chore: migrate build to Stars CLI

[RedStar071]

Summary

• migrate build/dev commands from raw tsdown to @wolfstar/cli 0.6.0
• move build aliases and locale copying into stars.config.ts
• replace legacy i18n/logger packages with @wolfstar/plugin-i18next and @wolfstar/plugin-logger
• rely on automatic @wolfstar/plugin-*/register side-effect injection
• update the Docker build for Stars and remove the custom tunnel implementation

Verification

• pnpm lint
• pnpm prisma:generate
• pnpm build

Confidence Score: 5/5

Merge-safe. The only remaining concern is non-blocking and does not make the change unsafe to merge.

_{Reviews (4) · Last reviewed commit: "chore(deps): migrate to http-framework v..."}

[coldtea-pr-lens]

◈ PR Lens

🟢 +1 new · 🟠 ~4 changed · 🔴 -2 removed · 1 flow · 7 files · commit ed94f2d

Architecture

7 components touched across 4 lanes.

Play the interactive walkthrough

Inside the changed components — 2 views

Component view — Server runtime & initialization

HTTP server startup sequence, framework v5 migration, and integrated plugin setup

Component view — Build toolchain & bundling

Migration from custom tsdown configuration to stars CLI with path alias resolution

Data flow

Server startup and initialization

Follow each request, response and payload

View

• Architecture lens
• Data flow lens
• Expand every detail

Tip

Run npx @coldtea/pr-lens-cli analyze --base origin/main on a branch, then npx @coldtea/pr-lens-cli render .pr-lens/graph.json. Same lenses, your own model key, before the pull request exists

🪧 More tips

• Run npx skills add coldteadotai/pr-lens, then tell your coding agent: "Diagram the change you just made with PR Lens and attach it to the pull request."
• Untick Architecture lens or Data flow lens under View to hide a diagram, or tick Expand every detail to open every section. The comment redraws in a few seconds
• Click the link under each diagram to open it on a canvas you can zoom, pan and step through
• The diagrams are links. Click one to open it on the canvas, then press W or click play to walk through the change
• Open a diagram on the canvas, then press W or click play to walk through the change one step at a time
• The CLI's render reads .github/pr-lens.yml and applies your renames, exclusions and lane pins at draw time
• Set github.comment.collapsed: true in .github/pr-lens.yml to fold the comment behind one View architecture and data flow row. Drawing still runs on every push
• Set github.draw: on-demand in .github/pr-lens.yml and PR Lens stops drawing every push. Comment @pr-lens draw on a pull request when you want that one drawn
• Add .github/workflows/pr-lens.yml with coldteadotai/pr-lens/packages/action@v0 and your model provider's key as its api-key to run PR Lens from your own CI. Any /chat/completions endpoint works
• Push a commit and the comment redraws for the new head. A slow older run never overwrites a newer one
• Switch GitHub to dark mode and the diagrams follow. The moving dots are this pull request's data in motion

---

Thanks for using PR Lens! It's built by Coldtea, free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Bluesky
• Mastodon
• Reddit
• LinkedIn

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​wolfstar/​start-banner@​2.0.3 ⏵ 2.1.1	+2		+10	+5
	@​wolfstar/​env-utilities@​2.0.3 ⏵ 2.1.1	+1		+5	+4
	@​commitlint/​cli@​21.0.2 ⏵ 21.2.2				-3
	@​wolfstar/​shared-http-pieces@​1.2.6 ⏵ 2.0.4	+2		+7	+4
	@​wolfstar/​plugin-logger@​0.2.0
	@​wolfstar/​plugin-api@​1.0.0 ⏵ 1.1.5	+1			+8
	@​wolfstar/​cli@​1.0.0
	@​wolfstar/​plugin-i18next@​2.0.3
	@​types/​node@​24.13.2 ⏵ 24.13.5			+1	+1
	@​wolfstar/​http-framework@​3.0.0 ⏵ 5.0.0	+5		+1	+5
	@​eslint-community/​eslint-plugin-eslint-comments@​4.7.2 ⏵ 4.8.1	+1		+1	+6
	@​prisma/​adapter-pg@​7.8.0 ⏵ 7.10.0			+1	+2
	@​prisma/​client@​7.8.0 ⏵ 7.10.0	+11			+2
	oxfmt@​0.55.0 ⏵ 0.68.0	+1			+1
	tsdown@​0.22.3 ⏵ 0.23.0			+1	-1
	oxlint@​1.70.0 ⏵ 1.83.0
	eslint-plugin-regexp@​3.1.0 ⏵ 3.3.0				+2
	@​commitlint/​config-conventional@​21.0.2 ⏵ 21.2.2				-3
	prisma@​7.8.0 ⏵ 7.10.0
	eslint@​10.5.0 ⏵ 10.10.0	+1
	taze@​19.14.1 ⏵ 19.17.2				+5
	discord-api-types@​0.38.47 ⏵ 0.38.55	+1			+1

View full report

[greptile-apps]

Point fallback at locale

defaultNS and defaultMissingKey both reference globals, but the locale tree only supplies commands/shared. A missing translation therefore resolves to the literal default key fragment rather than the intended diagnostic message. Add globals:default to the locale resources or configure an existing translated fallback. This is non-blocking, but it makes missing translations harder to diagnose.

Artifacts

Missing-key fallback validation script

• The authored script loads the real locale tree in an isolated temporary directory and formats one missing key under each configuration; it is the executed source.

Current globals fallback output

• The current `globals` configuration discovers only `commands/shared` and resolves the missing key to `default`, proving the configured fallback is unavailable.

Existing namespace control output

• The control using the existing `commands/shared` namespace resolves the same missing key to its configured translation, showing the fallback mechanism works when the resource exists.

_{Ran code and verified through T-Rex}

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/main.ts
Line: 23-24

Comment:
**Point fallback at locale**

`defaultNS` and `defaultMissingKey` both reference `globals`, but the locale tree only supplies `commands/shared`. A missing translation therefore resolves to the literal `default` key fragment rather than the intended diagnostic message. Add `globals:default` to the locale resources or configure an existing translated fallback. This is non-blocking, but it makes missing translations harder to diagnose.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

Dismissed because a newer commit was pushed; Greptile will re-review the current head.

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm robust-predicates is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/prisma@7.10.0 → npm/robust-predicates@3.0.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/robust-predicates@3.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report