@review-my-code/rmcode 0.1.0-alpha.1 → 0.1.1

package/README.md

@@ -0,0 +1,29 @@
+# RMCode CLI
+
+Run Review My Code from your terminal.
+
+```bash
+npm install -g @review-my-code/rmcode
+rmcode login
+export RMC_API_KEY=rmc_...
+rmcode --staged
+```
+
+The CLI sends the selected diff, file, or stdin content to RMCode for analysis.
+Anonymous CLI reviews are disabled by default, so set `RMC_API_KEY` before
+running a review.
+
+## Common Commands
+
+```bash
+rmcode                 # review branch diff from merge base
+rmcode --staged        # review staged changes
+rmcode --unstaged      # review unstaged changes
+rmcode --all           # review uncommitted tracked changes and safe text files
+rmcode src/auth.ts     # review one file
+git diff main | rmcode --lang typescript
+rmcode --json --fail-on-findings
+```
+
+Use `RMC_API_URL` to point at a non-production API and `RMC_APP_URL` to point
+`rmcode login` at a non-production web app.

package/dist/cli.js

@@ -6,7 +6,13 @@ const fs_1 = require("fs");
 const path_1 = require("path");
 const readline_1 = require("readline");
 const API_URL = process.env.RMC_API_URL || "https://review-my-code.com";
-const VERSION = "0.1.0";
+const APP_URL = process.env.RMC_APP_URL || "https://review-my-code.com";
+const VERSION = "0.1.1";
+const FREE_PLAN_CREDITS_PER_MONTH = 30;
+const REQUEST_TIMEOUT_MS = 290_000;
+const POLL_TIMEOUT_MS = 10 * 60_000;
+const POLL_INTERVAL_MS = 2_000;
+const MAX_UNTRACKED_FILE_BYTES = 512 * 1024;
 // ── Colors (no dependencies) ──────────────────────────────────────────
 const c = {
     reset: "\x1b[0m",
@@ -15,15 +21,12 @@ const c = {
     red: "\x1b[31m",
     green: "\x1b[32m",
     yellow: "\x1b[33m",
-    blue: "\x1b[34m",
-    magenta: "\x1b[35m",
     cyan: "\x1b[36m",
     gray: "\x1b[90m",
     white: "\x1b[97m",
     bgRed: "\x1b[41m",
     bgYellow: "\x1b[43m",
     bgGreen: "\x1b[42m",
-    bgBlue: "\x1b[44m",
 };
 const isCI = process.env.CI === "true";
 const noColor = process.env.NO_COLOR === "1" || !process.stdout.isTTY;
@@ -44,63 +47,198 @@ function severityBadge(severity) {
     return style(` ${severity.toUpperCase()} `, c.dim);
 }
 // ── Git helpers ───────────────────────────────────────────────────────
-function gitDiff(staged) {
+function git(args) {
+    return (0, child_process_1.execFileSync)("git", args, {
+        encoding: "utf-8",
+        maxBuffer: 10 * 1024 * 1024,
+    }).trim();
+}
+function isGitRepo() {
     try {
-        const flag = staged ? "--cached" : "";
-        const diff = (0, child_process_1.execSync)(`git diff ${flag}`, { encoding: "utf-8", maxBuffer: 5 * 1024 * 1024 });
-        return diff.trim() || null;
+        git(["rev-parse", "--is-inside-work-tree"]);
+        return true;
     }
     catch {
-        return null;
+        return false;
     }
 }
-function gitStagedFiles() {
+function gitWorktreeRoot() {
+    return git(["rev-parse", "--show-toplevel"]);
+}
+function mergeBase() {
+    const refs = [];
     try {
-        return (0, child_process_1.execSync)("git diff --cached --name-only", { encoding: "utf-8" }).trim().split("\n").filter(Boolean);
+        refs.push(git(["symbolic-ref", "--short", "refs/remotes/origin/HEAD"]));
     }
     catch {
-        return [];
+        // Remote HEAD is not available.
+    }
+    for (const ref of [
+        ...refs,
+        "origin/main",
+        "origin/master",
+        "main",
+        "master",
+    ]) {
+        try {
+            git(["rev-parse", "--verify", ref]);
+            return git(["merge-base", ref, "HEAD"]);
+        }
+        catch {
+            // Try the next common default branch ref.
+        }
     }
+    throw new Error("Could not determine a base branch. Set an upstream branch, or run rmcode --staged, rmcode --all, or pipe an explicit git diff.");
 }
-function gitUnstagedFiles() {
+function diffFromMergeBase() {
+    const base = mergeBase();
+    const diff = git(["diff", `${base}...HEAD`]);
+    const files = git(["diff", `${base}...HEAD`, "--name-only"])
+        .split("\n")
+        .filter(Boolean);
+    return { diff, files };
+}
+function diffStaged() {
+    const diff = git(["diff", "--cached"]);
+    const files = git(["diff", "--cached", "--name-only"])
+        .split("\n")
+        .filter(Boolean);
+    return { diff, files };
+}
+function diffUnstaged() {
+    const diff = git(["diff"]);
+    const files = git(["diff", "--name-only"]).split("\n").filter(Boolean);
+    return { diff, files };
+}
+function diffAll() {
+    const root = gitWorktreeRoot();
+    const trackedDiff = git(["diff", "HEAD"]);
+    const trackedFiles = git(["diff", "HEAD", "--name-only"])
+        .split("\n")
+        .filter(Boolean);
+    const untrackedFiles = git(["ls-files", "--others", "--exclude-standard"])
+        .split("\n")
+        .filter(Boolean);
+    const untrackedDiffs = untrackedFiles
+        .map((file) => pseudoDiffForNewFile(file, root))
+        .filter(Boolean);
+    const diff = [trackedDiff, ...untrackedDiffs].filter(Boolean).join("\n\n");
+    const files = [...trackedFiles, ...untrackedFiles];
+    return { diff, files };
+}
+function pseudoDiffForNewFile(file, worktreeRoot) {
     try {
-        return (0, child_process_1.execSync)("git diff --name-only", { encoding: "utf-8" }).trim().split("\n").filter(Boolean);
+        if ((0, path_1.isAbsolute)(file))
+            return "";
+        const stat = (0, fs_1.lstatSync)(file);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return "";
+        if (stat.size > MAX_UNTRACKED_FILE_BYTES)
+            return "";
+        const realRoot = (0, fs_1.realpathSync)(worktreeRoot);
+        const realFile = (0, fs_1.realpathSync)(file);
+        const rel = (0, path_1.relative)(realRoot, realFile);
+        if (rel.startsWith("..") || (0, path_1.isAbsolute)(rel))
+            return "";
+        const contents = (0, fs_1.readFileSync)(realFile, "utf-8");
+        if (contents.includes("\0"))
+            return "";
+        const added = contents
+            .split("\n")
+            .map((line) => `+${line}`)
+            .join("\n");
+        return `diff --git a/${file} b/${file}\nnew file mode 100644\n--- /dev/null\n+++ b/${file}\n@@ -0,0 +1,${contents.split("\n").length} @@\n${added}`;
     }
     catch {
-        return [];
+        return "";
     }
 }
-function isGitRepo() {
+function gitRepoName() {
     try {
-        (0, child_process_1.execSync)("git rev-parse --is-inside-work-tree", { encoding: "utf-8", stdio: "pipe" });
-        return true;
+        const remote = git(["remote", "get-url", "origin"]);
+        const m = remote.match(/github\.com[:/]([^/]+\/[^/.]+)/);
+        return m ? m[1] : null;
     }
     catch {
-        return false;
+        return null;
     }
 }
-function gitRepoName() {
+function currentBranch() {
     try {
-        const remote = (0, child_process_1.execSync)("git remote get-url origin", {
-            encoding: "utf-8",
-            stdio: ["pipe", "pipe", "pipe"],
-        }).trim();
-        const httpsMatch = remote.match(/github\.com\/([^/]+\/[^/.]+)/);
-        if (httpsMatch)
-            return httpsMatch[1];
-        const sshMatch = remote.match(/github\.com:([^/]+\/[^/.]+)/);
-        if (sshMatch)
-            return sshMatch[1];
-        return null;
+        return git(["branch", "--show-current"]);
     }
     catch {
-        return null;
+        return "unknown";
+    }
+}
+function filesFromDiff(diff) {
+    const files = new Set();
+    const re = /^diff --git a\/.+ b\/(.+)$/gm;
+    let match;
+    while ((match = re.exec(diff)) !== null) {
+        files.add(match[1]);
+    }
+    return [...files];
+}
+function looksLikeUnifiedDiff(value) {
+    return value.startsWith("diff --git ") || /\n@@ -\d/.test(value);
+}
+function hasPipedStdin() {
+    if (process.stdin.isTTY)
+        return false;
+    try {
+        const stat = (0, fs_1.fstatSync)(0);
+        return stat.isFIFO() || stat.isFile() || stat.isSocket();
+    }
+    catch {
+        return false;
     }
 }
 const API_KEY = process.env.RMC_API_KEY || null;
+async function fetchReviewJson(url, init) {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);
+    try {
+        const resp = await fetch(url, { ...init, signal: controller.signal });
+        const text = await resp.text();
+        let body;
+        try {
+            body = text ? JSON.parse(text) : { success: false };
+        }
+        catch {
+            body = {
+                success: false,
+                error: `RMCode API returned a non-JSON response (${resp.status}).`,
+                code: "RMC-5000",
+            };
+        }
+        if (!resp.ok && body.success !== false) {
+            body = {
+                ...body,
+                success: false,
+                error: body.error || `RMCode API request failed (${resp.status}).`,
+            };
+        }
+        return { status: resp.status, body };
+    }
+    catch (error) {
+        const message = error instanceof Error && error.name === "AbortError"
+            ? "RMCode API request timed out."
+            : error instanceof Error
+                ? error.message
+                : "RMCode API request failed.";
+        return {
+            status: 0,
+            body: { success: false, error: message, code: "RMC-5000" },
+        };
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
 async function callAuthenticatedAPI(code, language, type, files) {
     const repo = gitRepoName();
-    const resp = await fetch(`${API_URL}/api/reviews/cli`, {
+    const { status, body } = await fetchReviewJson(`${API_URL}/api/reviews/cli`, {
         method: "POST",
         headers: {
             "Content-Type": "application/json",
@@ -108,54 +246,89 @@ async function callAuthenticatedAPI(code, language, type, files) {
         },
         body: JSON.stringify({ type, value: code, language, files, repo }),
     });
-    return resp.json();
+    if (status === 202 && body.data?.accessToken) {
+        return pollForResults(`${API_URL}/api/reviews/cli/${body.data.accessToken}`, body.meta, { "X-API-Key": API_KEY });
+    }
+    return body;
 }
-async function callAnonymousAPI(code, language) {
+async function callAnonymousAPI(code, language, type, files) {
     const repo = gitRepoName();
-    const resp = await fetch(`${API_URL}/api/reviews/anonymous`, {
+    const { status, body } = await fetchReviewJson(`${API_URL}/api/reviews/anonymous`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ type: "snippet", value: code, language, repo }),
+        body: JSON.stringify({ type, value: code, language, files, repo }),
     });
-    const result = (await resp.json());
-    // Handle 202 polling
-    if (resp.status === 202 && result.data?.accessToken) {
-        return pollForResults(result.data.accessToken, result.meta);
+    if (status === 202 && body.data?.accessToken) {
+        return pollForResults(`${API_URL}/api/reviews/anonymous/${body.data.accessToken}`, body.meta);
     }
-    return result;
+    return body;
 }
-async function pollForResults(accessToken, initialMeta) {
-    const deadline = Date.now() + 60_000;
+async function pollForResults(url, initialMeta, headers) {
+    const deadline = Date.now() + POLL_TIMEOUT_MS;
     while (Date.now() < deadline) {
-        await new Promise((r) => setTimeout(r, 2000));
-        const resp = await fetch(`${API_URL}/api/reviews/anonymous/${accessToken}`);
-        const result = (await resp.json());
-        if (result.data?.status === "completed" || result.data?.status === "failed") {
-            if (initialMeta && !result.meta)
-                result.meta = initialMeta;
-            return result;
+        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+        const { status, body } = await fetchReviewJson(url, { headers });
+        if (status >= 400 || body.success === false) {
+            if (initialMeta && !body.meta)
+                body.meta = initialMeta;
+            return body;
+        }
+        if (body.data?.status === "completed" || body.data?.status === "failed") {
+            if (initialMeta && !body.meta)
+                body.meta = initialMeta;
+            return body;
         }
     }
-    return { success: false, error: "Review timed out after 60 seconds." };
+    return { success: false, error: "Review timed out after 10 minutes." };
 }
 function callAPI(code, language, type = "snippet", files = []) {
-    if (API_KEY) {
+    if (API_KEY)
         return callAuthenticatedAPI(code, language, type, files);
-    }
-    return callAnonymousAPI(code, language);
+    return Promise.resolve({
+        success: false,
+        error: "API key required. Run `rmcode login`, then set RMC_API_KEY before sending code for review.",
+        code: "RMC-1002",
+        meta: {
+            plan: null,
+            reviewer: "scout",
+            message: "Anonymous CLI reviews are disabled so your credits stay tied to your RMCode account.",
+        },
+    });
 }
 // ── Language detection ────────────────────────────────────────────────
 const EXT_TO_LANG = {
-    ".ts": "typescript", ".tsx": "typescript", ".js": "javascript", ".jsx": "javascript",
-    ".py": "python", ".java": "java", ".go": "go", ".rs": "rust",
-    ".c": "c", ".cpp": "cpp", ".h": "c", ".cs": "csharp",
-    ".rb": "ruby", ".php": "php", ".swift": "swift", ".kt": "kotlin",
-    ".scala": "scala", ".lua": "lua", ".dart": "dart",
-    ".v": "verilog", ".sv": "verilog", ".vhd": "vhdl",
-    ".glsl": "glsl", ".hlsl": "hlsl", ".wgsl": "wgsl",
-    ".jl": "julia", ".r": "r", ".ex": "elixir", ".erl": "erlang",
-    ".hs": "haskell", ".ml": "ocaml", ".fs": "fsharp",
-    ".sh": "bash", ".zig": "zig", ".sol": "solidity",
+    ".ts": "typescript",
+    ".tsx": "typescript",
+    ".js": "javascript",
+    ".jsx": "javascript",
+    ".py": "python",
+    ".java": "java",
+    ".go": "go",
+    ".rs": "rust",
+    ".c": "c",
+    ".cpp": "cpp",
+    ".h": "c",
+    ".cs": "csharp",
+    ".rb": "ruby",
+    ".php": "php",
+    ".swift": "swift",
+    ".kt": "kotlin",
+    ".scala": "scala",
+    ".lua": "lua",
+    ".dart": "dart",
+    ".v": "verilog",
+    ".sv": "verilog",
+    ".vhd": "vhdl",
+    ".sh": "bash",
+    ".zig": "zig",
+    ".sol": "solidity",
+    ".jl": "julia",
+    ".r": "r",
+    ".ex": "elixir",
+    ".erl": "erlang",
+    ".hs": "haskell",
+    ".ml": "ocaml",
+    ".fs": "fsharp",
 };
 function detectLanguage(files) {
     for (const f of files) {
@@ -166,33 +339,30 @@ function detectLanguage(files) {
     return "javascript";
 }
 // ── Output formatting ─────────────────────────────────────────────────
-function printFindings(findings, jsonMode) {
-    if (jsonMode) {
-        console.log(JSON.stringify(findings, null, 2));
-        return;
-    }
+function printFindings(findings) {
     if (findings.length === 0) {
         console.log(`\n  ${style("No issues found.", c.green, c.bold)} Your code looks good.\n`);
         return;
     }
     const counts = {};
-    for (const f of findings) {
+    for (const f of findings)
         counts[f.severity] = (counts[f.severity] || 0) + 1;
-    }
-    const summary = Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(" · ");
+    const summary = Object.entries(counts)
+        .map(([k, v]) => `${v} ${k}`)
+        .join(" · ");
     console.log(`\n  ${style(`${findings.length} finding${findings.length !== 1 ? "s" : ""}`, c.bold, c.white)} · ${summary}\n`);
     for (const f of findings) {
-        const location = f.filePath ? `${style(f.filePath, c.cyan)}${f.line ? `:${f.line}` : ""}` : "";
+        const location = f.filePath
+            ? `${style(f.filePath, c.cyan)}${f.line ? `:${f.line}` : ""}`
+            : "";
         console.log(`  ${severityBadge(f.severity)} ${style(f.title, c.bold, c.white)}`);
         if (location)
             console.log(`  ${style("at", c.dim)} ${location}`);
         console.log(`  ${style(f.explanation, c.gray)}`);
-        if (f.codeContext) {
+        if (f.codeContext)
             console.log(`  ${style(f.codeContext, c.dim)}`);
-        }
-        if (f.suggestedCode) {
+        if (f.suggestedCode)
             console.log(`  ${style("fix:", c.green)} ${style(f.suggestedCode, c.green)}`);
-        }
         console.log();
     }
 }
@@ -203,30 +373,33 @@ function printMeta(meta) {
     if (meta.reviewer)
         parts.push(meta.reviewer.charAt(0).toUpperCase() + meta.reviewer.slice(1));
     if (meta.plan) {
-        const planLabel = meta.plan.charAt(0).toUpperCase() + meta.plan.slice(1);
-        if (meta.creditsRemaining != null) {
-            parts.push(`${planLabel} (${meta.creditsRemaining} credits remaining)`);
-        }
-        else {
-            parts.push(planLabel);
-        }
+        const label = meta.plan.charAt(0).toUpperCase() + meta.plan.slice(1);
+        parts.push(meta.creditsRemaining != null
+            ? `${label} (${meta.creditsRemaining} cr left)`
+            : label);
     }
-    if (meta.quotaUsed) {
-        parts.push(`Free review (${meta.quotaUsed} today)`);
-    }
-    if (parts.length > 0) {
+    if (parts.length > 0)
         console.log(`  ${style(parts.join(" · "), c.dim)}`);
-    }
-    if (meta.message) {
+    if (meta.message)
         console.log(`  ${style(meta.message, c.yellow)}`);
-    }
+}
+function printJsonResponse(result) {
+    console.log(JSON.stringify(result, null, 2));
+}
+function hasBlockingFindings(result) {
+    const findings = result.data?.findings?.findings || [];
+    return (findings.length > 0 || result.data?.findings?.verdict === "request_changes");
 }
 // ── Spinner ───────────────────────────────────────────────────────────
 function createSpinner(msg) {
     if (noColor || isCI) {
         process.stderr.write(`  ${msg}...\n`);
-        return { stop: (final) => { if (final)
-                process.stderr.write(`  ${final}\n`); } };
+        return {
+            stop: (final) => {
+                if (final)
+                    process.stderr.write(`  ${final}\n`);
+            },
+        };
     }
     const frames = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
     let i = 0;
@@ -240,104 +413,30 @@ function createSpinner(msg) {
         },
     };
 }
-// ── Commands ──────────────────────────────────────────────────────────
-async function reviewDiff(staged, jsonMode) {
-    if (!isGitRepo()) {
-        console.error(style("  Not a git repository.", c.red));
-        process.exit(1);
-    }
-    const files = staged ? gitStagedFiles() : gitUnstagedFiles();
-    const diff = gitDiff(staged);
-    if (!diff) {
-        const which = staged ? "staged" : "unstaged";
-        console.error(style(`  No ${which} changes found.`, c.yellow));
-        if (!staged && gitStagedFiles().length > 0) {
-            console.error(style("  Try: rmcode --staged", c.dim));
-        }
-        process.exit(0);
-    }
-    const lang = detectLanguage(files);
-    const spinner = createSpinner(`Reviewing ${files.length} file${files.length !== 1 ? "s" : ""} (${lang})`);
-    try {
-        const result = await callAPI(diff, lang, "diff", files);
-        spinner.stop(`Reviewed ${files.length} file${files.length !== 1 ? "s" : ""}`);
-        if (!result.success) {
-            console.error(style(`  ${result.error || "Review failed."}`, c.red));
-            if (result.meta?.message) {
-                console.log(`  ${style(result.meta.message, c.yellow)}`);
-            }
-            process.exit(1);
-        }
-        if (!jsonMode)
-            printMeta(result.meta);
-        if (result.data?.findings?.findings) {
-            printFindings(result.data.findings.findings, jsonMode);
-        }
-    }
-    catch (err) {
-        spinner.stop("Review failed");
-        console.error(style(`  ${err.message}`, c.red));
-        process.exit(1);
-    }
-}
-async function reviewFile(filePath, jsonMode) {
-    const resolved = (0, path_1.resolve)(filePath);
-    if (!(0, fs_1.existsSync)(resolved)) {
-        console.error(style(`  File not found: ${filePath}`, c.red));
-        process.exit(1);
-    }
-    const content = (0, fs_1.readFileSync)(resolved, "utf-8");
-    const ext = (0, path_1.extname)(filePath).toLowerCase();
-    const lang = EXT_TO_LANG[ext] || "javascript";
-    const spinner = createSpinner(`Reviewing ${(0, path_1.basename)(filePath)} (${lang})`);
+// ── Review runner ─────────────────────────────────────────────────────
+async function runReview(content, files, label, jsonMode, failOnFindings, type = "diff", language) {
+    const lang = language || detectLanguage(files);
+    const spinner = createSpinner(`Reviewing ${label} (${files.length} file${files.length !== 1 ? "s" : ""}, ${lang})`);
     try {
-        const result = await callAPI(content, lang, "file", [filePath]);
-        spinner.stop(`Reviewed ${(0, path_1.basename)(filePath)}`);
-        if (!result.success) {
-            console.error(style(`  ${result.error || "Review failed."}`, c.red));
-            if (result.meta?.message) {
-                console.log(`  ${style(result.meta.message, c.yellow)}`);
-            }
-            process.exit(1);
-        }
-        if (!jsonMode)
-            printMeta(result.meta);
-        if (result.data?.findings?.findings) {
-            printFindings(result.data.findings.findings, jsonMode);
+        const result = await callAPI(content, lang, type, files);
+        spinner.stop(`Reviewed ${label}`);
+        if (jsonMode) {
+            printJsonResponse(result);
+            if (!result.success)
+                process.exit(1);
+            if (failOnFindings && hasBlockingFindings(result))
+                process.exit(2);
+            return;
         }
-    }
-    catch (err) {
-        spinner.stop("Review failed");
-        console.error(style(`  ${err.message}`, c.red));
-        process.exit(1);
-    }
-}
-async function reviewStdin(lang, jsonMode) {
-    const rl = (0, readline_1.createInterface)({ input: process.stdin });
-    const lines = [];
-    for await (const line of rl)
-        lines.push(line);
-    const code = lines.join("\n");
-    if (!code.trim()) {
-        console.error(style("  No input received on stdin.", c.red));
-        process.exit(1);
-    }
-    const spinner = createSpinner(`Reviewing stdin (${lang})`);
-    try {
-        const result = await callAPI(code, lang, "snippet", []);
-        spinner.stop("Reviewed stdin");
         if (!result.success) {
             console.error(style(`  ${result.error || "Review failed."}`, c.red));
-            if (result.meta?.message) {
+            if (result.meta?.message)
                 console.log(`  ${style(result.meta.message, c.yellow)}`);
-            }
             process.exit(1);
         }
-        if (!jsonMode)
-            printMeta(result.meta);
-        if (result.data?.findings?.findings) {
-            printFindings(result.data.findings.findings, jsonMode);
-        }
+        printMeta(result.meta);
+        if (result.data?.findings?.findings)
+            printFindings(result.data.findings.findings);
     }
     catch (err) {
         spinner.stop("Review failed");
@@ -345,48 +444,71 @@ async function reviewStdin(lang, jsonMode) {
         process.exit(1);
     }
 }
-// ── Help & Version ────────────────────────────────────────────────────
+// ── Help ──────────────────────────────────────────────────────────────
 function printHelp() {
     console.log(`
-  ${style("rmcode", c.bold, c.green)} — AI code review from your terminal
+  ${style("rmcode", c.bold, c.green)} ${style(`v${VERSION}`, c.dim)} — AI code review from your terminal
 
-  ${style("USAGE", c.bold)}
+  ${style("COMMANDS", c.bold)}
 
-    ${style("rmcode", c.cyan)}                   Review unstaged changes
-    ${style("rmcode --staged", c.cyan)}           Review staged changes
-    ${style("rmcode file.ts", c.cyan)}            Review a specific file
-    ${style("cat file.ts | rmcode", c.cyan)}      Review from stdin
+    ${style("rmcode", c.cyan)}                   Review changes from merge base (default)
+    ${style("rmcode --staged", c.cyan)}           Review staged changes only
+    ${style("rmcode --unstaged", c.cyan)}         Review unstaged changes only
+    ${style("rmcode --all", c.cyan)}              Review all uncommitted changes (staged + unstaged)
+    ${style("rmcode <file>", c.cyan)}             Review a single local file
     ${style("rmcode login", c.cyan)}              Set up your API key
-    ${style("rmcode install", c.cyan)}            Install the GitHub App for PR reviews
+    ${style("rmcode install", c.cyan)}            Install the GitHub App for automatic PR reviews
+    ${style("rmcode help", c.cyan)}               Show this help
 
   ${style("OPTIONS", c.bold)}
 
-    --staged             Review staged (git add) changes only
-    --deep               Deep multi-pass review (coming soon)
-    --json               Output findings as JSON (for agents/CI)
-    --lang <language>     Language hint for stdin input
+    --json               Output the full API response as JSON (for CI/agents)
+    --fail-on-findings   Exit 2 when JSON output contains findings
+    --lang <language>    Language hint for stdin input
     --help, -h           Show this help
     --version, -v        Show version
 
+  ${style("MODES", c.bold)}
+
+    ${style("Default", c.white)}    Diff from merge base to HEAD — what your PR would contain
+    ${style("--staged", c.white)}   Only changes in the staging area (git add)
+    ${style("--unstaged", c.white)} Only working directory changes not yet staged
+    ${style("--all", c.white)}      Everything not yet committed, including untracked text files
+    ${style("file", c.white)}       A single local file
+    ${style("stdin", c.white)}      Pipe any diff or code: ${style("git diff main | rmcode", c.dim)}
+
   ${style("EXAMPLES", c.bold)}
 
-    ${style("# Review your work before committing", c.dim)}
+    ${style("# Review your branch before opening a PR", c.dim)}
+    rmcode
+
+    ${style("# Review only what you're about to commit", c.dim)}
     rmcode --staged
 
-    ${style("# Let an AI agent review its own code", c.dim)}
-    rmcode --staged --json
+    ${style("# Review a specific range", c.dim)}
+    git diff abc123..def456 | rmcode --lang typescript
 
-    ${style("# Review a file directly", c.dim)}
-    rmcode src/auth/login.ts
+    ${style("# Review one file", c.dim)}
+    rmcode src/auth.ts
 
-    ${style("# Pipe from another command", c.dim)}
-    git diff main | rmcode --lang typescript
+    ${style("# JSON output for CI pipeline", c.dim)}
+    rmcode --json
 
-    ${style("# Set up authenticated reviews (30/month free)", c.dim)}
+    ${style(`# Set up authenticated reviews (${FREE_PLAN_CREDITS_PER_MONTH} credits/month free)`, c.dim)}
     rmcode login
 
-    ${style("# Auto-review every PR on GitHub", c.dim)}
-    rmcode install
+  ${style("ENVIRONMENT", c.bold)}
+
+    RMC_API_KEY          API key for authenticated reviews (get one: rmcode login)
+    RMC_API_URL          API endpoint (default: https://review-my-code.com)
+    RMC_APP_URL          App URL for login (default: https://review-my-code.com)
+
+  ${style("PRIVACY", c.bold)}
+
+    CLI reviews run locally to collect your diff/file/stdin content, then send that
+    review content to RMCode's backend and model providers for analysis. For
+    automatic PR reviews, install the GitHub App; that path uses the repository's
+    GitHub Actions runner to produce review context.
 
   ${style("https://review-my-code.com", c.dim)}
 `);
@@ -394,28 +516,59 @@ function printHelp() {
 // ── Version check ─────────────────────────────────────────────────────
 async function checkForUpdate() {
     try {
-        const resp = await fetch("https://registry.npmjs.org/rmcode/latest", {
+        const resp = await fetch("https://registry.npmjs.org/@review-my-code/rmcode/latest", {
             signal: AbortSignal.timeout(3000),
         });
         if (!resp.ok)
             return;
-        const data = await resp.json();
-        const latest = data.version;
-        if (latest && latest !== VERSION) {
-            console.log(style(`\n  Update available: ${VERSION} → ${latest}`, c.yellow));
-            console.log(style(`  Run: npm install -g rmcode\n`, c.dim));
+        const data = (await resp.json());
+        if (data.version && data.version !== VERSION) {
+            console.log(style(`\n  Update available: ${VERSION} → ${data.version}`, c.yellow));
+            console.log(style(`  Run: npm install -g @review-my-code/rmcode\n`, c.dim));
         }
     }
     catch {
-        // Silent fail — don't block the review
+        /* silent */
     }
 }
+function parseArgs(args) {
+    const flags = new Set();
+    const options = {};
+    const positional = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === "--lang") {
+            options.lang = args[i + 1];
+            i++;
+        }
+        else if (arg.startsWith("-")) {
+            flags.add(arg);
+        }
+        else {
+            positional.push(arg);
+        }
+    }
+    return { flags, options, positional };
+}
+function unknownFlags(flags) {
+    const known = new Set([
+        "--all",
+        "--fail-on-findings",
+        "--help",
+        "-h",
+        "--json",
+        "--staged",
+        "--unstaged",
+        "--version",
+        "-v",
+    ]);
+    return [...flags].filter((flag) => !known.has(flag));
+}
 // ── Main ──────────────────────────────────────────────────────────────
 async function main() {
     const args = process.argv.slice(2);
-    const flags = new Set(args.filter((a) => a.startsWith("-")));
-    const positional = args.filter((a) => !a.startsWith("-"));
-    if (flags.has("--help") || flags.has("-h")) {
+    const { flags, options, positional } = parseArgs(args);
+    if (flags.has("--help") || flags.has("-h") || positional[0] === "help") {
         printHelp();
         return;
     }
@@ -423,65 +576,165 @@ async function main() {
         console.log(`rmcode v${VERSION}`);
         return;
     }
-    const jsonMode = flags.has("--json");
-    const staged = flags.has("--staged");
-    // rmc install
+    const invalidFlags = unknownFlags(flags);
+    if (invalidFlags.length > 0) {
+        console.error(style(`\n  Unknown option: ${invalidFlags[0]}`, c.red));
+        console.error(style(`  Run: rmcode help\n`, c.dim));
+        process.exit(1);
+    }
     if (positional[0] === "install") {
         console.log(`\n  ${style("Install the GitHub App for automatic PR reviews:", c.bold)}\n`);
         console.log(`  ${style("https://github.com/apps/rmcode-ai", c.cyan, c.bold)}\n`);
-        console.log(`  ${style("Once installed, RMCode AI reviews every PR automatically.", c.dim)}\n`);
+        console.log(`  ${style("Install from the same GitHub account linked in RMCode so PR reviews share your plan credits.", c.dim)}`);
+        console.log(`  ${style("The app uses a GitHub Actions workflow in your repo for context extraction.", c.dim)}`);
+        console.log(`  ${style("If that workflow cannot be created or dispatched, the PR check fails until setup is fixed.", c.dim)}\n`);
         return;
     }
-    // rmc login
     if (positional[0] === "login") {
-        const url = `${API_URL}/api-keys`;
+        const url = `${APP_URL}/api-keys`;
         console.log(`\n  ${style("Opening your browser to create an API key...", c.bold)}\n`);
         try {
             const openCmd = process.platform === "darwin"
                 ? "open"
                 : process.platform === "win32"
-                    ? "start"
+                    ? "cmd"
                     : "xdg-open";
-            (0, child_process_1.execSync)(`${openCmd} ${url}`, { stdio: "ignore" });
+            const openArgs = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+            (0, child_process_1.execFileSync)(openCmd, openArgs, { stdio: "ignore" });
         }
         catch {
-            console.log(`  ${style("Could not open browser. Visit this URL:", c.yellow)}`);
+            console.log(`  ${style("Could not open browser. Visit:", c.yellow)}`);
         }
         console.log(`  ${style(url, c.cyan, c.bold)}\n`);
         console.log(`  ${style("Then set your API key:", c.dim)}`);
-        console.log(`  ${style("export RMC_API_KEY=rmc_k_...", c.green)}\n`);
+        console.log(`  ${style("export RMC_API_KEY=rmc_...", c.green)}\n`);
         return;
     }
-    // --deep stub
-    if (flags.has("--deep")) {
-        console.log(`\n  ${style("Deep review is coming soon.", c.yellow)}`);
-        console.log(`  ${style("Scout review is available now — just run: rmcode --staged", c.dim)}\n`);
-        return;
+    const jsonMode = flags.has("--json");
+    const failOnFindings = flags.has("--fail-on-findings");
+    if (positional.length > 1) {
+        console.error(style(`\n  Unknown command: ${positional[0]}`, c.red));
+        console.error(style(`  Run: rmcode help\n`, c.dim));
+        process.exit(1);
     }
-    console.log(`\n  ${style("rmcode", c.green, c.bold)} ${style(`v${VERSION}`, c.dim)}`);
-    // rmc file.ts
-    if (positional.length > 0 && (0, fs_1.existsSync)((0, path_1.resolve)(positional[0]))) {
-        await reviewFile(positional[0], jsonMode);
-        return;
+    if (!jsonMode) {
+        console.log(`\n  ${style("rmcode", c.green, c.bold)} ${style(`v${VERSION}`, c.dim)}`);
     }
     // Piped stdin
-    if (!process.stdin.isTTY) {
-        const langIdx = args.indexOf("--lang");
-        const lang = langIdx >= 0 && args[langIdx + 1] ? args[langIdx + 1] : "javascript";
-        await reviewStdin(lang, jsonMode);
+    if (hasPipedStdin()) {
+        const lang = options.lang || "javascript";
+        const rl = (0, readline_1.createInterface)({ input: process.stdin });
+        const lines = [];
+        for await (const line of rl)
+            lines.push(line);
+        const code = lines.join("\n");
+        if (!code.trim()) {
+            console.error(style("  No input received on stdin.", c.red));
+            process.exit(1);
+        }
+        const spinner = createSpinner(`Reviewing stdin (${lang})`);
+        try {
+            const stdinType = looksLikeUnifiedDiff(code) ? "diff" : "snippet";
+            const stdinFiles = stdinType === "diff" ? filesFromDiff(code) : [];
+            const result = await callAPI(code, lang, stdinType, stdinFiles);
+            spinner.stop("Reviewed stdin");
+            if (jsonMode) {
+                printJsonResponse(result);
+                if (!result.success)
+                    process.exit(1);
+                if (failOnFindings && hasBlockingFindings(result))
+                    process.exit(2);
+                return;
+            }
+            if (!result.success) {
+                console.error(style(`  ${result.error || "Review failed."}`, c.red));
+                process.exit(1);
+            }
+            printMeta(result.meta);
+            if (result.data?.findings?.findings)
+                printFindings(result.data.findings.findings);
+        }
+        catch (err) {
+            spinner.stop("Review failed");
+            console.error(style(`  ${err.message}`, c.red));
+            process.exit(1);
+        }
         return;
     }
-    // Default: review git diff
-    await reviewDiff(staged, jsonMode);
+    if (positional.length === 1) {
+        const file = positional[0];
+        let code;
+        try {
+            code = (0, fs_1.readFileSync)(file, "utf-8");
+        }
+        catch (err) {
+            console.error(style(`  Could not read ${file}: ${err.message}`, c.red));
+            process.exit(1);
+        }
+        if (!code.trim()) {
+            console.error(style(`  ${file} is empty.`, c.yellow));
+            process.exit(0);
+        }
+        await runReview(code, [file], file, jsonMode, failOnFindings, "file", detectLanguage([file]));
+        if (!jsonMode)
+            await checkForUpdate();
+        return;
+    }
+    // Git modes
+    if (!isGitRepo()) {
+        console.error(style("  Not a git repository. Run from inside a git repo.", c.red));
+        process.exit(1);
+    }
+    const branch = currentBranch();
+    let diff;
+    let files;
+    let label;
+    if (flags.has("--staged")) {
+        ({ diff, files } = diffStaged());
+        label = "staged changes";
+        if (!diff) {
+            console.error(style("  No staged changes. Stage files with: git add <files>", c.yellow));
+            process.exit(0);
+        }
+    }
+    else if (flags.has("--unstaged")) {
+        ({ diff, files } = diffUnstaged());
+        label = "unstaged changes";
+        if (!diff) {
+            console.error(style("  No unstaged changes.", c.yellow));
+            process.exit(0);
+        }
+    }
+    else if (flags.has("--all")) {
+        ({ diff, files } = diffAll());
+        label = "all uncommitted changes";
+        if (!diff) {
+            console.error(style("  No uncommitted changes.", c.yellow));
+            process.exit(0);
+        }
+    }
+    else {
+        ({ diff, files } = diffFromMergeBase());
+        label = `branch ${style(branch, c.cyan)} vs base`;
+        if (!diff) {
+            console.error(style("  No changes from merge base. Your branch matches main.", c.yellow));
+            process.exit(0);
+        }
+    }
+    await runReview(diff, files, label, jsonMode, failOnFindings);
     if (!jsonMode && !API_KEY) {
-        console.log(style("  Get 30 reviews/month free: rmcode login", c.dim));
+        console.log(style(`  Get ${FREE_PLAN_CREDITS_PER_MONTH} credits/month free: rmcode login`, c.dim));
         console.log(style("  Auto-review every PR: rmcode install", c.dim));
         console.log();
     }
-    // Non-blocking update check after review completes
-    await checkForUpdate();
+    if (!jsonMode)
+        await checkForUpdate();
 }
-main().catch((err) => {
+main()
+    .then(() => {
+    process.exit(process.exitCode ?? 0);
+})
+    .catch((err) => {
     console.error(style(`  Fatal: ${err.message}`, c.red));
     process.exit(1);
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@review-my-code/rmcode",
-  "version": "0.1.0-alpha.1",
+  "version": "0.1.1",
   "description": "AI code review from your terminal. Catches logic errors, null risks, security holes, and broken error handling.",
   "keywords": [
     "code-review",
@@ -17,7 +17,8 @@
     "rmc": "dist/cli.js"
   },
   "files": [
-    "dist"
+    "dist",
+    "README.md"
   ],
   "scripts": {
     "build": "tsc",
@@ -34,9 +35,13 @@
     "node": ">=18"
   },
   "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
   "repository": {
     "type": "git",
-    "url": "https://github.com/review-my-code/review-my-code"
+    "url": "git+https://github.com/review-my-code/review-my-code.git",
+    "directory": "cli"
   },
   "homepage": "https://review-my-code.com",
   "author": "Alex Yang"