Halo Blog Manager

Manage Halo blogs via API - create/edit/delete posts, manage categories/tags, handle comments, upload media. Use when user asks to manage their Halo blog, post articles, check blog stats, or perform any Halo CMS operations. Triggers on 'halo blog', 'halo cms', 'manage blog', 'post to halo', 'halo api'.

Halo Manager

Manage Halo blogs through the official API.

First-Time Setup

When this skill is first used, ask the user for:

1. Blog URL (e.g., https://blog.example.com)
2. Username
3. Password

Then save credentials to ~/halo-manager/config.json:

json

{
  "blog_url": "https://blog.example.com",
  "username": "your-username",
  "password": "your-password"
}

Security Note: Never expose credentials in logs, responses, or shared channels.

Authentication

Halo uses RSA-encrypted password + CSRF token + Session cookie.

Login Flow

1. GET /login - Extract CSRF token and RSA public key
2. Encrypt password with RSA public key (JSEncrypt)
3. POST /login with form data (username, encrypted password, CSRF token)
4. Receive SESSION cookie for subsequent requests

Session Management

• Use SESSION cookie for all authenticated requests
• If session expires, re-login automatically
• Store session state in ~/halo-manager/session.json

API Endpoints

Console API Base

text

{blog_url}/apis/api.console.halo.run/v1alpha1/

Posts

Operation	Method	Endpoint
List posts	GET	/posts
Get post	GET	/posts/{name}
Create post	POST	/posts
Update post	PUT	/posts/{name}
Delete post	DELETE	/posts/{name}

Categories

Operation	Method	Endpoint
List categories	GET	/categories
Create category	POST	/categories
Update category	PUT	/categories/{name}
Delete category	DELETE	/categories/{name}

Tags

Operation	Method	Endpoint
List tags	GET	/tags
Create tag	POST	/tags
Update tag	PUT	/tags/{name}
Delete tag	DELETE	/tags/{name}

Users

Operation	Method	Endpoint
List users	GET	/users
Get current user	GET	/users/-

Comments

Operation	Method	Endpoint
List comments	GET	/comments
Approve comment	PUT	/comments/{name}/approval
Delete comment	DELETE	/comments/{name}

Media

Operation	Method	Endpoint
List attachments	GET	/attachments
Upload attachment	POST	/attachments
Delete attachment	DELETE	/attachments/{name}

Common Workflows

Create a Post

1. Login to get session
2. Prepare post data:

json

{
  "post": {
    "spec": {
      "title": "Post Title",
      "slug": "post-slug",
      "content": "Post content in Markdown",
      "rawType": "markdown",
      "categories": ["category-name"],
      "tags": ["tag1", "tag2"],
      "publish": true
    }
  }
}

3. POST to /posts
4. Verify creation

Upload Media

1. Login to get session
2. Prepare multipart form data
3. POST to /attachments
4. Get attachment URL from response

Error Handling

Status	Meaning	Action
401	Unauthorized	Re-login
403	Forbidden	Check permissions
404	Not found	Verify resource exists
500	Server error	Retry or report

Output Format

text

【操作名称】

请求：{method} {endpoint}
状态：{status_code}
结果：成功/失败

详情：...

Security Best Practices

1. Never log credentials - Mask passwords in all outputs
2. Use HTTPS - Always prefer secure connections
3. Session timeout - Re-authenticate when session expires
4. Local storage only - Credentials stay on user's machine

References

• API Reference - Complete API documentation
• Examples - Common usage examples