chore(cli): integrate Hono server and update proxy app to use Hono for handling requests

[jiashengguo]

Summary by CodeRabbit

• Improvements
  • Updated the proxy server for improved performance and maintainability.
  • Added configurable CORS support.
  • Added flexible options-based configuration while preserving existing configuration support.
  • Preserved authentication and request-signature verification behavior.
  • Improved schema endpoint serving and database path handling.
• Testing
  • Expanded coverage for proxy configuration and schema endpoint availability.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 234e533e-d910-4ac1-a49c-f44601c60c3b

📥 Commits

Reviewing files that changed from the base of the PR and between accb4e9 and d156bcf.

📒 Files selected for processing (1)

• packages/cli/src/actions/proxy.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• packages/cli/src/actions/proxy.ts

---

📝 Walkthrough

Walkthrough

Changes

CLI proxy migration

Layer / File(s)	Summary
Hono proxy factory and routes packages/cli/package.json, packages/cli/src/actions/proxy.ts	The proxy now uses Hono, configurable CORS, Hono middleware, RPC routes, a schema endpoint, and schema-relative SQLite paths. createProxyApp supports an options-object overload and optional authDb.
Hono authentication and signature handling packages/cli/src/actions/proxy.ts	Signature verification uses Hono request and response APIs. Authentication failures, client resolution, and $setAuth handling remain supported.
Hono server startup and validation packages/cli/src/actions/proxy.ts, packages/cli/test/proxy.test.ts	CLI and test servers use Hono’s serve API. Tests verify the options-object form and the /api/schema response.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• zenstackhq/zenstack#2698: Refactors the same proxy implementation and tests from Express to Hono.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the migration of the CLI proxy app to Hono.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jiasheng-hono

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

packages/cli/package.json (1)

50-57: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Remove the leftover cors and Express type dependencies.

packages/cli/src/actions/proxy.ts imports CORS from hono/cors, so the cors runtime dependency is unused. Drop cors, @types/cors, and @types/express from packages/cli/package.json.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/cli/package.json` around lines 50 - 57, Remove the unused cors
runtime dependency and the `@types/cors` and `@types/express` development
dependencies from the CLI package manifest. Keep the existing hono/cors import
in proxy.ts unchanged.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@packages/cli/src/actions/proxy.ts`:
- Around line 304-313: Update the CORS setup around the Hono app initialization
and options.cors so unauthenticated proxies do not default to allowing every
origin. Apply a restrictive default origin when no CORS configuration is
supplied, while preserving explicitly provided options.cors behavior.

---

Nitpick comments:
In `@packages/cli/package.json`:
- Around line 50-57: Remove the unused cors runtime dependency and the
`@types/cors` and `@types/express` development dependencies from the CLI package
manifest. Keep the existing hono/cors import in proxy.ts unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fc867c7e-1dcf-4a39-a8f3-45421ec8c110

📥 Commits

Reviewing files that changed from the base of the PR and between 2a462fd and accb4e9.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (3)

• packages/cli/package.json
• packages/cli/src/actions/proxy.ts
• packages/cli/test/proxy.test.ts