Tela CLI

@meistrari/tela-cli owns the local tela binary for scriptable access to Tela Local state and agent workflows.

The CLI reads and writes the same ~/.tela/config.json state as Tela Dock through @meistrari/tela-local-config. It should not parse local config files directly, and normal output must not print token material.

Commands

Current first-slice commands:

tela auth token --json
tela auth token --raw
tela context current --json
tela context list --json
tela context show <context-id> --json
tela context use <context-id>
tela env list --json
tela update --json
tela api <slug> <METHOD> <PATH> [args...] --env <slug> --body <json> --pretty
tela docs endpoints <slug> --pretty
tela docs reference <slug> [METHOD PATH|file-path] --pretty
tela docs guide <slug> [path]
tela env list <ingredient-slug> --pretty
tela env set <ingredient-slug> <environment>
tela whoami --pretty
tela doctor auth --json
tela agent sync [repo] --current --all --dry-run --json --verbose
tela agent run --input <name=path>... --plain --json --verbose
tela agent push --message <text> --claude --manual --dry-run --json --verbose
tela agent feedback --list --apply <all|select> --json --verbose

context use is the only normal config mutation in this slice. auth token may refresh a user-session credential in Keychain before returning metadata or printing a raw token. Creating, removing, editing, and repairing contexts are Dock-first workflows.

The legacy telactl Pantry/service workflows are ported into this binary as top-level update, api, docs, whoami, and token commands. Ingredient cache and per-ingredient environment defaults live under TELA_HOME next to the Dock config, while credential material still comes from the selected Tela context through @meistrari/tela-local-config.

Development

From the repository root:

pnpm cli:build
pnpm cli:test
pnpm --filter @meistrari/tela-cli run typecheck

Run the built binary directly during development:

node apps/tela-cli/dist/index.js context current --json
node apps/tela-cli/dist/index.js auth token --json

Use TELA_HOME to point the CLI at an isolated config directory:

TELA_HOME=/tmp/tela-home node apps/tela-cli/dist/index.js env list --json

Credential Behavior

The CLI uses the credential adapter contract from local-config.

• env credentials read TELA_ACCESS_TOKEN, TELA_REFRESH_TOKEN, or TELA_DATA_TOKEN.
• macOS keychain credentials use the system security command.
• expired user-session access tokens with a refresh token are reported as refreshable, not as a hard auth failure.
• auth token refreshes expired user-session access tokens when a refresh token is available.
• unsupported providers report diagnostic status instead of exposing secrets.

auth token --raw is the explicit token-export escape hatch for shell scripts. Default and --json output stay redacted.

Tests

Tests are black-box node --test cases that execute the compiled CLI with an isolated TELA_HOME.

pnpm --filter @meistrari/tela-cli run test