feature: integrated CLI panel (#91)

[jamby77]

Summary

• Adds a WebSocket-based CLI panel to the Monitor UI for running Valkey/Redis commands directly from the browser
• Two modes: safe (read-only allowlist, default) and unsafe (BETTERDB_UNSAFE_CLI=true, all commands)
• Backend: WebSocket gateway with dedicated Valkey client per connection, command parser, response formatter, rate limiter, auth
• Frontend: collapsible bottom panel with shadcn components, command history, auto-reconnecting WebSocket, keyboard shortcuts

Closes #92, closes #93, closes #94

What's included

Backend (apps/api/src/cli/)

• cli.gateway.ts — WebSocket upgrade handler with token-bucket rate limiter (50 cmd/s), cloud-mode JWT auth, 1 MiB payload limit
• cli.service.ts — command execution with two-tier filtering (safe/unsafe), 18 blocked commands, 30s timeout, 512 KB response truncation
• command-parser.ts — state machine parser for quoted strings (ported from VS Code extension)
• cli.module.ts, cli.types.ts — NestJS module and shared types

Frontend (apps/web/)

• CliPanel.tsx — collapsible panel with shadcn ScrollArea, Collapsible, Tooltip, Separator
• useCliWebSocket.ts — WebSocket connection with exponential backoff reconnection
• useCliHistory.ts — ref-based command history with up/down navigation (no re-render cascade)
• useCliPanel.ts — panel state with sessionStorage persistence and `Ctrl+`` shortcut
• Built-in commands: help, clear, history, exit

Security hardening

• SENTINEL removed from safe-mode allowlist (destructive subcommands)
• Bare subcommand bypass fixed (e.g., CONFIG without subcommand rejected)
• SLOWLOG RESET removed from safe mode
• Cloud-mode JWT session cookie validation on WebSocket upgrade
• 30s command timeout, 512 KB response truncation, 1 MiB WS payload limit
• Token-bucket rate limiter per WebSocket connection

Other changes

• BETTERDB_UNSAFE_CLI env var in Zod schema + startup warning
• unsafeCliEnabled in health response
• CLI types in packages/shared (used by both backend and frontend)
• Cloud auth middleware updated to whitelist /cli/ws
• PRD docs in docs/prd/

Test plan

• Backend: 44 tests (command parser: 11, CLI service: 33 — blocked commands, safe/unsafe mode, subcommand enforcement, response formatting, credential checks)
• Frontend: 13 tests (useCliHistory: 9, CliPanel: 4)
• TypeScript: zero errors (backend + frontend)
• Manual: pnpm dev → open browser → click CLI button → type PING → see "PONG"
• Manual: BETTERDB_UNSAFE_CLI=true pnpm dev → SET foo bar → GET foo → "bar"
• Manual: Try SUBSCRIBE → blocked error
• Manual: `Ctrl+`` toggles panel, up/down arrows navigate history

🤖 Generated with Claude Code

---

Note

Medium Risk
Adds a new WebSocket command-execution surface area and a call() API on database adapters, which is security- and stability-sensitive despite safe-mode/blocked-command guards, rate limiting, timeouts, and output truncation.

Overview
Adds an integrated CLI that lets the web UI execute Valkey/Redis commands via a new /cli/ws WebSocket, with per-client FIFO execution, token-bucket rate limiting, 30s timeouts, and response formatting/truncation.

Introduces BETTERDB_UNSAFE_CLI (default false) to control safe vs unsafe command filtering, centralizes allow/deny logic in @betterdb/shared (checkSafeMode/checkBlocked), and updates database adapters/agent plumbing to support dedicated CLI connections via a new DatabasePort.call(..., { cli }) API.

Adds a collapsible frontend CliPanel (toggle + Ctrl+` shortcut) with command history and auto-reconnecting WebSocket hook, plus supporting shadcn/radix UI primitives and tests; also unifies HTTP upgrade handling in main.ts to route both CLI and agent WebSockets.

^{Reviewed by Cursor Bugbot for commit acfff20. Bugbot is set up for automated code reviews on this repo. Configure here.}

[KIvanow]

Changes here are wrong. The goal was to keep the whitelist and ignore it only if an environment variable/flag is used when the agent starts up, so it is secure by default and then only via explicit change allow the rest of the commands.

[jamby77]

There are no funcitonal changes here, besides moving the allowed commands to shared package. The behavior is the same. Nothing is changing for the agent, regardless of of startup flag. Should the same logic apply as for the CLI?

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Agent CONFIG handler hardcodes GET, breaks unsafe mode
  • The CONFIG-specific fast path now only handles CONFIG GET so other CONFIG subcommands correctly fall through to generic execution in unsafe mode.

Or push these changes by commenting:

@cursor push b5ecd77e73

Preview (b5ecd77e73)

diff --git a/packages/agent/src/command-executor.ts b/packages/agent/src/command-executor.ts
--- a/packages/agent/src/command-executor.ts
+++ b/packages/agent/src/command-executor.ts
@@ -55,7 +55,7 @@
       return this.client.lastsave();
     }
 
-    if (upperCmd === 'CONFIG' && args) {
+    if (upperCmd === 'CONFIG' && args && args.length > 0 && args[0].toUpperCase() === 'GET') {
       return this.client.config('GET', ...args.slice(1));
     }

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 98bf8d1. Configure here.}