Command reference

Global flags

Available on every command:

Flag	Description
`--tenant <id\|name>`	Override the active tenant for this command
`--project <id\|name>`	Override the active project for this command
`--format <format>` / `-f`	Output format: `table` (default), `json`, `plain`
`--quiet` / `-q`	Suppress success messages and interactive prompts
`--endpoint <url>`	Override the API endpoint
`--no-browser`	Force device flow for `westyx login`
`--version`	Print the version and exit (same output as `westyx version`)
`--help` / `-h`	Show help

Environment variables

Priority: explicit flag > env var > .westyx/config > global config > default

Variable	Equivalent flag	Description
`WESTYX_TOKEN`	-	Access token for CI/CD - bypasses all OAuth flows
`WESTYX_TENANT`	`--tenant`	Active tenant
`WESTYX_PROJECT`	`--project`	Active project
`WESTYX_ENDPOINT`	`--endpoint`	API endpoint
`WESTYX_ENV`	`--env`	Target environment for `secret`/`config`/`flag`, `snapshot`, and `service` commands
`WESTYX_NO_BROWSER`	`--no-browser`	Force device flow

Auth

Authenticate and store credentials.

westyx login [--no-browser] [--force]

Flag	Description
`--no-browser`	Force device flow even on machines with a display
`--force`	Skip the “already logged in” prompt

On success, the CLI auto-selects the first tenant and project.

`westyx logout`

Clear stored credentials. Active tenant and project context is preserved.

westyx logout

`westyx version`

Print the CLI version.

westyx version
# westyx v0.9.0 (linux/amd64)

Upgrade

`westyx upgrade`

Fetch and install a newer release manifest, or check availability without installing.

westyx upgrade [--check] [--force] [--version <version>] [--channel <channel>]

Flag	Description
`--check`	Print latest version and exit without upgrading. Safe for scripts.
`--force`	Bypass the managed-path heuristic (refuses to replace a Homebrew/`.deb`/`.rpm` install otherwise) and skip the downgrade/channel-crossing confirmation prompt.
`--version <version>`	Target version: exact (`v0.4.0`) or major.minor constraint (`v1.2`, resolves to the latest patch in `--channel`).
`--channel <channel>`	Release channel: `stable` (default), `beta`, `dev`. Composes with `--version`.

An exact --version older than the running binary shows a downgrade confirmation (default N; non-interactive stdin exits 2 without --force). A background update check runs once per invocation and prints a one-line notice on stderr when a newer stable version is available, without blocking the command.

Context

`westyx tenant list`

List tenants you belong to.

  ID                                    NAME              ROLE      ACTIVE
  a1b2c3d4-e5f6-7890-abcd-ef1234567890  Acme Digital      owner     *
  b2c3d4e5-f6a7-8901-bcde-f12345678901  Startup Inc       member

`westyx tenant set <id|name>`

Set the active tenant.

westyx tenant set acme-digital

`westyx project list`

List projects in the active tenant.

`westyx project set <id|name>`

Set the active project.

westyx project set backend

`westyx environment list`

Show the active project’s tier and its allowed environment names.

TIER: m

NAME       ACTIVE
develop
test
staging
prod       *

ACTIVE marks whichever environment is currently active for this invocation, from any resolution tier below - including a transient WESTYX_ENV override.

`westyx environment set <name|all>`

Persist a default environment, validated against the tier’s allowed set.

westyx environment set prod
westyx environment set all   # clears the persisted default

Environment resolution priority for every command that takes --env (secret/config/flag get|set|list, snapshot list|create, service list|get):

--env flag
WESTYX_ENV environment variable
.westyx/config workspace environment field
Global config’s persisted default (set via environment set)
Empty - the server resolves your personal environment, or (for a list-shaped command) shows every environment

Whenever the resolved environment came from tier 3 or 4 - never from an explicit --env or WESTYX_ENV, which you already see in what you typed - the CLI prints a one-line notice on stderr before running, suppressed by --quiet:

using default environment "prod" (run 'westyx environment set all' to clear)

Analyze

westyx analyze [path] [flags]

Reads a .env file, classifies each entry, and writes a .wx file for review.

Flag	Default	Description
`[path]`	`.env`	Path to the `.env` file
`--service=<id\|name>`	-	Not yet implemented - prints a notice and proceeds without service metadata
`--output <path>`	`.westyx/.wx`	Output path
`--monorepo` / `--multi-service`	off	Group entries by service prefix (multi-service mode; `--multi-service` is an alias)

Classification rules (applied in order):

Entry	Classified as
Value is `true` or `false` (case-insensitive)	`flag`
Key has a `_`/`-`-separated segment that exactly matches a secret keyword (`password`, `passwd`, `pwd`, `pw`, `secret`, `token`, `api_key`, `apikey`, `private_key`, `credential`, `auth`, `signing`)	`secret`
Value matches an embedded credential URL pattern (`://user:pass@`)	`secret`
Value contains a credential query-string parameter (`password=`, `passwd=`, or `secret=`)	`secret`
Everything else	`config`

Matching is word-boundary based, not substring: AUTH_TOKEN matches (auth and token are whole segments) but AUTHOR_NAME does not. westyx analyze prints no summary on success - it writes the .wx file silently (exit 0) and adds *.wx / !.westyx/example.wx to the nearest .gitignore on first write. Review the generated file, then run westyx dev push.

Developer workflow (`westyx dev`)

`westyx dev push`

Push a .wx file to your personal Nexus dev environment.

westyx dev push [path] [--overwrite] [--ask]

Flag	Default	Description
`[path]`	`.westyx/.wx`	`.wx` file to push
`--overwrite`	off	Force-overwrite all existing keys
`--ask`	off	Prompt on conflict

--overwrite and --ask are mutually exclusive (exit 2 if both are set). In non-interactive mode (no TTY on stdin), --ask has no effect and silently falls back to keep, printing a warning first. Conflict behaviour per entry:

Situation	Default	`--overwrite`	`--ask`
Key does not exist	CREATED	CREATED	CREATED
Key exists	SKIPPED	UPDATED	Prompt
Key exists, `on_conflict = "overwrite"` in `.wx`	UPDATED	UPDATED	UPDATED

Output:

  CREATED  secret  db_password
  SKIPPED  config  max_retries    (exists - on_conflict: keep)
  UPDATED  config  log_level      (on_conflict: overwrite)
Push complete: 2 created · 1 updated · 1 skipped · 0 failed

If a service block has an empty id, the service is created in Nexus and the assigned UUID is written back into the .wx file.

`westyx dev pull`

Download the entire project’s current state to a .wx file.

westyx dev pull [--output <path>] [--service=<id|name>] [--yes]

Flag	Default	Description
`--output <path>`	`.westyx/.wx`	Output path
`--service=<id\|name>`	all	Pull one service only
`--yes` / `-y`	off	Skip the overwrite/replace confirmation prompt

`westyx dev setup`

Configure Developer WIF credentials for a service. After setup, the Nexus SDK detects the credentials automatically - no api_key needed in your local config.

westyx dev setup --service=<id|name> [--ttl <duration>]

--ttl defaults to the server default of 8h when omitted. Credentials are stored at ~/.config/westyx/dev-credentials.json (0600). Scope by tier (production-type environments - prod, prod-blue, prod-green - are never accessible via Developer WIF, regardless of tier):

Tier	Accessible environments
`free`, `xs`	`develop`
`s`	`develop`, `test`
`m`, `l`, `xl`	`develop`, `test`, `staging`

`westyx dev run`

Start a process with Nexus values injected as environment variables.

westyx dev run [script-name] [-- command]

Scripts are defined in .westyx/config:

westyx dev run              # default_script from .westyx/config
westyx dev run start        # named script
westyx dev run test         # named script
westyx dev run -- go run .  # ad-hoc command, default .wx profile

When Nexus is unreachable, values are read from .westyx/.wx as a fallback. Key name transformation on injection: uppercased, dots and hyphens replaced with underscores. (max.retries becomes MAX_RETRIES)

`westyx dev status`

Show Developer WIF credential state.

  SERVICE           ENDPOINT                                EXPIRES     STATUS
  my-backend-api    https://swift-ocean-a5rx7.westyx.dev    in 6h 42m   ✓ valid
  payments          https://bold-river-9xk2m.westyx.dev     expired     ✗ expired

`westyx dev teardown`

Remove Developer WIF credentials.

westyx dev teardown --service=<id|name> [--yes]
westyx dev teardown --all [--yes]

--service and --all are mutually exclusive; exactly one is required. --yes / -y skips the confirmation prompt (only asked for --all).

Services

westyx service list   [--env=<env>]
westyx service get    <id|name> [--env=<env>]
westyx service create --name=<name> --env=<env> [--kind=backend|frontend] [--description=<text>] [--umbrella] [--auth-mode=api_key|wif]
westyx service delete <id|name> [--env=<env>] [--yes]

Table output columns: ID, NAME, KIND, ENV, ENDPOINT, UMBRELLA (✓ / -). get renders through the same row type as list, just with one row. <id|name> resolves the same way every --service flag does: a UUID resolves directly; a name is matched by listing, and --env disambiguates a same-named service across environments. create requires --name and --env - a service belongs to exactly one environment. --kind defaults to backend, --auth-mode defaults to api_key. Tier limits, WIF prerequisites (auth-mode=wif needs the project’s Security add-on and at least one trust policy) and name collisions are reported by the server.

✓ Service created: svc_01jx... "payments"
  Kind:      backend
  Env:       prod
  Umbrella:  no

delete requires project owner or manager, prompts for confirmation unless --yes, and deletes the service and everything scoped to it (secrets, configs, flags, keys). Refused with an error if the target is an umbrella that still has services linked to it - unlink them first.

Snapshots

westyx snapshot list    [--env=<env>]
westyx snapshot create  --env=<env> [--name=<name>] [--auto-delete-days=<n|never>]
westyx snapshot delete  <id> [--yes]
westyx snapshot diff    <id>
westyx snapshot restore <id> [--service-ids=<uuid,...>] [--save-before] [--yes]

Table output columns for list: ID, NAME (- if unnamed), ENV, CREATED, AUTO-DELETE (in N days / keep), SERVICES (count). create defaults to a 7-day auto-delete; --auto-delete-days=never pins the snapshot. 409 snapshot_cap_exceeded from the API is surfaced as-is. diff shows secrets as changed/unchanged only (values are never printed), configs with their actual before/after values, and flags with their enabled state. Services deleted since the snapshot show STATUS: deleted_since; services added since show STATUS: added_since. restore is atomic - the backend applies every targeted service in one transaction, so a failure leaves nothing changed. Without --yes it prints the diff summary and prompts before restoring. --save-before takes a backup snapshot first and aborts the restore if that backup fails. --service-ids (comma-separated UUIDs, from snapshot list/diff output - names are not accepted) selects a subset for restore. delete requires manager+ role and prompts for confirmation unless --yes.

Secrets

westyx secret get <key>            [--service=<id|name>] [--env=<env>]
westyx secret set <key> <value>    --service=<id|name>   [--env=<env>]
westyx secret list                 [--service=<id|name>] [--env=<env>]

get without --service searches all non-umbrella services; exits 2 if the key exists in more than one service.
set always creates a new version - secrets are versioned and cannot be overwritten.
get and list both mask values in table output (***). Use --format=json or --format=plain to retrieve the actual value.

westyx secret get DB_PASSWORD --service=payments --format=plain

Configs

westyx config get <key>            [--service=<id|name>] [--env=<env>]
westyx config set <key> <value>    --service=<id|name>   [--env=<env>]
westyx config list                 [--service=<id|name>] [--env=<env>]

set is an upsert - creates or updates the key.

Feature flags

westyx flag get <key>              [--service=<id|name>] [--env=<env>]
westyx flag set <key> <value>      --service=<id|name>   [--env=<env>]
westyx flag list                   [--service=<id|name>] [--env=<env>]

set value must be true, false, 1, or 0.

Output formats

Format	Description
`table`	Aligned columns with headers (default for list commands)
`json`	Compact JSON - stable, suitable for scripting
`plain`	One value per line, no headers - for `grep`/`awk`/`xargs`

plain on tenant list / project list prints the primary identifier (name) one per line. plain on secret/config/flag list prints KEY=VALUE one per line. plain on single-value commands (get) prints the bare value.

Exit codes

Code	Meaning	When
`0`	Success	Command completed as requested
`1`	General error	Network failure, unexpected server error
`2`	Usage error	Invalid flags, missing arguments, ambiguous name
`3`	Auth error	Not logged in, session expired, permission denied (403)
`4`	Partial success	`dev push` when some entries succeed and others fail

The `.wx` file format

.wx files are the local representation of your Nexus resources. They are gitignored (contain real secret values) and human-editable. westyx analyze and westyx dev pull both generate them.

workspace {
  tenant  = "acme-digital"
  project = "backend"
}

defaults {
  on_conflict = "keep"   # keep | overwrite | ask
}

service "payments" {
  id   = "b2c3d4e5-f6a7-8901-bcde-f12345678901"
  type = "backend"   # backend | frontend | umbrella
}

secret "stripe_api_key" {
  service     = "payments"
  value       = "sk_live_abc123"
  on_conflict = "overwrite"   # overrides defaults block
}

config "max_retries" {
  service = "payments"
  value   = "3"
}

flag "new_checkout" {
  service = "payments"
  value   = false
}

The on_conflict field on individual blocks overrides the defaults block.

Commit .westyx/example.wx as a structure template for new team members. Never commit .wx files with real values. westyx analyze adds *.wx to .gitignore automatically.

The `.westyx/config` file

Committed to git. Contains workspace context and westyx dev run script definitions.

workspace {
  tenant      = "acme-digital"
  project     = "backend"
  environment = "prod"       # optional - set via 'westyx environment set'
}

run {
  default_script = "start"
}

script "start" {
  command = "go run main.go"
}

script "dev" {
  command = "air"
}

script "test" {
  command = "go test ./..."
}

script "start-staging" {
  profile = "staging"      # uses .westyx/staging.wx
  command = "go run main.go"
}

profile points to a named .wx file in .westyx/ (without the .wx extension). Defaults to .wx (the dot-prefixed default file).

Overview

Reference

Global flags

Environment variables

Auth

`westyx logout`

`westyx version`

Upgrade

`westyx upgrade`

Context

`westyx tenant list`

`westyx tenant set <id|name>`

`westyx project list`

`westyx project set <id|name>`

`westyx environment list`

`westyx environment set <name|all>`

Analyze

Developer workflow (`westyx dev`)

`westyx dev push`

`westyx dev pull`

`westyx dev setup`

`westyx dev run`

`westyx dev status`

`westyx dev teardown`

Services

Snapshots

Secrets

Configs

Feature flags

Output formats

Exit codes

The `.wx` file format

The `.westyx/config` file

​Global flags

​Environment variables

​Auth

​westyx login

​westyx logout

​westyx version

​Upgrade

​westyx upgrade

​Context

​westyx tenant list

​westyx tenant set <id|name>

​westyx project list

​westyx project set <id|name>

​westyx environment list

​westyx environment set <name|all>

​Analyze

​Developer workflow (westyx dev)

​westyx dev push

​westyx dev pull

​westyx dev setup

​westyx dev run

​westyx dev status

​westyx dev teardown

​Services

​Snapshots

​Secrets

​Configs

​Feature flags

​Output formats

​Exit codes

​The .wx file format

​The .westyx/config file

Global flags

Environment variables

Auth

`westyx login`

`westyx logout`

`westyx version`

Upgrade

`westyx upgrade`

Context

`westyx tenant list`

`westyx tenant set <id|name>`

`westyx project list`

`westyx project set <id|name>`

`westyx environment list`

`westyx environment set <name|all>`

Analyze

Developer workflow (`westyx dev`)

`westyx dev push`

`westyx dev pull`

`westyx dev setup`

`westyx dev run`

`westyx dev status`

`westyx dev teardown`

Services

Snapshots

Secrets

Configs

Feature flags

Output formats

Exit codes

The `.wx` file format

The `.westyx/config` file