Merged
Conversation
🦋 Changeset detectedLatest commit: 5245cd7 The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
📝 WalkthroughWalkthroughThese changes refactor the CLI initialization flow by making DATABASE_URL a required environment variable check (removing interactive collection), introducing a conditional installation helper function, and expanding the installation step to handle both stack and stack-forge packages with production and development install commands. Changes
Sequence Diagram(s)sequenceDiagram
participant User
participant CLI as CLI Init
participant Env as Environment
participant FS as File System
participant PM as Package Manager
User->>CLI: Run init command
CLI->>Env: Check DATABASE_URL
alt DATABASE_URL not set
CLI->>User: Display guidance note
CLI-->>User: Exit setup
else DATABASE_URL set
CLI->>FS: Generate stash.config.ts
FS-->>CLI: Config created
CLI->>PM: Check if `@cipherstash/stack` installed
alt Stack not installed
CLI->>User: Prompt to install stack
alt User confirms
CLI->>PM: Run prod install command
PM-->>CLI: Install complete
else User cancels
CLI-->>User: Continue without installing
end
end
CLI->>PM: Check if `@cipherstash/stack-forge` installed
alt Forge not installed
CLI->>User: Prompt to install stack-forge
alt User confirms
CLI->>PM: Run dev install command
PM-->>CLI: Install complete
else User cancels
CLI-->>User: Continue without installing
end
end
CLI-->>User: Setup complete
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~22 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches
🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip You can make CodeRabbit's review stricter and more nitpicky using the `assertive` profile, if that's what you prefer.Change the |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
packages/stack/src/bin/commands/init/steps/install-forge.ts (1)
54-58: Consider sanitizing error messages before logging.The error message at line 57 could potentially include sensitive information if the install command or environment contains credentials. While the command itself is just package installation, error messages from package managers can sometimes include environment details.
🛡️ Optional: Sanitize error output
} catch (err) { - const message = err instanceof Error ? err.message : String(err) s.stop(`${packageName} installation failed`) - p.log.error(message) + p.log.error(`Failed to install ${packageName}. Check your network and permissions.`) p.note(`You can install it manually:\n ${cmd}`, 'Manual Installation') return false }As per coding guidelines: "Do NOT log plaintext; the library never logs plaintext by design and logs should never leak sensitive data."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/stack/src/bin/commands/init/steps/install-forge.ts` around lines 54 - 58, The catch block logs raw error text which may leak secrets; change the error logging in the catch to pass the error through a sanitizer helper (e.g., sanitizeErrorMessage) before calling p.log.error and only emit a short, non-sensitive summary via s.stop/p.log.error while keeping p.note as-is; specifically, update the catch handling around packageName, cmd, s.stop, p.log.error to build a redactedMessage = sanitizeErrorMessage(err instanceof Error ? err.message : String(err)) that strips/masks URLs with credentials, tokens (token=, auth=, password=), long hex strings, and environment variable values, then log a generic failure plus the redactedMessage rather than the raw message.packages/stack-forge/src/commands/init.ts (1)
113-126: Step number comment is inconsistent.The comment at line 147 says "// 6. Determine install flags..." but there's no step 5. The step numbering jumps from 4 to 6.
🔧 Fix step numbering
- // 6. Determine install flags from database provider + // 5. Determine install flags from database provider🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@packages/stack-forge/src/commands/init.ts` around lines 113 - 126, The step numbering in the inline comments is inconsistent: after the block that creates CONFIG_FILENAME the next step comment jumps from "// 4. Install EQL extensions..." to a later comment labeled "// 6. Determine install flags..."; update the comment text near the install-flag logic (the comment that currently reads "// 6. Determine install flags...") to "// 5. Determine install flags..." and scan the subsequent comments in the same function (e.g., surrounding generateConfig, CONFIG_FILENAME, p.note, p.outro usages) to ensure all step numbers are sequentially corrected.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@packages/stack-forge/src/commands/init.ts`:
- Around line 113-126: The step numbering in the inline comments is
inconsistent: after the block that creates CONFIG_FILENAME the next step comment
jumps from "// 4. Install EQL extensions..." to a later comment labeled "// 6.
Determine install flags..."; update the comment text near the install-flag logic
(the comment that currently reads "// 6. Determine install flags...") to "// 5.
Determine install flags..." and scan the subsequent comments in the same
function (e.g., surrounding generateConfig, CONFIG_FILENAME, p.note, p.outro
usages) to ensure all step numbers are sequentially corrected.
In `@packages/stack/src/bin/commands/init/steps/install-forge.ts`:
- Around line 54-58: The catch block logs raw error text which may leak secrets;
change the error logging in the catch to pass the error through a sanitizer
helper (e.g., sanitizeErrorMessage) before calling p.log.error and only emit a
short, non-sensitive summary via s.stop/p.log.error while keeping p.note as-is;
specifically, update the catch handling around packageName, cmd, s.stop,
p.log.error to build a redactedMessage = sanitizeErrorMessage(err instanceof
Error ? err.message : String(err)) that strips/masks URLs with credentials,
tokens (token=, auth=, password=), long hex strings, and environment variable
values, then log a generic failure plus the redactedMessage rather than the raw
message.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e76ea215-4143-4ca3-b695-a9823f9b95c9
📒 Files selected for processing (5)
.changeset/nice-pugs-retire.mdpackages/stack-forge/src/commands/init.tspackages/stack/src/bin/commands/init/steps/install-forge.tspackages/stack/src/bin/commands/init/types.tspackages/stack/src/bin/commands/init/utils.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Chores