@delegance/claude-autopilot 2.0.0 → 2.1.0

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [2.1.0] — 2026-04-22
+
+### Added
+- **Risk-weighted file ordering** (`src/core/chunking/risk-ranker.ts`) — ranks files before sending to LLM: protected paths (score 100) → auth/security (80) → payment/billing (70) → core logic (50) → config files (40) → everything else (30) → tests (10) → docs (5); ensures most sensitive code appears at the start of the LLM's context window
+- `BuildChunksInput.protectedPaths` — passed from config through review-phase to ranker so glob patterns from `protectedPaths:` config key are respected
+- 9 new tests for `rankByRisk` — **224 total**
+
 ## [2.0.0] — 2026-04-22
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@delegance/claude-autopilot",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "type": "module",
   "description": "Claude Code automation pipeline: spec → plan → implement → validate → PR",
   "keywords": [

package/src/core/chunking/index.ts

@@ -2,6 +2,7 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import type { ReviewEngine, ReviewInput } from '../../adapters/review-engine/types.ts';
 import type { AutopilotConfig } from '../config/types.ts';
+import { rankByRisk } from './risk-ranker.ts';
 
 export interface ReviewChunk {
   content: string;
@@ -15,6 +16,7 @@ export interface BuildChunksInput {
   chunking?: AutopilotConfig['chunking'];
   engine: ReviewEngine;
   cwd?: string;
+  protectedPaths?: string[];
 }
 
 const DEFAULT_SMALL_TIER_TOKENS = 8000;
@@ -24,7 +26,8 @@ export async function buildReviewChunks(input: BuildChunksInput): Promise<Review
   const smallMax = input.chunking?.smallTierMaxTokens ?? DEFAULT_SMALL_TIER_TOKENS;
   const fileMax = input.chunking?.perFileMaxTokens ?? DEFAULT_FILE_TIER_TOKENS;
 
-  const fileContents = await readFiles(input.touchedFiles, input.cwd);
+  const ranked = rankByRisk(input.touchedFiles, { protectedPaths: input.protectedPaths });
+  const fileContents = await readFiles(ranked, input.cwd);
 
   if (input.strategy === 'single-pass') {
     const combined = formatBatch(fileContents);

package/src/core/chunking/risk-ranker.ts

@@ -0,0 +1,56 @@
+import { minimatch } from 'minimatch';
+
+interface RankOptions {
+  protectedPaths?: string[];
+}
+
+const AUTH_PATTERNS = [
+  /auth/i, /login/i, /logout/i, /session/i, /token/i, /jwt/i, /oauth/i,
+  /password/i, /credential/i, /secret/i, /permission/i, /role/i, /acl/i,
+];
+
+const PAYMENT_PATTERNS = [
+  /payment/i, /billing/i, /stripe/i, /checkout/i, /invoice/i, /charge/i,
+  /subscription/i, /wallet/i, /transaction/i, /refund/i,
+];
+
+const CORE_PATTERNS = [
+  /\/services\//i, /\/core\//i, /\/api\//i, /\/routes?\//i,
+  /\/controllers?\//i, /\/models?\//i, /\/middleware\//i, /\/handlers?\//i,
+];
+
+const TEST_EXT = /\.(test|spec)\.[a-z]+$/i;
+const DOC_EXT = /\.(md|txt|rst|adoc)$/i;
+const CONFIG_EXT = /\.(ya?ml|json|toml|ini|env)$/i;
+const CONFIG_NAMES = /(config|settings|env|constants)\./i;
+
+function scoreFile(file: string, protectedPaths: string[]): number {
+  const norm = file.replace(/\\/g, '/');
+
+  // Protected paths are highest risk
+  for (const pattern of protectedPaths) {
+    if (minimatch(norm, pattern, { matchBase: false }) ||
+        minimatch(norm, pattern, { matchBase: true })) {
+      return 100;
+    }
+  }
+
+  if (TEST_EXT.test(norm)) return 10;
+  if (DOC_EXT.test(norm)) return 5;
+
+  if (AUTH_PATTERNS.some(p => p.test(norm))) return 80;
+  if (PAYMENT_PATTERNS.some(p => p.test(norm))) return 70;
+  if (CORE_PATTERNS.some(p => p.test(norm))) return 50;
+  if (CONFIG_EXT.test(norm) || CONFIG_NAMES.test(norm)) return 40;
+
+  return 30;
+}
+
+/**
+ * Returns files sorted highest-risk first so LLM sees the most sensitive code
+ * at the start of its context window.
+ */
+export function rankByRisk(files: string[], options: RankOptions = {}): string[] {
+  const protectedPaths = options.protectedPaths ?? [];
+  return [...files].sort((a, b) => scoreFile(b, protectedPaths) - scoreFile(a, protectedPaths));
+}

package/src/core/pipeline/review-phase.ts

@@ -34,6 +34,7 @@ export async function runReviewPhase(input: ReviewPhaseInput): Promise<ReviewPha
     chunking: input.config.chunking,
     engine: input.engine,
     cwd: input.cwd,
+    protectedPaths: input.config.protectedPaths,
   });
 
   const allFindings: Finding[] = [];