Command reference

Run hexel <command> --help for the same information in your terminal.

Global flags

Every command accepts these flags.

activity

Audit log, API activity and logs

hexel activity api

Summarize the organization's API calls: volume, errors and latency

hexel activity api [flags]

hexel activity audit count

Count audit events (same filters as list)

hexel activity audit count [flags]

hexel activity audit get

Show an audit event

hexel activity audit get EVENT_ID

hexel activity audit list

List audit events, newest first

hexel activity audit list [flags]

Also: ls.

hexel activity audit list --since 24h
hexel activity audit list --action token.issue --user su_123 --limit 20

hexel activity audit verify

Check an audit event: Titan's audit service verifies the event's signature over its signed payload and that the indexed copy matches it. Exits 1 when the event does not verify.

hexel activity audit verify EVENT_ID

hexel activity logs

Show the organization's service logs, newest first

hexel activity logs [flags]

hexel activity logs --level error --period 24h
hexel activity logs --service titan-gateway --search denied

hexel activity requests

List the organization's recent API requests, newest first

hexel activity requests [flags]

hexel activity requests --status server_error --period 7d
hexel activity requests --request-id 97b7eff1-7802-4a5f-ab76-20df483c9a42

auth

Sign in, sign out, and show who you are

hexel auth login

Sign in with your Hexel account: hexel shows a code, you approve it in the browser, and the login is stored in your OS keychain.

For CI and scripts, use a service user's API key instead:

echo "$KEY" | hexel auth login --with-api-key

or set HEXEL_API_KEY, which is used without being stored.

hexel auth login [flags]

hexel auth logout

Sign out and remove stored credentials

hexel auth logout

hexel auth token

Print a CIAM access token for the current organization (for scripts)

hexel auth token

hexel auth whoami

Show who you are signed in as, and the current context

hexel auth whoami

Also: status.

billing

Balance, usage, subscription, invoices and credits

hexel billing balance

Show the balance and its credit buckets

hexel billing balance

hexel billing budgets

List budgets and what they have spent

hexel billing budgets

Also: budget.

hexel billing forecast

Show month-to-date spend and the projection for the month

hexel billing forecast [flags]

hexel billing invoice get

Show an invoice

hexel billing invoice get ID

hexel billing invoice list

List invoices

hexel billing invoice list

Also: ls.

hexel billing invoice pdf

Download an invoice as PDF

hexel billing invoice pdf ID [flags]

hexel billing ledger

List credit ledger entries (newest first)

hexel billing ledger [flags]

hexel billing plans

List the plans you can subscribe to

hexel billing plans

hexel billing subscription

Show the organization's subscription

hexel billing subscription

Also: plan.

hexel billing usage

Show a month's costs, by meter, workspace, environment or principal

hexel billing usage [flags]

hexel billing usage
hexel billing usage --period 2026-09 --by workspace
hexel billing usage --workspace ws_123 --by environment

completion

Generate the autocompletion script for the specified shell

hexel completion bash

Generate the autocompletion script for bash

hexel completion bash

hexel completion fish

Generate the autocompletion script for fish

hexel completion fish [flags]

hexel completion powershell

Generate the autocompletion script for powershell

hexel completion powershell [flags]

hexel completion zsh

Generate the autocompletion script for zsh

hexel completion zsh [flags]

config

View and change hexel's settings (endpoints)

hexel config set

Set a setting: api, sts, issuer or client-id (empty value restores the default)

hexel config set KEY VALUE

hexel config view

Show the effective settings and where they are stored

hexel config view

context

Choose the organization, workspace, environment and deployment to work in

hexel context delete

Delete a context

hexel context delete NAME

hexel context list

List contexts

hexel context list

Also: ls.

hexel context set

Set fields of the current context

hexel context set [flags]

hexel context set --org org_123 --workspace ws_456
hexel context set --deployment td-0123…   # default for hexel titan commands

hexel context show

Show the current context

hexel context show

hexel context use

Switch to a context (created empty when it does not exist)

hexel context use NAME

env

Environments in the current workspace

hexel env list

List environments

hexel env list

Also: ls.

iam

Identity and access: service users, API keys, policies, groups, roles and members

hexel iam api-key create

Create an API key for a service user. The key is printed once: Hexel Studio stores only a hash. Keys expire after 90 days unless --expires says otherwise, and at most a year from today.

hexel iam api-key create SERVICE_USER_ID --name NAME [flags]

hexel iam api-key create su_123 --name github-actions --expires 30d
KEY=$(hexel iam api-key create su_123 --name ci -o json | jq -r .api_key)

hexel iam api-key list

List a service user's active API keys (never the keys themselves)

hexel iam api-key list SERVICE_USER_ID

Also: ls.

hexel iam api-key revoke

Revoke an API key (permanent)

hexel iam api-key revoke SERVICE_USER_ID KEY_ID [flags]

hexel iam group list

List groups

hexel iam group list

Also: ls.

hexel iam group members

List a group's members

hexel iam group members GROUP_ID

hexel iam members

List the organization's members

hexel iam members

Also: member.

hexel iam policy get

Show a policy and its document

hexel iam policy get ID

hexel iam policy list

List policies (managed and your own)

hexel iam policy list

Also: ls.

hexel iam role get

Show a role and its trust policy

hexel iam role get ID

hexel iam role list

List roles

hexel iam role list

Also: ls.

hexel iam service-user create

Create a service user (it can do nothing until you attach a policy)

hexel iam service-user create NAME [flags]

hexel iam service-user delete

Delete a service user (its API keys stop working)

hexel iam service-user delete ID [flags]

hexel iam service-user get

Show a service user

hexel iam service-user get ID

hexel iam service-user list

List service users

hexel iam service-user list

Also: ls.

hexel iam service-user policy attach

Attach a policy to a service user

hexel iam service-user policy attach SERVICE_USER_ID POLICY_ID

hexel iam service-user policy detach

Detach a policy (by attachment ID, from policy list)

hexel iam service-user policy detach SERVICE_USER_ID ATTACHMENT_ID

hexel iam service-user policy list

List the policies attached to a service user

hexel iam service-user policy list SERVICE_USER_ID

Also: ls.

memory

Memory stores: what your agents remember, and recall

hexel memory add

Add a memory (or, with --extract, let Hexel Studio extract facts from TEXT)

hexel memory add STORE_ID TEXT [flags]

hexel memory add mst_123 "Prefers metric units" --user u_42
hexel memory add mst_123 "I moved to Pune last month and work nights now" --user u_42 --extract

hexel memory delete

Delete a memory

hexel memory delete STORE_ID MEMORY_ID

hexel memory forget

Erase everything a store holds for a user, agent or run (permanent)

hexel memory forget STORE_ID --user ID | --agent ID | --run ID [flags]

hexel memory get

Show a memory

hexel memory get STORE_ID MEMORY_ID

hexel memory history

Show how a memory changed

hexel memory history STORE_ID MEMORY_ID

hexel memory job

Show an extraction job

hexel memory job STORE_ID JOB_ID

hexel memory list

List a store's memories (oldest first)

hexel memory list STORE_ID [flags]

Also: ls.

hexel memory recall

Recall the memories that best match a query, from up to 8 stores

hexel memory recall QUERY --store STORE_ID [--store STORE_ID...] [flags]

hexel memory recall "what units does she use" --store mst_123 --user u_42
hexel memory recall "deployment preferences" --store mst_1 --store mst_2 --top-k 5

hexel memory store create

Create a memory store in the current workspace and environment.

--scope-policy caller_managed (the default) lets callers choose the scope of each memory; principal_bound always files a memory under the caller.

hexel memory store create NAME [flags]

hexel memory store delete

Delete a store and every memory in it (permanent)

hexel memory store delete STORE_ID [flags]

hexel memory store get

Show a store

hexel memory store get STORE_ID

hexel memory store list

List memory stores

hexel memory store list

Also: ls.

hexel memory store stats

Count a store's memories

hexel memory store stats STORE_ID

org

Organizations you belong to

hexel org get

Show an organization (default: the current one)

hexel org get [ID]

hexel org list

List your organizations

hexel org list

Also: ls.

skills

Agent skills in the Hexel Studio registry: publish, version, tag and resolve

hexel skills audit

Show your organization's registry audit log (hash-chained)

hexel skills audit [flags]

hexel skills deprecate

Deprecate a version (consumers get a warning)

hexel skills deprecate NAMESPACE/NAME@VERSION [flags]

hexel skills get

Show a skill (its tags), or one version (files, digest, scan, status)

hexel skills get NAMESPACE/NAME[@VERSION]

hexel skills list

List the skills in a namespace

hexel skills list NAMESPACE

Also: ls.

hexel skills namespace create

Create a namespace in your organization. Names are global across the registry and cannot be renamed or moved yet, so pick a stable one. Names reserved for Hexel Studio (hexel*, titan*, look-alikes, words like official) are refused.

hexel skills namespace create SLUG

hexel skills namespace list

List your organization's namespaces

hexel skills namespace list

Also: ls.

hexel skills publish

Publish the skill in DIR (its SKILL.md and every file beside it) as a new version. The name comes from SKILL.md's frontmatter (or --name) and the version from its metadata.version (or --version). Versions are never reused: publishing the same content again is a no-op, different content under a published version is refused.

The registry checks the skill, signs the version and scans it; it returns warnings when the change looks bigger than the version bump. Skills up to 10 MB publish in one request; for larger ones use the registry's skills CLI.

hexel skills publish DIR --namespace NAMESPACE [flags]

hexel skills publish ./release-notes --namespace acme --dry-run
hexel skills publish ./release-notes --namespace acme --tag beta
hexel skills publish . --namespace acme --version 1.2.0 --tag stable

hexel skills remove

Remove a version's content (needs registry admin; permanent)

hexel skills remove NAMESPACE/NAME@VERSION [flags]

hexel skills resolve

Resolve references (NS/NAME, NS/[email protected], NS/NAME@stable, NS/NAME@^1.2) to pinned versions

hexel skills resolve REF...

hexel skills restore

Make a deprecated or yanked version active again

hexel skills restore NAMESPACE/NAME@VERSION [flags]

hexel skills scan

Show a version's content scan and its findings

hexel skills scan NAMESPACE/NAME@VERSION

hexel skills search

Search the skills your organization may read

hexel skills search QUERY [flags]

hexel skills tag delete

Delete a tag

hexel skills tag delete NAMESPACE/NAME TAG

hexel skills tag list

List a skill's tags

hexel skills tag list NAMESPACE/NAME

Also: ls.

hexel skills tag set

Point a tag at a version (latest moves by itself)

hexel skills tag set NAMESPACE/NAME TAG VERSION [flags]

hexel skills tag set acme/release-notes stable 1.2.0
hexel skills tag set acme/release-notes stable 1.3.0 --if-match 1.2.0   # only if it still points at 1.2.0

hexel skills versions

List a skill's versions, highest first

hexel skills versions NAMESPACE/NAME [flags]

hexel skills whoami

Show how the registry sees you: organization and permissions

hexel skills whoami

hexel skills yank

Yank a version (pinned consumers get an error)

hexel skills yank NAMESPACE/NAME@VERSION [flags]

titan

Titan: control and audit what your AI agents do

These flags apply to every hexel titan command:

hexel titan agent create

Register an agent

hexel titan agent create --name NAME [flags]

hexel titan agent create --name support-bot --label team=support

hexel titan agent events

List an agent's registry events

hexel titan agent events ID [flags]

Also: ls.

hexel titan agent get

Show an agent

hexel titan agent get ID

hexel titan agent list

List agents in the organization

hexel titan agent list

Also: ls.

hexel titan agent resume

Resume a suspended agent

hexel titan agent resume ID

hexel titan agent retire

Retire an agent (permanent)

hexel titan agent retire ID [flags]

hexel titan agent suspend

Suspend an agent (until resumed)

hexel titan agent suspend ID [flags]

hexel titan agent-deployment create

Create an agent deployment: a published revision, running under a control profile, in the workspace and environment of the context (or --workspace and --env). --runtime-class is workload, interactive, ephemeral, titan_managed or external_managed.

hexel titan agent-deployment create --name NAME --revision REVISION_ID --control-profile PROFILE_ID --runtime-class CLASS [flags]

hexel titan agent-deployment create --name support-prod --revision rev_123 --control-profile dcp_123 --runtime-class workload

hexel titan agent-deployment events

List an agent deployment's registry events

hexel titan agent-deployment events ID [flags]

Also: ls.

hexel titan agent-deployment get

Show an agent deployment

hexel titan agent-deployment get ID

hexel titan agent-deployment list

List agent deployments

hexel titan agent-deployment list [flags]

Also: ls.

hexel titan agent-deployment resume

Resume a suspended agent deployment

hexel titan agent-deployment resume ID

hexel titan agent-deployment retire

Retire an agent deployment (permanent)

hexel titan agent-deployment retire ID [flags]

hexel titan agent-deployment suspend

Suspend an agent deployment (until resumed)

hexel titan agent-deployment suspend ID [flags]

hexel titan approval approve

Approve a pending request

hexel titan approval approve ID

hexel titan approval deny

Deny a pending request

hexel titan approval deny ID

hexel titan approval list

List approvals (default: pending)

hexel titan approval list [flags]

Also: ls.

hexel titan binding create

Create an identity binding from a JSON request body (- reads standard input). A Kubernetes service account binding:

{"type": "kubernetes_service_account", "runtime_principal_id": "…",
 "selector": {"cluster_id": "…", "issuer": "…", "audience": "…",
              "namespace": "…", "service_account_name": "…",
              "service_account_uid": "…"}}

Optional: maximum_assurance and valid_until (RFC 3339). A device key binding (type titan_device_key) is made by hexel titan enrollment create.

hexel titan binding create -f FILE [flags]

hexel titan binding create -f binding.json

hexel titan binding events

List an identity binding's registry events

hexel titan binding events ID [flags]

Also: ls.

hexel titan binding get

Show an identity binding

hexel titan binding get ID

hexel titan binding list

List identity bindings

hexel titan binding list [flags]

Also: ls.

hexel titan binding resume

Resume a suspended identity binding

hexel titan binding resume ID

hexel titan binding retire

Retire an identity binding (permanent)

hexel titan binding retire ID [flags]

hexel titan binding suspend

Suspend an identity binding (until resumed)

hexel titan binding suspend ID [flags]

hexel titan control list

List the quarantines and kills in force

hexel titan control list [flags]

Also: ls.

hexel titan control quarantine

Quarantine stops a target at once and reversibly: Titan refuses its actions until hexel titan control resume. --type chooses what TARGET_ID names: agent (default) or deployment (an agent deployment).

hexel titan control quarantine TARGET_ID [flags]

hexel titan control quarantine agt_123 --reason SECURITY_INCIDENT

hexel titan control resume

Lift a quarantine

hexel titan control resume TARGET_ID [flags]

hexel titan control resume agt_123

hexel titan control-profile create

Create a deployment control profile in an enforcement deployment (default: the context's deployment). The switches it records are what Titan requires of every agent deployment that uses the profile.

hexel titan control-profile create --attestation none|platform_bound|titan_managed [flags]

hexel titan control-profile create --attestation titan_managed --mandatory-mediation --credential-isolation --runtime-peer-auth --deny-egress-bypass

hexel titan control-profile events

List a control profile's registry events

hexel titan control-profile events ID [flags]

Also: ls.

hexel titan control-profile get

Show a control profile

hexel titan control-profile get ID

hexel titan control-profile list

List control profiles

hexel titan control-profile list [flags]

Also: ls.

hexel titan control-profile resume

Resume a suspended control profile

hexel titan control-profile resume ID

hexel titan control-profile retire

Retire a control profile (permanent)

hexel titan control-profile retire ID [flags]

hexel titan control-profile suspend

Suspend a control profile (until resumed)

hexel titan control-profile suspend ID [flags]

hexel titan deployment domains

List a deployment's custom domains

hexel titan deployment domains [ID]

hexel titan deployment get

Show a deployment (default: the context's)

hexel titan deployment get [ID]

hexel titan deployment list

List deployments in the organization

hexel titan deployment list [flags]

Also: ls.

hexel titan deployment retire

Retire a deployment (permanent: its agents stop getting tokens)

hexel titan deployment retire ID [flags]

hexel titan discovery events

List a discovery card's registry events

hexel titan discovery events ID [flags]

Also: ls.

hexel titan discovery get

Show a discovery card

hexel titan discovery get ID

hexel titan discovery list

List the organization's discovery cards

hexel titan discovery list [flags]

Also: ls.

hexel titan discovery resume

Resume a suspended discovery card

hexel titan discovery resume ID

hexel titan discovery retire

Retire a discovery card (permanent)

hexel titan discovery retire ID [flags]

hexel titan discovery search

Search the discovery cards visible to the organization

hexel titan discovery search [--capability ID] [flags]

hexel titan discovery search --capability invoice.summarize

hexel titan discovery suspend

Suspend a discovery card (until resumed)

hexel titan discovery suspend ID [flags]

hexel titan enrollment create

Enroll a device's Ed25519 public key (base64url, unpadded: the 32 raw bytes, as titand stores it) for a runtime principal. Titan creates the device key identity binding with it.

hexel titan enrollment create --principal ID --public-key KEY [flags]

hexel titan enrollment create --principal rp_123 --public-key 3q2-7w…

hexel titan enrollment get

Show a device enrollment

hexel titan enrollment get ID

hexel titan finding list

List Defender findings

hexel titan finding list

Also: ls.

hexel titan fleet list

List the fleet's sessions

hexel titan fleet list

Also: ls.

hexel titan kill

Stops a target at once: Titan refuses its next action, and running sessions end. --type chooses what TARGET_ID names: agent (default), session, deployment, workspace, environment, connection, capability, destination or organization.

hexel titan kill TARGET_ID [flags]

hexel titan kill agt_123 --reason SECURITY_INCIDENT

hexel titan ledger list

Lists the Agent Ledger, oldest first: up to --limit entries with a sequence number (SEQ) above --after. To read the next page, pass the last SEQ shown as --after. Entries the deployment has pruned are not returned.

EXECUTOR is the Tool Gateway's own refusal code behind a PRE_DISPATCH_FAILED execution (for example NO_ELIGIBLE_CONNECTION); it is empty on other entries.

--type and --outcome filter on the client: the API returns the page of --limit entries, and the CLI shows only the entries in it that match (case-insensitive). A filtered page can show fewer entries than --limit, or none; page on with --after as usual.

hexel titan ledger list [flags]

Also: ls.

hexel titan ledger list --limit 20
hexel titan ledger list --after 300 --type execution --outcome failed

hexel titan ledger verify

Recomputes the Agent Ledger's hash chain on the deployment, from the prune checkpoint to the head. It exits 1 when the chain is broken, and says at which entry.

hexel titan ledger verify

hexel titan principal create

Create a runtime principal for an agent deployment

hexel titan principal create --agent-deployment ID --name NAME [flags]

hexel titan principal create --agent-deployment dep_123 --name worker-1

hexel titan principal events

List a runtime principal's registry events

hexel titan principal events ID [flags]

Also: ls.

hexel titan principal get

Show a runtime principal

hexel titan principal get ID

hexel titan principal list

List runtime principals

hexel titan principal list [flags]

Also: ls.

hexel titan principal resume

Resume a suspended runtime principal

hexel titan principal resume ID

hexel titan principal retire

Retire a runtime principal (permanent)

hexel titan principal retire ID [flags]

hexel titan principal suspend

Suspend a runtime principal (until resumed)

hexel titan principal suspend ID [flags]

hexel titan revision create

Create a draft revision of an agent (publish it to use it)

hexel titan revision create AGENT_ID --artifact-digest D --configuration-digest D --manifest-digest D [flags]

hexel titan revision create agt_123 --artifact-digest sha256:… --configuration-digest sha256:… --manifest-digest sha256:… --capability tools.call

hexel titan revision events

List a revision's registry events

hexel titan revision events ID [flags]

Also: ls.

hexel titan revision get

Show a revision

hexel titan revision get ID

hexel titan revision list

List an agent's revisions

hexel titan revision list AGENT_ID [flags]

Also: ls.

hexel titan revision publish

Publish a revision so it can be deployed

hexel titan revision publish ID

hexel titan revision resume

Resume a suspended revision

hexel titan revision resume ID

hexel titan revision retire

Retire a revision (permanent)

hexel titan revision retire ID [flags]

hexel titan revision suspend

Suspend a revision (until resumed)

hexel titan revision suspend ID [flags]

hexel titan session get

Show a session

hexel titan session get ID

hexel titan session list

List sessions

hexel titan session list [flags]

Also: ls.

hexel titan session resume

Resume a suspended session

hexel titan session resume ID [flags]

hexel titan session revoke

Revoke a session permanently

hexel titan session revoke ID [flags]

hexel titan session suspend

Suspend a session (it can be resumed)

hexel titan session suspend ID [flags]

tools

Toolkits, tools, connections and MCP servers your agents use

hexel tools apply

Register the toolkit and tools a manifest describes: create what is missing, update drafts that changed, and leave the rest alone, after showing the plan. hexel tools import openapi --out writes a manifest; you can also write one by hand (the fields are the registry's create-tool fields).

hexel tools apply -f FILE [flags]

hexel tools apply -f tools.yaml --dry-run
hexel tools apply -f tools.yaml --publish --yes

hexel tools auth-config list

List auth configs in the current workspace

hexel tools auth-config list

Also: ls.

hexel tools connection list

List connected accounts in the current workspace

hexel tools connection list

Also: ls.

hexel tools import openapi

Turn every operation of an OpenAPI 3 or Swagger 2.0 document (a file or an https URL, JSON or YAML) into a tool of one toolkit, and register them.

hexel shows the plan first: each operation, whether it changes data, and whether it is created, updated or left alone; operations the executor cannot call (a non-JSON body, a GET with a body, a required header) are listed as skipped with the reason. Nothing changes until you confirm.

Tools are registered as drafts: review them, then publish the ones your agents may use (--publish publishes them now). Running the import again is safe: unchanged tools are left alone and changed drafts are updated.

Authentication comes from the document's security schemes (an API key in a header or query parameter, HTTP bearer or basic, or OAuth 2); --auth overrides it. Connections of the toolkit supply the credential.

To review or edit the tools before registering, write them to a manifest with --out, then register it with hexel tools apply -f.

hexel tools import openapi SPEC [flags]

hexel tools import openapi ./openapi.yaml --dry-run
hexel tools import openapi https://api.example.com/openapi.json --toolkit EXAMPLE --read-only
hexel tools import openapi spec.json --include 'GET /orders*' --exclude '*Admin*' --publish
hexel tools import openapi spec.json --out tools.yaml   # review, then: hexel tools apply -f tools.yaml

hexel tools mcp import

Read the server's tools/list and register each tool as a draft in the server's toolkit; publish them with hexel tools tool publish --toolkit <toolkit> --all. Re-importing is safe: slugs stay stable, and a tool that changed upstream returns to draft.

A server that needs authentication is imported with a connection of your organization (--connection) or a bearer token read from an environment variable (--bearer-env), used for this import only.

hexel tools mcp import SERVER_ID [flags]

hexel tools mcp list

List MCP servers

hexel tools mcp list

Also: ls.

hexel tools mcp register

Register an MCP server, then import its tools with hexel tools mcp import. --auth-toolkit names the toolkit whose connections authenticate the server's tools, when it needs authentication.

hexel tools mcp register URL --slug SLUG [flags]

hexel tools mcp register https://mcp.example.com/mcp --slug example --name "Example MCP"
hexel tools mcp import <server-id> && hexel tools tool publish --toolkit <toolkit> --all

hexel tools tool delete

Delete tools

hexel tools tool delete [SLUG|ID...] [--toolkit SLUG] [--all] [flags]

hexel tools tool deprecate

Deprecate published tools

hexel tools tool deprecate [SLUG|ID...] [--toolkit SLUG] [--all] [flags]

hexel tools tool get

Show a tool, with its input schema

hexel tools tool get SLUG [flags]

hexel tools tool list

List tools

hexel tools tool list [flags]

Also: ls.

hexel tools tool list --toolkit GITHUB

hexel tools tool publish

Publish draft tools (the owner's approval: only published tools reach agents)

hexel tools tool publish [SLUG|ID...] [--toolkit SLUG] [--all] [flags]

hexel tools tool retire

Retire tools (agents can no longer use them); published tools are deprecated first

hexel tools tool retire [SLUG|ID...] [--toolkit SLUG] [--all] [flags]

hexel tools toolkit create

Create a toolkit in your organization

hexel tools toolkit create SLUG --name NAME [flags]

hexel tools toolkit delete

Delete one of your organization's toolkits

hexel tools toolkit delete SLUG [flags]

hexel tools toolkit get

Show a toolkit

hexel tools toolkit get SLUG

hexel tools toolkit list

List toolkits

hexel tools toolkit list [flags]

Also: ls.

version

Show the hexel version

hexel version

Show the hexel version

hexel version

workspace

Workspaces in the current organization

hexel workspace list

List workspaces

hexel workspace list

Also: ls.