helmr computer

helmr computer create TEMPLATE [--key KEY] [--idempotency-key KEY] [--json]
helmr computer list [--key KEY | [--secret NAME] [--cursor CURSOR] [--limit N]] [--json]
helmr computer get (--id UUID | --key KEY) [--json]
helmr computer sessions (--id UUID | --key KEY) [--cursor CURSOR] [--limit N] [--json]
helmr computer commands (--id UUID | --key KEY) [--cursor CURSOR] [--limit N] [--json]
helmr computer delete (--id UUID | --key KEY) [--dry-run] [--idempotency-key KEY] [--json]
helmr computer exec (--id UUID | --key KEY) [--idempotency-key KEY] -- COMMAND [ARG...]

All commands also accept project/environment scope.

exec accepts --cwd, repeated --set-env NAME=VALUE, --stdin FILE, and --timeout (default 5m, maximum 24h). Without --idempotency-key, each run admits a new Command; reuse a key to retry one admission. It returns a Command ID after admission. Use helmr command to read output, wait, or cancel. The -- separator is required before the remote command.

Delete a Computer

Deleting cancels its Sessions and the Sessions they started, including ones on other Computers, and its unfinished Commands; computers.delete is the only permission it needs. --dry-run prints those counts (sessions_cancelled, commands_cancelled) without changing anything. delete acknowledges the request; get reports deleting while execution stops, in-flight saves settle and retained disk and checkpoint data are released. Once that cleanup completes, the status becomes deleted and its reserved storage is available for new Computers in the Environment. Deletion does not increase the Environment’s storage limit or delete Session history.

Unreferenced stored objects are removed asynchronously. Images and data still used by other Computers remain protected.

Secret bindings at creation

Use one JSON binding array with --secrets-file; it contains stable Secret IDs and placements, never Secret values. JSON and SDK bindings use secret and allowedOrigins.

Replace these example IDs with Secret IDs from the selected Environment.

[
  {"secret":"GITHUB_TOKEN","env":{"name":"GH_TOKEN","mode":"protected","allowedOrigins":["https://api.github.com"]}},
  {"secret":"DATABASE_PASSWORD","env":{"name":"PGPASSWORD","mode":"raw"}},
  {"secret":"CLIENT_KEY","file":{"path":"/run/secrets/client.key"}}
]

helmr computer create reviewer --secrets-file bindings.json --idempotency-key create-reviewer

Bindings are fixed at Computer creation. See Secrets for client support, upstream trust, rotation, and revocation limits. The Console Computer detail page shows modes and origins without values.

Inspect Templates and usage

Use helmr template list and get to inspect available Templates. Computer get reports the actual instance and its origin template and deployment_id.

sessions and commands list work currently occupying the Computer, including terminated work whose process cleanup is pending (unreconciled). These are not historical lists. Each entry includes id, usage_state and created_at; usage state is distinct from the Session or Command’s lifecycle status. Each collection has its own cursor; do not move a cursor between them.

list, sessions and commands accept page sizes 1–100 (default 50). Computer list --key KEY is an exact lookup and rejects secret, cursor and limit.

Find Computers holding a raw Secret value

list --secret NAME lists non-deleted Computers that received a raw value of that Secret. Each row ends with received when a process or Command on the Computer received the value directly, or may hold (image) when the Computer’s image was prepared with it. JSON output reports the same as secret_exposure: received or image. Protected bindings never deliver the value, so they do not appear here.

helmr computer list --secret DATABASE_PASSWORD

Use this list after revoking or rotating a Secret: raw copies already delivered stay on these Computers until you delete them.