feat(storage): add storage zone and file commands with S3 credentials by jamie-at-bunny · Pull Request #98 · BunnyWay/cli

jamie-at-bunny · 2026-06-18T12:25:13Z

No description provided.

changeset-bot · 2026-06-18T12:25:17Z

🦋 Changeset detected

Latest commit: 7819dfe

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@bunny.net/cli	Minor
@bunny.net/cli-linux-x64	Minor
@bunny.net/cli-linux-arm64	Minor
@bunny.net/cli-darwin-x64	Minor
@bunny.net/cli-darwin-arm64	Minor
@bunny.net/cli-windows-x64	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

amir-at-bunny · 2026-06-19T12:08:51Z

+
+# Files: list, upload, download, delete (paths are relative to the zone root)
+bunny storage file list my-zone
+bunny storage file list my-zone images/


when dir doesn't exist it says Directory is empty. maybe a more accurate error message would be nicer. the current one implies the dir exists but empty.

I don't think we know either way here, unless something changed in the API recently. I discovered this while working on bunny-upload/file-manager. We could instead return No files found at "images/". The path may be empty or not exist though, wdyt?

amir-at-bunny · 2026-06-19T12:11:27Z

+bunny storage file list my-zone images/
+bunny storage file upload my-zone ./photo.png --to images/
+bunny storage file upload my-zone ./photo.png --checksum --content-type image/png
+bunny storage file download my-zone images/photo.png --out ./local.png


this doesn't work for me. it gets stuck on downloading and blocks the process.

@amir-at-bunny can you check with the latest this works as you expect.

bogdan-at-bunny · 2026-06-22T09:24:00Z

@codex review

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2eb4f25d96

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-06-22T09:33:59Z

+): string[] {
+  const primary = primaryCode?.toUpperCase();
+  const normalized = regions
+    .map((region) => region.trim().toUpperCase())


Split comma-separated replication regions

The new examples use --replication LA,SG, but the parser passes that as one array element, and this normalization only trims/uppercases each element before validating it. As a result LA,SG is checked as a single region code and rejected as unknown, so the documented creation/update form fails unless users repeat the flag; split each entry on commas before validation or change the documented syntax.

Useful? React with 👍 / 👎.

chatgpt-codex-connector · 2026-06-22T09:33:59Z

+      };
+    }
+
+    if (output === "json") {


Add the requested domain before returning JSON

When bunny storage zones add ... --domain <host> --output json is used, --domain already made the pull zone get created, but this JSON branch returns before the custom-domain block below runs. The command therefore reports success while silently skipping the explicit domain the user asked to attach; perform the non-interactive hostname add before this return and include its result/error in the JSON payload.

Useful? React with 👍 / 👎.

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

greptile-apps

Your free trial has ended. If you'd like to continue receiving code reviews, you can add a payment method here.

jamie-at-bunny · 2026-06-22T16:29:16Z

@codex review

chatgpt-codex-connector · 2026-06-22T16:29:21Z

To use Codex here, create a Codex account and connect to github.

jamie-at-bunny · 2026-06-22T16:39:11Z

@greptile-apps re-review

greptile-apps · 2026-06-22T16:44:00Z

Greptile Summary

This PR adds a comprehensive storage command group to the bunny CLI, covering storage zone lifecycle (add, list, show, update, remove), S3 credential export in multiple tool formats (rclone, aws, s3cmd, env), and file operations (list, upload, download, remove) backed by @bunny.net/storage-sdk.

Zone management (zones add/list/show/update/remove/credentials): interactive prompting with region/replication pickers, a toSafeStorageZone helper that strips passwords before any JSON output, and integrated pull-zone + custom-domain creation in the add flow.
File commands (files list/upload/download/remove): streaming I/O via FileSink for large objects, optional SHA-256 checksum on upload, and a --force bypass for the directory-delete confirmation.
S3 credentials (zones credentials): proper single-quote shell escaping for the env format (tested with metacharacters), and a maskSecret helper fix that now fully masks secrets ≤ 8 characters rather than leaking them.

Confidence Score: 5/5

The change is safe to merge. All new commands follow the established patterns in the codebase, passwords are stripped before JSON output, and the shell-quoting implementation for S3 env credentials is correctly tested.

The code is well-structured with no new defects found beyond what was already discussed in prior review threads. The maskSecret fix from the previous round has been correctly applied. The only new observations are a detached JSDoc comment in flow.ts and a double disk read when --checksum is used on upload — both cosmetic or minor performance concerns that don't affect correctness.

No files require special attention. The orphaned JSDoc in core/hostnames/flow.ts and the double file read in file/upload.ts are the only remaining items worth a second look.

Important Files Changed

Filename	Overview
packages/cli/src/commands/storage/zone/add.ts	New `zones add` command with interactive prompting, pull zone creation, and custom domain setup. Logic and overall flow look correct.
packages/cli/src/commands/storage/s3.ts	S3 credential helpers with proper shell quoting for the `env` format. All four tool formats look correct.
packages/cli/src/commands/storage/zone/credentials.ts	Shows/exports S3 credentials with secret masked in human mode and fully exposed in JSON/tool-format modes (intentional for scripting).
packages/cli/src/commands/storage/file/upload.ts	Upload command with optional SHA-256 checksum. File is read twice when `--checksum` is passed — functionally correct but doubles disk I/O for large files.
packages/cli/src/commands/storage/files-api.ts	Thin wrapper over `@bunny.net/storage-sdk` with correct region validation before connecting.
packages/cli/src/commands/storage/api.ts	`toSafeStorageZone` strips passwords before JSON serialization; `resolveStorageZone` handles both numeric IDs and name lookups.
packages/cli/src/core/format.ts	`maskSecret` fix correctly applied — short secrets ≤ 8 chars now return 8 bullets instead of partially revealing the value.
packages/cli/src/core/hostnames/flow.ts	Extended with `offerBunnyDnsThenSsl`/`setupHostname`. An orphaned JSDoc block was left immediately above `setupHostname` during a refactor.
packages/cli/src/commands/storage/interactive.ts	Zone picker that falls back from explicit ref → linked manifest → interactive select. Correctly blocks in non-TTY/JSON mode.
packages/cli/src/commands/storage/file/download.ts	Streaming download with `FileSink`, properly creating parent directories and cleaning up partial files on error.

_{Reviews (3): Last reviewed commit: "apply greptile feedback" | Re-trigger Greptile}

greptile-apps · 2026-06-22T16:44:09Z

+      });
+      replicationRegions = picked ?? [];
+    }
+    const replicationCodes = replicationRegions
+      ? normalizeReplicationRegions(replicationRegions, mainRegion)
+      : [];
+
+    const spin = spinner("Creating storage zone...");
+    spin.start();
+    let created: StorageZoneModel | undefined;
+    try {
+      const { data } = await client.POST("/storagezone", {
+        body: {
+          Name: zoneName,
+          Region: mainRegion,
+          ReplicationRegions: replicationCodes.length ? replicationCodes : null,
+        },
+      });
+      created = data;


Unchecked API response on zone creation — also affects remove.ts and update.ts

client.POST (openapi-fetch) never throws on HTTP error responses; it returns { data: undefined, error: ... }. When the API rejects the request (e.g. 409 name conflict, 400 invalid region), data is undefined, created stays undefined, and execution continues — ultimately printing "Created storage zone <name>." or, in JSON mode, returning { "Name": "<name>", "PullZone": null, "CustomDomain": null } with no error signal. Callers have no way to distinguish a failure from success.

The same silent-success pattern appears in zone/remove.ts (the client.DELETE response is completely discarded) and zone/update.ts (the client.POST response is discarded), so a failed delete or update also logs "Deleted/Updated storage zone X." as if it succeeded.

I don't think this applies. We get {data,error} in our responses, and no throws.

Looking at the actual code, the error from client.POST is never checked — only data is destructured:

const { data } = await client.POST("/storagezone", { ... }); created = data;

If the API returns a 409 or 400, data is undefined and error carries the failure — but error is silently dropped here. Execution continues past the try/finally, hits const zoneId = created?.Id (which is undefined), and eventually logs "Created storage zone <name>." as if it succeeded.

The fix would be to destructure and check error:

Suggested change

});

replicationRegions = picked ?? [];

}

const replicationCodes = replicationRegions

? normalizeReplicationRegions(replicationRegions, mainRegion)

: [];

const spin = spinner("Creating storage zone...");

spin.start();

let created: StorageZoneModel | undefined;

try {

const { data } = await client.POST("/storagezone", {

body: {

Name: zoneName,

Region: mainRegion,

ReplicationRegions: replicationCodes.length ? replicationCodes : null,

},

});

created = data;

const { data, error } = await client.POST("/storagezone", {

body: {

Name: zoneName,

Region: mainRegion,

ReplicationRegions: replicationCodes.length ? replicationCodes : null,

},

});

if (error) throw new UserError(String(error));

created = data;

Tip: You can customize Greptile's behavior for this repo with .greptile/rules.md and .greptile/config.json.

jamie-at-bunny · 2026-06-24T11:41:30Z

We should also prompt before adding a replica that it cannot later be removed.

feat(storage): add storage zone and file commands with S3 credentials

0b61790

jamie-at-bunny added 2 commits June 18, 2026 18:03

updates to creating storage zones with domains

221c0a0

update table header color

6cc1ccb

amir-at-bunny reviewed Jun 19, 2026

View reviewed changes

apply fixes

2eb4f25

jamie-at-bunny marked this pull request as ready for review June 22, 2026 09:23

greptile-apps Bot reviewed Jun 22, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Jun 22, 2026

View reviewed changes

apply code suggestions

4d94b00

greptile-apps Bot reviewed Jun 22, 2026

View reviewed changes

add note about flags for secrets

2ab12a5

jamie-at-bunny self-assigned this Jun 22, 2026

greptile-apps Bot reviewed Jun 22, 2026

View reviewed changes

jamie-at-bunny added 2 commits June 22, 2026 17:44

link and fix file listing

0e44f5c

apply greptile feedback

7819dfe

Uh oh!

Conversation

jamie-at-bunny commented Jun 18, 2026

Uh oh!

changeset-bot Bot commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🦋 Changeset detected

Uh oh!

Uh oh!

Uh oh!

Uh oh!

amir-at-bunny Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

jamie-at-bunny Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

amir-at-bunny Jun 19, 2026

Choose a reason for hiding this comment

Uh oh!

jamie-at-bunny Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

bogdan-at-bunny commented Jun 22, 2026

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot left a comment

Choose a reason for hiding this comment

Uh oh!

jamie-at-bunny commented Jun 22, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jun 22, 2026

Uh oh!

jamie-at-bunny commented Jun 22, 2026

Uh oh!

greptile-apps Bot commented Jun 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

greptile-apps Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

jamie-at-bunny Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot Jun 22, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jamie-at-bunny commented Jun 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

changeset-bot Bot commented Jun 18, 2026 •

edited

Loading

greptile-apps Bot commented Jun 22, 2026 •

edited

Loading