Auditor CLI

Install

The CLI needs Node.js 20 or later and has no dependencies. Run it with npx, or install it once:

npx @inferencebureau/auditor status

Every command works on the repository you are in, named from git's origin remote. Every command but review and repos takes --repo owner/name to name another, and every command takes --json to print the API's response. Exit codes: 0 done, 1 a review found something at or above --fail-on, 2 the command couldn't run (no key, a bad option, an API error) or a review stopped early.

Keys

The CLI reads its key from the IB_API_KEY environment variable and nowhere else: there is no flag for it and no .env file is read, so a key never lands in your shell history or a config file the CLI writes. Create one on a project's API Keys page in the console. It is shown once, so copy it straight into one of these:

export IB_API_KEY=ib_live_…
auditor status

Without it, every command stops with IB_API_KEY is not set. IB_BASE_URL points the CLI at another API origin; you will not normally need it.

auditor review works with any project key and is billed to it, and drift, templates and screenshot work with any key of the team. The commands that read or change the team's Auditor setup (repos, status, enable, disable, preview set, preview off, preview deploy and docs) need a key with Auditor Permissions ticked. Only owners and admins can create one. Such a key can switch repositories on and store store passwords, so keep it to the people and pipelines that set repositories up, and give a pipeline that only reviews an ordinary key. Each change it makes is in the team's audit log under the key.

Review local changes

The same review Auditor runs on a pull request runs on changes that are still on your machine. auditor review sends what differs from your base branch, uncommitted and untracked files included, to the review endpoint and prints the findings with file, line and suggested change. It works with any project key and is billed to it. Exit code 1 means a finding is at or above --fail-on (High by default) and 2 that the review couldn't run or stopped early (no key, the balance or a budget), so it works as a pre-push hook or a step a coding agent runs before it opens a pull request.

auditor review                       # everything that differs from origin's default branch
auditor review --staged              # only what is staged
auditor review --base develop        # compare with another branch or commit
auditor review --title "Retry failed payouts" --fail-on medium

Without --base, the base is origin's default branch, then a local main. --fail-on takes high, medium, low or never.

A local review always uses the standard depth and does not run static analysis. It reads .rules/ from your working tree, so you can try a rule before committing it. Your team's settings and enforced team rulesets always apply; when the repository is one Auditor reviews on GitHub, its documentation facts and the deep review's learnings apply too. A change can have up to 60 files and 3,000 changed lines. The files are not stored.

Set up a repository

Install the GitHub App on the repository first, from the console; the CLI cannot do that. Then:

auditor repos          # the team's repositories and what is on
auditor enable         # review this repository's pull requests
auditor status         # its setup and its last theme preview
auditor disable

Shopify theme previews

One command sets up theme previews with a Theme Access password: it is checked against the store, stored encrypted, and never shown again. Passwords are read from the environment or asked for, never taken as arguments, so they stay out of your shell history.

SHOPIFY_THEME_ACCESS_PASSWORD=shptka_… \
  auditor preview set --store inference-bureau.myshopify.com --enable-repo

preview set always turns previews on; otherwise only what you pass changes. A new store needs its Theme Access password in the same command; a storefront password can also come from SHOPIFY_STOREFRONT_PASSWORD. A repository that reaches its store through the team's Shopify sign-in is set up in the console.

Working with the store

These commands read the store the repository's previews deploy to, through the store tools of the inference-bureau MCP server. Any key of the team works, except for preview deploy, which needs Auditor Permissions.

auditor preview deploy --pr 42 --wait   # exits 1 when the deploy fails, 2 after 20 minutes

drift --write writes only files that differ, at their paths in the repository; review them with git diff. templates exits 1 when something is assigned to a template the theme does not have, and screenshot exits 1 when the page shows a Liquid error, so both can run in CI.

Shopify theme documentation

auditor docs on --max-run-usd 5 --no-regenerate-daily
auditor docs on --name "Inference Bureau theme" --no-captures --no-regenerate-push
auditor docs off

Theme documentation reads the store set for theme previews, so set that up first, even if previews stay off. The guide's address is in auditor status. Its logo, colours and pages are edited in the console.