Skip to content

Rename the CLI to allthings, keeping atw as an alias for now - #178

Merged
esthor merged 1 commit into
mainfrom
esthor/cli-allthings
Oct 7, 2026
Merged

esthor merged 1 commit into
mainfrom
esthor/cli-allthings

Conversation

@esthor

@esthor esthor commented Oct 7, 2026 •

Copy link
Copy Markdown
Contributor

preview: ready coderabbit: approved findings: none checks: passing merge: ready

Preview · Change Stack · Checks · Files: +359 −124 in 30 files

What

The CLI ships under the new name: allthings. It isn't at, because at collides with /usr/bin/at. It stays a prerelease (2.0.0-alpha.2) until the rebrand launch.

  • Rename. The package and binary are allthings, and the directory moves from atw-cli/ to cli/. The Makefile, the CI, lint and release workflows, the README and the other in-repo references follow.
  • The old name still works. You can still run atw, from the package's atw bin (src/atw.ts) or the installer's atw symlink to the compiled binary. The binary tells which name started it from process.argv0.
    • Run as atw, it prints a note on stderr: "atw is now allthings. The old name still works for now and goes away in a later release."
    • stdout and exit codes are unchanged, so scripts keep working.
  • One config value for the site. siteOrigin in cli/src/config.ts sets the site, and defaultEndpoint derives from it.
    • It stays https://allthingsweb.dev until allthings.dev serves the new site. Before the domain moves, allthings.dev only redirects, and a redirect drops an MCP POST.
    • It flips with the move (runbook Phase 4). The type admits only those two origins.
  • Environment. ALLTHINGS_MCP_URL is the new override; ATW_MCP_URL is still read when it's unset.
  • Releases. cli-release.yaml still only creates a GitHub release from a tag matching cli/package.json's version. A hyphenated tag makes it a prerelease. Assets are now allthings-<platform>. Nothing is published to npm: the package stays private.
  • Installer. pages/install.bash installs allthings and the atw symlink in ~/.allthings/bin.
    • Earlier releases ship atw-cli-<platform>, so the installer falls back to that name.
    • ALLTHINGS_VERSION picks a prerelease, and ATW_VERSION is still read.
    • pages/atw-install.bash, the old address, now runs the new installer.
  • Docs. cli/README.md and the help text are in the brand voice ("evenings", lowercase all things). The commands (events, event, rsvp, …) keep their names, because scripts and agents rely on them.

Verified

  • cli: check, typecheck and all 26 tests pass, including new ones for:
    • the endpoint precedence
    • old-name detection from argv0
    • the package bins
    • the alias printing its note on stderr, with stdout identical
  • Compiled binary: allthings --version, --help, events and event nope (exit 3) run, and an atw symlink prints the note. CI now runs the alias check too.
  • Installer: I ran it against the real releases into a temp home:
    • 2.0.0-alpha.1 falls back to the atw-cli-* asset
    • the default installs 1.3.1
    • an unknown version fails clearly
  • Other packages: web's legacy-URL tests and repo lint pass.

Summary by CodeRabbit

  • New Features
    • Added an installer for the allthings command-line tool, with support for Linux and macOS on x64 and ARM64.
    • The legacy atw command remains available as an alias and displays a notice; existing endpoint settings continue to work.
    • Added CLI documentation covering installation, commands, configuration, and compatibility.
  • Updates
    • Renamed the CLI command and release binaries to allthings. The old installer address now directs users to the new installer.

The package and binary are allthings (cli/), at 2.0.0-alpha.2. The old
name still runs, from the package's atw bin or the installer's atw
symlink, and prints a note on stderr. The site it reads is one value,
siteOrigin in cli/src/config.ts, which stays on allthingsweb.dev until
allthings.dev serves the new site. ALLTHINGS_MCP_URL replaces
ATW_MCP_URL, which is still read. Releases ship allthings-<platform>
binaries, and a new installer puts allthings and atw in ~/.allthings/bin,
falling back to the old asset names for earlier releases.
@coderabbitai

coderabbitai Bot commented Oct 7, 2026 •

Copy link
Copy Markdown
Contributor

Review in Change Stack →

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration
  • Configuration used: Repository: allthingsweb-dev/allthingsweb/.coderabbit.yaml
  • Review profile: ASSERTIVE
  • Plan: Advanced
  • Run ID: 0d24b856-4a03-4667-885b-1e2081b37917
📥 Commits

Reviewing files that changed from the base of the PR and between f4bc697 and c52a59c.

⛔ Files ignored due to path filters (1)
  • cli/bun.lock is excluded by !**/*.lock
📒 Files selected for processing (29)
  • .github/workflows/cli-release.yaml
  • .github/workflows/cli.yaml
  • .github/workflows/lint.yaml
  • Makefile
  • README.md
  • atw-cli/src/index.ts
  • cli/.gitignore
  • cli/README.md
  • cli/package.json
  • cli/src/atw.ts
  • cli/src/cli.ts
  • cli/src/client.ts
  • cli/src/config.ts
  • cli/src/errors.ts
  • cli/src/format.ts
  • cli/src/index.ts
  • cli/src/main.ts
  • cli/src/schemas.ts
  • cli/tests/cli.test.ts
  • cli/tests/client.test.ts
  • cli/tests/config.test.ts
  • cli/tests/contract.test.ts
  • cli/tests/fixtures.ts
  • cli/tsconfig.json
  • infra/docs/r2-migration.md
  • pages/atw-install.bash
  • pages/install.bash
  • web/src/mcp/tools.ts
  • web/tests/support/legacy-urls.ts
💤 Files with no reviewable changes (1)
  • atw-cli/src/index.ts

Limit details: You’ve used the included review currently available. Your 104 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (5)
  • GitHub Check: PR header
  • GitHub Check: 🌐 Web
  • GitHub Check: 🧹 Lint
  • GitHub Check: 🧪 Tests
  • GitHub Check: 🚀 Deploy
🧰 Additional context used
🪛 ast-grep (0.45.3)
pages/atw-install.bash

[error] 6-6: Remote content fetched with curl/wget is piped directly into a shell interpreter, so any server compromise, MITM, or tampered mirror results in arbitrary code execution on this host. Download the script to a file first, verify its integrity (checksum/signature) and inspect it, then run the verified local copy.
Context: curl -fsSL https://allthingsweb-dev.github.io/allthingsweb/install.bash | bash
Note: [CWE-494] Download of Code Without Integrity Check.

(curl-pipe-to-shell-bash)

🪛 checkmake (0.3.2)
Makefile

[warning] 66-66: Required target "all" is missing from the Makefile.

(minphony)


[warning] 66-66: Required target "clean" is missing from the Makefile.

(minphony)


[warning] 66-66: Required target "test" is missing from the Makefile.

(minphony)

🪛 LanguageTool
cli/README.md

[uncategorized] ~44-~44: The official name of this software platform is spelled with a capital “H”.
Context: ...at matches version in package.json (.github/workflows/cli-release.yaml). A hyphena...

(GITHUB)

🪛 zizmor (1.30.1)
.github/workflows/cli.yaml

[warning] 3-21: insufficient job-level concurrency limits (concurrency-limits): workflow is missing concurrency setting

(concurrency-limits)

🔇 Additional comments (21)
cli/package.json (1)

2-4: LGTM!

Also applies to: 8-9

cli/src/config.ts (1)

1-37: LGTM!

cli/src/cli.ts (1)

3-10: LGTM!

Also applies to: 27-28, 31-58, 72-76, 112-112, 171-175

cli/src/client.ts (1)

2-2: LGTM!

Also applies to: 148-148

cli/src/main.ts (1)

1-32: LGTM!

cli/src/index.ts (1)

1-7: LGTM!

cli/src/atw.ts (1)

1-5: LGTM!

cli/tests/config.test.ts (1)

1-62: LGTM!

cli/tests/cli.test.ts (1)

2-2: LGTM!

Also applies to: 37-37, 42-42, 66-66, 120-120, 152-178

cli/tests/client.test.ts (1)

81-81: LGTM!

cli/README.md (1)

1-44: LGTM!

Makefile (1)

12-12: LGTM!

Also applies to: 62-62, 68-68

.github/workflows/cli.yaml (1)

7-7: LGTM!

Also applies to: 16-16, 47-47, 51-51, 55-55, 59-59, 63-63, 65-69

.github/workflows/lint.yaml (1)

42-42: LGTM!

.github/workflows/cli-release.yaml (1)

28-30: LGTM!

Also applies to: 36-36, 56-57

cli/.gitignore (1)

35-39: LGTM!

README.md (1)

17-17: LGTM!

infra/docs/r2-migration.md (1)

127-127: LGTM!

web/src/mcp/tools.ts (1)

20-20: LGTM!

web/tests/support/legacy-urls.ts (1)

214-214: LGTM!

Also applies to: 220-220, 226-226

pages/atw-install.bash (1)

6-6: 🔒 Security & Privacy | 🛡️ Detected with Advanced Tier

The wrapper matches the documented install path and preserves ATW_VERSION. cli/README.md uses the same curl | bash command. The new installer falls back to ATW_VERSION when ALLTHINGS_VERSION is unset. The previous script also downloaded and ran a release binary without an integrity check, so this change does not add a new integrity gap.


📝 Walkthrough

Walkthrough

The CLI moves from atw-cli to cli and adopts allthings as its primary command. The atw alias and legacy endpoint-variable fallback remain available. Build and release workflows use the renamed package and assets, and installation uses a new script.

Changes

CLI rename and compatibility

Layer / File(s) Summary
CLI identity, configuration, and execution
cli/package.json, cli/src/*, atw-cli/src/index.ts, cli/tests/*, cli/README.md
The package and primary command use allthings. The atw entry point runs in legacy mode and prints a notice. Endpoint selection prefers ALLTHINGS_MCP_URL, then ATW_MCP_URL, then the default. Tests and CLI documentation cover the command names, endpoint selection, and legacy behavior.
Build and release integration
.github/workflows/*, Makefile, cli/.gitignore, README.md, infra/docs/r2-migration.md, web/src/mcp/tools.ts, web/tests/support/legacy-urls.ts
Build and release steps use the cli directory and allthings asset names. The CLI workflow checks the primary command and the legacy alias. Repository references use the renamed CLI identity.
Installer and legacy installer address
pages/install.bash, pages/atw-install.bash
The new installer selects a release asset for supported platforms, installs allthings, creates an atw symlink, and runs allthings --help. The former installer address invokes the new installer.

Priority: ➖ Normal

Estimated code review effort: 3 (Moderate) | ~25 minutes

Change: Feature

Sequence Diagram(s)

sequenceDiagram
  participant installer as pages/install.bash
  participant releases as GitHub Releases
  participant installDir as Install directory
  participant allthings as allthings binary
  installer->>releases: Resolve latest release tag when no version is set
  installer->>releases: Download allthings platform asset
  installer->>releases: Download legacy atw-cli asset if the allthings asset fails
  installer->>installDir: Save binary as allthings and create atw symlink
  installer->>allthings: Run --help
Loading

Merge Risk: ⚪ Minimal · up to c52a5

No actionable merge-blocking issue remains. A failed download may produce a misleading installer error, but it does not make an otherwise successful installation fail.

Security Architecture Review

Security architecture risk: 🔵 Low · up to c52a5

The rename preserves the CLI’s existing server access and does not introduce additional credentials or privileges. The main concern is upgrade consistency: previously installed atw commands can remain on an older binary after the new installer succeeds.

Retained concerns

  • Low · reliability · inferred: Existing installations remain outside the renamed executable’s upgrade and rollback lifecycle. The former installer created ~/atw and recommended invoking or aliasing that path; the new installer only updates ~/.allthings/bin/allthings and its adjacent atw symlink. Existing explicit paths and shell aliases can therefore continue executing an older binary after a successful reinstall, weakening version consistency and propagation of future fixes. The new adjacent alias preserves compatibility for the new location, but does not migrate the old one.
Security review details

Security Blast Radius

  • inferred — The installer’s execution authority is that of the invoking user, including its configurable installation directory. Compromise of the trusted installer or release publisher could execute code with that user’s authority; this remote distribution trust model existed before the rename, and the inspected changes do not add privilege elevation.

Trust Boundaries and Controls

  • observed — Environment-controlled destination selection predates this PR. The new override changes precedence, not the transport’s credential scope. The legacy command flag affects stderr only and does not bypass a separate authorization control.

Resilience and Maintainability Implications

  • inferred — Download failures before replacement preserve an existing primary executable, improving containment relative to downloading directly into the historical artifact location. Recovery remains version-selection and rerun based; neither the new alias sequence nor migration from ~/atw provides a coordinated rollback of every invocation path.

Hardening Proposals

  • proposed — Authenticated artifact verification before replacement and execution would strengthen the existing distribution boundary. This is prospective hardening: neither installer version verifies a checksum or signature, and that omission is not established as a newly introduced vulnerability.
🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 13 files. (9 skipped: … Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the CLI rename to allthings and the retention of atw as an alias.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage

Explanation

Docstring coverage is 37.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 13 files. (9 skipped: 9 unsupported.)

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Commit to this branch
  • Create a new PR
✨ Simplify code
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Usage-based review receipt

Note

This review was completed with usage-based billing: files reviewed beyond your plan's included limits are billed at $0.25/file. View usage-based billing.


Comment @coderabbitai help to get the list of available commands.

@esthor
esthor merged commit 64424dc into main Oct 7, 2026
17 checks passed
@esthor
esthor deleted the esthor/cli-allthings branch October 7, 2026 01:58

This branch was successfully deployed

1 active deployment
preview — c52a59c9 Deployed Oct 7, 2026 by esthor via 🚀 Deploy #392
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant