deslicer

Vendor-neutral CI client for planning, approving, and shipping Splunk configuration changes via the Deslicer Automation Platform (DAP).

The CLI uses a resolve-then-direct architecture: it calls deslicer-ai at POST /api/cli/resolve-backend to discover the correct Observer backend for your tenant, then talks to that backend directly for plan lifecycle operations. OIDC audience is always https://api.deslicer.ai.

Repository: github.com/deslicer/cli · crates.io: deslicer-cli

Install

Homebrew

brew install deslicer/tap/deslicer

cargo

cargo install deslicer-cli

curl (latest GitHub Release)

curl -fsSL https://raw.githubusercontent.com/deslicer/cli/main/scripts/install.sh | bash

From source (current main, or your local checkout — does not wait for a release)

./scripts/install-from-source.sh

Or without a clone:

curl -fsSL https://raw.githubusercontent.com/deslicer/cli/main/scripts/install-from-source.sh | bash

CI runners — install the binary in your pipeline (GitHub Actions, GitLab CI, Azure DevOps, Bitbucket Pipelines). See docs/installation.md for per-platform OIDC setup.

Updating — deslicer update self-updates from GitHub Releases (Linux/macOS); Homebrew users run brew upgrade deslicer. Source installs: re-run scripts/install-from-source.sh. See docs/installation.md.

Quick start

Agents setting up local Git, an existing repository, or a new GitHub App repo can use the bundled deslicer-repo-setup skill. Ask: “Use deslicer-repo-setup to configure this repository for Deslicer.” It separates Git initialization, CI scaffolding, remote creation, and binding.

New to the CLI? Follow the Quickstart. The fastest way to a first plan — no GitHub App or OIDC setup required — is the bundle flow:

export OBSERVER_API_URL="https://observer.example.com:8088"
export DESLICER_API_TOKEN="<api-key-with-tools-scope>"

deslicer change plan \
  --source-dir ./my-splunk-config \
  --target-group <host-group-uuid> \
  --name "my-first-plan"

See docs/bundle-flow.md for the full walkthrough, limits, and security model. For how the CLI fits into DAP and deslicer-ai, see docs/architecture.md. Testing from a source checkout against a local Observer? Follow docs/local-testing.md.

Commands

Group	Command	Description
auth	deslicer auth login	Exchange CI OIDC for a session; resolve Observer backend
auth	deslicer auth status	Print OIDC/platform binding diagnostics
groups	deslicer groups list	List host groups (id is the value for --target-group)
inventory	deslicer inventory list	List Ansible inventory groups and their hosts
init	deslicer init	Write CI templates from Observer (--provider, optional --bind)
docs	deslicer docs	Print a topic URL (path-a2, init, …). --print for URL only; --open for a browser
enroll	deslicer enroll create	Mint a one-time enrollment token (device session; --write-file when not a TTY)
enroll	deslicer enroll list	List tokens (never reprints the secret)
enroll	deslicer enroll revoke	Revoke a token by UUID --jti
worker	deslicer worker instructions	Print a worker install recipe (--format, --product, --channel)
repo	deslicer repo bootstrap	Create a private GitHub App org repo (dry-run unless --yes; --check for readiness)
repo	deslicer repo refresh	Open a workflow refresh pull request
repo	deslicer repo status	List linked repos and bootstrap job fields
	deslicer completion bash|zsh|fish	Print shell completions to stdout
change	deslicer change plan	Create or refresh a change plan (add --source-dir for the GitHub-App-free bundle flow)
change	deslicer change show	Show plan details
change	deslicer change approve	Approve a pending plan
change	deslicer change reject	Reject a pending plan
change	deslicer change deploy	Execute an approved plan
change	deslicer change revert	Create a Pending inverse plan from a completed plan (dry-run unless --yes)
change	deslicer change jobs	List per-job state and retry_count for a plan execution
change	deslicer change retry	Retry failed plan/job execution (dry-run unless --yes)
change	deslicer change validate	Validate an existing persisted plan
change	deslicer change verify	Verify deployment outcome
change	deslicer change status	Poll plan/execution status
agent	deslicer agent	REPL on the tenant Orchestrator (-a to pick another agent)
agent	deslicer agent list	List the agents this session can run
agent	deslicer agent ls	List recent runs started by this session
agent	deslicer agent run	One-shot run (Orchestrator by default; -a for name or id)
agent	deslicer agent resume	Continue the last conversation (REPL on a TTY; pass a prompt otherwise)
agent	deslicer agent logs	Read or follow a run (--follow; omit the id for the latest)
	deslicer update	Self-update the binary from GitHub Releases (--check to preview)

Global flags and environment

Flag / env	Default	Purpose
--deslicer-api-url / DESLICER_API_URL	https://api.deslicer.ai	deslicer-ai portal (resolve-backend)
--observer-api-url / OBSERVER_API_URL	(unset)	Air-gapped escape hatch — skip resolve; requires DESLICER_API_TOKEN
DESLICER_API_TOKEN (env only)	(unset)	Observer API key (tools scope) for direct Observer access (bundle flow or git-sourced CI). Create under Platform → API keys. Not DAI's stored admin/read key.
--ci-platform	auto	Force platform: github, gitlab, azure, bitbucket, local
--log-format	human	human or json
DESLICER_DOCS_BASE_URL (env only)	GitHub cli blob on main	Hosted docs root when /cli exists (today docs.deslicer.io is Enterprise-only)

GitHub Actions

Grant OIDC to the job, then invoke the composite action (ships from a separate repo — Plan 1d):

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: deslicer/change-action@v1
        with:
          environment: production
          command: deploy
          plan-id: ${{ inputs.plan_id }}

For raw CLI usage inside a workflow, install deslicer and either:

• grant id-token: write and run deslicer auth login (OIDC via DAI), or
• set OBSERVER_API_URL + DESLICER_API_TOKEN and run deslicer change plan --target-group <uuid> (direct Observer; no OIDC).

See docs/installation.md and docs/quickstart.md.

Documentation

• Architecture — how the CLI integrates with DAP and deslicer-ai
• Quickstart — zero to an approved, deployed change (both auth paths)
• Plan-runner E2E — enroll → worker → draft → approve smoke runbook
• Bundle flow — GitHub-App-free plans from a local directory
• Agent runs — run a deslicer-ai agent from a terminal or a pipeline
• CI outputs — output variables per command and CI platform
• Local testing — build from source and test against a local Observer
• Installation — Homebrew, cargo, curl, Docker, and CI platform matrix
• OIDC troubleshooting — exit codes and fixes
• Environments — .deslicer/environments/ convention
• Contributing — local dev and PR guidelines
• Release process — tagging, signing, and publish pipeline

License

Apache-2.0