Skip to content

fix(coderabbit): update CLI commands to match official docs #124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
marcusquinn merged 1 commit into from
Jan 18, 2026
Merged

fix(coderabbit): update CLI commands to match official docs #124

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
160 changes: 122 additions & 38 deletions .agent/scripts/coderabbit-cli.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,19 @@
# Usage: ./coderabbit-cli.sh [command] [options]
# Commands:
# install - Install CodeRabbit CLI
# setup - Configure API key and settings
# review - Review current changes
# analyze - Analyze specific files or directories
# auth - Authenticate with CodeRabbit (browser-based)
# review - Review uncommitted changes (--plain for AI agents)
# review-all - Review all changes including committed (--plain)
# status - Check CodeRabbit CLI status
# help - Show this help message
#
# CLI Modes:
# --plain - Plain text output (for scripts/AI agents)
# --prompt-only - Minimal output optimized for AI agents
# --base <branch> - Compare against specific base branch
#
# Author: AI DevOps Framework
# Version: 1.1.1
# Version: 1.2.0
# License: MIT

# Colors for output
Expand Down Expand Up @@ -280,54 +285,111 @@ load_api_key() {
return 0
}

# Review current changes
# Review uncommitted changes (default mode for local development)
review_changes() {
print_header "Reviewing current changes with CodeRabbit..."
local mode="${1:-plain}"
local base_branch="${2:-}"

print_header "Reviewing uncommitted changes with CodeRabbit..."

if ! check_cli_installed; then
print_error "CodeRabbit CLI not installed. Run: $0 install"
return 1
fi

if ! load_api_key; then
return 1
print_info "Analyzing uncommitted git changes..."

# Build command based on mode
local cmd="coderabbit"
case "$mode" in
"plain")
cmd="$cmd --plain --type uncommitted"
;;
"prompt-only")
cmd="$cmd --prompt-only --type uncommitted"
;;
"interactive")
cmd="$cmd --type uncommitted"
;;
esac

# Add base branch if specified
if [[ -n "$base_branch" ]]; then
cmd="$cmd --base $base_branch"
fi

print_info "Analyzing current git changes..."
if coderabbit review; then
print_info "Running: $cmd"
if eval "$cmd"; then
Copy link
Copy Markdown

@augmentcode augmentcode bot Jan 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Running a dynamically built command via eval can introduce unintended shell interpretation/word-splitting when mode/base_branch contain spaces or shell metacharacters (also applies to review_all_changes). This is especially risky since the inputs come directly from CLI args.

Fix This in Augment

🤖 Was this useful? React with 👍 or 👎

print_success "Code review completed"
return 0
else
print_error "Code review failed"
return 1
fi
Comment on lines +302 to 328
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Jan 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-critical critical

Using eval with user-provided input can lead to command injection vulnerabilities. If a malicious string is passed as an argument (e.g., for base_branch), it could be executed. It's much safer to build the command and its arguments in an array and execute it directly. This also allows for proper handling of arguments with spaces or special characters.

Additionally, the case statement lacks a default branch to handle invalid mode arguments, which could lead to unexpected behavior. I've added a default case to provide a clear error message.

Here is a safer implementation using an array:

    # Build command based on mode
    local cmd_args=("coderabbit")
    case "$mode" in
        "plain")
            cmd_args+=(--plain --type uncommitted)
            ;;
        "prompt-only")
            cmd_args+=(--prompt-only --type uncommitted)
            ;;
        "interactive")
            cmd_args+=(--type uncommitted)
            ;;
        *)
            print_error "Invalid review mode: '$mode'. Must be 'plain', 'prompt-only', or 'interactive'."
            return 1
            ;;
    esac
    
    # Add base branch if specified
    if [[ -n "$base_branch" ]]; then
        cmd_args+=(--base "$base_branch")
    fi
    
    print_info "Running: ${cmd_args[*]}"
    if "${cmd_args[@]}"; then
        print_success "Code review completed"
        return 0
    else
        print_error "Code review failed"
        return 1
    fi

return 0
}
Comment on lines +288 to 329
Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai bot Jan 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Avoid eval and validate mode to prevent injection.
User-provided mode/base are interpolated into eval, which enables command injection and can skip --type uncommitted on invalid modes. As per coding guidelines, prefer safe argument handling in shell automation.

🔒 Proposed safe invocation 
-    local cmd="coderabbit"
+    local -a cmd=(coderabbit)
     case "$mode" in
         "plain")
-            cmd="$cmd --plain --type uncommitted"
+            cmd+=(--plain --type uncommitted)
             ;;
         "prompt-only")
-            cmd="$cmd --prompt-only --type uncommitted"
+            cmd+=(--prompt-only --type uncommitted)
             ;;
         "interactive")
-            cmd="$cmd --type uncommitted"
+            cmd+=(--type uncommitted)
             ;;
+        *)
+            print_error "Unknown mode: $mode"
+            return 1
+            ;;
     esac
@@
-        cmd="$cmd --base $base_branch"
+        cmd+=(--base "$base_branch")
     fi
     
-    print_info "Running: $cmd"
-    if eval "$cmd"; then
+    print_info "Running: ${cmd[*]}"
+    if "${cmd[@]}"; then
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# Review uncommitted changes (default mode for local development)
review_changes() {
print_header "Reviewing current changes with CodeRabbit..."
local mode="${1:-plain}"
local base_branch="${2:-}"
print_header "Reviewing uncommitted changes with CodeRabbit..."
if ! check_cli_installed; then
print_error "CodeRabbit CLI not installed. Run: $0 install"
return 1
fi
if ! load_api_key; then
return 1
print_info "Analyzing uncommitted git changes..."
# Build command based on mode
local cmd="coderabbit"
case "$mode" in
"plain")
cmd="$cmd --plain --type uncommitted"
;;
"prompt-only")
cmd="$cmd --prompt-only --type uncommitted"
;;
"interactive")
cmd="$cmd --type uncommitted"
;;
esac
# Add base branch if specified
if [[ -n "$base_branch" ]]; then
cmd="$cmd --base $base_branch"
fi
print_info "Analyzing current git changes..."
if coderabbit review; then
print_info "Running: $cmd"
if eval "$cmd"; then
print_success "Code review completed"
return 0
else
print_error "Code review failed"
return 1
fi
return 0
}
# Review uncommitted changes (default mode for local development)
review_changes() {
local mode="${1:-plain}"
local base_branch="${2:-}"
print_header "Reviewing uncommitted changes with CodeRabbit..."
if ! check_cli_installed; then
print_error "CodeRabbit CLI not installed. Run: $0 install"
return 1
fi
print_info "Analyzing uncommitted git changes..."
# Build command based on mode
local -a cmd=(coderabbit)
case "$mode" in
"plain")
cmd+=(--plain --type uncommitted)
;;
"prompt-only")
cmd+=(--prompt-only --type uncommitted)
;;
"interactive")
cmd+=(--type uncommitted)
;;
*)
print_error "Unknown mode: $mode"
return 1
;;
esac
# Add base branch if specified
if [[ -n "$base_branch" ]]; then
cmd+=(--base "$base_branch")
fi
print_info "Running: ${cmd[*]}"
if "${cmd[@]}"; then
print_success "Code review completed"
return 0
else
print_error "Code review failed"
return 1
fi
}
🤖 Prompt for AI Agents 
In @.agent/scripts/coderabbit-cli.sh around lines 288 - 329, The review_changes
function builds a command string and then uses eval with unvalidated user input
(mode and base_branch), which risks command injection and can drop the required
"--type uncommitted" for invalid modes; fix it by validating the mode (accept
only "plain", "prompt-only", "interactive" and error on unknown), build the
command as an array (e.g., cmd=(coderabbit) and append safe flags like "--plain"
or "--prompt-only" and always append "--type" "uncommitted"), conditionally
append "--base" "$base_branch" only after validating/quoting base_branch, and
invoke the command without eval using the array (e.g., "${cmd[@]}"); reference
review_changes, mode, base_branch, and cmd when making the changes.


# Analyze specific files or directories
analyze_code() {
local target="${1:-.}"
# Review all changes (committed + uncommitted)
review_all_changes() {
local mode="${1:-plain}"
local base_branch="${2:-}"

print_header "Analyzing code with CodeRabbit: $target"
print_header "Reviewing all changes with CodeRabbit..."

if ! check_cli_installed; then
print_error "CodeRabbit CLI not installed. Run: $0 install"
return 1
fi

if ! load_api_key; then
print_info "Analyzing all git changes (committed + uncommitted)..."

# Build command based on mode
local cmd="coderabbit"
case "$mode" in
"plain")
cmd="$cmd --plain --type all"
;;
"prompt-only")
cmd="$cmd --prompt-only --type all"
;;
"interactive")
cmd="$cmd --type all"
;;
esac

# Add base branch if specified
if [[ -n "$base_branch" ]]; then
cmd="$cmd --base $base_branch"
fi

print_info "Running: $cmd"
if eval "$cmd"; then
print_success "Code review completed"
return 0
else
print_error "Code review failed"
return 1
fi
Comment on lines +345 to +371
Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist bot Jan 18, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-critical critical

Similar to review_changes, this function uses eval with user input, which is a security risk that can lead to command injection. It should be refactored to use an array for command arguments.

I've also noticed that review_changes and review_all_changes are nearly identical. After applying this fix, consider refactoring them into a single helper function that takes the review type (all or uncommitted) as a parameter to reduce code duplication and improve maintainability.

Here is the immediate fix for this function:

    # Build command based on mode
    local cmd_args=("coderabbit")
    case "$mode" in
        "plain")
            cmd_args+=(--plain --type all)
            ;;
        "prompt-only")
            cmd_args+=(--prompt-only --type all)
            ;;
        "interactive")
            cmd_args+=(--type all)
            ;;
        *)
            print_error "Invalid review mode: '$mode'. Must be 'plain', 'prompt-only', or 'interactive'."
            return 1
            ;;
    esac
    
    # Add base branch if specified
    if [[ -n "$base_branch" ]]; then
        cmd_args+=(--base "$base_branch")
    fi
    
    print_info "Running: ${cmd_args[*]}"
    if "${cmd_args[@]}"; then
        print_success "Code review completed"
        return 0
    else
        print_error "Code review failed"
        return 1
    fi

}

# Authenticate with CodeRabbit (browser-based OAuth)
auth_login() {
print_header "Authenticating with CodeRabbit..."

if ! check_cli_installed; then
print_error "CodeRabbit CLI not installed. Run: $0 install"
return 1
fi

print_info "Running CodeRabbit analysis on: $target"
if coderabbit analyze "$target"; then
print_success "Code analysis completed"
print_info "Opening browser for authentication..."
print_info "Follow the prompts to sign in and copy the access token."

if coderabbit auth login; then
print_success "Authentication successful"
return 0
else
print_error "Code analysis failed"
print_error "Authentication failed"
return 1
fi
return 0
}

# Check CodeRabbit CLI status
Expand Down Expand Up @@ -357,40 +419,62 @@ show_help() {
echo "Usage: $0 [command] [options]"
echo ""
echo "Commands:"
echo " install - Install CodeRabbit CLI"
echo " setup - Configure API key and settings"
echo " review - Review current git changes"
echo " analyze - Analyze specific files or directories"
echo " status - Check CodeRabbit CLI status"
echo " help - Show this help message"
echo " install - Install CodeRabbit CLI"
echo " auth - Authenticate with CodeRabbit (browser-based)"
echo " review [mode] [base] - Review uncommitted changes"
echo " review-all [mode] [base] - Review all changes (committed + uncommitted)"
echo " status - Check CodeRabbit CLI status"
echo " reviews - Fetch CodeRabbit reviews from GitHub PRs"
echo " fix <file> - Apply auto-fixes to a file"
echo " help - Show this help message"
echo ""
echo "Review modes:"
echo " plain - Plain text output (default, best for scripts/AI)"
echo " prompt-only - Minimal output optimized for AI agents"
echo " interactive - Full interactive TUI mode"
echo ""
echo "Examples:"
echo " $0 install"
echo " $0 setup"
echo " $0 review"
echo " $0 analyze .agent/scripts/"
echo " $0 status"
echo " $0 install # Install CLI"
echo " $0 auth # Authenticate (browser)"
echo " $0 review # Review uncommitted (plain mode)"
echo " $0 review prompt-only # Review for AI agents"
echo " $0 review plain develop # Review against develop branch"
echo " $0 review-all # Review all changes"
echo " $0 status # Check CLI status"
echo ""
echo "For more information, visit: https://www.coderabbit.ai/cli"
echo "Direct CLI usage (equivalent commands):"
echo " coderabbit --plain # Plain text review"
echo " coderabbit --prompt-only # AI agent optimized"
echo " coderabbit --type uncommitted # Only uncommitted changes"
echo " coderabbit --base develop # Compare against develop"
echo ""
echo "For more information: https://docs.coderabbit.ai/cli/overview"
return 0
}

# Main function
main() {
local command="${1:-help}"
local arg2="${2:-}"
local arg3="${3:-}"

case "$command" in
"install")
install_cli
;;
"auth"|"login")
auth_login
;;
"setup")
setup_api_key
# Legacy: redirect to auth
print_warning "setup is deprecated, use 'auth' instead"
auth_login
;;
"review")
review_changes
review_changes "$arg2" "$arg3"
;;
"analyze")
analyze_code "$_arg2"
"review-all")
review_all_changes "$arg2" "$arg3"
;;
"status")
check_status
Expand All @@ -399,7 +483,7 @@ main() {
get_coderabbit_reviews
;;
"fix")
apply_coderabbit_fixes "$_arg2"
apply_coderabbit_fixes "$arg2"
;;
"help"|"--help"|"-h")
show_help
Expand Down
Loading
Loading