cf-cli Code Review

Bun/TypeScript Cloudflare CLI — 5-Agent Multi-Perspective Analysis • 2026-03-01

Agent Status

Overall Assessment

cf-cli is a well-engineered, production-quality CLI tool. All 5 reviewers independently praised the architecture: clean separation of concerns, typed Context injection, atomic config writes with correct permissions, credential redaction in verbose mode, TTY-safe prompts, and a zero-dependency argument parser. The code shows serious engineering judgment throughout. Critical issues are concentrated in three areas: security (secret handling, input validation), correctness (retry logic, pagination bounds), and robustness (error swallowing, race conditions). All are fixable without architectural changes.

Critical Issues (Must Fix)

// Option A: stdin
const value = await readStdin();
// Option B: file
const value = await Bun.file(getStringFlag(flags, "value-file")).text();
// Option C: env var
const value = process.env["CF_SECRET_VALUE"];

if (response.status === 429 && attempt < MAX_RETRIES) {
  const retryAfter = response.headers.get("Retry-After");
  const waitMs = retryAfter
    ? parseFloat(retryAfter) * 1000
    : (RETRY_DELAYS[attempt - 1] ?? 4000);
  await sleep(waitMs);
  continue;
}

const MAX_PAGES = 1000;
while (page <= MAX_PAGES) {
  // ... existing logic ...
}
if (page > MAX_PAGES) {
  throw new Error(`fetchAll: exceeded ${MAX_PAGES} page limit for ${path}.`);
}

function pathSegment(value: string): string {
  return encodeURIComponent(value);
}
// Usage: `/zones/${pathSegment(zoneId)}/dns_records/${pathSegment(id)}`

const tmpFile = join(CONFIG_DIR, `.config.json.tmp.${process.pid}`);
try {
  writeFileSync(tmpFile, content, { mode: 0o600 });
  renameSync(tmpFile, CONFIG_FILE);
} catch (err) {
  try { unlinkSync(tmpFile); } catch { }
  throw err;
}

} catch (err: unknown) {
  if ((err as NodeJS.ErrnoException).code === "ENOENT") return defaultConfig();
  if (err instanceof SyntaxError) return defaultConfig();
  throw err; // Surface permission errors
}

if (!path.match(/^\/[a-z0-9\/_-]+$/i)) {
  throw new UsageError("Invalid API path");
}

import { isIPv4, isIPv6 } from "net";
export function validateIP(value: string): string {
  const trimmed = value.trim();
  if (isIPv4(trimmed) || isIPv6(trimmed)) return trimmed;
  throw new UsageError(`Invalid IP address: "${trimmed}".`);
}

Recommendations (Should Fix)

"User-Agent": `cf-cli/${VERSION} (Bun/${Bun.version})`

const RETRYABLE = new Set([429, 500, 502, 503, 504]);
if (RETRYABLE.has(response.status) && attempt < MAX_RETRIES) continue;

Observations (Nice to Have)

Security Checklist

• No hardcoded secrets — credentials from env vars and config file only
• Config file has 0o600 permissions, config dir has 0o700
• Atomic config writes with renameSync prevent partial writes
• Credential redaction in verbose mode (tokens show last 4 chars)
• Prototype pollution defense on profile names
• TTY-safe confirmation prompts for destructive operations
• Secret values accepted as CLI arguments (Issue #1)
• IPv6 validation too permissive (Issue #8)
• URL path encoding inconsistent (Issue #4)
• readConfig swallows permission errors silently (Issue #6)
• BillingProfile card_number field could leak PAN data (Issue #18)
• No input validation on API request paths (Issue #7)

Architectural Notes

Prioritized Action Plan

Review Metrics