Skip to content

Conversation

@arav1nd4n
Copy link

@arav1nd4n arav1nd4n commented Jul 18, 2025

User description

New Plugin: promptgenai

Adds an AI-powered Bash assistant using OpenRouter API. Provides commands, explanations, and error suggestions.

Features:

  • Trigger using pgi "your query"
  • Only runs on demand (doesn’t slow shell)
  • Requires API key via AI_PROMPTGEN_API_KEY in .bashrc

PR Type

Enhancement


Description

  • Add new promptgenai plugin for AI-powered Bash assistance

  • Implement pgi command with OpenRouter API integration

  • Include error handling and JSON response parsing

  • Require API key configuration via environment variable


Diagram Walkthrough

flowchart LR
  A["User Query"] --> B["pgi command"]
  B --> C["API Key Check"]
  C --> D["OpenRouter API Call"]
  D --> E["JSON Response Parsing"]
  E --> F["Command/Explanation Output"]
Loading

File Walkthrough

Relevant files
Enhancement
promptgenai.plugin.sh
New AI-powered Bash assistant plugin                                         

plugins/promptgenai/promptgenai.plugin.sh

  • Create new plugin with pgi function for AI assistance
  • Implement OpenRouter API integration with Mixtral model
  • Add input validation and error handling
  • Include JSON response parsing with fallback error display
+41/-0   

@qodo-merge-for-open-source
Copy link

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪
🧪 No relevant tests
🔒 Security concerns

Sensitive information exposure:
The API key is passed directly in the curl command arguments, making it visible in process lists (ps aux) and potentially logged in shell history or system logs. Additionally, the input sanitization only escapes double quotes but doesn't handle other JSON-breaking characters, which could potentially lead to JSON injection if malicious input is provided.

⚡ Recommended focus areas for review

Security Risk

The API key is exposed in the curl command through process arguments, making it visible in process lists and potentially logged in shell history or system logs.

local response=$(curl -s https://openrouter.ai/api/v1/chat/completions \
  -H "Authorization: Bearer $AI_PROMPTGEN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "mistralai/mixtral-8x7b-instruct",
    "messages": [
      {
        "role": "system",
        "content": "You are a bash expert. Reply with commands and explanations. Provide only relevant and copyable command blocks where applicable."
      },
      {
        "role": "user",
        "content": "'"${query//\"/\\\"}"'"
      }
    ]
  }')
Input Sanitization

The query parameter escaping on line 28 only handles double quotes but may not properly handle other special characters that could break the JSON structure or cause injection issues.

  "content": "'"${query//\"/\\\"}"'"
}

@qodo-merge-for-open-source
Copy link

PR Code Suggestions ✨

Explore these optional code suggestions:

CategorySuggestion                                                                                                                                    Impact
Possible issue
Add timeout and error handling

The curl command lacks proper error handling and timeout configuration. Network
failures or API timeouts could cause the function to hang indefinitely or fail
silently.

plugins/promptgenai/promptgenai.plugin.sh [16-31]

-local response=$(curl -s https://openrouter.ai/api/v1/chat/completions \
+local response=$(curl -s --max-time 30 --fail https://openrouter.ai/api/v1/chat/completions \
   -H "Authorization: Bearer $AI_PROMPTGEN_API_KEY" \
   -H "Content-Type: application/json" \
   -d '{
     "model": "mistralai/mixtral-8x7b-instruct",
     "messages": [
       {
         "role": "system",
         "content": "You are a bash expert. Reply with commands and explanations. Provide only relevant and copyable command blocks where applicable."
       },
       {
         "role": "user",
         "content": "'"${query//\"/\\\"}"'"
       }
     ]
   }')
 
+if [[ $? -ne 0 ]]; then
+  echo "❌ Failed to connect to API"
+  return 1
+fi
+
  • Apply / Chat
Suggestion importance[1-10]: 7

__

Why: The suggestion correctly points out that the curl command could hang indefinitely and proposes adding a timeout and failure flag, which significantly improves the script's robustness.

Medium
Check jq availability before use

The function should check if jq is available before using it. If jq is not
installed, the function will fail with an unclear error message.

plugins/promptgenai/promptgenai.plugin.sh [33-39]

-if echo "$response" | jq -e '.choices[0].message.content' > /dev/null; then
-  echo "$response" | jq -r '.choices[0].message.content'
+if command -v jq >/dev/null 2>&1; then
+  if echo "$response" | jq -e '.choices[0].message.content' > /dev/null; then
+    echo "$response" | jq -r '.choices[0].message.content'
+  else
+    echo "⚠️ Something went wrong."
+    echo "Raw response:"
+    echo "$response"
+  fi
 else
-  echo "⚠️ Something went wrong."
-  echo "Raw response:"
-  echo "$response"
+  echo "❌ jq is required but not installed"
+  return 1
 fi
  • Apply / Chat
Suggestion importance[1-10]: 6

__

Why: This is a good suggestion for improving user experience by checking for the jq dependency and providing a clear error message if it's not installed, preventing a cryptic command failure.

Low
Improve JSON string escaping

The JSON escaping only handles double quotes but ignores other special
characters like newlines, backslashes, and control characters that could break
the JSON structure.

plugins/promptgenai/promptgenai.plugin.sh [28]

-"content": "'"${query//\"/\\\"}"'"
+"content": "'"$(printf '%s' "$query" | sed 's/\\/\\\\/g; s/"/\\"/g; s/$/\\n/g' | tr -d '\n')"'"
  • Apply / Chat
Suggestion importance[1-10]: 5

__

Why: The suggestion correctly identifies that the current JSON escaping is incomplete and could fail with special characters, but the proposed sed solution is overly complex and potentially incorrect.

Low
  • More

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant