Halo Blog Manager

Manage Halo blogs via API - create/edit/delete posts, manage categories/tags, handle comments, upload media. Use when user asks to manage their Halo blog, po...

Halo Manager

Manage Halo blogs through the official API.

First-Time Setup

When this skill is first used, ask the user for:

1. Blog URL (e.g., https://blog.example.com)
2. Username
3. Password

Then save credentials to ~/halo-manager/config.json:

{
  "blog_url": "https://blog.example.com",
  "username": "your-username",
  "password": "your-password"
}

Security Note: Never expose credentials in logs, responses, or shared channels.

Authentication

Halo uses RSA-encrypted password + CSRF token + Session cookie.

Login Flow

1. GET /login - Extract CSRF token and RSA public key
2. Encrypt password with RSA public key (JSEncrypt)
3. POST /login with form data (username, encrypted password, CSRF token)
4. Receive SESSION cookie for subsequent requests

Session Management

• Use SESSION cookie for all authenticated requests
• If session expires, re-login automatically
• Store session state in ~/halo-manager/session.json

API Endpoints

Console API Base

{blog_url}/apis/api.console.halo.run/v1alpha1/

Posts

Operation	Method	Endpoint
List posts	GET	/posts
Get post	GET	/posts/{name}
Create post	POST	/posts
Update post	PUT	/posts/{name}
Delete post	DELETE	/posts/{name}

Categories

Operation	Method	Endpoint
List categories	GET	/categories
Create category	POST	/categories
Update category	PUT	/categories/{name}
Delete category	DELETE	/categories/{name}

Tags

Operation	Method	Endpoint
List tags	GET	/tags
Create tag	POST	/tags
Update tag	PUT	/tags/{name}
Delete tag	DELETE	/tags/{name}

Users

Operation	Method	Endpoint
List users	GET	/users
Get current user	GET	/users/-

Comments

Operation	Method	Endpoint
List comments	GET	/comments
Approve comment	PUT	/comments/{name}/approval
Delete comment	DELETE	/comments/{name}

Media

Operation	Method	Endpoint
List attachments	GET	/attachments
Upload attachment	POST	/attachments
Delete attachment	DELETE	/attachments/{name}

Common Workflows

Create a Post

1. Login to get session
2. Prepare post data:

{
  "post": {
    "spec": {
      "title": "Post Title",
      "slug": "post-slug",
      "content": "Post content in Markdown",
      "rawType": "markdown",
      "categories": ["category-name"],
      "tags": ["tag1", "tag2"],
      "publish": true
    }
  }
}

3. POST to /posts
4. Verify creation

Upload Media

1. Login to get session
2. Prepare multipart form data
3. POST to /attachments
4. Get attachment URL from response

Error Handling

Status	Meaning	Action
401	Unauthorized	Re-login
403	Forbidden	Check permissions
404	Not found	Verify resource exists
500	Server error	Retry or report

Output Format

【操作名称】

请求：{method} {endpoint}
状态：{status_code}
结果：成功/失败

详情：...

Security Best Practices

1. Never log credentials - Mask passwords in all outputs
2. Use HTTPS - Always prefer secure connections
3. Session timeout - Re-authenticate when session expires
4. Local storage only - Credentials stay on user's machine

References

• API Reference - Complete API documentation
• Examples - Common usage examples