Skip to content

Release 17.2.0#285

Merged
ChiragAgg5k merged 1 commit intomasterfrom
dev
Mar 31, 2026
Merged

Release 17.2.0#285
ChiragAgg5k merged 1 commit intomasterfrom
dev

Conversation

@ChiragAgg5k
Copy link
Copy Markdown
Member

@ChiragAgg5k ChiragAgg5k commented Mar 31, 2026

Summary

  • Added --show-secrets flag to control display of sensitive values in output
  • Added automatic redaction of secrets, API keys, tokens, and passwords in CLI output
  • Added init skill command for installing Appwrite agent skills for AI coding agents
  • Added automatic agent skills detection and installation during project initialization
  • Added OPEN_RUNTIMES_ENTRYPOINT environment variable to function emulation
  • Updated -j and -R output flag descriptions for clarity
  • Fixed project init to gracefully handle override decline instead of exiting

Summary by CodeRabbit

Release Notes - Version 17.2.0

  • New Features

    • Added --show-secrets flag to control sensitive data visibility in output
    • Automatic secret redaction (API keys, tokens, passwords) enabled by default in CLI output
    • New init skill command for setting up agent skills
    • Automatic detection and installation of agent skills during project initialization
    • Support for OPEN_RUNTIMES_ENTRYPOINT environment variable
  • Bug Fixes

    • Fixed project init to gracefully handle override declines instead of terminating

@ChiragAgg5k ChiragAgg5k changed the title feat: Command Line SDK update for version 17.2.0 Release 17.2.0 Mar 31, 2026
@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Mar 31, 2026

Walkthrough

This pull request updates the Appwrite CLI from version 17.1.0 to 17.2.0, introducing new features and conducting systematic refactoring. Key additions include a --show-secrets flag and automatic redaction of sensitive data (API keys, tokens, passwords) in CLI output, a new init skill command for agent skills initialization with automatic detection and installation, support for the OPEN_RUNTIMES_ENTRYPOINT environment variable, and a new getHeaders() method on the Client class. The update also refactors command registration across 20+ service files by replacing anonymous chained expressions with named const variables for improved code structure. Supporting changes include parser enhancements for sensitive data masking and display field filtering, new utility functions for skills management, graceful handling of override declines in project initialization, and documentation updates reflecting the new version and features.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~50 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title 'Release 17.2.0' directly and clearly summarizes the main change—updating the CLI to version 17.2.0. This is evident from the extensive version bumps across all files (package.json, constants.ts, installers, etc.) and corresponding feature additions for this release.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch dev

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@greptile-apps
Copy link
Copy Markdown

greptile-apps bot commented Mar 31, 2026

Greptile Summary

This PR updates the Appwrite CLI SDK from 17.1.0 → 17.2.0, introducing three main feature areas alongside several quality improvements:

  1. Agent skills management — new appwrite init skill command that clones a sparse subset of the appwrite/agent-skills repo and places (copy or symlink) the selected skills into .agents/skills and/or .claude/skills. Skills are also auto-detected and silently installed after init project completes, based on language markers found in the project directory.

  2. Secrets redaction — a new maskSensitiveData pass is applied to all output modes (default table, --json, --raw). Fields whose normalised key matches the SENSITIVE_KEYS set are masked with [hidden] and a hint is shown if any redaction occurred. A --show-secrets flag bypasses redaction for power users.

  3. Output filtering improvements — default table output now omits null, empty-string, empty-array, and empty-object values. An outputFields mechanism (currently wired only to projects list) lets individual commands declare which table columns to show.

Additional noteworthy changes:

  • process.exit(1) on override-decline in initProject replaced with a graceful return (genuine bug fix).
  • Missing whenOverride guard on the organisation question in questionsInitProject now fixed.
  • OPEN_RUNTIMES_ENTRYPOINT env var passed to Docker during function emulation.
  • All service files now assign command builder results to named const variables (cosmetic, no behaviour change).

Findings:

  • placeSkills silently falls back to copy mode when the user selected "Symlink" but only chose one agent directory — no notification is given to the user.
  • fetchAvailableSkills calls execSync for the git clone without a timeout, so a slow or unreachable network will hang the CLI indefinitely.
  • The default (table) output no longer shows null values — a behavioural change not called out in the CHANGELOG.
  • renderDepth / redactionApplied are module-level mutable globals; resilient in practice but fragile if the module is used in test harnesses or library contexts.

Confidence Score: 5/5

Safe to merge — all remaining findings are P2 style/UX suggestions with no data-loss or runtime-breakage risk.

No P0/P1 defects found. The symlink-fallback and execSync-timeout issues are quality improvements rather than current breakage. The null-value omission is intentional product behaviour. The module-level globals are correctly guarded.

lib/utils.ts (placeSkills symlink fallback, execSync timeout) and lib/parser.ts (null value behaviour change, module-level state)

Important Files Changed

Filename Overview
lib/utils.ts Adds ~230 lines of agent-skills helpers (fetchAvailableSkills, detectProjectSkills, placeSkills, hasSkillsInstalled). Synchronous git clone may hang on slow networks; symlink mode silently falls back to copy when only one agent dir is selected.
lib/parser.ts Adds secrets-redaction (maskSensitiveData, SENSITIVE_KEYS), renderDepth/redactionApplied module globals, applyDisplayFilter, and withRender wrapper; default output now silently skips null values (previously showed "key : null").
lib/commands/init.ts Adds initSkill command, replaces process.exit(1) on override-decline with a graceful return, and auto-installs detected skills after project init. Logic is sound.
cli.ts Adds --show-secrets flag, updates -j/-R descriptions, and adds a preAction hook that reads outputFields from each command to populate cliConfig.displayFields for column filtering.
lib/emulation/docker.ts Passes OPEN_RUNTIMES_ENTRYPOINT env var to Docker container during function emulation.
lib/questions.ts Adds Skill choice to questionsInitResources and fixes missing whenOverride guard on the organization question (was shown even when override=false).
lib/commands/services/projects.ts Assigns stored command references; sets outputFields on projectsListCommand to ["name", "$id", "region", "status"] for table column filtering.
lib/types.ts Adds showSecrets and displayFields fields to CliConfig interface.

Reviews (1): Last reviewed commit: "chore: update Command Line SDK to 17.2.0" | Re-trigger Greptile

Copy link
Copy Markdown

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 9

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (19)
lib/commands/services/messaging.ts (1)

29-1084: ⚠️ Potential issue | 🟠 Major

Build-breaking lint regression from unused command constants

All newly introduced command constants are never read (for example, Line 29 and similar declarations through Line 1084), which triggers @typescript-eslint/no-unused-vars errors across this file. This refactor will fail lint unless each intentionally-unused symbol matches the configured _ prefix rule or the assignment pattern is removed.

✅ Minimal fix pattern (apply consistently to all command const declarations)
-const messagingListMessagesCommand = messaging
+const _messagingListMessagesCommand = messaging
   .command(`list-messages`)
   // ...

-const messagingCreateEmailCommand = messaging
+const _messagingCreateEmailCommand = messaging
   .command(`create-email`)
   // ...

-const messagingUpdateEmailCommand = messaging
+const _messagingUpdateEmailCommand = messaging
   .command(`update-email`)
   // ...

If the variable names are not needed, reverting to expression-chaining without assignment is also valid.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/messaging.ts` around lines 29 - 1084, The file defines
many command constants (e.g., messagingListMessagesCommand,
messagingCreateEmailCommand, messagingUpdateEmailCommand,
messagingCreatePushCommand, etc.) that are never used, triggering
`@typescript-eslint/no-unused-vars`; either remove the local assignment and use
expression-chaining (e.g.,
messaging.command(...).description(...).option(...).action(...)) or rename each
intentionally-unused const to start with an underscore (e.g.,
_messagingListMessagesCommand) to satisfy the configured _-prefix rule; apply
the chosen pattern consistently to all command const declarations introduced in
this diff.
lib/commands/services/activities.ts (1)

29-53: ⚠️ Potential issue | 🟠 Major

New activities command constants are unused and fail lint.

Both introduced bindings are never referenced, which triggers @typescript-eslint/no-unused-vars.

🔧 Suggested fix
-const activitiesListEventsCommand = activities
+const _activitiesListEventsCommand = activities
...
-const activitiesGetEventCommand = activities
+const _activitiesGetEventCommand = activities

Or remove the variable assignments entirely.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/activities.ts` around lines 29 - 53, The two new
constants activitiesListEventsCommand and activitiesGetEventCommand are declared
but never used, causing `@typescript-eslint/no-unused-vars`; to fix, either remove
the const assignments and keep the chain expressions inline (i.e., call
activities.command(...).description(...).option(...).action(...) directly) or
use the constants where intended (e.g., register them with the parent command or
export them); update the bindings named activitiesListEventsCommand and
activitiesGetEventCommand (or delete them) and ensure the active variable is the
result of activities.command(...) so no unused variable remains.
lib/commands/services/tables-db.ts (1)

29-1401: ⚠️ Potential issue | 🟠 Major

tables-db command refactor currently breaks lint due to unused bindings.

The new named command constants are not read anywhere, so @typescript-eslint/no-unused-vars fails across this file.

🔧 Suggested pattern fix
-const tablesDBListCommand = tablesDB
+const _tablesDBListCommand = tablesDB
...
-const tablesDBCreateCommand = tablesDB
+const _tablesDBCreateCommand = tablesDB

Apply the same approach to all command constants in this file (or revert to direct chaining without assignment).

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/tables-db.ts` around lines 29 - 1401, Multiple const
command bindings (e.g., tablesDBListCommand, tablesDBCreateCommand,
tablesDBListTransactionsCommand, etc.) are unused and trigger
`@typescript-eslint/no-unused-vars`; remove the unused bindings by converting each
"const X = tablesDB.command(...)" into a direct chained call
"tablesDB.command(...)" (i.e., drop the const assignment) across the file so the
command registration stays intact but no unused variables remain.
lib/commands/services/tokens.ts (1)

29-99: ⚠️ Potential issue | 🟠 Major

New command constants are unused and fail lint.

The refactor introduced unused local bindings (tokens...Command), which violates @typescript-eslint/no-unused-vars.

🔧 Suggested fix
-const tokensListCommand = tokens
+const _tokensListCommand = tokens

Use the same _ prefix (or drop assignments) for all command constants in this file.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/tokens.ts` around lines 29 - 99, The new command
constants (tokensListCommand, tokensCreateFileTokenCommand, tokensGetCommand,
tokensUpdateCommand, tokensDeleteCommand) are declared but never used, causing
`@typescript-eslint/no-unused-vars`; fix by either removing the assignment and
chaining directly off tokens (e.g.,
tokens.command(...).description(...).action(...)) or rename each constant to
start with an underscore (e.g., _tokensListCommand,
_tokensCreateFileTokenCommand, _tokensGetCommand, _tokensUpdateCommand,
_tokensDeleteCommand) so the linter treats them as intentionally unused.
lib/commands/services/sites.ts (1)

31-537: ⚠️ Potential issue | 🟠 Major

Refactor causes widespread unused-var lint failures in sites commands.

From Line 31 onward, newly introduced const sites...Command bindings are never referenced, so lint fails on @typescript-eslint/no-unused-vars.

🔧 Suggested pattern fix
-const sitesListCommand = sites
+const _sitesListCommand = sites
...
-const sitesCreateCommand = sites
+const _sitesCreateCommand = sites

Apply to all newly added command constants in this module (or remove local assignments).

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/sites.ts` around lines 31 - 537, The newly added const
bindings (e.g., sitesListCommand, sitesCreateCommand,
sitesListFrameworksCommand, sitesListSpecificationsCommand,
sitesListTemplatesCommand, sitesGetTemplateCommand, sitesListUsageCommand,
sitesGetCommand, sitesUpdateCommand, sitesDeleteCommand,
sitesUpdateSiteDeploymentCommand, sitesListDeploymentsCommand,
sitesCreateDeploymentCommand, sitesCreateDuplicateDeploymentCommand,
sitesCreateTemplateDeploymentCommand, sitesCreateVcsDeploymentCommand,
sitesGetDeploymentCommand, sitesDeleteDeploymentCommand,
sitesGetDeploymentDownloadCommand, sitesUpdateDeploymentStatusCommand,
sitesListLogsCommand, sitesGetLogCommand, sitesDeleteLogCommand,
sitesGetUsageCommand, sitesListVariablesCommand, sitesCreateVariableCommand,
sitesGetVariableCommand, sitesUpdateVariableCommand, sitesDeleteVariableCommand)
are never used and trigger `@typescript-eslint/no-unused-vars`; remove the local
const assignments and directly chain the calls (i.e., replace "const X =
sites.command(...)" with "sites.command(...)" or prefix with void if you want to
keep the expression) across the file, or alternatively export any of these
identifiers if they must remain referenced elsewhere. Ensure each occurrence of
sites.command(...) is adjusted so no unused local binding remains.
lib/commands/services/storage.ts (1)

31-348: ⚠️ Potential issue | 🟠 Major

Unused command bindings introduce lint errors.

From Line 31 onward, each const storage...Command = storage.command(...) is unused, violating @typescript-eslint/no-unused-vars and breaking lint.

🔧 Suggested pattern fix
-const storageListBucketsCommand = storage
+const _storageListBucketsCommand = storage
...
-const storageCreateBucketCommand = storage
+const _storageCreateBucketCommand = storage

Apply consistently to all added command constants in this file (or revert to unassigned chaining).

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/storage.ts` around lines 31 - 348, The declared
constants like storageListBucketsCommand, storageCreateBucketCommand,
storageGetBucketCommand, etc., are never used and trigger
`@typescript-eslint/no-unused-vars`; fix by removing the assignments and directly
chaining the calls (replace "const X = storage.command(...)" with
"storage.command(...)" for each storage...Command symbol) so the commands are
registered without creating unused variables; apply this consistently to all
storage...Command declarations in the file.
lib/commands/services/organizations.ts (1)

29-555: ⚠️ Potential issue | 🟠 Major

Unused command constants are failing lint in this module.

From Line 29 onward, the new const ...Command = organizations.command(...) bindings are never read, triggering @typescript-eslint/no-unused-vars. This will fail lint/CI.

🔧 Suggested pattern fix
-const organizationsListCommand = organizations
+const _organizationsListCommand = organizations
...
-const organizationsCreateCommand = organizations
+const _organizationsCreateCommand = organizations

Apply this naming pattern to all newly introduced command constants in this file (or remove assignments and keep direct chaining).

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/organizations.ts` around lines 29 - 555, Lint fails
because many command constants (e.g., organizationsListCommand,
organizationsCreateCommand, organizationsEstimationCreateOrganizationCommand,
organizationsDeleteCommand, organizationsListAggregationsCommand,
organizationsGetAggregationCommand, etc.) are declared but never used,
triggering `@typescript-eslint/no-unused-vars`; fix by either removing the const
assignment and chaining directly off organizations
(organizations.command(...).description(...).action(...)) or rename each const
to start with an underscore (e.g., _organizationsListCommand) so the linter
ignores them—apply the chosen pattern consistently across all newly introduced
bindings in this file.
lib/commands/services/locale.ts (1)

29-109: ⚠️ Potential issue | 🟠 Major

Introduced locale*Command bindings are unused.

The new subcommand constants (starting Line 29) are not referenced, so this file now fails @typescript-eslint/no-unused-vars.

Please prefix with _ or remove the intermediate constants.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/locale.ts` around lines 29 - 109, The new constants
localeGetCommand, localeListCodesCommand, localeListContinentsCommand,
localeListCountriesCommand, localeListCountriesEUCommand,
localeListCountriesPhonesCommand, localeListCurrenciesCommand, and
localeListLanguagesCommand are unused and trigger
`@typescript-eslint/no-unused-vars`; fix by either removing the intermediate const
assignments and chaining the .command(...).description(...).action(...) calls
directly on the locale object, or rename each const to start with an underscore
(e.g., _localeGetCommand) to signal intentional unused variables; update the
declarations for the functions mentioned above accordingly.
lib/commands/services/graphql.ts (1)

29-50: ⚠️ Potential issue | 🟠 Major

New command variables are unused and fail lint.

graphqlQueryCommand (Line 29) and graphqlMutationCommand (Line 41) are assigned but never used, triggering @typescript-eslint/no-unused-vars.

Rename to _graphqlQueryCommand / _graphqlMutationCommand or remove the assignments.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/graphql.ts` around lines 29 - 50, The variables
graphqlQueryCommand and graphqlMutationCommand are assigned but never used which
triggers the no-unused-vars lint; rename them to _graphqlQueryCommand and
_graphqlMutationCommand (or remove the assignment) so the declarations remain
but are treated as intentionally unused; specifically update the two const
declarations that call
graphql.command(...).description(...).requiredOption(...).action(actionRunner(...))
to use the underscored names while leaving the chained calls (graphql.command,
actionRunner, getGraphqlClient, parse) unchanged.
lib/commands/services/webhooks.ts (1)

29-139: ⚠️ Potential issue | 🟠 Major

Unused webhooks*Command variables break ESLint.

The refactor added local constants (from Line 29 onward) that are not consumed later, triggering @typescript-eslint/no-unused-vars.

Use _webhooks... names or remove the assignments.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/webhooks.ts` around lines 29 - 139, The new local
constants (webhooksListCommand, webhooksCreateCommand, webhooksGetCommand,
webhooksUpdateCommand, webhooksDeleteCommand, webhooksUpdateSignatureCommand)
are never used and trigger `@typescript-eslint/no-unused-vars`; fix by either
removing the assignment and invoking the chain directly on webhooks (e.g.,
webhooks.command(...).description(...).option(...).action(...)) or rename each
constant to start with an underscore (e.g., _webhooksListCommand,
_webhooksCreateCommand, etc.) so ESLint treats them as intentionally unused;
update the declarations for all referenced symbols (webhooksListCommand,
webhooksCreateCommand, webhooksGetCommand, webhooksUpdateCommand,
webhooksDeleteCommand, webhooksUpdateSignatureCommand) consistently.
lib/commands/services/account.ts (1)

29-762: ⚠️ Potential issue | 🟠 Major

Refactor introduced unused local bindings for every subcommand.

The new const account*Command declarations (starting at Line 29) are never referenced and currently violate @typescript-eslint/no-unused-vars for this file.

Please either:

  • prefix these bindings with _ (matching your configured allowlist), or
  • remove the assignment and keep direct chaining on account.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/account.ts` around lines 29 - 762, The new const
bindings (e.g., accountGetCommand, accountCreateCommand, accountDeleteCommand,
accountUpdateEmailCommand, etc.) for every subcommand introduce unused local
variables and trigger `@typescript-eslint/no-unused-vars`; fix by either prefixing
each binding name with an underscore (e.g., _accountGetCommand) to match your
allowlist, or remove the assignment entirely and keep the chained call on the
account object (e.g., change "const accountXCommand = account.command(...)" to
"account.command(...)" for all account*Command declarations).
lib/commands/services/vcs.ts (1)

29-171: ⚠️ Potential issue | 🟠 Major

vcs*Command constants are currently unused (lint blocker).

The newly added local bindings from Line 29 onward are never used, which violates @typescript-eslint/no-unused-vars.

Please apply _ prefixing or remove these assignments and keep direct chaining.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/vcs.ts` around lines 29 - 171, The declared constants
(vcsCreateRepositoryDetectionCommand, vcsListRepositoriesCommand,
vcsCreateRepositoryCommand, vcsGetRepositoryCommand,
vcsListRepositoryBranchesCommand, vcsGetRepositoryContentsCommand,
vcsUpdateExternalDeploymentsCommand, vcsListInstallationsCommand,
vcsGetInstallationCommand, vcsDeleteInstallationCommand) are unused and trigger
`@typescript-eslint/no-unused-vars`; fix by either removing the local bindings and
keeping the direct chaining on the vcs object, or rename each constant to a
prefixed unused identifier (e.g., _vcsCreateRepositoryDetectionCommand,
_vcsListRepositoriesCommand, etc.) so the linter ignores them; update all
declarations consistently to one approach to resolve the lint error.
lib/commands/services/health.ts (1)

29-289: ⚠️ Potential issue | 🟠 Major

Unused subcommand const bindings trigger lint failures.

All newly introduced const health*Command = ... declarations are never read (for example, Line 29), which violates @typescript-eslint/no-unused-vars and will fail CI.

🔧 Suggested fix pattern
-const healthGetCommand = health
+const _healthGetCommand = health
   .command(`get`)
   ...
-const healthGetAntivirusCommand = health
+const _healthGetAntivirusCommand = health
   .command(`get-antivirus`)

Apply the same _ prefix pattern to all newly introduced command-builder constants in this file (or remove the assignments entirely and keep chained expression statements).

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/health.ts` around lines 29 - 289, The newly declared
command-builder constants (e.g., healthGetCommand, healthGetAntivirusCommand,
healthGetCacheCommand, healthGetCertificateCommand, healthGetDBCommand,
healthGetPubSubCommand, healthGetQueueAuditsCommand,
healthGetQueueBuildsCommand, healthGetQueueCertificatesCommand,
healthGetQueueDatabasesCommand, healthGetQueueDeletesCommand,
healthGetFailedJobsCommand, healthGetQueueFunctionsCommand,
healthGetQueueLogsCommand, healthGetQueueMailsCommand,
healthGetQueueMessagingCommand, healthGetQueueMigrationsCommand,
healthGetQueueStatsResourcesCommand, healthGetQueueUsageCommand,
healthGetQueueWebhooksCommand, healthGetStorageCommand,
healthGetStorageLocalCommand, healthGetTimeCommand) are never read and cause
`@typescript-eslint/no-unused-vars` failures; to fix, either remove the const
assignments and leave the chained .command(...).description(...).action(...)
expression statements, or rename each const to start with an underscore (e.g.,
_healthGetCommand) to mark them as intentionally unused, matching the project's
existing pattern—apply this consistently to all the listed health*Command
bindings so lint passes.
lib/commands/services/teams.ts (1)

38-254: ⚠️ Potential issue | 🟠 Major

Subcommand constants are unused after refactor.

The const teams*Command = teams.command(...) declarations (beginning Line 38) are never referenced, triggering @typescript-eslint/no-unused-vars.

Please rename them with _ prefix or remove the variable assignments.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/teams.ts` around lines 38 - 254, The declared constants
(e.g., teamsListCommand, teamsCreateCommand, teamsGetCommand,
teamsUpdateNameCommand, teamsDeleteCommand, teamsListLogsCommand,
teamsListMembershipsCommand, teamsCreateMembershipCommand,
teamsGetMembershipCommand, teamsUpdateMembershipCommand,
teamsDeleteMembershipCommand, teamsUpdateMembershipStatusCommand,
teamsGetPrefsCommand, teamsUpdatePrefsCommand) are unused after the refactor and
raise no-unused-vars errors; fix by either removing the variable assignments and
just chaining off teams.command(...) directly, or rename each const to start
with an underscore (e.g., _teamsListCommand) to mark them as intentionally
unused—apply the same change consistently for all listed teams*Command constants
and keep the original .command(...).action(...) chains intact (no other logic
changes).
lib/commands/services/users.ts (1)

29-667: ⚠️ Potential issue | 🟠 Major

All newly introduced users*Command constants are unused.

Starting at Line 29, the file now declares many local command-builder constants that are never read, causing @typescript-eslint/no-unused-vars errors.

Please apply one consistent fix in this file:

  • _ prefix for all these bindings, or
  • revert to direct chaining without intermediate constants.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/users.ts` around lines 29 - 667, The file declares many
local constants like usersListCommand, usersCreateCommand,
usersCreateArgon2UserCommand, usersCreateBcryptUserCommand, ... that are never
referenced and trigger no-unused-vars; fix by consistently renaming all these
local command bindings to start with an underscore (e.g., usersListCommand ->
_usersListCommand, usersCreateCommand -> _usersCreateCommand,
usersCreateArgon2UserCommand -> _usersCreateArgon2UserCommand, etc.) so they are
treated as intentionally unused, ensuring every declaration named users*Command
in the file is updated to its _users*Command equivalent.
lib/commands/services/project.ts (1)

29-123: ⚠️ Potential issue | 🟠 Major

Prefix or remove the unused command locals introduced by this refactor.

Every project*Command binding in this block is write-only. That introduces @typescript-eslint/no-unused-vars errors and will fail lint/CI even though command registration still works at runtime.

Representative fix
-const projectGetUsageCommand = project
+const _projectGetUsageCommand = project
   .command(`get-usage`)
   // ...

-const projectListVariablesCommand = project
+const _projectListVariablesCommand = project
   .command(`list-variables`)
   // ...

-const projectCreateVariableCommand = project
+const _projectCreateVariableCommand = project
   .command(`create-variable`)
   // ...

-const projectGetVariableCommand = project
+const _projectGetVariableCommand = project
   .command(`get-variable`)
   // ...

-const projectUpdateVariableCommand = project
+const _projectUpdateVariableCommand = project
   .command(`update-variable`)
   // ...

-const projectDeleteVariableCommand = project
+const _projectDeleteVariableCommand = project
   .command(`delete-variable`)
   // ...

If you do not need the locals at all, removing the assignment and keeping the fluent chain unbound is even cleaner.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/project.ts` around lines 29 - 123, The local constants
like projectGetUsageCommand, projectListVariablesCommand,
projectCreateVariableCommand, projectGetVariableCommand,
projectUpdateVariableCommand, and projectDeleteVariableCommand are unused and
trigger `@typescript-eslint/no-unused-vars`; fix by either removing the
assignments and leaving the fluent .command()/... chain unbound or renaming each
local to a prefixed underscore (e.g., _projectGetUsageCommand) so the variables
are treated as intentionally unused; update all occurrences in this block (the
const declarations that start with "project" for each command) accordingly.
lib/commands/services/projects.ts (1)

49-802: ⚠️ Potential issue | 🟠 Major

Keep only the command binding that is actually mutated.

projectsListCommand is justified because it gets outputFields, but the rest of the new projects*Command locals in this block are never read. They currently add a large set of @typescript-eslint/no-unused-vars errors and will break lint/CI.

Representative fix
-const projectsCreateCommand = projects
+const _projectsCreateCommand = projects
   .command(`create`)
   // ...

-const projectsGetCommand = projects
+const _projectsGetCommand = projects
   .command(`get`)
   // ...

-const projectsUpdateCommand = projects
+const _projectsUpdateCommand = projects
   .command(`update`)
   // ...

-const projectsDeleteSmsTemplateCommand = projects
+const _projectsDeleteSmsTemplateCommand = projects
   .command(`delete-sms-template`)
   // ...

Apply the same rename/remove pattern to the other intentionally-unused projects*Command bindings in this file.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/projects.ts` around lines 49 - 802, The file defines
many local const bindings like projectsCreateCommand, projectsGetCommand,
projectsUpdateCommand, etc., that are never used and trigger
`@typescript-eslint/no-unused-vars`; keep only the binding that is actually read
(projectsListCommand) and either remove the unused const assignments or rename
them to a leading underscore (e.g., _projectsCreateCommand) or inline the
.command(...) chain without assigning to a const; update each unused symbol
(projectsCreateCommand, projectsGetCommand, projectsUpdateCommand,
projectsDeleteCommand, projectsUpdateApiStatusCommand, ...
projectsDeleteSmsTemplateCommand) accordingly so only the genuinely used binding
remains.
lib/commands/services/databases.ts (1)

29-1415: ⚠️ Potential issue | 🟠 Major

This refactor introduces a file-wide unused-variable lint failure.

The new databases*Command bindings are never read after assignment, so the entire block now violates @typescript-eslint/no-unused-vars. The commands still register, but the PR will fail lint/CI until these locals are prefixed with _ or removed.

Representative fix
-const databasesListCommand = databases
+const _databasesListCommand = databases
   .command(`list`)
   // ...

-const databasesCreateCommand = databases
+const _databasesCreateCommand = databases
   .command(`create`)
   // ...

-const databasesGetUsageCommand = databases
+const _databasesGetUsageCommand = databases
   .command(`get-usage`)
   // ...

Please apply the same rename/remove pattern to the remaining intentionally-unused databases*Command bindings in this file.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/databases.ts` around lines 29 - 1415, The file declares
many local constants like databasesListCommand, databasesCreateCommand,
databasesListTransactionsCommand, etc. that are never used and trigger
`@typescript-eslint/no-unused-vars`; rename each intentionally-unused binding by
prefixing the identifier with an underscore (e.g. _databasesListCommand) or
remove the const if you prefer, ensuring you apply the same change to every
databases*Command symbol (all constants matching /^databases.*Command$/) so the
commands still register but the linter no longer flags unused locals.
lib/commands/services/backups.ts (1)

29-196: ⚠️ Potential issue | 🟠 Major

These new backups*Command locals will fail lint as unused.

The refactor turns every command registration into a write-only local, so this whole block now trips @typescript-eslint/no-unused-vars. Runtime behavior stays the same, but CI/lint will not.

Representative fix
-const backupsListArchivesCommand = backups
+const _backupsListArchivesCommand = backups
   .command(`list-archives`)
   // ...

-const backupsCreateArchiveCommand = backups
+const _backupsCreateArchiveCommand = backups
   .command(`create-archive`)
   // ...

-const backupsGetRestorationCommand = backups
+const _backupsGetRestorationCommand = backups
   .command(`get-restoration`)
   // ...

Alternatively, drop the assignment entirely for commands that do not need follow-up metadata.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/backups.ts` around lines 29 - 196, The declared locals
like backupsListArchivesCommand, backupsCreateArchiveCommand,
backupsGetArchiveCommand, backupsDeleteArchiveCommand,
backupsListPoliciesCommand, backupsCreatePolicyCommand, backupsGetPolicyCommand,
backupsUpdatePolicyCommand, backupsDeletePolicyCommand,
backupsCreateRestorationCommand, backupsListRestorationsCommand, and
backupsGetRestorationCommand are unused and trigger
`@typescript-eslint/no-unused-vars`; fix by removing the const assignments and
invoking the command registration directly (i.e. replace "const X =
backups.command(...)" with just "backups.command(...)" for each listed symbol)
so the commands are registered but no unused variables remain.
🧹 Nitpick comments (1)
lib/commands/services/migrations.ts (1)

29-262: Address unused variable assignments for command declarations.

All 14 command variable declarations are flagged by ESLint as unused because they're assigned but never referenced. In Commander.js, calling .command() on a parent command registers the subcommand as a side effect, so storing the result in a variable serves no functional purpose when the variable is not used elsewhere.

Consider one of the following approaches:

  1. Prefix variables with _ to indicate intentional non-use:

    const _migrationsListCommand = migrations.command('list')...
  2. Revert to the original chained style (preferred for Commander.js idioms):

    migrations
      .command('list')
      .description(...)
      .option(...)
      .action(...);

The chained style is more idiomatic for Commander.js when the command objects aren't exported or referenced elsewhere in the codebase—which is confirmed here.

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/commands/services/migrations.ts` around lines 29 - 262, The command
variables (migrationsListCommand, migrationsCreateAppwriteMigrationCommand,
migrationsGetAppwriteReportCommand, migrationsCreateCSVExportCommand,
migrationsCreateCSVImportCommand, migrationsCreateFirebaseMigrationCommand,
migrationsGetFirebaseReportCommand, migrationsCreateNHostMigrationCommand,
migrationsGetNHostReportCommand, migrationsCreateSupabaseMigrationCommand,
migrationsGetSupabaseReportCommand, migrationsGetCommand,
migrationsRetryCommand, migrationsDeleteCommand) are assigned but never used;
replace each "const <name> = migrations.command(...)" pattern with the idiomatic
chained form starting from "migrations.command(...)" (i.e., drop the unused
const) so the side-effect of registering subcommands remains while removing
unused variable assignments, or alternatively prefix any intentionally unused
consts with "_" if you prefer to keep the bindings. Ensure you update every
occurrence of the listed symbols to the chained style (or prepend "_"
consistently) to satisfy ESLint.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@install.ps1`:
- Around line 16-17: The install.ps1 file contains non-ASCII characters (emoji
in comments/output) but lacks a UTF-8 BOM, triggering
PSUseBOMForUnicodeEncodedFile; resave the script with UTF-8 with BOM encoding so
PowerShell 5.1 decodes the Unicode correctly—either use your editor's "Save As"
and select UTF-8 with BOM, or rewrite the file in place using a PowerShell
re-save operation that specifies UTF8-BOM encoding to ensure the file contains
the BOM.

In `@lib/commands/init.ts`:
- Around line 264-285: The auto-install path hard-codes useSymlinks = true when
calling placeSkills which fails on Windows; modify the init flow around
placeSkills (inside the detected.length > 0 block) to catch the symlink-specific
error thrown by placeSkills and retry the operation with useSymlinks = false
(copy mode), e.g., call placeSkills(...) inside a try/catch, detect the Windows
symlink error by inspecting the thrown Error message or code, and if matched
call placeSkills(skillsCwd, tempDir, names, [".agents", ".claude"], false) to
fall back to copy mode; ensure you still clean up tempDir in the existing
finally.

In `@lib/commands/services/functions.ts`:
- Line 31: Rename the unused const bindings created from fluent command calls so
they start with an underscore (e.g., change functionsListCommand to
_functionsListCommand) to satisfy `@typescript-eslint/no-unused-vars`; apply this
same rename pattern to all other write-only bindings in this file that follow
the const ... = functions.command(...) pattern so the lint rule accepts them as
intentionally-unused locals without changing the fluent command behavior.

In `@lib/commands/services/proxy.ts`:
- Line 29: The file defines several const command bindings (e.g.,
proxyListRulesCommand) that are never read and trigger
`@typescript-eslint/no-unused-vars`; remove those unused const declarations or
convert them to exported bindings if they must remain public (for example,
export const proxyListRulesCommand = proxy) so they are referenced, or simply
delete the unused const lines for each of the unused symbols
(proxyListRulesCommand and the other similarly unused proxy*Command constants)
to satisfy the linter and CI.

In `@lib/emulation/docker.ts`:
- Line 222: Guard against undefined entrypoint before adding the env var: check
func.entrypoint and either throw a clear error or use a safe fallback instead of
always pushing `"-e", \`OPEN_RUNTIMES_ENTRYPOINT=${func.entrypoint}\`` to
params; update the code around the params push (referencing params and
func.entrypoint / OPEN_RUNTIMES_ENTRYPOINT) to perform `if (!func.entrypoint) {
throw new Error("missing entrypoint for function <name>") }` or `if
(func.entrypoint) params.push("-e",
\`OPEN_RUNTIMES_ENTRYPOINT=${func.entrypoint}\`)` so you never pass "undefined"
into the container.

In `@lib/parser.ts`:
- Around line 251-252: Remove the dead variable printedScalar: delete its
declaration and all subsequent assignments (the repeated "printedScalar = ..."
statements) since the variable is never read and triggers the no-unused-vars
lint error; verify that no logic relies on printedScalar and that removing these
lines does not affect surrounding functions or control flow (search for the
symbol printedScalar to remove every occurrence).
- Around line 339-340: The fallback branches in drawTable call drawJSON(data)
and thus serialize the original unmasked input, leaking values when secrets
should be hidden; change those fallbacks to pass the already-built masked
representation (e.g., pass maskedRows or a sanitizedData object) into drawJSON
instead of the original data so drawJSON renders the redacted output when
--show-secrets is false; update both occurrences (the fallback near the
drawTable masked-rows construction and the second occurrence around lines
366-367) to use the masked output variable produced by drawTable.

In `@lib/utils.ts`:
- Around line 350-357: Validate and sanitize path segments before any filesystem
writes: ensure each entry in selectedDirNames and selectedAgents is a single
basename (no path separators, no '..', not absolute) and that resolved targets
stay inside the intended base directories by checking
path.relative(canonicalBase, path.resolve(base, segment)) does not start with
'..'; apply this validation before constructing src/dest for the loop that uses
skillsSrcDir and canonicalBase (where fs.rmSync and fs.cpSync are called) and
likewise before the blocks handling selectedAgents (the code that creates
symlinks/uses fs.symlinkSync or fs.cpSync), rejecting or skipping invalid
segments and logging an error.
- Around line 225-230: The hasSkillsInstalled check can throw on race/permission
errors when calling fs.statSync or fs.readdirSync; update the function (the
block using skillsDirs.some) to wrap the per-directory filesystem checks in a
try/catch so any thrown errors are caught and treated as "not present" (i.e.,
return false for that dir) and the loop continues, ensuring permission/race
failures don't abort initialization; keep the existing logic (existsSync,
isDirectory, non-empty) but perform statSync and readdirSync inside the try and
swallow/log the error as needed.

---

Outside diff comments:
In `@lib/commands/services/account.ts`:
- Around line 29-762: The new const bindings (e.g., accountGetCommand,
accountCreateCommand, accountDeleteCommand, accountUpdateEmailCommand, etc.) for
every subcommand introduce unused local variables and trigger
`@typescript-eslint/no-unused-vars`; fix by either prefixing each binding name
with an underscore (e.g., _accountGetCommand) to match your allowlist, or remove
the assignment entirely and keep the chained call on the account object (e.g.,
change "const accountXCommand = account.command(...)" to "account.command(...)"
for all account*Command declarations).

In `@lib/commands/services/activities.ts`:
- Around line 29-53: The two new constants activitiesListEventsCommand and
activitiesGetEventCommand are declared but never used, causing
`@typescript-eslint/no-unused-vars`; to fix, either remove the const assignments
and keep the chain expressions inline (i.e., call
activities.command(...).description(...).option(...).action(...) directly) or
use the constants where intended (e.g., register them with the parent command or
export them); update the bindings named activitiesListEventsCommand and
activitiesGetEventCommand (or delete them) and ensure the active variable is the
result of activities.command(...) so no unused variable remains.

In `@lib/commands/services/backups.ts`:
- Around line 29-196: The declared locals like backupsListArchivesCommand,
backupsCreateArchiveCommand, backupsGetArchiveCommand,
backupsDeleteArchiveCommand, backupsListPoliciesCommand,
backupsCreatePolicyCommand, backupsGetPolicyCommand, backupsUpdatePolicyCommand,
backupsDeletePolicyCommand, backupsCreateRestorationCommand,
backupsListRestorationsCommand, and backupsGetRestorationCommand are unused and
trigger `@typescript-eslint/no-unused-vars`; fix by removing the const assignments
and invoking the command registration directly (i.e. replace "const X =
backups.command(...)" with just "backups.command(...)" for each listed symbol)
so the commands are registered but no unused variables remain.

In `@lib/commands/services/databases.ts`:
- Around line 29-1415: The file declares many local constants like
databasesListCommand, databasesCreateCommand, databasesListTransactionsCommand,
etc. that are never used and trigger `@typescript-eslint/no-unused-vars`; rename
each intentionally-unused binding by prefixing the identifier with an underscore
(e.g. _databasesListCommand) or remove the const if you prefer, ensuring you
apply the same change to every databases*Command symbol (all constants matching
/^databases.*Command$/) so the commands still register but the linter no longer
flags unused locals.

In `@lib/commands/services/graphql.ts`:
- Around line 29-50: The variables graphqlQueryCommand and
graphqlMutationCommand are assigned but never used which triggers the
no-unused-vars lint; rename them to _graphqlQueryCommand and
_graphqlMutationCommand (or remove the assignment) so the declarations remain
but are treated as intentionally unused; specifically update the two const
declarations that call
graphql.command(...).description(...).requiredOption(...).action(actionRunner(...))
to use the underscored names while leaving the chained calls (graphql.command,
actionRunner, getGraphqlClient, parse) unchanged.

In `@lib/commands/services/health.ts`:
- Around line 29-289: The newly declared command-builder constants (e.g.,
healthGetCommand, healthGetAntivirusCommand, healthGetCacheCommand,
healthGetCertificateCommand, healthGetDBCommand, healthGetPubSubCommand,
healthGetQueueAuditsCommand, healthGetQueueBuildsCommand,
healthGetQueueCertificatesCommand, healthGetQueueDatabasesCommand,
healthGetQueueDeletesCommand, healthGetFailedJobsCommand,
healthGetQueueFunctionsCommand, healthGetQueueLogsCommand,
healthGetQueueMailsCommand, healthGetQueueMessagingCommand,
healthGetQueueMigrationsCommand, healthGetQueueStatsResourcesCommand,
healthGetQueueUsageCommand, healthGetQueueWebhooksCommand,
healthGetStorageCommand, healthGetStorageLocalCommand, healthGetTimeCommand) are
never read and cause `@typescript-eslint/no-unused-vars` failures; to fix, either
remove the const assignments and leave the chained
.command(...).description(...).action(...) expression statements, or rename each
const to start with an underscore (e.g., _healthGetCommand) to mark them as
intentionally unused, matching the project's existing pattern—apply this
consistently to all the listed health*Command bindings so lint passes.

In `@lib/commands/services/locale.ts`:
- Around line 29-109: The new constants localeGetCommand,
localeListCodesCommand, localeListContinentsCommand, localeListCountriesCommand,
localeListCountriesEUCommand, localeListCountriesPhonesCommand,
localeListCurrenciesCommand, and localeListLanguagesCommand are unused and
trigger `@typescript-eslint/no-unused-vars`; fix by either removing the
intermediate const assignments and chaining the
.command(...).description(...).action(...) calls directly on the locale object,
or rename each const to start with an underscore (e.g., _localeGetCommand) to
signal intentional unused variables; update the declarations for the functions
mentioned above accordingly.

In `@lib/commands/services/messaging.ts`:
- Around line 29-1084: The file defines many command constants (e.g.,
messagingListMessagesCommand, messagingCreateEmailCommand,
messagingUpdateEmailCommand, messagingCreatePushCommand, etc.) that are never
used, triggering `@typescript-eslint/no-unused-vars`; either remove the local
assignment and use expression-chaining (e.g.,
messaging.command(...).description(...).option(...).action(...)) or rename each
intentionally-unused const to start with an underscore (e.g.,
_messagingListMessagesCommand) to satisfy the configured _-prefix rule; apply
the chosen pattern consistently to all command const declarations introduced in
this diff.

In `@lib/commands/services/organizations.ts`:
- Around line 29-555: Lint fails because many command constants (e.g.,
organizationsListCommand, organizationsCreateCommand,
organizationsEstimationCreateOrganizationCommand, organizationsDeleteCommand,
organizationsListAggregationsCommand, organizationsGetAggregationCommand, etc.)
are declared but never used, triggering `@typescript-eslint/no-unused-vars`; fix
by either removing the const assignment and chaining directly off organizations
(organizations.command(...).description(...).action(...)) or rename each const
to start with an underscore (e.g., _organizationsListCommand) so the linter
ignores them—apply the chosen pattern consistently across all newly introduced
bindings in this file.

In `@lib/commands/services/project.ts`:
- Around line 29-123: The local constants like projectGetUsageCommand,
projectListVariablesCommand, projectCreateVariableCommand,
projectGetVariableCommand, projectUpdateVariableCommand, and
projectDeleteVariableCommand are unused and trigger
`@typescript-eslint/no-unused-vars`; fix by either removing the assignments and
leaving the fluent .command()/... chain unbound or renaming each local to a
prefixed underscore (e.g., _projectGetUsageCommand) so the variables are treated
as intentionally unused; update all occurrences in this block (the const
declarations that start with "project" for each command) accordingly.

In `@lib/commands/services/projects.ts`:
- Around line 49-802: The file defines many local const bindings like
projectsCreateCommand, projectsGetCommand, projectsUpdateCommand, etc., that are
never used and trigger `@typescript-eslint/no-unused-vars`; keep only the binding
that is actually read (projectsListCommand) and either remove the unused const
assignments or rename them to a leading underscore (e.g.,
_projectsCreateCommand) or inline the .command(...) chain without assigning to a
const; update each unused symbol (projectsCreateCommand, projectsGetCommand,
projectsUpdateCommand, projectsDeleteCommand, projectsUpdateApiStatusCommand,
... projectsDeleteSmsTemplateCommand) accordingly so only the genuinely used
binding remains.

In `@lib/commands/services/sites.ts`:
- Around line 31-537: The newly added const bindings (e.g., sitesListCommand,
sitesCreateCommand, sitesListFrameworksCommand, sitesListSpecificationsCommand,
sitesListTemplatesCommand, sitesGetTemplateCommand, sitesListUsageCommand,
sitesGetCommand, sitesUpdateCommand, sitesDeleteCommand,
sitesUpdateSiteDeploymentCommand, sitesListDeploymentsCommand,
sitesCreateDeploymentCommand, sitesCreateDuplicateDeploymentCommand,
sitesCreateTemplateDeploymentCommand, sitesCreateVcsDeploymentCommand,
sitesGetDeploymentCommand, sitesDeleteDeploymentCommand,
sitesGetDeploymentDownloadCommand, sitesUpdateDeploymentStatusCommand,
sitesListLogsCommand, sitesGetLogCommand, sitesDeleteLogCommand,
sitesGetUsageCommand, sitesListVariablesCommand, sitesCreateVariableCommand,
sitesGetVariableCommand, sitesUpdateVariableCommand, sitesDeleteVariableCommand)
are never used and trigger `@typescript-eslint/no-unused-vars`; remove the local
const assignments and directly chain the calls (i.e., replace "const X =
sites.command(...)" with "sites.command(...)" or prefix with void if you want to
keep the expression) across the file, or alternatively export any of these
identifiers if they must remain referenced elsewhere. Ensure each occurrence of
sites.command(...) is adjusted so no unused local binding remains.

In `@lib/commands/services/storage.ts`:
- Around line 31-348: The declared constants like storageListBucketsCommand,
storageCreateBucketCommand, storageGetBucketCommand, etc., are never used and
trigger `@typescript-eslint/no-unused-vars`; fix by removing the assignments and
directly chaining the calls (replace "const X = storage.command(...)" with
"storage.command(...)" for each storage...Command symbol) so the commands are
registered without creating unused variables; apply this consistently to all
storage...Command declarations in the file.

In `@lib/commands/services/tables-db.ts`:
- Around line 29-1401: Multiple const command bindings (e.g.,
tablesDBListCommand, tablesDBCreateCommand, tablesDBListTransactionsCommand,
etc.) are unused and trigger `@typescript-eslint/no-unused-vars`; remove the
unused bindings by converting each "const X = tablesDB.command(...)" into a
direct chained call "tablesDB.command(...)" (i.e., drop the const assignment)
across the file so the command registration stays intact but no unused variables
remain.

In `@lib/commands/services/teams.ts`:
- Around line 38-254: The declared constants (e.g., teamsListCommand,
teamsCreateCommand, teamsGetCommand, teamsUpdateNameCommand, teamsDeleteCommand,
teamsListLogsCommand, teamsListMembershipsCommand, teamsCreateMembershipCommand,
teamsGetMembershipCommand, teamsUpdateMembershipCommand,
teamsDeleteMembershipCommand, teamsUpdateMembershipStatusCommand,
teamsGetPrefsCommand, teamsUpdatePrefsCommand) are unused after the refactor and
raise no-unused-vars errors; fix by either removing the variable assignments and
just chaining off teams.command(...) directly, or rename each const to start
with an underscore (e.g., _teamsListCommand) to mark them as intentionally
unused—apply the same change consistently for all listed teams*Command constants
and keep the original .command(...).action(...) chains intact (no other logic
changes).

In `@lib/commands/services/tokens.ts`:
- Around line 29-99: The new command constants (tokensListCommand,
tokensCreateFileTokenCommand, tokensGetCommand, tokensUpdateCommand,
tokensDeleteCommand) are declared but never used, causing
`@typescript-eslint/no-unused-vars`; fix by either removing the assignment and
chaining directly off tokens (e.g.,
tokens.command(...).description(...).action(...)) or rename each constant to
start with an underscore (e.g., _tokensListCommand,
_tokensCreateFileTokenCommand, _tokensGetCommand, _tokensUpdateCommand,
_tokensDeleteCommand) so the linter treats them as intentionally unused.

In `@lib/commands/services/users.ts`:
- Around line 29-667: The file declares many local constants like
usersListCommand, usersCreateCommand, usersCreateArgon2UserCommand,
usersCreateBcryptUserCommand, ... that are never referenced and trigger
no-unused-vars; fix by consistently renaming all these local command bindings to
start with an underscore (e.g., usersListCommand -> _usersListCommand,
usersCreateCommand -> _usersCreateCommand, usersCreateArgon2UserCommand ->
_usersCreateArgon2UserCommand, etc.) so they are treated as intentionally
unused, ensuring every declaration named users*Command in the file is updated to
its _users*Command equivalent.

In `@lib/commands/services/vcs.ts`:
- Around line 29-171: The declared constants
(vcsCreateRepositoryDetectionCommand, vcsListRepositoriesCommand,
vcsCreateRepositoryCommand, vcsGetRepositoryCommand,
vcsListRepositoryBranchesCommand, vcsGetRepositoryContentsCommand,
vcsUpdateExternalDeploymentsCommand, vcsListInstallationsCommand,
vcsGetInstallationCommand, vcsDeleteInstallationCommand) are unused and trigger
`@typescript-eslint/no-unused-vars`; fix by either removing the local bindings and
keeping the direct chaining on the vcs object, or rename each constant to a
prefixed unused identifier (e.g., _vcsCreateRepositoryDetectionCommand,
_vcsListRepositoriesCommand, etc.) so the linter ignores them; update all
declarations consistently to one approach to resolve the lint error.

In `@lib/commands/services/webhooks.ts`:
- Around line 29-139: The new local constants (webhooksListCommand,
webhooksCreateCommand, webhooksGetCommand, webhooksUpdateCommand,
webhooksDeleteCommand, webhooksUpdateSignatureCommand) are never used and
trigger `@typescript-eslint/no-unused-vars`; fix by either removing the assignment
and invoking the chain directly on webhooks (e.g.,
webhooks.command(...).description(...).option(...).action(...)) or rename each
constant to start with an underscore (e.g., _webhooksListCommand,
_webhooksCreateCommand, etc.) so ESLint treats them as intentionally unused;
update the declarations for all referenced symbols (webhooksListCommand,
webhooksCreateCommand, webhooksGetCommand, webhooksUpdateCommand,
webhooksDeleteCommand, webhooksUpdateSignatureCommand) consistently.

---

Nitpick comments:
In `@lib/commands/services/migrations.ts`:
- Around line 29-262: The command variables (migrationsListCommand,
migrationsCreateAppwriteMigrationCommand, migrationsGetAppwriteReportCommand,
migrationsCreateCSVExportCommand, migrationsCreateCSVImportCommand,
migrationsCreateFirebaseMigrationCommand, migrationsGetFirebaseReportCommand,
migrationsCreateNHostMigrationCommand, migrationsGetNHostReportCommand,
migrationsCreateSupabaseMigrationCommand, migrationsGetSupabaseReportCommand,
migrationsGetCommand, migrationsRetryCommand, migrationsDeleteCommand) are
assigned but never used; replace each "const <name> = migrations.command(...)"
pattern with the idiomatic chained form starting from "migrations.command(...)"
(i.e., drop the unused const) so the side-effect of registering subcommands
remains while removing unused variable assignments, or alternatively prefix any
intentionally unused consts with "_" if you prefer to keep the bindings. Ensure
you update every occurrence of the listed symbols to the chained style (or
prepend "_" consistently) to satisfy ESLint.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 9b2fea31-176f-44a8-8dfb-6a466b88428f

📥 Commits

Reviewing files that changed from the base of the PR and between aa548b6 and 4c52227.

📒 Files selected for processing (38)
  • CHANGELOG.md
  • README.md
  • cli.ts
  • install.ps1
  • install.sh
  • lib/client.ts
  • lib/commands/init.ts
  • lib/commands/services/account.ts
  • lib/commands/services/activities.ts
  • lib/commands/services/backups.ts
  • lib/commands/services/databases.ts
  • lib/commands/services/functions.ts
  • lib/commands/services/graphql.ts
  • lib/commands/services/health.ts
  • lib/commands/services/locale.ts
  • lib/commands/services/messaging.ts
  • lib/commands/services/migrations.ts
  • lib/commands/services/organizations.ts
  • lib/commands/services/project.ts
  • lib/commands/services/projects.ts
  • lib/commands/services/proxy.ts
  • lib/commands/services/sites.ts
  • lib/commands/services/storage.ts
  • lib/commands/services/tables-db.ts
  • lib/commands/services/teams.ts
  • lib/commands/services/tokens.ts
  • lib/commands/services/users.ts
  • lib/commands/services/vcs.ts
  • lib/commands/services/webhooks.ts
  • lib/constants.ts
  • lib/emulation/docker.ts
  • lib/parser.ts
  • lib/questions.ts
  • lib/sdks.ts
  • lib/types.ts
  • lib/utils.ts
  • package.json
  • scoop/appwrite.config.json
💤 Files with no reviewable changes (1)
  • lib/sdks.ts

Comment on lines +339 to +340
drawJSON(data);
return;
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

Redaction bypass in drawTable JSON fallbacks.

drawTable builds masked rows, but these fallback branches serialize the original data. That can leak unredacted values when --show-secrets is false.

🔒 Proposed fix
 export const drawTable = (data: Array<JsonObject | null | undefined>): void => {
   withRender(() => {
     if (data.length == 0) {
       console.log("[]");
       return;
     }

+    const maskedData = data.map((item) => maskSensitiveData(item));
     const rows = applyDisplayFilter(
-      data.map((item): JsonObject => {
-        const maskedItem = maskSensitiveData(item);
-        return toJsonObject(maskedItem) ?? {};
-      }),
+      maskedData.map((item): JsonObject => toJsonObject(item) ?? {}),
     );

     // Create an object with all the keys in it
     const obj = rows.reduce((res, item) => ({ ...res, ...item }), {});
     // Get those keys as an array
     const allKeys = Object.keys(obj);
     if (allKeys.length === 0) {
-      drawJSON(data);
+      drawJSON(maskedData);
       return;
     }
@@
       const flatEntries = rowEntries.flat();
       if (flatEntries.length === 0) {
-        drawJSON(data);
+        drawJSON(maskedData);
         return;
       }

Also applies to: 366-367

🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In `@lib/parser.ts` around lines 339 - 340, The fallback branches in drawTable
call drawJSON(data) and thus serialize the original unmasked input, leaking
values when secrets should be hidden; change those fallbacks to pass the
already-built masked representation (e.g., pass maskedRows or a sanitizedData
object) into drawJSON instead of the original data so drawJSON renders the
redacted output when --show-secrets is false; update both occurrences (the
fallback near the drawTable masked-rows construction and the second occurrence
around lines 366-367) to use the masked output variable produced by drawTable.

@ChiragAgg5k ChiragAgg5k merged commit 64d7279 into master Mar 31, 2026
3 checks passed
@ChiragAgg5k ChiragAgg5k deleted the dev branch March 31, 2026 10:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants