Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
WalkthroughEstablishes a new CLI package for Inbox Zero with source code, TypeScript configuration, and package metadata. Introduces a GitHub Actions workflow for automated multi-platform builds and releases, adds a Homebrew formula for package distribution, updates the root setup command to invoke the CLI, and provides CLI documentation and installation guidance. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Possibly related PRs
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![macroscopeapp[bot]](https://avatars.githubusercontent.com/in/900172?s=60&v=4){kind=small}
| on_macos do | ||
| on_arm do | ||
| url "https://github.com/elie222/inbox-zero/releases/download/cli-v#{version}/inbox-zero-darwin-arm64.tar.gz" | ||
| sha256 "REPLACE_WITH_DARWIN_ARM64_SHA256" |
There was a problem hiding this comment.
Suggestion: Formula/inbox-zero.rb uses placeholder sha256 values; replace with the real 64‑char hex digests for each platform tarball so Homebrew verification succeeds (e.g., via shasum -a 256).
🚀 Reply to ask Macroscope to explain or update this suggestion.
👍 Helpful? React to give us feedback.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (5)
packages/cli/README.md (1)
3-3: Minor wording nit: hyphenate “open‑source”Consider changing “an open source AI email assistant” to “an open‑source AI email assistant” for consistency with common style guides. (From LanguageTool hint.)
.github/workflows/cli-release.yml (1)
64-76: Keepversion.txtand Homebrew SHA placeholders in sync with releasesThis workflow assumes:
version.txtexists and is updated before running the workflow.- The computed
cli-v${version}tag matches the Homebrew formula’sversion/URL.- SHA outputs here are copied into the formula’s
sha256fields.If any of these drift (e.g.,
version.txtnot updated, or formula version changed independently), releases orbrew install inbox-zerowill break. Consider documenting this release flow or adding a brief maintainer note nearversion.txt/the formula to reduce sync errors.Also applies to: 126-131
Formula/inbox-zero.rb (1)
6-7: Formula structure is sound; ensure version/SHA consistency before publishingClass name, URLs, arch‑specific installs, and the version test all look correct and align with the release workflow and CLI
program.version("2.21.15"). Before exposing this via the tap, remember to:
- Replace the
REPLACE_WITH_..._SHA256placeholders with the values printed by the workflow.- Keep
versionhere, the CLI--versionstring, andversion.txtin sync when cutting new releases.Also applies to: 11-12, 20-21, 31-32, 40-42
packages/cli/src/main.ts (2)
520-533: Update generated .env header to reflect the new CLI nameThe env generator still writes
# Generated by setup-env CLI, but the tool is now presented asinbox-zero/@inbox-zero/cli. Updating this string will avoid confusion about where the file came from.- "# Generated by setup-env CLI", + "# Generated by Inbox Zero CLI",Also applies to: 582-588
385-456: Define a shared LLM provider type to prevent map key drift during future additionsThe
llmProviderselect returns a narrow union type inferred from its options array. However,defaultModels,llmLinks, andapiKeyEnvVarare typed as plainRecord<string, …>, creating coupling risk: if someone adds a new provider to the select but forgets to update one of these maps, the code will fail at runtime when accessing that map with the new provider key.Define a shared type and use it consistently:
const llmProviders = ["anthropic", "openai", "google", "openrouter", "groq", "aigateway"] as const; type LlmProvider = (typeof llmProviders)[number]; const defaultModels: Record<LlmProvider, { default: string; economy: string }> = { anthropic: { /* ... */ }, // ... } as const; const llmLinks: Record<LlmProvider, string> = { /* ... */ }; const apiKeyEnvVar: Record<LlmProvider, string> = { /* ... */ };This enforces TypeScript coverage—missing a provider in any map will cause a compilation error rather than a runtime crash during setup.
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (7)
.github/workflows/cli-release.yml(1 hunks)Formula/inbox-zero.rb(1 hunks)package.json(1 hunks)packages/cli/README.md(1 hunks)packages/cli/package.json(1 hunks)packages/cli/src/main.ts(20 hunks)packages/cli/tsconfig.json(1 hunks)
🧰 Additional context used
📓 Path-based instructions (9)
!(pages/_document).{jsx,tsx}
📄 CodeRabbit inference engine (.cursor/rules/ultracite.mdc)
Don't use the next/head module in pages/_document.js on Next.js projects
Files:
packages/cli/README.md.github/workflows/cli-release.ymlpackages/cli/tsconfig.jsonpackage.jsonpackages/cli/src/main.tspackages/cli/package.jsonFormula/inbox-zero.rb
**/package.json
📄 CodeRabbit inference engine (.cursor/rules/installing-packages.mdc)
Use
pnpmas the package manager
Files:
package.jsonpackages/cli/package.json
**/*.{ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/data-fetching.mdc)
**/*.{ts,tsx}: For API GET requests to server, use theswrpackage
Useresult?.serverErrorwithtoastErrorfrom@/components/Toastfor error handling in async operations
**/*.{ts,tsx}: Use wrapper functions for Gmail message operations (get, list, batch, etc.) from @/utils/gmail/message.ts instead of direct API calls
Use wrapper functions for Gmail thread operations from @/utils/gmail/thread.ts instead of direct API calls
Use wrapper functions for Gmail label operations from @/utils/gmail/label.ts instead of direct API calls
**/*.{ts,tsx}: For early access feature flags, create hooks using the naming conventionuse[FeatureName]Enabledthat return a boolean fromuseFeatureFlagEnabled("flag-key")
For A/B test variant flags, create hooks using the naming conventionuse[FeatureName]Variantthat define variant types, useuseFeatureFlagVariantKey()with type casting, and provide a default "control" fallback
Use kebab-case for PostHog feature flag keys (e.g.,inbox-cleaner,pricing-options-2)
Always define types for A/B test variant flags (e.g.,type PricingVariant = "control" | "variant-a" | "variant-b") and provide type safety through type casting
**/*.{ts,tsx}: Don't use primitive type aliases or misleading types
Don't use empty type parameters in type aliases and interfaces
Don't use this and super in static contexts
Don't use any or unknown as type constraints
Don't use the TypeScript directive @ts-ignore
Don't use TypeScript enums
Don't export imported variables
Don't add type annotations to variables, parameters, and class properties that are initialized with literal expressions
Don't use TypeScript namespaces
Don't use non-null assertions with the!postfix operator
Don't use parameter properties in class constructors
Don't use user-defined types
Useas constinstead of literal types and type annotations
Use eitherT[]orArray<T>consistently
Initialize each enum member value explicitly
Useexport typefor types
Use `impo...
Files:
packages/cli/src/main.ts
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (.cursor/rules/prisma-enum-imports.mdc)
Always import Prisma enums from
@/generated/prisma/enumsinstead of@/generated/prisma/clientto avoid Next.js bundling errors in client componentsImport Prisma using the project's centralized utility:
import prisma from '@/utils/prisma'
Files:
packages/cli/src/main.ts
**/*.ts
📄 CodeRabbit inference engine (.cursor/rules/security.mdc)
**/*.ts: ALL database queries MUST be scoped to the authenticated user/account by including user/account filtering in WHERE clauses to prevent unauthorized data access
Always validate that resources belong to the authenticated user before performing operations, using ownership checks in WHERE clauses or relationships
Always validate all input parameters for type, format, and length before using them in database queries
Use SafeError for error responses to prevent information disclosure. Generic error messages should not reveal internal IDs, logic, or resource ownership details
Only return necessary fields in API responses using Prisma'sselectoption. Never expose sensitive data such as password hashes, private keys, or system flags
Prevent Insecure Direct Object References (IDOR) by validating resource ownership before operations. AllfindUnique/findFirstcalls MUST include ownership filters
Prevent mass assignment vulnerabilities by explicitly whitelisting allowed fields in update operations instead of accepting all user-provided data
Prevent privilege escalation by never allowing users to modify system fields, ownership fields, or admin-only attributes through user input
AllfindManyqueries MUST be scoped to the user's data by including appropriate WHERE filters to prevent returning data from other users
Use Prisma relationships for access control by leveraging nested where clauses (e.g.,emailAccount: { id: emailAccountId }) to validate ownership
Files:
packages/cli/src/main.ts
**/*.{tsx,ts}
📄 CodeRabbit inference engine (.cursor/rules/ui-components.mdc)
**/*.{tsx,ts}: Use Shadcn UI and Tailwind for components and styling
Usenext/imagepackage for images
For API GET requests to server, use theswrpackage with hooks likeuseSWRto fetch data
For text inputs, use theInputcomponent withregisterPropsfor form integration and error handling
Files:
packages/cli/src/main.ts
**/*.{tsx,ts,css}
📄 CodeRabbit inference engine (.cursor/rules/ui-components.mdc)
Implement responsive design with Tailwind CSS using a mobile-first approach
Files:
packages/cli/src/main.ts
**/*.{js,jsx,ts,tsx}
📄 CodeRabbit inference engine (.cursor/rules/ultracite.mdc)
**/*.{js,jsx,ts,tsx}: Don't useaccessKeyattribute on any HTML element
Don't setaria-hidden="true"on focusable elements
Don't add ARIA roles, states, and properties to elements that don't support them
Don't use distracting elements like<marquee>or<blink>
Only use thescopeprop on<th>elements
Don't assign non-interactive ARIA roles to interactive HTML elements
Make sure label elements have text content and are associated with an input
Don't assign interactive ARIA roles to non-interactive HTML elements
Don't assigntabIndexto non-interactive HTML elements
Don't use positive integers fortabIndexproperty
Don't include "image", "picture", or "photo" in img alt prop
Don't use explicit role property that's the same as the implicit/default role
Make static elements with click handlers use a valid role attribute
Always include atitleelement for SVG elements
Give all elements requiring alt text meaningful information for screen readers
Make sure anchors have content that's accessible to screen readers
AssigntabIndexto non-interactive HTML elements witharia-activedescendant
Include all required ARIA attributes for elements with ARIA roles
Make sure ARIA properties are valid for the element's supported roles
Always include atypeattribute for button elements
Make elements with interactive roles and handlers focusable
Give heading elements content that's accessible to screen readers (not hidden witharia-hidden)
Always include alangattribute on the html element
Always include atitleattribute for iframe elements
AccompanyonClickwith at least one of:onKeyUp,onKeyDown, oronKeyPress
AccompanyonMouseOver/onMouseOutwithonFocus/onBlur
Include caption tracks for audio and video elements
Use semantic elements instead of role attributes in JSX
Make sure all anchors are valid and navigable
Ensure all ARIA properties (aria-*) are valid
Use valid, non-abstract ARIA roles for elements with ARIA roles
Use valid AR...
Files:
packages/cli/src/main.ts
**/*.{js,ts,jsx,tsx}
📄 CodeRabbit inference engine (.cursor/rules/utilities.mdc)
**/*.{js,ts,jsx,tsx}: Use lodash utilities for common operations (arrays, objects, strings)
Import specific lodash functions to minimize bundle size (e.g.,import groupBy from 'lodash/groupBy')
Files:
packages/cli/src/main.ts
🧠 Learnings (13)
📚 Learning: 2025-11-25T14:42:08.869Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/ultracite.mdc:0-0
Timestamp: 2025-11-25T14:42:08.869Z
Learning: Applies to **/*.{ts,tsx} : Use `export type` for types
Applied to files:
packages/cli/tsconfig.json
📚 Learning: 2025-11-25T14:42:08.869Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/ultracite.mdc:0-0
Timestamp: 2025-11-25T14:42:08.869Z
Learning: Applies to **/*.{ts,tsx} : Use the namespace keyword instead of the module keyword to declare TypeScript namespaces
Applied to files:
packages/cli/tsconfig.json
📚 Learning: 2025-11-25T14:42:08.869Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/ultracite.mdc:0-0
Timestamp: 2025-11-25T14:42:08.869Z
Learning: Applies to **/*.{ts,tsx} : Don't use TypeScript namespaces
Applied to files:
packages/cli/tsconfig.json
📚 Learning: 2025-11-25T14:42:08.869Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/ultracite.mdc:0-0
Timestamp: 2025-11-25T14:42:08.869Z
Learning: Applies to **/*.{ts,tsx} : Use `import type` for types
Applied to files:
packages/cli/tsconfig.json
📚 Learning: 2025-11-25T14:36:18.416Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: apps/web/CLAUDE.md:0-0
Timestamp: 2025-11-25T14:36:18.416Z
Learning: Applies to apps/web/**/*.{ts,tsx} : Centralize shared types in dedicated type files
Applied to files:
packages/cli/tsconfig.json
📚 Learning: 2025-11-25T14:42:08.869Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/ultracite.mdc:0-0
Timestamp: 2025-11-25T14:42:08.869Z
Learning: Applies to **/*.{ts,tsx} : Don't use user-defined types
Applied to files:
packages/cli/tsconfig.json
📚 Learning: 2025-11-25T14:42:08.869Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/ultracite.mdc:0-0
Timestamp: 2025-11-25T14:42:08.869Z
Learning: Applies to **/*.{js,jsx,ts,tsx} : Use `with { type: "json" }` for JSON module imports
Applied to files:
packages/cli/tsconfig.json
📚 Learning: 2025-11-25T14:42:08.869Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/ultracite.mdc:0-0
Timestamp: 2025-11-25T14:42:08.869Z
Learning: Applies to **/*.{ts,tsx} : Use `as const` instead of literal types and type annotations
Applied to files:
packages/cli/tsconfig.json
📚 Learning: 2025-11-25T14:38:07.606Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-11-25T14:38:07.606Z
Learning: Applies to apps/web/utils/ai/**/*.ts : Use TypeScript types for all LLM function parameters and return values, and define clear interfaces for complex input/output structures
Applied to files:
packages/cli/tsconfig.json
📚 Learning: 2025-11-25T14:42:08.869Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/ultracite.mdc:0-0
Timestamp: 2025-11-25T14:42:08.869Z
Learning: Applies to **/*.{ts,tsx} : Don't use the TypeScript directive ts-ignore
Applied to files:
packages/cli/tsconfig.json
📚 Learning: 2025-11-25T14:42:08.869Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/ultracite.mdc:0-0
Timestamp: 2025-11-25T14:42:08.869Z
Learning: Applies to **/*.{js,jsx,ts,tsx} : Don't hardcode sensitive data like API keys and tokens
Applied to files:
packages/cli/src/main.ts
📚 Learning: 2025-11-25T14:38:42.022Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/prisma.mdc:0-0
Timestamp: 2025-11-25T14:38:42.022Z
Learning: Applies to **/prisma/schema.prisma : Use PostgreSQL as the database system with Prisma
Applied to files:
packages/cli/src/main.ts
📚 Learning: 2025-11-25T14:38:07.606Z
Learnt from: CR
Repo: elie222/inbox-zero PR: 0
File: .cursor/rules/llm.mdc:0-0
Timestamp: 2025-11-25T14:38:07.606Z
Learning: Applies to apps/web/utils/ai/**/*.ts : System prompts must define the LLM's role and task specifications
Applied to files:
packages/cli/src/main.ts
🧬 Code graph analysis (1)
packages/cli/src/main.ts (1)
apps/web/env.ts (1)
env(17-246)
🪛 LanguageTool
packages/cli/README.md
[grammar] ~3-~3: Use a hyphen to join words.
Context: ...(https://www.getinboxzero.com) - an open source AI email assistant. ## Installat...
(QB_NEW_EN_HYPHEN)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: cubic · AI code reviewer
- GitHub Check: test
🔇 Additional comments (6)
packages/cli/tsconfig.json (1)
1-13: CLI tsconfig looks consistent with build setupExtends the shared base, uses
src→dist, ESNext/bundler resolution and Node types; matches the CLI build scripts and bun usage with no obvious gaps..github/workflows/cli-release.yml (1)
11-22: Build matrix and artifact packaging look coherentOS/target/artifact triplets, bun compile command, tarball creation, and upload paths are all aligned and match the install instructions and Homebrew formula URLs.
Also applies to: 33-51
packages/cli/package.json (1)
6-17: CLI manifest and scripts line up with the build/release workflowBin path, bun-based build scripts (JS and native binaries), and
build:binary:*targets matchsrc/main.ts,distlayout, and the GitHub Actions workflow. No blocking issues here.packages/cli/src/main.ts (2)
9-29: Project-root detection and repo validation look robust
findProjectRoot()correctly handles being run from the repo root,apps/web, orpackages/cli, andrunSetupthen validates that anapps/webdirectory actually exists before proceeding. Combined with the clear error message, this should prevent mis-running the CLI outside a cloned inbox-zero repo.Also applies to: 57-73
38-55: Defaulting tosetupwhen no command is given is a good UX choiceThe
programconfiguration plusprocess.argv.length === 2check cleanly route bareinbox-zeroinvocations to thesetupcommand, while still allowing explicit subcommands in the future.package.json (1)
13-13: Rootsetupscript correctly delegates to the CLI entrypointPointing
setupattsx packages/cli/src/main.ts setupis consistent with the new CLI package and allows running the same flow without a prebuilt binary. No issues here.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
4 issues found across 7 files
Prompt for AI agents (all 4 issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="Formula/inbox-zero.rb">
<violation number="1" location="Formula/inbox-zero.rb:12">
P1: Replace the placeholder Homebrew checksum with the actual SHA-256 of the darwin-arm64 tarball so the formula can be installed securely.</violation>
<violation number="2" location="Formula/inbox-zero.rb:21">
P1: Provide the real SHA-256 checksum for the darwin-x64 archive instead of the placeholder, otherwise `brew install` will fail during verification.</violation>
<violation number="3" location="Formula/inbox-zero.rb:32">
P1: Fill in the actual SHA-256 for the linux-x64 release tarball so Linux installations pass Homebrew’s checksum validation.</violation>
</file>
<file name="packages/cli/package.json">
<violation number="1" location="packages/cli/package.json:43">
P2: The `license` field points to `../../LICENSE`, which is outside the package and isn’t included in the published tarball (the `files` array limits contents to `dist`). Consumers will not receive any license text. Copy the license into this package or reference an SPDX identifier that matches the included file.</violation>
</file>
Reply to cubic to teach it or ask questions. Re-run a review with @cubic-dev-ai review this PR
| on_linux do | ||
| on_intel do | ||
| url "https://github.com/elie222/inbox-zero/releases/download/cli-v#{version}/inbox-zero-linux-x64.tar.gz" | ||
| sha256 "REPLACE_WITH_LINUX_X64_SHA256" |
There was a problem hiding this comment.
P1: Fill in the actual SHA-256 for the linux-x64 release tarball so Linux installations pass Homebrew’s checksum validation.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At Formula/inbox-zero.rb, line 32:
<comment>Fill in the actual SHA-256 for the linux-x64 release tarball so Linux installations pass Homebrew’s checksum validation.</comment>
<file context>
@@ -0,0 +1,44 @@
+ on_linux do
+ on_intel do
+ url "https://github.com/elie222/inbox-zero/releases/download/cli-v#{version}/inbox-zero-linux-x64.tar.gz"
+ sha256 "REPLACE_WITH_LINUX_X64_SHA256"
+
+ def install
</file context>
|
|
||
| on_intel do | ||
| url "https://github.com/elie222/inbox-zero/releases/download/cli-v#{version}/inbox-zero-darwin-x64.tar.gz" | ||
| sha256 "REPLACE_WITH_DARWIN_X64_SHA256" |
There was a problem hiding this comment.
P1: Provide the real SHA-256 checksum for the darwin-x64 archive instead of the placeholder, otherwise brew install will fail during verification.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At Formula/inbox-zero.rb, line 21:
<comment>Provide the real SHA-256 checksum for the darwin-x64 archive instead of the placeholder, otherwise `brew install` will fail during verification.</comment>
<file context>
@@ -0,0 +1,44 @@
+
+ on_intel do
+ url "https://github.com/elie222/inbox-zero/releases/download/cli-v#{version}/inbox-zero-darwin-x64.tar.gz"
+ sha256 "REPLACE_WITH_DARWIN_X64_SHA256"
+
+ def install
</file context>
| on_macos do | ||
| on_arm do | ||
| url "https://github.com/elie222/inbox-zero/releases/download/cli-v#{version}/inbox-zero-darwin-arm64.tar.gz" | ||
| sha256 "REPLACE_WITH_DARWIN_ARM64_SHA256" |
There was a problem hiding this comment.
P1: Replace the placeholder Homebrew checksum with the actual SHA-256 of the darwin-arm64 tarball so the formula can be installed securely.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At Formula/inbox-zero.rb, line 12:
<comment>Replace the placeholder Homebrew checksum with the actual SHA-256 of the darwin-arm64 tarball so the formula can be installed securely.</comment>
<file context>
@@ -0,0 +1,44 @@
+ on_macos do
+ on_arm do
+ url "https://github.com/elie222/inbox-zero/releases/download/cli-v#{version}/inbox-zero-darwin-arm64.tar.gz"
+ sha256 "REPLACE_WITH_DARWIN_ARM64_SHA256"
+
+ def install
</file context>
| "cli", | ||
| "setup" | ||
| ], | ||
| "license": "SEE LICENSE IN ../../LICENSE" |
There was a problem hiding this comment.
P2: The license field points to ../../LICENSE, which is outside the package and isn’t included in the published tarball (the files array limits contents to dist). Consumers will not receive any license text. Copy the license into this package or reference an SPDX identifier that matches the included file.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At packages/cli/package.json, line 43:
<comment>The `license` field points to `../../LICENSE`, which is outside the package and isn’t included in the published tarball (the `files` array limits contents to `dist`). Consumers will not receive any license text. Copy the license into this package or reference an SPDX identifier that matches the included file.</comment>
<file context>
@@ -0,0 +1,44 @@
+ "cli",
+ "setup"
+ ],
+ "license": "SEE LICENSE IN ../../LICENSE"
+}
</file context>
1 participant
Add a Homebrew formula and CI release workflow to build and publish Bun-based Inbox Zero CLI binaries for macOS (arm64/x64) and Linux x64 with version 2.21.15
Introduce a dispatchable GitHub Actions release workflow that builds, tars, checksums, and publishes Bun-compiled CLI binaries and add a
Homebrewformula with platform URLs and tests. Update the CLI to run underbun, set version2.21.15, add asetupsubcommand with defaulting, and improve project root detection. Add a dedicated CLIpackage.jsonandtsconfig, and update the top-level setup script to invoke the CLI.📍Where to Start
Start with the CLI entry point in main.ts, then review the release workflow in cli-release.yml and the formula in inbox-zero.rb.
📊 Macroscope summarized 44b5e87. 2 files reviewed, 10 issues evaluated, 5 issues filtered, 1 comment posted
🗂️ Filtered Issues
packages/cli/src/main.ts — 0 comments posted, 7 evaluated, 5 filtered
process.argvarray in place (process.argv.push("setup")) to inject a default command when no args are provided. This persistent mutation is not restored on any exit path and can leak into subsequent invocations within the same process (e.g., tests or embedded usage), causing unexpected behavior for other code that readsprocess.argvor for later calls tomain(). Use a local copy when parsing (e.g., pass an augmented args array toprogram.parseAsync(...)) rather than mutating the global state. [ Low confidence ].envfile writing can cause an uncaught exception and leave the spinner running without a graceful terminal state.writeFileSync(ENV_FILE, envContent)may throw (e.g., permission denied, disk full), but the code does not catch and stop the spinner or provide a fallback log/exit. Addtry/catcharound file write, ensurespinner.stop(...)executes on all paths, and report the error before exiting. [ Out of scope ]addSection(if (!hasAnyNonComment && vars.every((v) => env[v.name] === undefined)) return;) skips entire sections when all variables are markedcomment: trueand none exist inenv. This contradicts the stated helper contract comment "comment: true = always show as comment", because such sections would not be shown at all instead of being rendered as commented lines. If a caller ever provides a section comprised solely of comment-only vars, the section would be silently omitted, violating the documented behavior. [ Out of scope ]errorto a string viaString(error)before logging (p.log.error(String(error))) loses diagnostic information (e.g., stack trace, error name, nested causes). This degrades error reporting and can hinder troubleshooting. Prefer logging the error object directly or includingerror.stack/error.messagewhen available. [ Out of scope ]ReferenceErrorifp(andp.log) is not initialized before use inp.log.error(String(error)). At runtime, a missing or undefinedpwould cause the catch handler itself to throw, preventing the intended error logging and exit path. Ensurepis defined and initialized or guard its usage. [ Out of scope ]Summary by CodeRabbit
Release Notes
New Features
Documentation
✏️ Tip: You can customize this high-level summary in your review settings.