fix(cli): wire Vite SPA deploys to CDN asset URLs - #1623
Conversation
When deploying a Vite app, set Vite base to the Agentuity CDN origin so index.html and the client module graph load hashed assets from CDN instead of the app origin. Pack-only and local builds are unchanged.
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 18 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (12)
📝 WalkthroughWalkthroughChangesVite builds now use a dedicated adapter that configures CDN asset bases, delegates to the generic adapter, and restores temporary changes. Monorepo detection validates workspace membership. The Hono template binds to a configurable hostname, and the WSL workflow explicitly scaffolds projects with Bun. Vite CDN build flowVite CDN preparation
Workspace detectionWorkspace membership validation
Runtime and workflow adjustmentsTemplate and WSL setup
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
Comment |
📦 Canary Packages Publishedversion: PackagesInstallAdd to your {
"dependencies": {
"@agentuity/coder": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-coder-3.1.12-7db626a.tgz",
"@agentuity/email": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-email-3.1.12-7db626a.tgz",
"@agentuity/cli": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-cli-3.1.12-7db626a.tgz",
"@agentuity/claude-code": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-claude-code-3.1.12-7db626a.tgz",
"@agentuity/api": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-api-3.1.12-7db626a.tgz",
"@agentuity/aigateway": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-aigateway-3.1.12-7db626a.tgz",
"@agentuity/queue": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-queue-3.1.12-7db626a.tgz",
"@agentuity/task": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-task-3.1.12-7db626a.tgz",
"@agentuity/pi": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-pi-3.1.12-7db626a.tgz",
"@agentuity/webhook": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-webhook-3.1.12-7db626a.tgz",
"@agentuity/storage": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-storage-3.1.12-7db626a.tgz",
"@agentuity/coder-tui": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-coder-tui-3.1.12-7db626a.tgz",
"@agentuity/drizzle": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-drizzle-3.1.12-7db626a.tgz",
"@agentuity/keyvalue": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-keyvalue-3.1.12-7db626a.tgz",
"@agentuity/server": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-server-3.1.12-7db626a.tgz",
"@agentuity/db": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-db-3.1.12-7db626a.tgz",
"@agentuity/schema": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-schema-3.1.12-7db626a.tgz",
"@agentuity/hono": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-hono-3.1.12-7db626a.tgz",
"@agentuity/client": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-client-3.1.12-7db626a.tgz",
"@agentuity/opencode": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-opencode-3.1.12-7db626a.tgz",
"@agentuity/runtime": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-runtime-3.1.12-7db626a.tgz",
"@agentuity/vite": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-vite-3.1.12-7db626a.tgz",
"@agentuity/schedule": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-schedule-3.1.12-7db626a.tgz",
"@agentuity/sandbox": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-sandbox-3.1.12-7db626a.tgz",
"@agentuity/skills": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-skills-3.1.12-7db626a.tgz",
"@agentuity/core": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-core-3.1.12-7db626a.tgz",
"@agentuity/stream": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-stream-3.1.12-7db626a.tgz",
"@agentuity/telemetry": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-telemetry-3.1.12-7db626a.tgz",
"@agentuity/config": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-config-3.1.12-7db626a.tgz",
"@agentuity/migrate": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-migrate-3.1.12-7db626a.tgz",
"@agentuity/adapter": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-adapter-3.1.12-7db626a.tgz",
"create-agentuity": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/create-agentuity-3.1.12-7db626a.tgz",
"@agentuity/postgres": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-postgres-3.1.12-7db626a.tgz",
"@agentuity/vector": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-vector-3.1.12-7db626a.tgz",
"@agentuity/analytics": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-analytics-3.1.12-7db626a.tgz",
"@agentuity/genesis": "https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-genesis-3.1.12-7db626a.tgz"
}
}Or install directly: bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-coder-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-email-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-cli-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-claude-code-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-api-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-aigateway-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-queue-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-task-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-pi-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-webhook-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-storage-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-coder-tui-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-drizzle-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-keyvalue-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-server-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-db-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-schema-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-hono-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-client-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-opencode-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-runtime-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-vite-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-schedule-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-sandbox-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-skills-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-core-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-stream-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-telemetry-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-config-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-migrate-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-adapter-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/create-agentuity-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-postgres-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-vector-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-analytics-3.1.12-7db626a.tgz
bun add https://agentuity-sdk-objects.t3.storageapi.dev/npm/3.1.12-7db626a/agentuity-genesis-3.1.12-7db626a.tgz |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🧹 Nitpick comments (1)
packages/cli/src/cmd/build/adapters/vite/cdn-build.ts (1)
83-131: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winRedundant idempotency shortcut (Lines 89-95) — remove; also clears the static-analysis hint.
Whenever the guard at Lines 89-95 returns
changed: false, the catch-all/\bbase\s*:/.test(source)at Line 114 would return the exact same result anyway (any existingbase:assignment is left alone). This block never produces a different outcome than falling through — it's dead logic that only adds the dynamicRegExpconstruction ast-grep flagged. Since it's escaped viaescapeRegExp, that ReDoS hint is a false positive, but removing this block removes the flagged pattern entirely and simplifies the function (and makesescapeRegExpat Lines 129-131 removable too, as it becomes unused).♻️ Suggested cleanup
const quoted = JSON.stringify(cdnBase); - // Already pointing at this CDN base. - if (source.includes(quoted) || source.includes(cdnBase.replace(/\/$/, ''))) { - // Only skip when an explicit base assignment already uses this value. - if (new RegExp(String.raw`\bbase\s*:\s*${escapeRegExp(quoted)}`).test(source)) { - return { content: source, changed: false }; - } - } - // base: '/' → CDNRemove the now-unused
escapeRegExphelper as well.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/cli/src/cmd/build/adapters/vite/cdn-build.ts` around lines 83 - 131, Remove the initial idempotency guard in patchViteConfigCdnBase, including its dynamic RegExp check, since the later explicit base assignment branch already returns unchanged. After removing that block, delete the now-unused escapeRegExp helper and preserve the existing base replacement and insertion behavior.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/cli/src/cmd/build/adapters/vite/cdn-build.ts`:
- Around line 149-236: Wrap the risky fallback I/O in prepareViteCdnBuild with
rollback handling so any readFileSync, writeFileSync, or related config-patching
error invokes the accumulated cleanup callbacks before rethrowing. Ensure
previously applied framework.buildEnv and framework.buildCommand mutations are
restored even when the function fails before returning its preparation object;
preserve normal return and cleanup behavior for successful builds.
- Around line 69-77: Update injectViteBaseFlag to append --base=${cdnBase} to
the command segment that invokes vite, rather than to the entire trimmed
command. Preserve existing behavior for empty commands, commands already
containing --base, and commands without vite, while keeping compound-command
segments after the vite invocation unchanged.
- Line 19: Replace synchronous filesystem usage in prepareViteCdnBuild and
cleanup with node:fs/promises operations and pathExists, making both functions
async. Update their callers in vite.ts and the tests to await preparation and
cleanup, including the restore path, while preserving existing file-read, write,
and cleanup behavior.
---
Nitpick comments:
In `@packages/cli/src/cmd/build/adapters/vite/cdn-build.ts`:
- Around line 83-131: Remove the initial idempotency guard in
patchViteConfigCdnBase, including its dynamic RegExp check, since the later
explicit base assignment branch already returns unchanged. After removing that
block, delete the now-unused escapeRegExp helper and preserve the existing base
replacement and insertion behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 29389e52-bebe-40a5-bb00-74e826b11305
📒 Files selected for processing (5)
packages/cli/src/cmd/build/adapters/index.tspackages/cli/src/cmd/build/adapters/vite.tspackages/cli/src/cmd/build/adapters/vite/cdn-build.tspackages/cli/test/cmd/build/adapters/registry.test.tspackages/cli/test/cmd/build/adapters/vite-cdn.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (18)
- GitHub Check: Native install (Linux)
- GitHub Check: Bun version checks
- GitHub Check: Installer scenarios
- GitHub Check: Linux distro install smoke
- GitHub Check: Native install (macOS)
- GitHub Check: Agentuity - docs-docs
- GitHub Check: Queue CLI Tests (bun)
- GitHub Check: Package Installation & Usage Test (bun)
- GitHub Check: Package Installation & Usage Test (node)
- GitHub Check: Queue CLI Tests (node)
- GitHub Check: Testing Apps (local tests)
- GitHub Check: Migrate Chain (v1 → v2 → v3)
- GitHub Check: Framework Demo Tests
- GitHub Check: Service Client Smoke Tests
- GitHub Check: Postgres SSL Integration Test
- GitHub Check: Build
- GitHub Check: Windows WSL CLI Smoke Test
- GitHub Check: Pack & Upload
🧰 Additional context used
📓 Path-based instructions (5)
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Run
bun run formatusing Biome with tabs (width 3), single quotes, semicolons, lineWidth 100, and trailingCommas es5
Files:
packages/cli/test/cmd/build/adapters/registry.test.tspackages/cli/src/cmd/build/adapters/index.tspackages/cli/src/cmd/build/adapters/vite.tspackages/cli/test/cmd/build/adapters/vite-cdn.test.tspackages/cli/src/cmd/build/adapters/vite/cdn-build.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Use TypeScript in strict mode with ESNext target and bundler moduleResolution
UseStructuredErrorfrom@agentuity/corefor error handling
Files:
packages/cli/test/cmd/build/adapters/registry.test.tspackages/cli/src/cmd/build/adapters/index.tspackages/cli/src/cmd/build/adapters/vite.tspackages/cli/test/cmd/build/adapters/vite-cdn.test.tspackages/cli/src/cmd/build/adapters/vite/cdn-build.ts
**/packages/*/test/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/packages/*/test/**/*.{ts,tsx}: Place tests intest/folder parallel tosrc/directory, never insidesrc/or under__tests__/
Import from../src/in test files
Use@agentuity/test-utilsfor shared mocks in tests
Files:
packages/cli/test/cmd/build/adapters/registry.test.tspackages/cli/test/cmd/build/adapters/vite-cdn.test.ts
packages/cli/src/cmd/**/index.ts
📄 CodeRabbit inference engine (packages/cli/AGENTS.md)
packages/cli/src/cmd/**/index.ts: Each command must be a directory insrc/cmd/with anindex.tsentry point
Always define interfaces for command options using Zod schemas; never useanyfor type safety
Files:
packages/cli/src/cmd/build/adapters/index.ts
packages/cli/src/**/*.ts
📄 CodeRabbit inference engine (packages/cli/AGENTS.md)
packages/cli/src/**/*.ts: Usetui.*helpers for formatted output (header,info,success,warning,error,table,progress)
Usectx.loggerfor logging;logger.fatal()logs and exits with code 1
Useawait readFile(p, 'utf-8')andawait writeFile(p, content)fromnode:fs/promisesfor file I/O
ImportpathExistsfromnode-compat/fsfor file existence checks instead of using Node's built-in
Do not use Bun globals (Bun.file,Bun.spawn,Bun.color,Bun.stringWidth, etc.) in production source code;tsconfig.jsontype checking enforces this
Imports must use explicit.tsextensions for relative paths (e.g.,from './foo.ts', notfrom './foo'); TypeScript'srewriteRelativeImportExtensionswill rewrite them to.jsin output
Always checkisJSONMode()for machine-readable output in command handlers
UserequireAuth(ctx)oroptionalAuth(ctx)for authenticated commands
Files:
packages/cli/src/cmd/build/adapters/index.tspackages/cli/src/cmd/build/adapters/vite.tspackages/cli/src/cmd/build/adapters/vite/cdn-build.ts
🧠 Learnings (3)
📚 Learning: 2025-12-21T00:31:41.858Z
Learnt from: jhaynie
Repo: agentuity/sdk PR: 274
File: packages/cli/src/cmd/build/vite/server-bundler.ts:12-41
Timestamp: 2025-12-21T00:31:41.858Z
Learning: In Bun runtime, BuildMessage and ResolveMessage are global types and are not exported from the bun module. Do not import { BuildMessage } from 'bun' or similar; these types are available globally and should be used without import. This applies to all TypeScript files that target the Bun runtime within the repository.
Applied to files:
packages/cli/test/cmd/build/adapters/registry.test.tspackages/cli/src/cmd/build/adapters/index.tspackages/cli/src/cmd/build/adapters/vite.tspackages/cli/test/cmd/build/adapters/vite-cdn.test.tspackages/cli/src/cmd/build/adapters/vite/cdn-build.ts
📚 Learning: 2026-02-21T02:05:57.982Z
Learnt from: jhaynie
Repo: agentuity/sdk PR: 1010
File: packages/drizzle/test/proxy.test.ts:594-603
Timestamp: 2026-02-21T02:05:57.982Z
Learning: Do not rely on StructuredError from agentuity/core in test files or simple error handling paths. In tests and straightforward error handling, use plain Error objects to represent failures, reserving StructuredError for more complex error scenarios in application logic.
Applied to files:
packages/cli/test/cmd/build/adapters/registry.test.tspackages/cli/test/cmd/build/adapters/vite-cdn.test.ts
📚 Learning: 2026-02-17T14:23:15.448Z
Learnt from: potofpie
Repo: agentuity/sdk PR: 974
File: packages/cli/src/cmd/git/account/list.ts:39-40
Timestamp: 2026-02-17T14:23:15.448Z
Learning: In the Agentuity CLI framework (packages/cli), when a subcommand declares requires: { auth: true }, the framework will automatically call requireAuth() before invoking the handler. Do not call requireAuth(ctx) manually inside command handlers. This applies to all TypeScript command files under packages/cli/src, including paths like packages/cli/src/cmd/git/account/list.ts.
Applied to files:
packages/cli/src/cmd/build/adapters/index.tspackages/cli/src/cmd/build/adapters/vite.tspackages/cli/src/cmd/build/adapters/vite/cdn-build.ts
🪛 ast-grep (0.44.1)
packages/cli/src/cmd/build/adapters/vite/cdn-build.ts
[warning] 91-91: Do not use variable for regular expressions
Context: new RegExp(String.raw\bbase\s*:\s*${escapeRegExp(quoted)})
Note: [CWE-1333] Inefficient Regular Expression Complexity. Security best practice.
(regexp-non-literal-typescript)
🔇 Additional comments (4)
packages/cli/test/cmd/build/adapters/vite-cdn.test.ts (1)
1-179: LGTM!packages/cli/src/cmd/build/adapters/vite.ts (1)
12-33: LGTM!packages/cli/src/cmd/build/adapters/index.ts (1)
13-13: LGTM!Also applies to: 22-22
packages/cli/test/cmd/build/adapters/registry.test.ts (1)
20-23: LGTM!
Scaffold the WSL deploy smoke app under ~/agentuity-smoke instead of ~/sdk so monorepo detection does not treat it as a workspace subpackage and package the entire SDK into the deploy.
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/test-windows-wsl.yaml:
- Around line 177-187: Update the metadata extraction flow around PROJECT_ID and
PROJECT_DIR: persist PROJECT_DIR to ~/test-env.sh before reading agentuity.json,
and wrap the jq assignment in an if ! ...; then failure branch so malformed or
missing metadata reaches the diagnostic output despite set -e. Preserve the
existing validation and exit behavior, while ensuring cleanup retains the
project path even when PROJECT_ID extraction fails.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 0e5f81b1-e163-4bcd-88d5-4665b12bb12c
📒 Files selected for processing (1)
.github/workflows/test-windows-wsl.yaml
📜 Review details
⏰ Context from checks skipped due to timeout. (18)
- GitHub Check: Bun version checks
- GitHub Check: Linux distro install smoke
- GitHub Check: Installer scenarios
- GitHub Check: Native install (macOS)
- GitHub Check: Native install (Linux)
- GitHub Check: Framework Demo Tests
- GitHub Check: Service Client Smoke Tests
- GitHub Check: Package Installation & Usage Test (bun)
- GitHub Check: Queue CLI Tests (bun)
- GitHub Check: Queue CLI Tests (node)
- GitHub Check: Postgres SSL Integration Test
- GitHub Check: Migrate Chain (v1 → v2 → v3)
- GitHub Check: Package Installation & Usage Test (node)
- GitHub Check: Build
- GitHub Check: Windows WSL CLI Smoke Test
- GitHub Check: Pack & Upload
- GitHub Check: OSV Scanner PR
- GitHub Check: Agentuity - docs-docs
🔇 Additional comments (4)
.github/workflows/test-windows-wsl.yaml (4)
142-157: LGTM!Also applies to: 168-168
190-199: LGTM!
210-210: LGTM!
219-223: LGTM!
Make prepareViteCdnBuild async with fs/promises, roll back env/command mutations on I/O failure, inject --base only on the vite command segment, drop redundant patchViteConfigCdnBase idempotency guard, and persist WSL smoke PROJECT_DIR before agentuity.json parse.
Isolating the smoke app under ~/agentuity-smoke avoided monorepo packaging but made deploy fail faster (no server start, status failed within seconds). Main has always nested the project under ~/sdk and that path is still green. Keep the Vite CDN adapter; restore the previous WSL layout so this job matches main.
WSL smoke creates apps as siblings of packages/ under the SDK tree. Those are not workspace members, but monorepo detection still packaged the entire monorepo and set workingDirectory to the smoke path — which correlates with Hadron readiness never passing after the app starts. Require workspace-pattern membership before returning monorepo context. Bind the Hono template to 0.0.0.0 for container TCP health probes, and create the WSL smoke app with --packageManager bun.
- Single mechanism: inject vite --base (drop disk config patch + cleanup) - Pure prepare returns command/env overrides; adapter does not mutate detection - Shared cdn-origin + PACK_ONLY_DEPLOYMENT_ID used by pack and TanStack host - Monorepo pnpm membership fails closed like npm/yarn/bun
The CLI option is kebab-case --package-manager, not --packageManager.
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
packages/cli/src/cmd/build/adapters/vite/cdn-build.ts (1)
52-64: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winExplicit
AGENTUITY_CDN_ORIGINbypasses the pack-only guard.The pack-only sentinel check only runs on the
deploymentId/AGENTUITY_CLOUD_DEPLOYMENT_IDfallback path (Line 60-61). IfAGENTUITY_CDN_ORIGINhappens to be set in the environment whiledeploymentIdisPACK_ONLY_DEPLOYMENT_ID, the function returns the explicit origin at Line 58 before ever reaching the pack-only check — silently wiring CDN base into a build the PR states should be unaffected ("Local builds and--pack-onlybuilds are unchanged"). No test covers this combination (the existing "skips pack-only deployment id" test only setsenv: {}).🐛 Proposed fix: check the pack-only sentinel before the explicit-origin short-circuit
export function resolveViteCdnBase(options: { deploymentId?: string; env?: NodeJS.ProcessEnv; }): string | undefined { const env = options.env ?? process.env; - const explicit = env.AGENTUITY_CDN_ORIGIN?.trim().replace(/\/+$/, ''); - if (explicit) return `${explicit}/`; - const id = (options.deploymentId ?? env.AGENTUITY_CLOUD_DEPLOYMENT_ID)?.trim(); - if (!id || id === PACK_ONLY_DEPLOYMENT_ID) return undefined; + if (id === PACK_ONLY_DEPLOYMENT_ID) return undefined; + + const explicit = env.AGENTUITY_CDN_ORIGIN?.trim().replace(/\/+$/, ''); + if (explicit) return `${explicit}/`; + + if (!id) return undefined; return `https://cdn.agentuity.com/${id}/`; }Also worth adding a regression test combining
PACK_ONLY_DEPLOYMENT_IDwithAGENTUITY_CDN_ORIGINset, inpackages/cli/test/cmd/build/adapters/vite-cdn.test.ts.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/cli/src/cmd/build/adapters/vite/cdn-build.ts` around lines 52 - 64, Update resolveViteCdnBase so PACK_ONLY_DEPLOYMENT_ID is checked before the explicit AGENTUITY_CDN_ORIGIN short-circuit, returning undefined for pack-only builds regardless of the configured origin. Add a regression test in the Vite CDN tests covering the sentinel deployment ID with AGENTUITY_CDN_ORIGIN set.
🧹 Nitpick comments (1)
packages/cli/src/cmd/build/adapters/vite/cdn-build.ts (1)
251-255: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider wrapping the rethrown error in
StructuredError.The catch block rethrows the raw underlying error (e.g. an fs
EISDIR) without additional context. As per path instructions,**/*.{ts,tsx}files should "UseStructuredErrorfrom@agentuity/corefor error handling," which would let this failure carry a clearer message (e.g. which vite.config file failed to patch) through the CLI's error reporting.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/cli/src/cmd/build/adapters/vite/cdn-build.ts` around lines 251 - 255, Update the catch block around the Vite config patching flow to rethrow the failure as a StructuredError from `@agentuity/core`, preserving the original error as its cause and adding context identifying the vite.config file being patched. Keep runCleanup() execution before propagating the wrapped error.Source: Path instructions
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@packages/cli/src/cmd/build/adapters/vite/cdn-build.ts`:
- Around line 145-151: Update runCleanups to execute every cleanup in reverse
order even when one fails by isolating each cleanup failure, swallowing it, and
optionally reporting it through the existing debug logger. Ensure
prepareViteCdnBuild’s catch path still rethrows the original build error after
awaiting runCleanup, without allowing cleanup failures to replace it.
In `@packages/cli/src/cmd/build/detect/monorepo.ts`:
- Around line 83-128: Update readPnpmWorkspacePatterns and the workspace
matching flow to parse pnpm-workspace YAML with a YAML parser, including
flow-style packages entries, rather than manually scanning lines. Preserve
ordered pnpm glob semantics: include patterns add matches, while !-prefixed
patterns remove previously included paths; ensure matchesWorkspacePattern
handles exclusion patterns through this ordered evaluation instead of treating !
as a literal.
---
Outside diff comments:
In `@packages/cli/src/cmd/build/adapters/vite/cdn-build.ts`:
- Around line 52-64: Update resolveViteCdnBase so PACK_ONLY_DEPLOYMENT_ID is
checked before the explicit AGENTUITY_CDN_ORIGIN short-circuit, returning
undefined for pack-only builds regardless of the configured origin. Add a
regression test in the Vite CDN tests covering the sentinel deployment ID with
AGENTUITY_CDN_ORIGIN set.
---
Nitpick comments:
In `@packages/cli/src/cmd/build/adapters/vite/cdn-build.ts`:
- Around line 251-255: Update the catch block around the Vite config patching
flow to rethrow the failure as a StructuredError from `@agentuity/core`,
preserving the original error as its cause and adding context identifying the
vite.config file being patched. Keep runCleanup() execution before propagating
the wrapped error.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 9df66366-c5f9-44ea-bcfc-b1cb4a7806b8
📒 Files selected for processing (7)
.github/workflows/test-windows-wsl.yamlpackages/cli/src/cmd/build/adapters/vite.tspackages/cli/src/cmd/build/adapters/vite/cdn-build.tspackages/cli/src/cmd/build/detect/monorepo.tspackages/cli/src/cmd/project/templates/hono/src/index.tspackages/cli/test/cmd/build/adapters/vite-cdn.test.tspackages/cli/test/cmd/build/detect/monorepo.test.ts
📜 Review details
⏰ Context from checks skipped due to timeout. (18)
- GitHub Check: Native install (macOS)
- GitHub Check: Linux distro install smoke
- GitHub Check: Native install (Linux)
- GitHub Check: Bun version checks
- GitHub Check: Installer scenarios
- GitHub Check: Windows WSL CLI Smoke Test
- GitHub Check: Package Installation & Usage Test (node)
- GitHub Check: Queue CLI Tests (bun)
- GitHub Check: Service Client Smoke Tests
- GitHub Check: Migrate Chain (v1 → v2 → v3)
- GitHub Check: Package Installation & Usage Test (bun)
- GitHub Check: Queue CLI Tests (node)
- GitHub Check: Postgres SSL Integration Test
- GitHub Check: Framework Demo Tests
- GitHub Check: Pack & Upload
- GitHub Check: Build
- GitHub Check: OSV Scanner PR
- GitHub Check: Agentuity - docs-docs
🧰 Additional context used
📓 Path-based instructions (5)
**/*.{ts,tsx,js,jsx}
📄 CodeRabbit inference engine (AGENTS.md)
Run
bun run formatusing Biome with tabs (width 3), single quotes, semicolons, lineWidth 100, and trailingCommas es5
Files:
packages/cli/src/cmd/project/templates/hono/src/index.tspackages/cli/test/cmd/build/detect/monorepo.test.tspackages/cli/src/cmd/build/adapters/vite.tspackages/cli/src/cmd/build/detect/monorepo.tspackages/cli/test/cmd/build/adapters/vite-cdn.test.tspackages/cli/src/cmd/build/adapters/vite/cdn-build.ts
**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/*.{ts,tsx}: Use TypeScript in strict mode with ESNext target and bundler moduleResolution
UseStructuredErrorfrom@agentuity/corefor error handling
Files:
packages/cli/src/cmd/project/templates/hono/src/index.tspackages/cli/test/cmd/build/detect/monorepo.test.tspackages/cli/src/cmd/build/adapters/vite.tspackages/cli/src/cmd/build/detect/monorepo.tspackages/cli/test/cmd/build/adapters/vite-cdn.test.tspackages/cli/src/cmd/build/adapters/vite/cdn-build.ts
packages/cli/src/cmd/**/index.ts
📄 CodeRabbit inference engine (packages/cli/AGENTS.md)
packages/cli/src/cmd/**/index.ts: Each command must be a directory insrc/cmd/with anindex.tsentry point
Always define interfaces for command options using Zod schemas; never useanyfor type safety
Files:
packages/cli/src/cmd/project/templates/hono/src/index.ts
packages/cli/src/**/*.ts
📄 CodeRabbit inference engine (packages/cli/AGENTS.md)
packages/cli/src/**/*.ts: Usetui.*helpers for formatted output (header,info,success,warning,error,table,progress)
Usectx.loggerfor logging;logger.fatal()logs and exits with code 1
Useawait readFile(p, 'utf-8')andawait writeFile(p, content)fromnode:fs/promisesfor file I/O
ImportpathExistsfromnode-compat/fsfor file existence checks instead of using Node's built-in
Do not use Bun globals (Bun.file,Bun.spawn,Bun.color,Bun.stringWidth, etc.) in production source code;tsconfig.jsontype checking enforces this
Imports must use explicit.tsextensions for relative paths (e.g.,from './foo.ts', notfrom './foo'); TypeScript'srewriteRelativeImportExtensionswill rewrite them to.jsin output
Always checkisJSONMode()for machine-readable output in command handlers
UserequireAuth(ctx)oroptionalAuth(ctx)for authenticated commands
Files:
packages/cli/src/cmd/project/templates/hono/src/index.tspackages/cli/src/cmd/build/adapters/vite.tspackages/cli/src/cmd/build/detect/monorepo.tspackages/cli/src/cmd/build/adapters/vite/cdn-build.ts
**/packages/*/test/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
**/packages/*/test/**/*.{ts,tsx}: Place tests intest/folder parallel tosrc/directory, never insidesrc/or under__tests__/
Import from../src/in test files
Use@agentuity/test-utilsfor shared mocks in tests
Files:
packages/cli/test/cmd/build/detect/monorepo.test.tspackages/cli/test/cmd/build/adapters/vite-cdn.test.ts
🧠 Learnings (3)
📚 Learning: 2025-12-21T00:31:41.858Z
Learnt from: jhaynie
Repo: agentuity/sdk PR: 274
File: packages/cli/src/cmd/build/vite/server-bundler.ts:12-41
Timestamp: 2025-12-21T00:31:41.858Z
Learning: In Bun runtime, BuildMessage and ResolveMessage are global types and are not exported from the bun module. Do not import { BuildMessage } from 'bun' or similar; these types are available globally and should be used without import. This applies to all TypeScript files that target the Bun runtime within the repository.
Applied to files:
packages/cli/src/cmd/project/templates/hono/src/index.tspackages/cli/test/cmd/build/detect/monorepo.test.tspackages/cli/src/cmd/build/adapters/vite.tspackages/cli/src/cmd/build/detect/monorepo.tspackages/cli/test/cmd/build/adapters/vite-cdn.test.tspackages/cli/src/cmd/build/adapters/vite/cdn-build.ts
📚 Learning: 2026-02-17T14:23:15.448Z
Learnt from: potofpie
Repo: agentuity/sdk PR: 974
File: packages/cli/src/cmd/git/account/list.ts:39-40
Timestamp: 2026-02-17T14:23:15.448Z
Learning: In the Agentuity CLI framework (packages/cli), when a subcommand declares requires: { auth: true }, the framework will automatically call requireAuth() before invoking the handler. Do not call requireAuth(ctx) manually inside command handlers. This applies to all TypeScript command files under packages/cli/src, including paths like packages/cli/src/cmd/git/account/list.ts.
Applied to files:
packages/cli/src/cmd/project/templates/hono/src/index.tspackages/cli/src/cmd/build/adapters/vite.tspackages/cli/src/cmd/build/detect/monorepo.tspackages/cli/src/cmd/build/adapters/vite/cdn-build.ts
📚 Learning: 2026-02-21T02:05:57.982Z
Learnt from: jhaynie
Repo: agentuity/sdk PR: 1010
File: packages/drizzle/test/proxy.test.ts:594-603
Timestamp: 2026-02-21T02:05:57.982Z
Learning: Do not rely on StructuredError from agentuity/core in test files or simple error handling paths. In tests and straightforward error handling, use plain Error objects to represent failures, reserving StructuredError for more complex error scenarios in application logic.
Applied to files:
packages/cli/test/cmd/build/detect/monorepo.test.tspackages/cli/test/cmd/build/adapters/vite-cdn.test.ts
🪛 ast-grep (0.44.1)
packages/cli/src/cmd/build/detect/monorepo.ts
[warning] 122-122: Regular expression constructed from variable input detected. This can lead to Regular Expression Denial of Service (ReDoS) attacks if the variable contains malicious patterns. Use libraries like 'recheck' to validate regex safety or use static patterns.
Context: new RegExp(^${escaped}$)
Note: [CWE-1333] Inefficient Regular Expression Complexity
(regexp-from-variable)
🔇 Additional comments (7)
.github/workflows/test-windows-wsl.yaml (2)
170-175: 🩺 Stability & AvailabilityHandle
jqfailures beforeset -eaborts the step.If
agentuity.jsonis missing or malformed, line 171 exits the step immediately, so the diagnostic output on lines 172-175 is skipped. Wrap the assignment in anif ! PROJECT_ID=$(jq ...); thenbranch before validating the extracted value.
139-168: LGTM!Also applies to: 202-204
packages/cli/src/cmd/project/templates/hono/src/index.ts (1)
23-34: LGTM!packages/cli/test/cmd/build/detect/monorepo.test.ts (1)
180-211: LGTM!packages/cli/src/cmd/build/adapters/vite/cdn-build.ts (1)
19-46: LGTM!Also applies to: 66-131, 157-250
packages/cli/test/cmd/build/adapters/vite-cdn.test.ts (1)
47-58: LGTM!Also applies to: 93-97, 109-141, 143-168, 170-194, 196-208
packages/cli/src/cmd/build/adapters/vite.ts (1)
15-32: LGTM!
Add a durable unit test that rebuilds the SDK-like monorepo + non-member smoke app, asserts monorepo detection is null, generic adapter packaging has no workingDirectory, and documents the bad monorepo-stage path. Add wsl-smoke-local-validate.ts which runs real project create with --package-manager bun under a temp monorepo and checks the same detection + optional runBuildPipeline (WSL_SMOKE_PACK_ONLY=1).
1 participant
Summary
baseto the Agentuity CDN origin during cloud deploy builds (when a realdeploymentIdis present).index.html/ JS keep using origin-relative/assets/…(e.g. Genesis on*.agentcompany.work).vite build --base=https://cdn.agentuity.com/<deploymentId>/; fall back to a temporaryvite.configpatch when the build command does not invokevitedirectly.--pack-only(deploymentId === pack-only).AGENTUITY_CDN_ORIGIN/AGENTUITY_CLOUD_DEPLOYMENT_IDinto the build env for configs that want them.Complements #1571 (TanStack Start
transformAssets); this covers plain Vite SPAs (Hono, custom servers, etc.) with no app code changes.Test plan
bun test packages/cli/test/cmd/build/adapters/vite-cdn.test.tsbun test packages/cli/test/cmd/build/adapters/registry.test.tsbun test packages/cli/test/cmd/build/adapters/tanstack-start.test.tsbun run typecheckinpackages/cli@agentuity/cliapps/web, redeploy, confirm Network tab loadshttps://cdn.agentuity.com/<deployId>/assets/…Summary by CodeRabbit
New Features
base.0.0.0.0).Bug Fixes
Tests
--baseinjection, config patching, and cleanup behavior.Chores