feat(pkl): add pklr as opt-in pkl backend by jdx · Pull Request #769 · jdx/hk

jdx · 2026-03-23T22:09:26Z

Summary

Add pklr as a built-in Rust pkl evaluator, removing the need for the external pkl CLI
Set HK_PKL_BACKEND=pklr to use it instead of the default pkl CLI
Pass proxy (http_proxy/HTTP_PROXY), CA certificate (HK_PKL_CA_CERTIFICATES), and HTTP rewrite (HK_PKL_HTTP_REWRITE) settings through to the pklr HTTP client
Load all certificates from CA bundle files (not just the first)
Inject _type tags and normalize missing converter transforms in pklr JSON output for pkl CLI parity
Added bats integration tests for the pklr backend
Updated docs to note pkl CLI is no longer required when using pklr

pklr is experimental and may not support every pkl feature yet.

Test plan

Existing bats + cargo tests pass
New test/pklr_backend.bats covers pklr-specific behavior
Verified proxy, CA cert, and HTTP rewrite settings propagate correctly

Note

Medium Risk
Changes how .pkl config (including hkrc) can be evaluated by introducing an alternate Rust-based evaluator and new HTTP client wiring, which could affect config loading and network/certificate behavior. Default CLI-based evaluation remains unchanged unless HK_PKL_BACKEND=pklr is set.

Overview
Adds an opt-in pklr evaluation path for .pkl config files (including hkrc discovery/parsing) when HK_PKL_BACKEND=pklr is set, otherwise continuing to use the external pkl CLI.

When using pklr, config evaluation now builds a dedicated HTTP client that propagates proxy / no-proxy settings, supports loading all certs from HK_PKL_CA_CERTIFICATES PEM bundles, and passes HK_PKL_HTTP_REWRITE rules into pklr eval options. Also updates Cargo.lock to use an older windows-sys version for os_pipe.

^{Written by Cursor Bugbot for commit d587a79. This will update automatically on new commits. Configure here.}

gemini-code-assist · 2026-03-23T22:09:31Z

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

greptile-apps · 2026-03-23T22:11:36Z

Greptile Summary

This PR introduces pklr (an embedded Rust pkl evaluator) as an opt-in backend for config evaluation, selectable via HK_PKL_BACKEND=pklr, so users no longer need the external pkl CLI when using this mode.

Key changes:

build_pklr_http_client() constructs a reqwest::Client honoring http_proxy/HTTP_PROXY/https_proxy/HTTPS_PROXY, no_proxy/NO_PROXY, HK_PKL_CA_CERTIFICATES (loading the full PEM bundle), and passes it through pklr::EvalOptions to the evaluator.
no_proxy support — the concern raised in a prior review has been addressed; get_no_proxy() is now called and applied to the Proxy::all() object via proxy.no_proxy(...).
HK_PKL_HTTP_REWRITE is parsed by splitting on commas and passed as a Vec<String> to pklr::EvalOptions.http_rewrites, matching pklr's native multi-rewrite API.
The Cargo.lock update reflects pklr being bumped to 0.4.0; a transitive change in os_pipe's windows-sys dependency (0.61.2 → 0.45.0) is an artefact of Cargo's resolution, both versions can coexist, and the build passes cleanly.

Confidence Score: 5/5

Safe to merge — the primary prior concern (no_proxy not honoured) is resolved, and no new P0/P1 issues are present.

The no_proxy gap from the previous review round is addressed: get_no_proxy() is called and properly wired into the Proxy object. The reqwest-based client correctly handles all four proxy env vars and loads full PEM bundles. No correctness, security, or data-integrity issues remain.

No files require special attention.

Important Files Changed

Filename	Overview
src/config.rs	Adds pklr backend with build_pklr_http_client() handling proxy, no_proxy, CA certs, and HTTP rewrites; no_proxy concern from prior review is addressed
Cargo.lock	Downgrades os_pipe's windows-sys transitive dependency from 0.61.2 to 0.45.0 as a result of pklr 0.4.0 resolution; normal Cargo behavior with no runtime impact

Sequence Diagram

sequenceDiagram
    participant Caller
    participant Config
    participant run_pklr
    participant build_pklr_http_client
    participant pklr

    Caller->>Config: load config (hkrc / project pkl)
    Config->>Config: check HK_PKL_BACKEND == "pklr"
    alt pklr backend
        Config->>run_pklr: run_pklr(path)
        run_pklr->>build_pklr_http_client: build_pklr_http_client()
        build_pklr_http_client->>build_pklr_http_client: get_http_proxy() → Proxy::all()
        build_pklr_http_client->>build_pklr_http_client: get_no_proxy() → proxy.no_proxy()
        build_pklr_http_client->>build_pklr_http_client: read HK_PKL_CA_CERTIFICATES PEM bundle
        build_pklr_http_client-->>run_pklr: reqwest::Client
        run_pklr->>run_pklr: build EvalOptions {client, http_rewrites}
        run_pklr->>pklr: eval_to_json_with_options(path, options)
        pklr-->>run_pklr: serde_json::Value
        run_pklr-->>Config: deserialized T
    else pkl CLI backend
        Config->>Config: run_pkl(&["eval"], path)
    end
    Config-->>Caller: Config / UserConfig

_{Reviews (12): Last reviewed commit: "fix(pkl): remove pklr normalize workarou..." | Re-trigger Greptile}

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

## Summary pklr previously skipped pkl's `output` block entirely, which meant converter functions were never applied. This caused consumers like hk to need [post-processing workarounds](jdx/hk#769) (`pklr_normalize_step_or_group`) to normalize the JSON output. This PR implements `output.renderer.converters` support: - Track which pkl class each object was instantiated from via `ObjectSource.type_name` - Parse the `output.renderer.converters` block from the AST and evaluate converter lambdas - Add `Evaluator::apply_converters()` which recursively walks the value tree and applies matching converter functions - Call `apply_converters()` in `eval_to_json_with_options()` before serializing to JSON This enables pkl files like hk's `Config.pkl` to use converters for: - Type discrimination (`_type` tags for serde tagged enums) - Value coercion (string → array, bool → string) - Custom serialization (Regex objects) Without this, hk needed ~100 lines of Rust to replicate what pkl's converters do natively. ## Test plan - [x] All 229 existing tests pass unchanged - [x] 5 new tests covering converter functionality: - `converter_injects_type_tag` — basic _type injection - `converter_coerces_values` — string→array and bool→string coercion - `converter_multiple_types` — Group + Step converters with nesting - `converter_no_converters_is_noop` — no converters = unchanged output - `converter_output_not_in_result` — output block excluded from JSON *This comment was generated by Claude Code.* --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

## Summary Fixes the `missing field '_type'` error in hk's CI ([PR #769](jdx/hk#769)). PR #49 added `output.renderer.converters` support, but only extracted converters from the *current* module's body entries. When a file `amends` or `extends` a base module that defines converters (like hk's `hk.pkl` amending `Config.pkl`), those converters were never extracted. - Extract converters from the base module's AST during amends processing - Extract converters from the base module's AST during extends processing - Added `converter_inherited_from_amends_base` test with two files on disk ## Test plan - [x] New test: `converter_inherited_from_amends_base` — creates Base.pkl with converters + child.pkl that amends it, verifies converters are applied - [x] All 235 existing tests pass *This comment was generated by Claude Code.* --------- Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]> Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com>

When using HK_PKL_BACKEND=pklr, proxy (http_proxy/HTTP_PROXY) and CA certificate (HK_PKL_CA_CERTIFICATES) settings were silently ignored. Now builds a configured reqwest::Client with these settings and passes it to pklr via eval_to_json_with_client(). Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

…e warning - Route hkrc evaluation through pklr backend when HK_PKL_BACKEND=pklr - Support no_proxy/NO_PROXY in pklr HTTP client - Remove http:// restriction on proxy URLs (reqwest supports https proxies) - Warn when HK_PKL_HTTP_REWRITE is set with pklr backend (unsupported) Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

pklr 0.2.2 added eval_to_json_with_options() with HTTP URL rewrite support. Use it instead of warning that rewrites are unsupported. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

Certificate::from_pem only parses the first PEM certificate, silently dropping the rest. Use from_pem_bundle to handle CA bundles correctly. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

pklr does not yet implement pkl's output.renderer.converters, so the _type tags that Config.pkl adds to Step/Group objects are missing. This causes deserialization to fail with "missing field _type". Post-process the pklr JSON to inject _type based on object shape: objects with a nested "steps" field are groups, everything else is a step. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

pklr skips pkl's output.renderer.converters block, so several normalizations are missing: - _type tags for Step/Group/Regex (already partially handled) - depends/stage: string -> array coercion - stash: bool -> string coercion ("git"/"none") - Regex objects: inject _type: "regex" for glob/exclude fields Also add #[serde(default)] to Step.depends and Step.env so missing fields default to empty rather than failing deserialization. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

pklr 0.3.0 implements output.renderer.converters natively, so the Rust-side workarounds (pklr_normalize_output, pklr_normalize_step_or_group, pklr_tag_regex) and the #[serde(default)] annotations are no longer needed. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

pklr's output.renderer.converters don't apply to objects created via Mapping type parameters (only explicit `new ClassName { ... }`), so the normalize workarounds are still needed. Keep pklr 0.3.0 for the other improvements (converter infrastructure, HTTP rewrites). This reverts the normalize removal from 4290fbf while retaining the version bump. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

pklr 0.4.0 implements output.renderer.converters natively and propagates type info through Mapping generics and body amendments, so the Rust-side workarounds (pklr_normalize_output, pklr_normalize_step_or_group, pklr_tag_regex) and the Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

@hituzi-no-sippo

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [hk](https://github.com/jdx/hk) | minor | `1.39.0` → `1.40.0` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>jdx/hk (hk)</summary> ### [`v1.40.0`](https://github.com/jdx/hk/blob/HEAD/CHANGELOG.md#1400---2026-04-01) [Compare Source](jdx/hk@v1.39.0...v1.40.0) ##### 🚀 Features - **(betterleaks)** add betterleaks config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#750](jdx/hk#750) - **(builtins)** add google-java-format to builtins by [@timothysparg](https://github.com/timothysparg) in [#777](jdx/hk#777) - **(builtins)** add dclint to builtins by [@timothysparg](https://github.com/timothysparg) in [#779](jdx/hk#779) - **(config)** set default value for exclude to List() by [@timothysparg](https://github.com/timothysparg) in [#781](jdx/hk#781) - **(core)** add required field to prevent unconfigured steps from running by [@timothysparg](https://github.com/timothysparg) in [#785](jdx/hk#785) - **(gitleaks)** add gitleaks config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#749](jdx/hk#749) - **(mdschema)** add mdschema config to hk builtin config by [@hituzi-no-sippo](https://github.com/hituzi-no-sippo) in [#748](jdx/hk#748) - **(pkl)** add pklr as opt-in pkl backend by [@jdx](https://github.com/jdx) in [#769](jdx/hk#769) - add pklr as opt-in pkl backend by [@jdx](https://github.com/jdx) in [#768](jdx/hk#768) ##### 🐛 Bug Fixes - **(docs)** replace invalid /latest/ pkl package URIs with versioned format by [@jdx](https://github.com/jdx) in [#770](jdx/hk#770) - **(stage)** do not stage pre-existing untracked files by [@jdx](https://github.com/jdx) in [#788](jdx/hk#788) ##### 📚 Documentation - add benchmarks page and reproducible benchmark suite by [@jdx](https://github.com/jdx) in [#766](jdx/hk#766) - add recommended setup section to mise integration by [@timothysparg](https://github.com/timothysparg) in [#780](jdx/hk#780) ##### 📦️ Dependency Updates - lock file maintenance by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#762](jdx/hk#762) - update rust crate pklr to 0.4 by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#776](jdx/hk#776) - update apple-actions/import-codesign-certs digest to [`fe74d46`](jdx/hk@fe74d46) by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#774](jdx/hk#774) - update anthropics/claude-code-action digest to [`094bd24`](jdx/hk@094bd24) by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#773](jdx/hk#773) - update taiki-e/upload-rust-binary-action digest to [`0e34102`](jdx/hk@0e34102) by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#775](jdx/hk#775) - bump usage to 3.2.0 and pkl to 0.31.1, add windows platforms by [@jdx](https://github.com/jdx) in [#787](jdx/hk#787) - lock file maintenance by [@renovate\[bot\]](https://github.com/renovate\[bot]) in [#786](jdx/hk#786) ##### New Contributors - [@timothysparg](https://github.com/timothysparg) made their first contribution in [#781](jdx/hk#781) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

greptile-apps Bot reviewed Mar 23, 2026

View reviewed changes

Comment thread src/config.rs

Comment thread src/config.rs

cursor Bot reviewed Mar 23, 2026

View reviewed changes

Comment thread src/config.rs

Comment thread src/config.rs

jdx force-pushed the feat/pklr-backend branch from 29004a1 to f9060ec Compare March 23, 2026 23:37

cursor Bot reviewed Mar 24, 2026

View reviewed changes

Comment thread src/config.rs Outdated

cursor Bot reviewed Mar 24, 2026

View reviewed changes

Comment thread src/config.rs Outdated

Comment thread src/config.rs Outdated

jdx changed the title ~~feat: add pklr as opt-in pkl backend~~ feat(pkl): add pklr as opt-in pkl backend Mar 24, 2026

jdx mentioned this pull request Mar 24, 2026

feat: implement output.renderer.converters support jdx/pklr#49

Merged

2 tasks

This was referenced Mar 25, 2026

fix: inject _type field in JSON output for typed class instances jdx/pklr#51

Closed

fix: extract converters from amends/extends base modules jdx/pklr#52

Merged

jdx and others added 12 commits April 1, 2026 09:08

[autofix.ci] apply automated fixes

1376297

[autofix.ci] apply automated fixes (attempt 2/3)

32689b0

feat: wire up HK_PKL_HTTP_REWRITE to pklr backend

9839dea

pklr 0.2.2 added eval_to_json_with_options() with HTTP URL rewrite support. Use it instead of warning that rewrites are unsupported. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

fix: load all certificates from CA bundle files

8952273

Certificate::from_pem only parses the first PEM certificate, silently dropping the rest. Use from_pem_bundle to handle CA bundles correctly. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

[autofix.ci] apply automated fixes

0393912

jdx force-pushed the feat/pklr-backend branch from 1c450a6 to d587a79 Compare April 1, 2026 14:09

jdx enabled auto-merge (squash) April 1, 2026 14:09

jdx merged commit 9fa0aa6 into main Apr 1, 2026
20 checks passed

jdx deleted the feat/pklr-backend branch April 1, 2026 14:29

jdx mentioned this pull request Apr 1, 2026

chore: release v1.40.0 #763

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(pkl): add pklr as opt-in pkl backend#769

feat(pkl): add pklr as opt-in pkl backend#769
jdx merged 12 commits intomainfrom
feat/pklr-backend

jdx commented Mar 23, 2026 •

edited by cursor Bot

Loading

Uh oh!

gemini-code-assist Bot commented Mar 23, 2026

Uh oh!

greptile-apps Bot commented Mar 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jdx commented Mar 23, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

gemini-code-assist Bot commented Mar 23, 2026

Uh oh!

greptile-apps Bot commented Mar 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented Mar 23, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented Mar 23, 2026 •

edited

Loading