plugins/eth-validator-cli/plugin_eth-validator-cli.sh (1)

130-152: 🛠️ Refactor suggestion

Provide a default action when no flags supplied.
If the script is invoked without -i, -u, or -r, it silently exits. It’s better to show usage:

if [[ $OPTIND -eq 1 ]]; then
  usage
  exit 1
fi

or force at least one option.

plugins/eth-validator-cli/menu.sh (3)

62-74: Duplicate of previous command-invocation pattern.
The same string-concatenation approach is used in exitCommand. Please apply the array-based fix described above to harden against word splitting.

---

76-88: Duplicate of previous command-invocation pattern.
switchWithdrawalCredentialTypeCommand also builds command as a string. Refactor to use an array as per the earlier suggestion to avoid edge-case failures.

---

90-104: Duplicate of previous command-invocation pattern.
withdrawCommand follows the same pattern—please refactor to use an array-based invocation to ensure robust handling of user input.

plugins/eth-validator-cli/env.example (1)

1-3: Consider adding inline documentation to the template.
While the three variables are clear, it would help first-time users if each line had a brief comment explaining its purpose and expected format. For example:

# JSON-RPC endpoint for your execution client
JSON_RPC_URL=http://localhost:8545
# Beacon node API endpoint
BEACON_API_URL=http://localhost:5052
# Maximum number of validator operations per block
MAX_REQUESTS_PER_BLOCK=5

plugins/eth-validator-cli/menu.sh (2)

13-20: Remove or leverage unused color variables.
ShellCheck flags y, b, and p as unused (SC2034). Either delete them or use them for warnings/prompts to avoid stale code.

🧰 Tools

🪛 Shellcheck (0.10.0)

[warning] 14-14: y appears unused. Verify use (or export if used externally).

(SC2034)

---

[warning] 15-15: b appears unused. Verify use (or export if used externally).

(SC2034)

---

[warning] 16-16: p appears unused. Verify use (or export if used externally).

(SC2034)

---

106-160: Add robust error handling and shell safety flags.
Consider adding at the top:

set -euo pipefail

and catching the absence of dependencies (whiptail, jq, etc.) before entering the main loop. This will improve maintainability and prevent partial failures.

plugins/eth-validator-cli/plugin_eth-validator-cli.sh (5)

10-11: Consider enabling strict mode.
Right after the shebang, add:

set -euo pipefail
IFS=$'\n\t'

to catch errors early, avoid unset variables, and handle pipelines correctly.

---

53-60: Handle missing current_version gracefully.
If the plugin isn’t installed yet, current_version won’t exist. Before reading it:

if [[ ! -f "$PLUGIN_INSTALL_PATH/current_version" ]]; then
  error "No installed version found; please install first (-i)"; return
fi

This prevents confusing upgrade prompts.

---

63-100: After copying the example env, ensure executables have correct permissions.
You copy env.example to env, but don’t set the menu.sh and client binary as executable. Consider:

sudo chmod +x "$PLUGIN_INSTALL_PATH/eth-validator-cli" "$PLUGIN_INSTALL_PATH/menu.sh"

so users can run the menu immediately.

---

103-108: Verify removal path before rm -rf.
To avoid catastrophic deletion if PLUGIN_INSTALL_PATH is unset, wrap:

if [[ -d "$PLUGIN_INSTALL_PATH" ]]; then
  sudo rm -rf "$PLUGIN_INSTALL_PATH"
else
  error "Installation directory not found"
fi

---

111-128: Typo in usage help formatting.
The Options) and About $APP_NAME) lines use a closing parenthesis instead of a colon, which is inconsistent. Changing them to:

Options:
...
About $APP_NAME:

improves readability.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

plugins/eth-validator-cli/plugin_eth-validator-cli.sh (1)

30-36: Initialize _arch and _platform before use.
These variables are referenced in downloadClient() but never set, causing SC2154 warnings and download failures. Insert this before downloadClient():

+ # Detect architecture and platform
+ _arch=$(uname -m)
+ case "$_arch" in
+   x86_64) _arch=amd64 ;;
+   aarch64) _arch=arm64 ;;
+   *) error "Unsupported arch: $_arch"; exit 1 ;;
+ esac
+ _platform=$(uname -s | tr '[:upper:]' '[:lower:]')

🧰 Tools

🪛 Shellcheck (0.10.0)

[warning] 32-32: _arch is referenced but not assigned.

(SC2154)

---

[warning] 36-36: _platform is referenced but not assigned.

(SC2154)

plugins/eth-validator-cli/menu.sh (2)

32-35: Consider quoting paths in file checks.
To prevent globbing or word-splitting if PLUGIN_INSTALL_PATH ever contains spaces, quote the tests:

- [[ -f $PLUGIN_INSTALL_PATH/env ]] && source $PLUGIN_INSTALL_PATH/env
+ [[ -f "$PLUGIN_INSTALL_PATH/env" ]] && source "$PLUGIN_INSTALL_PATH/env"
- [[ -f $PLUGIN_INSTALL_PATH/current_version ]] && VERSION=$(cat $PLUGIN_INSTALL_PATH/current_version)
+ [[ -f "$PLUGIN_INSTALL_PATH/current_version" ]] && VERSION=$(cat "$PLUGIN_INSTALL_PATH/current_version")

---

152-156: Use the install path for helper script invocation.
Relying on a relative path (./plugins/...) may fail if the CWD changes. Prefer the absolute install location:

- exec ./plugins/eth-validator-cli/plugin_eth-validator-cli.sh -u
+ exec "$PLUGIN_INSTALL_PATH"/plugin_eth-validator-cli.sh -u

And similarly for -r.

plugins/eth-validator-cli/plugin_eth-validator-cli.sh (1)

35-38: Guard against empty binary URLs.
If BINARIES_URL is empty, wget will silently fail. Add a check:

- BINARIES_URL=$(echo "$json" | jq -r ".assets[] | select(.name) | .browser_download_url" | grep -i "${_platform}-${_custom}")
+ BINARIES_URL=$(echo "$json" | jq -r ".assets[] | select(.name) | .browser_download_url" | grep -i "${_platform}-${_custom}")
+ if [[ -z "$BINARIES_URL" ]]; then
+   error "Failed to find a matching binary for $_platform-$_custom"
+   exit 1
+ fi

🧰 Tools

🪛 Shellcheck (0.10.0)

[warning] 36-36: _platform is referenced but not assigned.

(SC2154)

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

plugins/eth-validator-cli/plugin_eth-validator-cli.sh (2)

132-137: 🛠️ Refactor suggestion

Show usage when no flags are provided
Currently, running the script without any options results in no action. Add a pre-check before getopts to display help:

+if [[ $# -eq 0 ]]; then
+  usage
+  exit 1
+fi
 while getopts :iurh opt; do
   case ${opt} in
     i ) install ;;

---

13-21: ⚠️ Potential issue

Missing architecture & platform detection
Variables _arch and _platform are later referenced in downloadClient() but never initialized, causing SC2154 warnings and breaking the download logic. Add detection via uname:

 # Variables
 RELEASE_URL="https://api.github.com/repos/TobiWo/eth-validator-cli/releases/latest"
 ...
 PLUGIN_SOURCE_PATH="$SOURCE_DIR"
+
+# Detect architecture and platform
+_arch=$(uname -m)
+case "$_arch" in
+  x86_64) _arch=amd64 ;;
+  aarch64) _arch=arm64 ;;
+  *) echo "Unsupported architecture: $_arch"; exit 1 ;;
+esac
+_platform=$(uname -s | tr '[:upper:]' '[:lower:]')

plugins/eth-validator-cli/plugin_eth-validator-cli.sh (3)

23-26: Use failure-safe curl flags
In getLatestVersion(), replace curl -s with flags that cause errors on non-2xx responses. This makes your empty-TAG check more reliable:

-function getLatestVersion(){
-  TAG=$(curl -s $RELEASE_URL | jq -r .tag_name )
+function getLatestVersion() {
+  TAG=$(curl -fsSL "$RELEASE_URL" | jq -r .tag_name)
   if [[ -z "$TAG" ]]; then echo "Failed to fetch latest version"; exit 1; fi
}

---

29-36: Quote variables & improve error branch
Inside downloadClient(), always quote expansions to prevent globbing/word-splitting and make the unsupported-arch check clearer:

-function downloadClient(){
-  local _custom
-  [[ $_arch == "amd64" ]] && _custom="x64"
-  [[ -z $_custom ]] && echo "Unsupported arch: $_arch" && exit 1
+function downloadClient() {
+  local _custom
+  [[ "$_arch" == "amd64" ]] && _custom="x64"
+  if [[ -z "$_custom" ]]; then
+    echo "Unsupported architecture: $_arch"
+    exit 1
+  fi

Also, when grepping the JSON, quote ${_platform} and ${_custom}:

-  BINARIES_URL=$(echo "$json" | jq -r ".assets[] | select(.name) | .browser_download_url" | grep --ignore-case "${_platform}"-"${_custom}")
+  BINARIES_URL=$(echo "$json" | jq -r '.assets[] .browser_download_url' | grep -i "${_platform}-${_custom}")

🧰 Tools

🪛 Shellcheck (0.10.0)

[warning] 32-32: _arch is referenced but not assigned.

(SC2154)

---

[warning] 36-36: _platform is referenced but not assigned.

(SC2154)

---

113-120: Minor help text formatting
In usage(), the “Options” header uses a parenthesis. For consistency with other help tools, switch to a colon:

-Options)
+Options:

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

plugins/eth-validator-cli/plugin_eth-validator-cli.sh (4)

133-134: Show usage when no options are provided
Invoking the script without flags currently does nothing. Add a guard to display help instead of silently exiting.

Insert before the getopts loop:

if [[ $# -eq 0 ]]; then
  usage
  exit 1
fi

---

1-2: 🛠️ Refactor suggestion

Enable strict mode for robust error handling
We should bail out on errors, undefined variables, and pipeline failures to avoid silent failures.

Apply this diff right after the shebang:

 #!/bin/bash
+set -euo pipefail
+IFS=$'\n\t'

---

30-36: ⚠️ Potential issue

Detect architecture and platform before downloading
The variables _arch and _platform are used but never set, causing the download logic to always exit with “Unsupported architecture.”

Add detection logic (e.g. before downloadClient or at the top of the script):

_arch=$(uname -m)
case "$_arch" in
  x86_64) _arch=amd64 ;;
  aarch64) _arch=arm64 ;;
  *) echo "Unsupported architecture: $_arch"; exit 1 ;;
esac

_platform=$(uname -s | tr '[:upper:]' '[:lower:]')

🧰 Tools

🪛 Shellcheck (0.10.0)

[warning] 32-32: _arch is referenced but not assigned.

(SC2154)

---

67-79: 🛠️ Refactor suggestion

Fix newline handling in MSG_ABOUT
Backslash-escaped \n inside double quotes won’t render as newlines. Use ANSI-C quoting or a here-doc.

Replace with:

-MSG_ABOUT="🔧 eth-validator-cli by TobiWo: CLI tool for managing validators via execution layer requests
-\nFeatures:
-- Consolidate one or multiple source validators to one target validator
-...
-Continue to install?"
+MSG_ABOUT=$'🔧 eth-validator-cli by TobiWo: CLI tool for managing validators via execution layer requests\n\nFeatures:\n- Consolidate one or multiple source validators to one target validator\n- Switch withdrawal credentials from type 0x01 to 0x02 (compounding) for one or multiple validators\n- Partially withdraw ETH from one or many validators\n- Exit one or many validators\n- This CLI currently only supports validator related features included in the Pectra hardfork.\n- The tool is especially useful if you need to manage multiple validators at once.\n- Currently it only supports private keys as secret. This will change soon with e.g. hardware ledger support.\n- ⚠️ Tool is very early. Use on Hoodi only. Not recommended for mainnet yet!\n\nDocumentation: '"$DOCUMENTATION"$'\nSource Code: '"$SOURCE_CODE"$'\n\nContinue to install?'

plugins/eth-validator-cli/plugin_eth-validator-cli.sh (2)

37-43: Validate the download URL before attempting to fetch
If the asset URL isn’t found, wget will fail in an unclear way. Let’s catch an empty BINARIES_URL early.

For example:

-  BINARIES_URL=$(echo "$json" | jq -r ".assets[] | select(.name) | .browser_download_url" | grep --ignore-case "${_platform}"-"${_custom}")
+  BINARIES_URL=$(echo "$json" | jq -r ".assets[] | select(.name) | .browser_download_url" | grep --ignore-case "${_platform}-${_custom}")
+  if [[ -z "$BINARIES_URL" ]]; then
+    echo "Error: No download URL found for ${_platform}-${_custom}"
+    exit 1
+  fi

🧰 Tools

🪛 Shellcheck (0.10.0)

[warning] 38-38: _platform is referenced but not assigned.

(SC2154)

---

127-131: Nit: Fix stray parenthesis in usage help
The line About $APP_NAME) includes an extra ). It should read:

About $APP_NAME

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

plugins/eth-validator-cli/plugin_eth-validator-cli.sh (3)

30-36: Implement architecture and platform detection
past_review_comments: Critical: _arch and _platform are unset.
You must populate these before using them in downloadClient().

 function downloadClient(){
-  local _custom
+  local _custom
+  # Detect host architecture and platform
+  _arch=$(uname -m)
+  case "${_arch}" in
+    x86_64) _arch="amd64" ;;
+    aarch64) _arch="arm64" ;;
+    *) echo "Unsupported architecture: ${_arch}"; exit 1 ;;
+  esac
+  _platform=$(uname -s | tr '[:upper:]' '[:lower:]')

This snippet must appear before you reference $_arch or $_platform.

🧰 Tools

🪛 Shellcheck (0.10.0)

[warning] 32-32: _arch is referenced but not assigned.

(SC2154)

---

71-83: Fix newline handling in multi-line MSG_ABOUT
past_review_comments: Backslash-n in double quotes won’t render as newlines in whiptail. Use ANSI-C quoting or a here-doc.

- MSG_ABOUT="🔧 eth-validator-cli by TobiWo: CLI tool for managing validators via execution layer requests
-\nFeatures:
-- Consolidate ...
-...
-"
+ MSG_ABOUT=$'🔧 eth-validator-cli by TobiWo: CLI tool for managing validators via execution layer requests\n\nFeatures:\n- Consolidate one or multiple source validators to one target validator\n- Switch withdrawal credentials from type 0x01 to 0x02 (compounding) for one or multiple validators\n- Partially withdraw ETH from one or many validators\n- Exit one or many validators\n- This CLI currently only supports features from the Pectra hardfork.\n- Useful for batch validator operations.\n- ⚠️ Early-stage: use on testnets only!\n\nDocumentation: '"$DOCUMENTATION"$'\nSource Code: '"$SOURCE_CODE"$'\n\nContinue to install?'

---

1-2: 🛠️ Refactor suggestion

Enable strict mode for safer scripting

Adding strict mode (set -euo pipefail) and a safe IFS prevents silent failures, unbound variables, and word-splitting issues early in the script.

 #!/bin/bash
+set -euo pipefail
+IFS=$'\n\t'

plugins/eth-validator-cli/plugin_eth-validator-cli.sh (3)

131-135: Remove stray parenthesis in usage output

There's an extra ) on the "About" line that may confuse users.

- About $APP_NAME)
+ About $APP_NAME

---

14-17: Consistent naming: rename GITHUB_RELEASE_NODES to GITHUB_RELEASE_NOTES

NODES suggests a collection; NOTES better reflects that this is a link to the release notes page.

- GITHUB_RELEASE_NODES="https://github.com/TobiWo/eth-validator-cli/releases"
+ GITHUB_RELEASE_NOTES="https://github.com/TobiWo/eth-validator-cli/releases"

And update all references accordingly.

---

22-27: Check for required dependencies before execution

Fail early if curl, jq, wget, tar, or whiptail are missing:

function check_dependencies() {
  for cmd in curl jq wget tar whiptail; do
    command -v "$cmd" >/dev/null 2>&1 || { echo "Error: $cmd is required but not installed."; exit 1; }
  done
}
check_dependencies

This ensures users get a clear error rather than cryptic failures.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro