@senticor/hive

The unified command-line interface for Cognitive Hive OS, packaged as a single self-contained file. The only runtime prerequisite is Node.js 24.

Documentation

New to Cognitive Hive OS? The public developer kit walks through getting access, installing this CLI, creating an app and verifying it works:

https://gitlab.com/senticor/oss/sdk

Install

# Run without installing
npx -y @senticor/hive --help

# Or install globally
npm i -g @senticor/hive
hive --help

This package ships one pre-bundled hive.cjs with no runtime dependencies and no install-time scripts — installing it only places the file on disk and links the hive command. It is the same hive.cjs produced for the air-gapped release, so hive version reports an identical build identity across install paths.

Point it at your Hive

export HIVE_API_URL=https://api.hive.example.internal
export HIVE_TENANT=acme

Authenticate

Most commands need a session. Log in over OIDC (Authorization Code + PKCE): the CLI discovers the issuer and OIDC client from your API, so you only supply the API URL, and it never sees your password — SSO/MFA apply as configured.

# Opens a browser, captures the loopback redirect, and stores the token.
hive login --api-url https://api.hive.example.internal

# Pre-fill the username on the login form.
hive login alice

# Remote shell (SSH / Coder / container) where the browser is on another host:
# prints the URL — authenticate anywhere, then paste the code / callback URL back.
# An imperfect paste gets up to three attempts; the printed link stays valid.
hive login --no-browser

# Verify the session, then go.
hive whoami
hive health deep --format json

hive auth is an alias group for login / logout / status (e.g. hive auth status shows token validity; hive logout clears local tokens).

Non-interactive (CI, bots, headless): skip the browser and pass a token directly instead of logging in.

export HIVE_TOKEN=eyJ…          # a Keycloak access token for the caller
hive whoami

Updating

Because this is an npm-managed install, update it with npm — hive upgrade is intentionally inert here and will tell you to:

npm update -g @senticor/hive

Which install path should I use?

| Use case | Install path | Trust basis | | --- | --- | --- | | Public evaluator | npx -y @senticor/hive | npm package integrity (+ provenance where available) | | Connected enterprise dev | npm i -g @senticor/hive or an internal npm mirror | pinned version + SBOM + release evidence | | Sovereign / air-gapped production | Harbor/oras signed artifact or an agency-controlled mirror | pinned digest + signature + SBOM + offline verification |

This public npm package is a convenience for connected developers and evaluators. It is not the authoritative install path for German sovereign or air-gapped production, and publishing it to npm does not constitute BSI certification, VS-NfD approval, or any other sovereign certification. For those environments use the signed Harbor/oras artifact and verify it inside the target environment; your platform operator has the artifact and the verification procedure.

Building this package

This wrapper carries no source. The publishable tarball is assembled from the canonical bundle in packages/hive-cli via an explicit (non-lifecycle) step:

pnpm hive:npm:stage          # bundles hive-cli, leak-scans, stages hive.cjs + LICENSE
cd packages/hive-cli-npm && npm pack --ignore-scripts