Package Raycast command suggestions - #139
Conversation
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Sorry @tonythethompson, you have reached your weekly rate limit of 500000 diff characters.
Please try again later or upgrade to continue using Sourcery
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughRaycast now builds and publishes ChangesRaycast Suggest integration
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
🚥 Pre-merge checks | ✅ 7 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (7 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
✨ Simplify code
Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b05d749364
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Qodo FixerNo findings are available for this PR yet. Findings appear here once Qodo has reviewed the PR. |
Code Review by Qodo
Context used✅ Compliance rules (platform):
44 rules🔴 Action Required 1.
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Generate Suggest.exe on Windows prebuild/prepublish so Store packages include it, hide the empty disabled dropdown, and leave local-heuristic leftovers selectable. Co-authored-by: Cursor <cursoragent@cursor.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
|
Code review by qodo was updated up to the latest commit d6545c7 |
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@QuickShell.Raycast/package.json`:
- Line 161: Update QuickShell.Raycast/package.json so ensure-suggest-asset.js
runs in the actual npm publish flow, using the publish or prepare script rather
than relying only on prepublishOnly. Update QuickShell.Raycast/README.md’s
publish instructions or claim to match the resulting lifecycle behavior.
In `@QuickShell.Raycast/src/lib/suggest-commands.ts`:
- Around line 196-200: Validate the parsed payload in the CLI response handling
before returning it from the function containing the generation-mismatch check.
Ensure the result is a valid SuggestionResponse with a usable pills collection;
otherwise return null so resolveWorkspaceSetupSuggestions falls back locally,
while preserving the existing generation validation and successful return path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 0c41e090-ca73-4300-9854-839b375a6a6f
📒 Files selected for processing (13)
.gitignoreQuickShell.Raycast/README.mdQuickShell.Raycast/package.jsonQuickShell.Raycast/scripts/ensure-suggest-asset.jsQuickShell.Raycast/src/__tests__/suggest-commands.test.tsQuickShell.Raycast/src/components/discover-git-repos-view.tsxQuickShell.Raycast/src/components/workspace-form.tsxQuickShell.Raycast/src/lib/suggest-commands.tsdocs/architecture/forms.mddocs/architecture/intelligence.mdscripts/RaycastLifecycle.ps1scripts/build-raycast-extension.ps1scripts/build-raycast-suggest.ps1
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
Trackdubllc/Trackdub(manual)tonythethompson/QuickShell(manual)tonythethompson/numan(manual)tonythethompson/dependency-chain-substrate(manual)
📜 Review details
⏰ Context from checks skipped due to timeout. (1)
- GitHub Check: Analyze C# with CodeQL
🧰 Additional context used
📓 Path-based instructions (4)
scripts/*.ps1
📄 CodeRabbit inference engine (AGENTS.md)
Use the required x64 or ARM64 platform when invoking .NET build and test commands; deploy the MSIX rather than merely building it when validating CmdPal changes.
Files:
scripts/build-raycast-extension.ps1scripts/RaycastLifecycle.ps1scripts/build-raycast-suggest.ps1
.gitignore
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
If using git, do not ignore
**/Properties/launchSettings.jsonor*.pubxml, because these files are required for deployment.
Files:
.gitignore
QuickShell.Raycast/package.json
📄 CodeRabbit inference engine (AGENTS.md)
Require Node.js
>=22.14.0as declared by the project and keep the extension out of the .NET solution.
Files:
QuickShell.Raycast/package.json
QuickShell.Raycast/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Maintain Raycast behavior in parity with Core launch behavior and use the project's Vitest test conventions.
Files:
QuickShell.Raycast/src/__tests__/suggest-commands.test.tsQuickShell.Raycast/src/components/workspace-form.tsxQuickShell.Raycast/src/components/discover-git-repos-view.tsxQuickShell.Raycast/src/lib/suggest-commands.ts
🪛 ast-grep (0.45.0)
QuickShell.Raycast/scripts/ensure-suggest-asset.js
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: require("node:child_process")
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process)
QuickShell.Raycast/src/lib/suggest-commands.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🔍 Remote MCP GitHub Copilot
Additional review context
-
QuickShell.Raycast/src/lib/suggest-commands.tsnow resolvesQuickShell.Suggest.exefrom Raycastassets/(orQUICKSHELL_SUGGEST_EXE), skips CLI lookup on non-Windows unless the env override is set, logs missing-exe / generation-mismatch cases, and lowers the local fallback seed cap toLOCAL_SETUP_SEED_TASKS = 2. -
workspace-form.tsxno longer clears manual-add suggestions; it now resolves them withenvironment.assetsPathand merges seeded tasks + leftover pills viacombineSuggestionTasksAndPills.discover-git-repos-view.tsxpasses the sameenvironment.assetsPathinto the resolver. -
scripts/build-raycast-suggest.ps1publishesQuickShell.Suggest\QuickShell.Suggest.csprojas a single-filewin-x64app intoQuickShell.Raycast/bin/SuggestPublish, then copies it toQuickShell.Raycast/assets/QuickShell.Suggest.exe. That script is now invoked from bothscripts/build-raycast-extension.ps1andscripts/RaycastLifecycle.ps1on Windows. -
QuickShell.Raycast/package.jsonaddsprepublishOnly: node scripts/ensure-suggest-asset.js;predevuses--if-missing, whileprebuildalways regenerates the asset. -
Repo search shows the
resolveWorkspaceSetupSuggestionscallers are localized toworkspace-form.tsxanddiscover-git-repos-view.tsx, andresolveSuggestExecutableis only defined/used insuggest-commands.ts. -
.gitignorenow ignores onlyQuickShell.Raycast/assets/QuickShell.Suggest.exe, and theQuickShell.Raycast/assetsfolder already contains the extension’s existing image assets. -
The README now documents that development requires Node.js 22.14+ and the .NET 10 SDK, and says Windows build/publish flows place
QuickShell.Suggest.exeintoassets/while macOS continues to use local heuristics.
🔇 Additional comments (19)
scripts/build-raycast-suggest.ps1 (1)
1-64: LGTM!scripts/RaycastLifecycle.ps1 (1)
158-167: LGTM!scripts/build-raycast-extension.ps1 (1)
25-31: LGTM!QuickShell.Raycast/src/components/discover-git-repos-view.tsx (1)
1-1: LGTM!Also applies to: 31-31
QuickShell.Raycast/src/components/workspace-form.tsx (1)
4-4: LGTM!Also applies to: 36-40, 180-185, 298-312, 331-331
docs/architecture/forms.md (1)
32-32: LGTM!docs/architecture/intelligence.md (1)
78-78: LGTM!QuickShell.Raycast/scripts/ensure-suggest-asset.js (1)
1-50: LGTM!QuickShell.Raycast/package.json (1)
157-160: LGTM!.gitignore (1)
92-92: LGTM!QuickShell.Raycast/README.md (1)
18-18: LGTM!QuickShell.Raycast/src/lib/suggest-commands.ts (7)
5-15: LGTM!
38-44: LGTM!
81-100: LGTM!
171-186: LGTM!
201-203: LGTM!
213-220: LGTM!
238-238: LGTM!QuickShell.Raycast/src/__tests__/suggest-commands.test.ts (1)
1-8: LGTM!Also applies to: 23-28, 81-92, 115-126
Ensure Store publish builds Suggest.exe, validate CLI payloads before use, and avoid logging local paths on Suggest failures. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Code review by qodo was updated up to the latest commit 44b71a6 |
Parse --generation as long so Date.now() values echo correctly, pass the form request counter into Suggest, and add ensure-raycast-suggest.ps1 for Suggest publish plus Raycast deploy. Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
|
Code review by qodo was updated up to the latest commit 2a3c5c4 |
Validate each suggestion pill shape before use, and make the ensure helper safer for smoke-test JSON and SkipDeploy/stop paths. Co-authored-by: Cursor <cursoragent@cursor.com>
|
Code review by qodo was updated up to the latest commit 92bfb64 |
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@QuickShell.Raycast/src/lib/suggest-commands.ts`:
- Around line 261-269: Update resolveWorkspaceSetupSuggestions and its callers
in workspace-form.tsx so unexpected suggestion-execution errors are caught
rather than rethrown from fire-and-forget flows. Preserve the existing
expected-failure handling, and ensure the mount effect, manual-add branch, and
full-mode branch fall back to local heuristics without producing unhandled
promise rejections.
In `@scripts/ensure-raycast-suggest.ps1`:
- Around line 97-118: Update the Raycast lifecycle flow around
Stop-RaycastProcesses and Start-RaycastApp so both stopping and restarting occur
only when -not $BuildOnly. Keep deployment and build behavior unchanged, and
ensure -BuildOnly neither stops nor launches Raycast regardless of whether a
process was found.
- Around line 83-85: Update the response validation around ConvertFrom-Json in
the smoke-test flow: require $parsed to be an object, generation to equal 1, and
pills to be an array before writing the “Smoke test OK” message. Reject null or
responses missing either property, and preserve the existing success output only
for valid responses.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: a6788747-edc6-4e41-aee9-30e17262f884
📒 Files selected for processing (7)
QuickShell.Core.Tests/SuggestCommandLineArgsTests.csQuickShell.Core/Services/SuggestCommandLineArgs.csQuickShell.Raycast/README.mdQuickShell.Raycast/package.jsonQuickShell.Raycast/src/components/workspace-form.tsxQuickShell.Raycast/src/lib/suggest-commands.tsscripts/ensure-raycast-suggest.ps1
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
Trackdubllc/Trackdub(manual)tonythethompson/QuickShell(manual)tonythethompson/numan(manual)tonythethompson/dependency-chain-substrate(manual)
📜 Review details
⏰ Context from checks skipped due to timeout. (5)
- GitHub Check: Analyze Raycast TypeScript with CodeQL
- GitHub Check: Analyze C# with CodeQL
- GitHub Check: Performance harness (artifacts)
- GitHub Check: Raycast lint, test, and build
- GitHub Check: .NET build and test
🧰 Additional context used
📓 Path-based instructions (7)
**/*.{cs,py}
📄 CodeRabbit inference engine (Custom checks)
Keep
SessionWorkflowStagemembers in strictly ascending order:Foundation < MediaLoaded < Transcribed < Diarized < Translated < TtsGenerated. Comparisons must use enum member names rather than raw integer literals. When adding or renumbering members, provide a legacy-compatible JSON converter for old numeric values; when reordering, verify all inequalities across the solution retain their original semantic meaning.
Files:
QuickShell.Core/Services/SuggestCommandLineArgs.csQuickShell.Core.Tests/SuggestCommandLineArgsTests.cs
QuickShell.Core/**/*.cs
📄 CodeRabbit inference engine (AGENTS.md)
Keep
QuickShell.Corefree of CmdPal SDK dependencies; expose domain behavior through host-independent services and interfaces.
Files:
QuickShell.Core/Services/SuggestCommandLineArgs.cs
**/*.cs
📄 CodeRabbit inference engine (AGENTS.md)
**/*.cs: Use namespaces that mirror folders and preserve the repository'sQuickShell.*namespace hierarchy.
Keep one type per file; make most typesinternal, useinternal static classfor stateless helpers, andinternal sealed classfor stateful singletons.
Prefer pure logic ininternal statichelpers and swappable dependencies as interfaces registered through dependency injection.
Use explicit DI factory lambdas where appropriate for AOT and trimming friendliness; avoid reflection-based registration.
Preserve existing#region agent loginstrumentation blocks andAgentDebugLogcalls.
Files:
QuickShell.Core/Services/SuggestCommandLineArgs.csQuickShell.Core.Tests/SuggestCommandLineArgsTests.cs
scripts/*.ps1
📄 CodeRabbit inference engine (AGENTS.md)
Use the required x64 or ARM64 platform when invoking .NET build and test commands; deploy the MSIX rather than merely building it when validating CmdPal changes.
Files:
scripts/ensure-raycast-suggest.ps1
QuickShell.Core.Tests/**/*.cs
📄 CodeRabbit inference engine (AGENTS.md)
QuickShell.Core.Tests/**/*.cs: Use xUnit tests with underscore-separated method names; do not introduce Moq or FluentAssertions.
Prefer real services and the established seams (LaunchExecutorTestEnvironment,FakeShortcutRepository, andAgentCliCatalog.AgentCli...Override) instead of mocks; group tests using shared process-wide seams with[Collection].
Files:
QuickShell.Core.Tests/SuggestCommandLineArgsTests.cs
QuickShell.Raycast/package.json
📄 CodeRabbit inference engine (AGENTS.md)
Require Node.js
>=22.14.0as declared by the project and keep the extension out of the .NET solution.
Files:
QuickShell.Raycast/package.json
QuickShell.Raycast/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Maintain Raycast behavior in parity with Core launch behavior and use the project's Vitest test conventions.
Files:
QuickShell.Raycast/src/components/workspace-form.tsxQuickShell.Raycast/src/lib/suggest-commands.ts
🪛 ast-grep (0.45.0)
QuickShell.Raycast/src/lib/suggest-commands.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🔍 Remote MCP GitHub Copilot
Additional review context
QuickShell.Suggesttargetsnet10.0-windows7.0and the packaging script publishes with--self-contained false, confirming the documented requirement for the .NET 10 Desktop Runtime.- The CLI serializes
generationdirectly in its JSON payload, while PR#139changes parsing tolong; this matches Raycast’s millisecondDate.now()generation values. - The PR’s actual
package.jsonuses an explicit"publish"script invokingensure-suggest-asset.js; repository search found noprepublishOnlyhook. Any documentation or review assumption that publishing is lifecycle-hook based should be corrected. - The platform helper treats only
win32as Windows and onlydarwinas macOS; packaged Suggest execution is therefore intentionally skipped on Linux and macOS unlessQUICKSHELL_SUGGEST_EXEis set.
🔇 Additional comments (8)
QuickShell.Core/Services/SuggestCommandLineArgs.cs (1)
9-9: LGTM!Also applies to: 37-38
QuickShell.Core.Tests/SuggestCommandLineArgsTests.cs (1)
24-36: LGTM!QuickShell.Raycast/package.json (1)
166-166: LGTM!QuickShell.Raycast/README.md (1)
18-18: LGTM!Also applies to: 65-65
scripts/ensure-raycast-suggest.ps1 (1)
1-82: LGTM!Also applies to: 88-96, 121-127
QuickShell.Raycast/src/lib/suggest-commands.ts (2)
5-15: LGTM!Also applies to: 38-46, 175-260, 277-304
82-99: 🩺 Stability & AvailabilityNo issue: malformed pills are filtered before combining
parseSuggestionResponse()already drops pills without a stringcommand, socombineSuggestionTasksAndPills()only receives valid pills on this path.> Likely an incorrect or invalid review comment.QuickShell.Raycast/src/components/workspace-form.tsx (1)
4-4: LGTM! Call sites correctly threadgenerationandenvironment.assetsPaththrough the updatedresolveWorkspaceSetupSuggestions/combineSuggestionTasksAndPillssignatures, and the manual-add branch now surfaces suggestions instead of clearing them, matching the PR's stated behavior. Note: none of these call sites catch a potential rethrow fromresolveWorkspaceSetupSuggestions— see the root-cause comment onQuickShell.Raycast/src/lib/suggest-commands.ts(fetchSuggestionPills) for that concern.Also applies to: 36-40, 178-211, 298-314, 331-331
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
scripts/ensure-raycast-suggest.ps1 (1)
99-110: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick winKeep Raycast restarted if deploy fails.
Deploy-RaycastExtensioncan throw afterStop-RaycastProcesses, which skips the restart block and leaves Raycast down. Move the restart intofinallyso it still runs on failure, while preserving-NoRestartand-BuildOnly.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/ensure-raycast-suggest.ps1` around lines 99 - 110, Wrap the deployment flow after Stop-RaycastProcesses in a try/finally block, placing the Raycast restart logic in finally so it executes when Deploy-RaycastExtension throws. Preserve the existing -NoRestart and -BuildOnly conditions and keep the normal deployment behavior unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/ensure-raycast-suggest.ps1`:
- Around line 93-96: Update the SkipDeploy output in the script to print the
resolved Raycast project path derived from the custom ProjectRoot before the npm
command, and reorder the commands so QUICKSHELL_SUGGEST_EXE is set before npm
run dev. Preserve the existing assetPath value and runnable PowerShell
formatting.
---
Outside diff comments:
In `@scripts/ensure-raycast-suggest.ps1`:
- Around line 99-110: Wrap the deployment flow after Stop-RaycastProcesses in a
try/finally block, placing the Raycast restart logic in finally so it executes
when Deploy-RaycastExtension throws. Preserve the existing -NoRestart and
-BuildOnly conditions and keep the normal deployment behavior unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: cf69637d-3add-4839-88e9-9aeb1d9afff0
📒 Files selected for processing (3)
QuickShell.Raycast/src/__tests__/suggest-commands.test.tsQuickShell.Raycast/src/lib/suggest-commands.tsscripts/ensure-raycast-suggest.ps1
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
Trackdubllc/Trackdub(manual)tonythethompson/QuickShell(manual)tonythethompson/numan(manual)tonythethompson/dependency-chain-substrate(manual)
📜 Review details
⚠️ CI failures not shown inline (2)
GitHub Actions: CodeQL / Analyze C# with CodeQL: Package Raycast command suggestions
Conclusion: failure
##[group]Run dotnet build QuickShell.sln -c Release -p:Platform=x64 --no-restore --verbosity minimal
�[36;1mdotnet build QuickShell.sln -c Release -p:Platform=x64 --no-restore --verbosity minimal�[0m
shell: C:\Program Files\PowerShell\7\pwsh.EXE -command ". '{0}'"
env:
DOTNET_NOLOGO: true
DOTNET_CLI_TELEMETRY_OPTOUT: true
NUGET_XMLDOC_MODE: skip
DOTNET_ROOT: C:\Program Files\dotnet
CODEQL_ACTION_FEATURE_MULTI_LANGUAGE: false
CODEQL_ACTION_FEATURE_SANDWICH: false
CODEQL_ACTION_FEATURE_SARIF_COMBINE: true
CODEQL_ACTION_FEATURE_WILL_UPLOAD: true
CODEQL_ACTION_VERSION: 4.37.3
JOB_RUN_UUID: 3d966b07-2632-474a-baa2-7622c8beb577
CODEQL_ACTION_INIT_HAS_RUN: true
CODEQL_ACTION_ANALYSIS_KEY: .github/workflows/codeql.yml:analyze-csharp
CODEQL_WORKFLOW_STARTED_AT:
CODEQL_ACTION_CLI_VERSION_INFO: {"cmd":"C:\\hostedtoolcache\\windows\\CodeQL\\2.26.1\\x64\\codeql\\codeql.exe","version":{"productName":"CodeQL","vendor":"GitHub","version":"2.26.1","sha":"1ffdebae722922fb50a64b14a97789ed6161f4a7","branches":["codeql-cli-2.26.1"],"copyright":"Copyright (C) 2019-2026 GitHub, Inc.","unpackedLocation":"C:\\hostedtoolcache\\windows\\CodeQL\\2.26.1\\x64\\codeql","configFileLocation":"C:\\Users\\runneradmin\\.config\\codeql\\config","configFileFound":false,"overlayVersion":4,"features":{"analysisSummaryV2Default":true,"buildModeOption":true,"bundleSupportsIncludeDiagnostics":true,"bundleSupportsIncludeLogs":true,"bundleSupportsOverlay":true,"databaseInterpretResultsSupportsSarifRunProperty":true,"featuresInVersionResult":true,"indirectTracingSupportsStaticBinaries":false,"informsAboutUnsupportedPathFilters":true,"supportsPython312":true,"mrvaPackCreate":true,"threatModelOption":true,"traceCommandUseBuildMode":true,"v2ramSizing":true,"mrvaPackCreateMultipleQueries":true,"setsCodeqlRunnerEnvVar":true,"sarifMergeRunsFromEqualCategory":true,"forceOverwrite":true,"generateSummarySymbolMap":true,"pythonDefaultIsToNotExtractStdlib":true,"queryServerR...
GitHub Actions: CodeQL / 0_Analyze C# with CodeQL.txt: Package Raycast command suggestions
Conclusion: failure
##[group]Run dotnet build QuickShell.sln -c Release -p:Platform=x64 --no-restore --verbosity minimal
�[36;1mdotnet build QuickShell.sln -c Release -p:Platform=x64 --no-restore --verbosity minimal�[0m
shell: C:\Program Files\PowerShell\7\pwsh.EXE -command ". '{0}'"
env:
DOTNET_NOLOGO: true
DOTNET_CLI_TELEMETRY_OPTOUT: true
NUGET_XMLDOC_MODE: skip
DOTNET_ROOT: C:\Program Files\dotnet
CODEQL_ACTION_FEATURE_MULTI_LANGUAGE: false
CODEQL_ACTION_FEATURE_SANDWICH: false
CODEQL_ACTION_FEATURE_SARIF_COMBINE: true
CODEQL_ACTION_FEATURE_WILL_UPLOAD: true
CODEQL_ACTION_VERSION: 4.37.3
JOB_RUN_UUID: 3d966b07-2632-474a-baa2-7622c8beb577
CODEQL_ACTION_INIT_HAS_RUN: true
CODEQL_ACTION_ANALYSIS_KEY: .github/workflows/codeql.yml:analyze-csharp
CODEQL_WORKFLOW_STARTED_AT:
CODEQL_ACTION_CLI_VERSION_INFO: {"cmd":"C:\\hostedtoolcache\\windows\\CodeQL\\2.26.1\\x64\\codeql\\codeql.exe","version":{"productName":"CodeQL","vendor":"GitHub","version":"2.26.1","sha":"1ffdebae722922fb50a64b14a97789ed6161f4a7","branches":["codeql-cli-2.26.1"],"copyright":"Copyright (C) 2019-2026 GitHub, Inc.","unpackedLocation":"C:\\hostedtoolcache\\windows\\CodeQL\\2.26.1\\x64\\codeql","configFileLocation":"C:\\Users\\runneradmin\\.config\\codeql\\config","configFileFound":false,"overlayVersion":4,"features":{"analysisSummaryV2Default":true,"buildModeOption":true,"bundleSupportsIncludeDiagnostics":true,"bundleSupportsIncludeLogs":true,"bundleSupportsOverlay":true,"databaseInterpretResultsSupportsSarifRunProperty":true,"featuresInVersionResult":true,"indirectTracingSupportsStaticBinaries":false,"informsAboutUnsupportedPathFilters":true,"supportsPython312":true,"mrvaPackCreate":true,"threatModelOption":true,"traceCommandUseBuildMode":true,"v2ramSizing":true,"mrvaPackCreateMultipleQueries":true,"setsCodeqlRunnerEnvVar":true,"sarifMergeRunsFromEqualCategory":true,"forceOverwrite":true,"generateSummarySymbolMap":true,"pythonDefaultIsToNotExtractStdlib":true,"queryServerR...
🧰 Additional context used
📓 Path-based instructions (2)
QuickShell.Raycast/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Maintain Raycast behavior in parity with Core launch behavior and use the project's Vitest test conventions.
Files:
QuickShell.Raycast/src/__tests__/suggest-commands.test.tsQuickShell.Raycast/src/lib/suggest-commands.ts
scripts/*.ps1
📄 CodeRabbit inference engine (AGENTS.md)
Use the required x64 or ARM64 platform when invoking .NET build and test commands; deploy the MSIX rather than merely building it when validating CmdPal changes.
Files:
scripts/ensure-raycast-suggest.ps1
🪛 ast-grep (0.45.0)
QuickShell.Raycast/src/lib/suggest-commands.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🔍 Remote MCP DeepWiki, GitHub Copilot
Additional review context
- PR
#139changesSuggestCommandLineArgs.TryParsegeneration frominttolong, matching Raycast’s millisecond-scaleDate.now()values; a regression test covers1785335300454. - The packaged executable is published with
dotnet publish --self-contained false -r win-x64 -p:PublishSingleFile=true, so the .NET 10 Desktop Runtime is required at runtime. ensure-suggest-asset.jsis an explicitpublishscript prerequisite; no lifecycleprepublishOnlyhook is shown. It skips non-Windows platforms and validates both the PowerShell exit code and resulting asset.- Runtime lookup precedence is:
QUICKSHELL_SUGGEST_EXE, thenenvironment.assetsPath/QuickShell.Suggest.exe; packaged execution is skipped on non-Windows unless the override is set. parseSuggestionResponserequires numeric finitegeneration, an array of pills, and rejects non-empty payloads containing no valid pills. Generation mismatches and expected process failures fall back to local heuristics.- Related PR
#112adds the searchable command-suggestion dropdown inworkspace-form.tsx; PR#137changes discovered repositories to use full workspace seeding. These overlap directly with PR#139’s suggestion plumbing and discovered-repository call path. - DeepWiki could not provide repository context because
tonythethompson/QuickShellwas not indexed.
🔇 Additional comments (4)
QuickShell.Raycast/src/lib/suggest-commands.ts (1)
38-45: LGTM!Also applies to: 82-98, 167-200, 241-287, 300-330
QuickShell.Raycast/src/__tests__/suggest-commands.test.ts (1)
7-7: LGTM!Also applies to: 24-27, 82-93, 116-126, 141-181
scripts/ensure-raycast-suggest.ps1 (2)
83-85: The response-contract validation issue remains unresolved.Any parseable JSON, including
nullor an object missinggeneration/array-valuedpills, is still reported as a successful smoke test. Validate the expected object shape before logging “Smoke test OK.”
100-102: Keep-BuildOnlyfree of Raycast lifecycle side effects.This is still unresolved from the previous review: guard both stopping and restarting with
-not $BuildOnly, and do not set$stoppedRaycast = $trueunconditionally.Also applies to: 111-115
Catch unexpected Suggest failures so form flows fall back locally, and tighten ensure-raycast-suggest smoke-test and BuildOnly/SkipDeploy behavior. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Actionable comments posted: 2
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
scripts/ensure-raycast-suggest.ps1 (1)
133-139: 🎯 Functional Correctness | 🟡 Minor | ⚡ Quick winDo not report deployment after
-BuildOnly.
Deploy-RaycastExtension -BuildOnlyonly builds and explicitly skips deployment and the dev server, but the unconditional completion message says “deploy complete” and points users at the workspace form. Use a separate BuildOnly completion message and omit runtime guidance in that mode.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/ensure-raycast-suggest.ps1` around lines 133 - 139, Update the completion-output block after Deploy-RaycastExtension so the -BuildOnly path reports only that the build completed, without deployment or workspace/dev-server guidance. Keep the existing deployment-complete message, runtime instructions, and asset details for the normal deployment path, using the BuildOnly parameter to select the appropriate messages.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/ensure-raycast-suggest.ps1`:
- Around line 103-108: Resolve the custom project path to an absolute path
before the -SkipDeploy output in the script’s command-printing block. Update the
$assetPath value, or its source, so the QUICKSHELL_SUGGEST_EXE command remains
valid after Set-Location changes to $raycastRoot; preserve the existing printed
command flow.
- Around line 86-99: The smoke validation around the response checks must
enforce the runtime contract before printing success: require generation to be a
finite numeric value without string coercion and retain the expected value of 1,
then validate every non-empty element of parsed.pills has the required runtime
pill fields so arrays like [{}] are rejected. Update the checks near
$parsed.generation and $parsed.pills, preserving the existing failure messages
where applicable and only emit “Smoke test OK” after all validations pass.
---
Outside diff comments:
In `@scripts/ensure-raycast-suggest.ps1`:
- Around line 133-139: Update the completion-output block after
Deploy-RaycastExtension so the -BuildOnly path reports only that the build
completed, without deployment or workspace/dev-server guidance. Keep the
existing deployment-complete message, runtime instructions, and asset details
for the normal deployment path, using the BuildOnly parameter to select the
appropriate messages.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: be06340a-3701-4e02-acd6-578a3c8e3d25
📒 Files selected for processing (2)
QuickShell.Raycast/src/lib/suggest-commands.tsscripts/ensure-raycast-suggest.ps1
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
Trackdubllc/Trackdub(manual)tonythethompson/QuickShell(manual)tonythethompson/numan(manual)tonythethompson/dependency-chain-substrate(manual)
📜 Review details
⏰ Context from checks skipped due to timeout. (5)
- GitHub Check: Analyze C# with CodeQL
- GitHub Check: Analyze Raycast TypeScript with CodeQL
- GitHub Check: Performance harness (artifacts)
- GitHub Check: Raycast lint, test, and build
- GitHub Check: .NET build and test
🧰 Additional context used
📓 Path-based instructions (2)
scripts/*.ps1
📄 CodeRabbit inference engine (AGENTS.md)
Use the required x64 or ARM64 platform when invoking .NET build and test commands; deploy the MSIX rather than merely building it when validating CmdPal changes.
Files:
scripts/ensure-raycast-suggest.ps1
QuickShell.Raycast/**/*.{ts,tsx}
📄 CodeRabbit inference engine (AGENTS.md)
Maintain Raycast behavior in parity with Core launch behavior and use the project's Vitest test conventions.
Files:
QuickShell.Raycast/src/lib/suggest-commands.ts
🪛 ast-grep (0.45.0)
QuickShell.Raycast/src/lib/suggest-commands.ts
[warning] Importing child_process exposes a command-execution surface; ensure any command/argument built from input is validated, and prefer execFile/spawn with an argument array over exec.
Context: import { execFile } from "node:child_process";
Note: [CWE-78] Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection').
(detect-child-process-typescript)
🔍 Remote MCP DeepWiki, GitHub Copilot
Additional review context
- PR
#112introduced the Raycast command-suggestion dropdown and earlierresolveWorkspaceSetupSuggestionswiring; PR#139extends that path with packaged assets,assetsPath, generation tokens, and combined task/pill handling. - PR
#137changed discovered-repository flows to use full workspace seeding. PR#139now passesDate.now()andenvironment.assetsPathwhen seeding discovered repositories. QuickShell.Suggest.exeis published as a framework-dependent, single-filewin-x64executable, so the target machine requires the corresponding .NET runtime. The build script temporarily overridesDOTNET_ROOTandMSBuildSDKsPath, then copies the output intoQuickShell.Raycast/assets.- Runtime executable resolution gives precedence to
QUICKSHELL_SUGGEST_EXE; otherwise it uses the supplied Raycast assets path. Non-Windows execution is skipped unless the override is explicitly set. - The new response parser requires a finite numeric
generation, an array of pills, and all required string fields on retained pills. A non-empty response with no valid pills is rejected; generation mismatches and expected process failures fall back to local heuristics. - DeepWiki could not retrieve repository context because
tonythethompson/QuickShellis not indexed.
🔇 Additional comments (2)
QuickShell.Raycast/src/lib/suggest-commands.ts (1)
311-324: LGTM!Also applies to: 335-335
scripts/ensure-raycast-suggest.ps1 (1)
112-117: LGTM!Also applies to: 126-126
Require absolute SkipDeploy paths, numeric generation without string coercion, valid pill shapes, and BuildOnly-specific completion output. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
scripts/ensure-raycast-suggest.ps1 (1)
169-174: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winPropagate the requested configuration into deployment.
-Configuration Debugbuilds and smoke-tests Debug at Line 65, butDeploy-RaycastExtensionrebuildsQuickShell.Suggest.exeas Release before deployment. The deployed asset can therefore differ from the validated one.Proposed fix
# scripts/ensure-raycast-suggest.ps1 Deploy-RaycastExtension ` -ProjectRoot $ProjectRoot ` + -Configuration $Configuration ` -SkipTests:$SkipTests ` # scripts/RaycastLifecycle.ps1 function Deploy-RaycastExtension { param( [string]$ProjectRoot, + [ValidateSet('Debug', 'Release')] + [string]$Configuration = 'Release', [switch]$SkipTests, [switch]$BuildOnly, [switch]$StartDevServer @@ - & $suggestBuildScript -ProjectRoot $ProjectRoot -Configuration Release -Platform x64 + & $suggestBuildScript -ProjectRoot $ProjectRoot -Configuration $Configuration -Platform x64🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@scripts/ensure-raycast-suggest.ps1` around lines 169 - 174, Pass the requested Configuration value from the script’s build and smoke-test flow into the Deploy-RaycastExtension call, so deployment rebuilds QuickShell.Suggest.exe using the same Debug or Release configuration that was validated. Update the deployment invocation and its supporting parameter flow without changing the existing BuildOnly or StartDevServer behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@scripts/ensure-raycast-suggest.ps1`:
- Around line 102-110: Update Test-SuggestPillShape and the related root-payload
validation to enforce exact JSON key casing: inspect the actual property names
and require root keys and pill fields to match the expected lowercase names
using -ceq, rather than relying on case-insensitive PSObject.Properties lookups.
Reject mismatched casing before reporting the smoke contract as valid.
---
Outside diff comments:
In `@scripts/ensure-raycast-suggest.ps1`:
- Around line 169-174: Pass the requested Configuration value from the script’s
build and smoke-test flow into the Deploy-RaycastExtension call, so deployment
rebuilds QuickShell.Suggest.exe using the same Debug or Release configuration
that was validated. Update the deployment invocation and its supporting
parameter flow without changing the existing BuildOnly or StartDevServer
behavior.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 3def0524-e5f9-425f-b4bf-7315ac811a91
📒 Files selected for processing (1)
scripts/ensure-raycast-suggest.ps1
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
Trackdubllc/Trackdub(manual)tonythethompson/QuickShell(manual)tonythethompson/numan(manual)tonythethompson/dependency-chain-substrate(manual)
📜 Review details
⏰ Context from checks skipped due to timeout. (5)
- GitHub Check: Analyze Raycast TypeScript with CodeQL
- GitHub Check: Analyze C# with CodeQL
- GitHub Check: .NET build and test
- GitHub Check: Performance harness (artifacts)
- GitHub Check: Raycast lint, test, and build
🧰 Additional context used
📓 Path-based instructions (1)
scripts/*.ps1
📄 CodeRabbit inference engine (AGENTS.md)
Use the required x64 or ARM64 platform when invoking .NET build and test commands; deploy the MSIX rather than merely building it when validating CmdPal changes.
Files:
scripts/ensure-raycast-suggest.ps1
🔍 Remote MCP DeepWiki, GitHub Copilot
Additional review context
- DeepWiki could not provide repository context because
tonythethompson/QuickShellis not indexed. - PR
#139changes the C# CLI contract:--generationis now parsed aslong, matching Raycast’sDate.now()millisecond values; a regression test covers1785335300454. - The packaged executable is published as framework-dependent
win-x64single-file output (--self-contained false), then copied toQuickShell.Raycast/assets/QuickShell.Suggest.exe; therefore the documented .NET runtime prerequisite is operationally relevant. - Runtime precedence is explicit:
QUICKSHELL_SUGGEST_EXEoverrides the packaged path; otherwise Raycast resolves the executable fromenvironment.assetsPath. Non-Windows platforms skip the packaged CLI unless the override is set. - PR
#112established the earliersuggest-commands.ts/workspace-form.tsxsuggestion plumbing; PR#139extends those call paths withassetsPath, generation cancellation, validation, and fallback handling. - PR
#137established full discovered-repository workspace seeding; PR#139now passesDate.now()andenvironment.assetsPaththrough that resolution path. - The response parser requires a finite numeric generation, an array of pills, and all five required string fields per retained pill. Non-empty responses with no valid pills, malformed JSON, generation mismatches, missing executables, and expected process failures fall back to local heuristics.
🔇 Additional comments (1)
scripts/ensure-raycast-suggest.ps1 (1)
47-51: LGTM!Also applies to: 74-100, 152-167, 176-193
Pass Configuration through Deploy-RaycastExtension and require exact lowercase smoke-test JSON property names. Co-authored-by: Cursor <cursoragent@cursor.com>
Code Review by QodoSorry, something went wrongWe weren't able to complete the code review on our side. Please try again manually by commenting/agentic_review on this PR.
Powered by Qodo |
2 participants
Summary
Validation
Summary by cubic
Packages the Suggest CLI into the Raycast Windows extension and resolves it from Raycast assets for reliable command suggestions. Adds a manual-create suggestions dropdown and hardens packaging, validation, and fallbacks.
New Features
QuickShell.Raycast/assetson Windows viapredev/prebuild/publishand deploy/build scripts;ensure-suggest-asset.jsinvokesscripts/build-raycast-suggest.ps1;scripts/ensure-raycast-suggest.ps1smoke-tests JSON, supportsBuildOnly/SkipDeploy/NoRestartwith absolute paths, and deploy now passesConfiguration.environment.assetsPath; still supportsQUICKSHELL_SUGGEST_EXE; macOS uses local heuristics by default.generationand assets path; README notes .NET 10 SDK and the .NET 10 Desktop Runtime.Bug Fixes
generation, valid pill shape, exact key casing in smoke tests); drop malformed pills, reject corrupt payloads; handle and log CLI failures safely (no local paths); non-Windows skips the CLI unless overridden.--generationaslongand pass the form request counter through Suggest to prevent mismatched responses.Written for commit bcf862b. Summary will update on new commits.