shared access

Solo workspaces do not need RBAC setup. Organisation workspaces can inspect and manage people, ownership, and access with:

fused-cli team list
fused-cli user list
fused-cli team eligible-owners
fused-cli workspace access bucket grant company-credentials

SDKs, MCP servers, and webhook registrations belong to the authenticated person by default. Pass plan --owner-team <team-slug> only when a team should own the resource. Workspace-wide use is separate from ownership and does not grant secret, configuration, or token management.

See the command reference for the complete team, user, bucket, secret, connect, and access command surface.