feat: add ai command for cli to start the project #7352

denar90 · 2025-06-16T11:45:19Z

🎉 Thanks for submitting a pull request! 🎉

Summary

Fixes #<replace_with_issue_number>

For us to review and ship your PR efficiently, please perform the following steps:

Open a bug/issue before writing your code 🧑‍💻. This ensures we can discuss the changes and get feedback from everyone that should be involved. If you`re fixing a typo or something that`s on fire 🔥 (e.g. incident related), you can skip this step.
Read the contribution guidelines 📖. This ensures your code follows our style guide and
passes our tests.
Update or add tests (if any source code was changed or added) 🧪
Update or add documentation (if features were changed or added) 📝
Make sure the status checks below are successful ✅

A picture of a cute animal (not mandatory, but encouraged)

github-actions · 2025-06-16T11:46:17Z

📊 Benchmark results

Comparing with 9b16f4f

Dependency count: 1,105 (no change)
Package size: 277 MB ⬇️ 0.00% decrease vs. 9b16f4f
Number of ts-expect-error directives: 399 (no change)

denar90 · 2025-06-23T08:51:03Z

src/commands/init/ai-rules.ts

@@ -0,0 +1,447 @@
+import { resolve } from 'node:path'


part of code here is duplication, but we still not setelled the command and want to see how it feels so then we can extract stuff into common utils after we work on making command fully public

I'm not sure why trialing the new command should mean more code duplication? If you move the generic methods you're reusing to a separate file (which I would argue should already be the case), you're making it easier for this PR to be reviewed, you're going to have less code to maintain, and you reduce the number of places where you might need to adjust things if an issue or an improvement come up.

If you then decide that you want to keep the new command in its current shape, great — you already have the code in the structure you want and no further changes are needed; if you decide you want to bin it, you can just delete it and the code you abstracted away into a separate file still makes sense on its own.

denar90 · 2025-06-23T08:51:32Z

src/commands/init/ai-rules.ts

+
+    // Step 4: Save AI instructions to file
+    if (projectInfo.prompt) {
+      const ntlContext = await fetch(


in future we don't wanna fetch context if we installing MCP

eduardoboucas · 2025-06-23T09:04:48Z

src/commands/init/ai-rules.ts

@@ -0,0 +1,447 @@
+import { resolve } from 'node:path'


I'm not sure why trialing the new command should mean more code duplication? If you move the generic methods you're reusing to a separate file (which I would argue should already be the case), you're making it easier for this PR to be reviewed, you're going to have less code to maintain, and you reduce the number of places where you might need to adjust things if an issue or an improvement come up.

If you then decide that you want to keep the new command in its current shape, great — you already have the code in the structure you want and no further changes are needed; if you decide you want to bin it, you can just delete it and the code you abstracted away into a separate file still makes sense on its own.

eduardoboucas · 2025-06-23T09:06:33Z

src/commands/init/ai-rules.ts

+}
+
+// Generate MCP configuration for the detected IDE
+const generateMcpConfig = (ide: ConsumerConfig): string => {


Why are you returning the config as a string here only to then re-parse it into an object in configureMcpForVSCode?

eduardoboucas · 2025-06-23T09:07:52Z

src/commands/init/ai-rules.ts

+    await fs.writeFile(configPath, JSON.stringify(updatedConfig, null, 2), 'utf-8')
+    log(`${chalk.green('✅')} VS Code MCP configuration saved to ${chalk.cyan('.vscode/mcp.json')}`)
+  } catch (error) {
+    throw new Error(`Failed to configure VS Code MCP: ${error instanceof Error ? error.message : 'Unknown error'}`)


When will error not be an instance of Error?

it's always unknown, but here yeah it will be Error, it's more following code pattern across repo

I see a couple of instances of that, which doesn't feel like enough of a reason to perpetuate this and just duplicate this code every time we handle an error, especially when we know for a fact that the type will be Error.

This is a normal idiom--TypeScript can't guarantee caught values are errors.

eduardoboucas · 2025-06-23T09:08:19Z

src/commands/init/ai-rules.ts

+
+// VS Code specific MCP configuration
+const configureMcpForVSCode = async (config: string, projectPath: string): Promise<void> => {
+  const configPath = resolve(projectPath, '.vscode', 'mcp.json')


nit: Save the path to the .vscode directory in a variable to avoid resolving the path multiple times.

eduardoboucas · 2025-06-23T09:09:09Z

src/commands/init/ai-rules.ts

+
+// Windsurf specific MCP configuration
+const configureMcpForWindsurf = async (config: string, _projectPath: string): Promise<void> => {
+  const { homedir } = await import('node:os')


Why are you using a dynamic import here?

eduardoboucas · 2025-06-23T09:16:39Z

src/commands/init/ai-rules.ts

+  const { api } = command.netlify
+
+  log(`${chalk.blue('🤖 Initializing AI project')} with rules...`)
+  log(`${chalk.gray('Hash:')} ${hash}`)


Do we have to print the hash? Why do people care?

src/commands/init/ai-rules.ts

eduardoboucas · 2025-06-23T09:19:01Z

src/commands/init/ai-rules.ts

+    let mcpConfigured = false
+
+    if (detectedIDE) {
+      log(`${chalk.green('✅')} Detected IDE: ${chalk.cyan(detectedIDE.presentedName)}`)


Can we settle on either "development environment" or "IDE"? Using both next to each other feels unnecessarily confusing.

eduardoboucas · 2025-06-23T09:19:40Z

src/commands/init/ai-rules.ts

+      } else {
+        log(chalk.yellowBright(`🔧 Step 2: Manual MCP Configuration`))
+        log(`   ${chalk.cyan(detectedIDE.key)} detected - MCP setup was skipped`)
+        log(`   ${chalk.gray('You can configure MCP manually later for enhanced AI capabilities')}`)


Co-authored-by: Eduardo Bouças <[email protected]>

eduardoboucas

Approving so you can get unblocked, but I left some notes and questions that I think we should be addressed.

eduardoboucas · 2025-06-23T12:46:26Z

src/commands/init/ai-rules.ts

+    log(`${chalk.green('✅')} AI instructions saved to ${chalk.cyan('AI-instructions.md')}`)
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : 'Unknown error'
+    log(`${chalk.yellow('⚠️')} Warning: Failed to save AI instructions: ${errorMessage}`)


The CLI has a warn method precisely for this purpose:

cli/src/utils/command-helpers.ts

Lines 185 to 188 in f449ad8

export const warn = (message = '') => {

const bang = chalk.yellow(BANG)

log(` ${bang} Warning: ${message}`)

}

eduardoboucas · 2025-06-23T12:49:10Z

src/utils/mcp-utils.ts

+ * Generate MCP configuration for the detected IDE or development environment
+ */
+export const generateMcpConfig = (ide: ConsumerConfig): Record<string, unknown> => {
+  const configs: Record<string, Record<string, unknown>> = {


It would be great to properly type this.

eduardoboucas · 2025-06-23T12:53:09Z

src/commands/init/ai-rules.ts

+  }
+}
+
+const fetchProjectInfo = async (url: string): Promise<ProjectInfo> => {


It would be great to have a comment explaining what is the URL we're hitting — is it the Netlify API, something else?

eduardoboucas · 2025-06-23T12:54:18Z

src/commands/init/ai-rules.ts

+
+const getRepoUrlFromProjectId = async (api: NetlifyAPI, projectId: string): Promise<string> => {
+  try {
+    const siteInfo = (await api.getSite({ siteId: projectId })) as SiteInfo


Do we not already have the site information populated by the base command? Or is this a different site? If we could use that, we'd avoid making an extra API call.

eduardoboucas · 2025-06-23T12:56:53Z

src/commands/init/ai-rules.ts

+        {
+          method: 'GET',
+          headers: {
+            'Content-Type': 'text/plain',


Why are you setting Content-Type on a GET request? Did you mean to use Accept?

eduardoboucas · 2025-06-23T12:58:32Z

src/commands/init/ai-rules.ts

+    }
+
+    // Update working directory to cloned repo
+    process.chdir(targetDir)


What is the purpose of this?

denar90 · 2025-06-23T13:36:11Z

Awesome 🙌 thank you

…i-to-start-the-project

…5-add-ai-command-for-cli-to-start-the-project

…mmand-for-cli-to-start-the-project' into artemdenysov/wrfl-2615-add-ai-command-for-cli-to-start-the-project

dist/lib/functions/synchronous.js

+    response.statusCode = 500;
+    if (acceptsHtml) {
+        response.setHeader('Content-Type', 'text/html');
+        response.end(await renderErrorTemplate(errorString, '../../src/lib/templates/function-error.html', 'function'));


dist/lib/functions/synchronous.js

+        response.end(await renderErrorTemplate(errorString, '../../src/lib/templates/function-error.html', 'function'));
+    }
+    else {
+        response.end(errorString);


dist/utils/gh-auth.js

+            res.end(`${"<html><head><title>Logged in</title><script>if(history.replaceState){history.replaceState({},'','/')}</script><style>html{font-family:system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol';line-height:1.5;background:rgb(18 24 31)}body{overflow:hidden;position:relative;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;width:100vw;}h3{margin:0}p{margin: 1rem 0 0.5rem}.card{position:relative;display:flex;flex-direction:column;width:75%;max-width:364px;padding:24px;background:white;color:rgb(18 24 31);border-radius:8px;box-shadow:rgb(6 11 16 / 20%) 0px 16px 24px, rgb(6 11 16 / 30%) 0px 6px 30px, rgb(6 11 16 / 40%) 0px 8px 10px;}</style></head>" +
+                "<body><div class=card><h3>Logged in</h3><p>You're now logged into Netlify CLI with your "}${parameters.get('provider') ?? ''} credentials. Please close this window.</p></div>`);


To fix the reflected cross-site scripting vulnerability, the user-controlled input (parameters.get('provider')) must be sanitized before being incorporated into the HTML response. The best approach is to use a library like escape-html to escape special characters in the input, ensuring that it cannot be interpreted as executable code by the browser.

Steps to fix:

Import the escape-html library at the top of the file.

Use escape-html to sanitize the value of parameters.get('provider') before embedding it in the HTML response.

This fix ensures that the functionality remains unchanged while eliminating the XSS vulnerability.

dist/utils/proxy.js

+const isEndpointExists = async function (endpoint, origin) {
+    const url = new URL(endpoint, origin);
+    try {
+        const res = await fetch(url, { method: 'HEAD' });


To fix the issue, we need to ensure that user-controlled input (req.url) does not directly influence the hostname or path of the outgoing request. This can be achieved by implementing an allow-list of valid endpoints or paths and validating the endpoint against this allow-list before constructing the url object.

Steps to fix:

Introduce an allow-list of valid endpoints or paths that the server is allowed to query.

Validate the endpoint against this allow-list before constructing the url object.

Reject or sanitize any endpoint value that does not match the allow-list.

denar90 added 10 commits June 10, 2025 14:14

Add AI command

82710fd

Add login verification functionality

6864489

Add login verification functionality

a403e15

Add clone fucntionality

614fe51

Add navigate

eb21fb0

Improvements

8edaf5f

improve codestyle

1e31e7d

Add MCP to be installed along the process

8633645

Move into init command

775fa44

fixes for parsing

04a41a3

denar90 changed the title ~~Artemdenysov/wrfl 2615 add ai command for cli to start the project~~ (feat): add ai command for cli to start the project Jun 16, 2025

feat: lint and test

6a36601

denar90 marked this pull request as ready for review June 23, 2025 08:44

denar90 requested a review from a team as a code owner June 23, 2025 08:44

denar90 commented Jun 23, 2025

View reviewed changes

eduardoboucas requested changes Jun 23, 2025

View reviewed changes

denar90 and others added 11 commits June 23, 2025 12:30

Update src/commands/init/ai-rules.ts

ad065d7

Co-authored-by: Eduardo Bouças <[email protected]>

Update src/commands/init/ai-rules.ts

4ccd1ba

Co-authored-by: Eduardo Bouças <[email protected]>

Update src/commands/init/ai-rules.ts

127f8b4

Co-authored-by: Eduardo Bouças <[email protected]>

Update src/commands/init/ai-rules.ts

165f6e3

Co-authored-by: Eduardo Bouças <[email protected]>

Update src/commands/init/ai-rules.ts

5285a5d

Co-authored-by: Eduardo Bouças <[email protected]>

code review

983aef7

merge

eb18730

extracting common utils

29228e6

extracting common utils

05b325a

code review

b7bb36c

drop claude file

723222a

denar90 requested a review from eduardoboucas June 23, 2025 10:48

eduardoboucas approved these changes Jun 23, 2025

View reviewed changes

denar90 enabled auto-merge (squash) June 23, 2025 13:38

denar90 added the automerge Add to Kodiak auto merge queue label Jun 23, 2025

Merge branch 'main' into artemdenysov/wrfl-2615-add-ai-command-for-cl…

04e3a8d

…i-to-start-the-project

sarahetter changed the title ~~(feat): add ai command for cli to start the project~~ feat: add ai command for cli to start the project Jun 23, 2025

Merge branch 'main' into artemdenysov/wrfl-2615-add-ai-command-for-cl…

581e80d

…i-to-start-the-project

denar90 disabled auto-merge June 23, 2025 16:09

denar90 removed the automerge Add to Kodiak auto merge queue label Jun 23, 2025

denar90 marked this pull request as draft June 23, 2025 16:14

denar90 added 3 commits June 23, 2025 19:19

Merge remote-tracking branch 'origin/main' into artemdenysov/wrfl-261…

d50b455

…5-add-ai-command-for-cli-to-start-the-project

add dist

b456920

Merge remote-tracking branch 'origin/artemdenysov/wrfl-2615-add-ai-co…

c73cb02

…mmand-for-cli-to-start-the-project' into artemdenysov/wrfl-2615-add-ai-command-for-cli-to-start-the-project

github-advanced-security bot found potential problems Jun 23, 2025

View reviewed changes

@@ -9,2 +9,3 @@
             import openBrowser from './open-browser.js';
+            import escapeHtml from 'escape-html';
             const SERVER_PORT = 3000;
@@ -37,3 +38,3 @@
                         res.end(`${"<html><head><title>Logged in</title><script>if(history.replaceState){history.replaceState({},'','/')}</script><style>html{font-family:system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol';line-height:1.5;background:rgb(18 24 31)}body{overflow:hidden;position:relative;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;width:100vw;}h3{margin:0}p{margin: 1rem 0 0.5rem}.card{position:relative;display:flex;flex-direction:column;width:75%;max-width:364px;padding:24px;background:white;color:rgb(18 24 31);border-radius:8px;box-shadow:rgb(6 11 16 / 20%) 0px 16px 24px, rgb(6 11 16 / 30%) 0px 6px 30px, rgb(6 11 16 / 40%) 0px 8px 10px;}</style></head>" +
-                            "<body><div class=card><h3>Logged in</h3><p>You're now logged into Netlify CLI with your "}${parameters.get('provider') ?? ''} credentials. Please close this window.</p></div>`);
+                            "<body><div class=card><h3>Logged in</h3><p>You're now logged into Netlify CLI with your "}${escapeHtml(parameters.get('provider') ?? '')} credentials. Please close this window.</p></div>`);
                         server.close();

@@ -152,3 +152,4 @@
                 "write-file-atomic": "5.0.1",
-                "ws": "8.18.2"
+                "ws": "8.18.2",
+                "escape-html": "^1.0.3"
               },

Package	Version	Security advisories
escape-html (npm)	1.0.3	None

@@ -115,2 +115,7 @@
             const isEndpointExists = async function (endpoint, origin) {
+                const allowedEndpoints = ['/valid-path-1', '/valid-path-2']; // Define allow-list of valid paths
+                if (!allowedEndpoints.includes(endpoint)) {
+                    console.warn(NETLIFYDEVWARN, `Blocked attempt to access invalid endpoint: ${endpoint}`);
+                    return false;
+                }
                 const url = new URL(endpoint, origin);

	export const warn = (message = '') => {
	const bang = chalk.yellow(BANG)
	log(` ${bang} Warning: ${message}`)
	}

		res.end(`${"<html><head><title>Logged in</title><script>if(history.replaceState){history.replaceState({},'','/')}</script><style>html{font-family:system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif, 'Apple Color Emoji', 'Segoe UI Emoji', 'Segoe UI Symbol';line-height:1.5;background:rgb(18 24 31)}body{overflow:hidden;position:relative;display:flex;flex-direction:column;align-items:center;justify-content:center;height:100vh;width:100vw;}h3{margin:0}p{margin: 1rem 0 0.5rem}.card{position:relative;display:flex;flex-direction:column;width:75%;max-width:364px;padding:24px;background:white;color:rgb(18 24 31);border-radius:8px;box-shadow:rgb(6 11 16 / 20%) 0px 16px 24px, rgb(6 11 16 / 30%) 0px 6px 30px, rgb(6 11 16 / 40%) 0px 8px 10px;}</style></head>" +
		"<body><div class=card><h3>Logged in</h3><p>You're now logged into Netlify CLI with your "}${parameters.get('provider') ?? ''} credentials. Please close this window.</p></div>`);

feat: add ai command for cli to start the project #7352

Are you sure you want to change the base?

feat: add ai command for cli to start the project #7352

Conversation

denar90 commented Jun 16, 2025

Summary

Uh oh!

github-actions bot commented Jun 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📊 Benchmark results

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eduardoboucas left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

eduardoboucas Jun 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

denar90 commented Jun 23, 2025

Uh oh!

Check warning

Uh oh!

Check warning

Uh oh!

Check failure

Uh oh!

Copilot Autofix

Check failure

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot Autofix

Uh oh!

github-actions bot commented Jun 16, 2025 •

edited

Loading

eduardoboucas Jun 23, 2025 •

edited

Loading