[purpshell]

Summary

Adds curated everyday Messaging commands on top of existing MessagingClient methods only.

• message send image|video|audio|document from --file (inline base64 via messages.send) or --url, with --caption, --mime-type (inferred from extension), --max-bytes, document --filename, audio --voice (push-to-talk).
• message send template|location|contact|poll|buttons|list.
• message edit / message delete (chats.editMessage / chats.deleteMessage; delete requires --yes or an interactive confirmation).
• group create, group participants add|remove|promote|demote (remove requires --yes), group subject, group description, group settings (info editing, messaging, member add, join approval; one SDK call each, error lists already-applied settings on partial failure).
• Local validation before transport: exactly one media source, file size, coordinates, poll option count/uniqueness, button/row syntax, participant IDs as Polymorfa user IDs.

Missing SDK/API methods (skipped, no raw HTTP)

• Sticker send: neither the SDK (MediaMessageKind = image|file|voice|video) nor the API MessageContent has a sticker kind. No message send sticker.
• Messaging media upload: MessagingMediaResource has no upload method and the API has no Messaging upload route; local files are sent inline as base64 in the send body (the SDK-supported upload path).

Avoids overlap with open PRs: does not touch message send text/react (#11) or test/commands/messages.test.ts; idempotency keys stay optional passthrough, matching current dev (#11 can extend auto-generation to these commands).

Five-part assessment

• API — unaffected. No API change. Commands call existing routes via the SDK: POST /messaging/{session}/messages/send, PUT|DELETE /messaging/{session}/chats/{conversation}/messages/{messageId} (chats:manage), group routes (groups:manage).
• SDK — unaffected (gaps noted). Uses pinned @polymorfa/sdk methods only. Gaps above (sticker, Messaging upload) exist in both SDK and API contract, so they are API/product gaps rather than SDK parity bugs.
• CLI — updated. 20 new commands, help text and examples, group:participants topic, README sections.
• Docs — unaffected. The CLI is unpublished and has no page in the public Mintlify site (docs/ in polymorfa/polymorfa has no CLI guide); README is the CLI reference. No monorepo docs PR needed.
• Feature releases — unaffected. No flags; the commands expose already-available API operations, still gated by server scopes and client-token rules.

Verification

• npm run verify (format, lint, typecheck, 515 tests, build, pack, audit) passes.
• New tests: test/commands/message-sends.test.ts (19), test/commands/group-mutations.test.ts (10), covering request shapes, routes, idempotency headers and pre-transport failures.
• Not exercised: a live session against a real API.

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[purpshell]

@coderabbitai review

[coderabbitai]

Warning

Review limit reached

• Ask an admin to enable usage-based reviews

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Next included review available in 59 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 87 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

The included review limit has been reached and this organization has disabled usage-based review continuation. Wait for reviews to reset or ask a billing admin to change After included review limits.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: d18f85cd-7c62-4311-be30-dfd6e8722423

📥 Commits

Reviewing files that changed from the base of the PR and between 5d0b039 and a166f1a.

📒 Files selected for processing (29)

• README.md
• package.json
• src/commands/group/create.ts
• src/commands/group/description.ts
• src/commands/group/participants/add.ts
• src/commands/group/participants/demote.ts
• src/commands/group/participants/promote.ts
• src/commands/group/participants/remove.ts
• src/commands/group/settings.ts
• src/commands/group/subject.ts
• src/commands/message/delete.ts
• src/commands/message/edit.ts
• src/commands/message/send/audio.ts
• src/commands/message/send/buttons.ts
• src/commands/message/send/contact.ts
• src/commands/message/send/document.ts
• src/commands/message/send/image.ts
• src/commands/message/send/list.ts
• src/commands/message/send/location.ts
• src/commands/message/send/poll.ts
• src/commands/message/send/template.ts
• src/commands/message/send/video.ts
• src/input/message-send.ts
• src/messaging/media-send.ts
• src/services/groups.ts
• src/services/message-content.ts
• src/services/messages.ts
• test/commands/group-mutations.test.ts
• test/commands/message-sends.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[purpshell]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[purpshell]

Reviewed locally because CodeRabbit is rate-limited (it answered @coderabbitai review with "Review rate limited" on the current head). Ran the CodeRabbit CLI against dev plus a separate local code review.

No changes needed. Both findings were false positives:

• test/commands/message-sends.test.ts (×2, "remove the literal double quotes from --name/--button"): the quotes are load-bearing. @oclif/test's runCommand joins the argv array with spaces and re-splits it shell-style, so removing them splits Ada, Countess into two arguments. Verified: the test fails with the suggested change.
• audio --voice sending everything under the voice content key: correct. The SDK content union has no audio key (MediaMessageKind = image | file | voice | video); ptt is what distinguishes a voice note from an audio file.

Left unfixed as low-severity/by-design: no escape syntax for / in --row IDs, vCard output is LF-joined without \r escaping or line folding, and url: button targets are not validated locally.

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

@purpshell Thanks for the detailed verification.

The quoted values in test/commands/message-sends.test.ts are required for @oclif/test parsing. The earlier quote-removal findings are invalid.

The voice content key for audio --voice matches the SDK union. The ptt flag distinguishes a voice note from an audio file. The earlier finding is invalid.

The listed remaining cases are intentional limitations for this PR.

---

✏️ Learnings added

Learnt from: purpshell
URL: https://github.com/polymorfa/cli/pull/18

Timestamp: 2026-09-20T07:05:13.164Z
Learning: In `test/commands/message-sends.test.ts`, quoted CLI argument values that contain spaces, such as `Ada, Countess`, are required because `oclif/test` `runCommand` joins and shell-splits the argument array. Removing the quotes changes the parsed arguments.

---

Learnt from: purpshell
URL: https://github.com/polymorfa/cli/pull/18

Timestamp: 2026-09-20T07:05:13.164Z
Learning: For CLI audio message sends, use the SDK `voice` media content key. The SDK media union supports `image`, `file`, `voice`, and `video`, not `audio`. Use `ptt` to distinguish a voice note from an audio file.

Note: Learnings are effective only in the context of similar code segments. To apply general coding guidelines, please configure review instructions. You can manage existing learnings in the app.

You are interacting with an AI system.