codeant-cli 0.5.11 → 0.5.13

package/README.md

@@ -16,8 +16,11 @@ For installation, authentication, and self-hosted setup, see the [CodeAnt CLI se
 # Login to CodeAnt
 codeant login
 
-# Scan staged files for secrets
+# Scan your changes for secrets
 codeant secrets
+
+# Review your changes
+codeant review
 ```
 
 ## Usage
@@ -56,10 +59,14 @@ codeant secrets [options]
 
 | Option | Description |
 |--------|-------------|
-| `--staged` | Scan only staged files (default) |
-| `--all` | Scan all changed files compared to base branch |
-| `--uncommitted` | Scan all uncommitted changes |
+| `--all` | Scan committed (unpushed) + uncommitted changes, including untracked files (default) |
+| `--committed` | Scan only unpushed commits |
+| `--uncommitted` | Scan staged + unstaged + untracked changes |
+| `--staged` | Scan only staged files |
 | `--last-commit` | Scan files from the last commit |
+| `--last-n-commits <n>` | Scan files from the last n commits (max 5) |
+| `--base <branch>` | Scan committed + uncommitted + untracked changes since the merge-base with `<branch>` |
+| `--base-commit <commit>` | Scan committed + uncommitted + untracked changes since `<commit>` |
 | `--fail-on <level>` | Fail only on HIGH, MEDIUM, or all (default: HIGH) |
 | `--include <patterns>` | Comma-separated glob patterns to include files |
 | `--exclude <patterns>` | Comma-separated glob patterns to exclude files |
@@ -67,11 +74,11 @@ codeant secrets [options]
 **Examples:**
 
 ```bash
-# Scan staged files (default)
+# Scan all changed files (default)
 codeant secrets
 
-# Scan all changed files
-codeant secrets --all
+# Scan only staged files
+codeant secrets --staged
 
 # Scan last commit
 codeant secrets --last-commit
@@ -108,6 +115,46 @@ Use `--include` and `--exclude` with glob patterns to filter files:
 - `MEDIUM` - Medium confidence, may need review
 - `FALSE_POSITIVE` - Detected but likely not a real secret (always ignored)
 
+#### `review`
+
+Run an AI code review on your local changes.
+
+```bash
+codeant review [options]
+```
+
+**Options:**
+
+| Option | Description |
+|--------|-------------|
+| `--all` | Review committed (unpushed) + uncommitted changes, including untracked files (default) |
+| `--committed` | Review only unpushed commits |
+| `--uncommitted` | Review staged + unstaged + untracked changes |
+| `--staged` | Review only staged files |
+| `--last-commit` | Review the last commit |
+| `--last-n-commits <n>` | Review the last n commits (max 5) |
+| `--base <branch>` | Review committed + uncommitted + untracked changes since the merge-base with `<branch>` |
+| `--base-commit <commit>` | Review committed + uncommitted + untracked changes since `<commit>` |
+| `--fail-on <level>` | Fail on issues at or above BLOCKER, CRITICAL, MAJOR, MINOR, or INFO (default: CRITICAL) |
+| `--include <patterns>` | Comma-separated glob patterns to include files |
+| `--exclude <patterns>` | Comma-separated glob patterns to exclude files |
+| `--headless` | Print JSON with no spinners (for agents and CI) |
+
+`--base` and `--base-commit` take precedence over the other scope flags. They compare the base against your working tree, so staged, unstaged, and untracked files are reviewed along with commits. Files ignored by `.gitignore` are never reviewed. The same applies to `secrets`.
+
+**Examples:**
+
+```bash
+# Review everything on your branch since it left main, including uncommitted and new files
+codeant review --base main
+
+# Review only uncommitted work
+codeant review --uncommitted
+
+# CI: fail on MAJOR or worse, JSON output
+codeant review --base main --fail-on MAJOR --headless
+```
+
 #### `set-base-url <url>`
 
 Set a custom API base URL.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeant-cli",
-  "version": "0.5.11",
+  "version": "0.5.13",
   "description": "Code review CLI tool",
   "type": "module",
   "repository": {

package/src/index.js

@@ -72,8 +72,8 @@ program
   .option('--staged', 'Scan only staged files')
   .option('--last-commit', 'Scan last commit')
   .option('--last-n-commits <n>', 'Scan last n commits (max 5)', toCount)
-  .option('--base <branch>', 'Compare against a specific base branch (e.g. --base develop)')
-  .option('--base-commit <commit>', 'Compare against a specific commit (e.g. --base-commit HEAD~3)')
+  .option('--base <branch>', 'Scan committed + uncommitted + untracked changes since the merge-base with a branch (e.g. --base develop). Takes precedence over the other scope flags')
+  .option('--base-commit <commit>', 'Scan committed + uncommitted + untracked changes since a commit (e.g. --base-commit HEAD~3). Takes precedence over the other scope flags')
   .option('--include <paths>', 'Comma-separated list of file paths glob patterns to include')
   .option('--exclude <paths>', 'Comma-separated list of file paths glob patterns to exclude')
   .option('--hook', 'Running from pre-commit hook (enables bypass prompt)')
@@ -83,6 +83,8 @@ program
     let baseBranch = null;
     let baseCommit = null;
 
+    // Precedence: --base > --base-commit > other scope flags. The base modes already diff
+    // against the working tree, so they include uncommitted and untracked changes too.
     if (options.base) {
       scanType = 'base-branch';
       baseBranch = options.base;
@@ -123,8 +125,8 @@ program
   .option('--staged', 'Review only staged files')
   .option('--last-commit', 'Review last commit')
   .option('--last-n-commits <n>', 'Review last n commits (max 5)', toCount)
-  .option('--base <branch>', 'Compare against a specific base branch (e.g. --base develop)')
-  .option('--base-commit <commit>', 'Compare against a specific commit (e.g. --base-commit HEAD~3)')
+  .option('--base <branch>', 'Review committed + uncommitted + untracked changes since the merge-base with a branch (e.g. --base develop). Takes precedence over the other scope flags')
+  .option('--base-commit <commit>', 'Review committed + uncommitted + untracked changes since a commit (e.g. --base-commit HEAD~3). Takes precedence over the other scope flags')
   .option('--fail-on <level>', 'Fail on issues at or above this level: BLOCKER, CRITICAL, MAJOR, MINOR, INFO (default: CRITICAL)', 'CRITICAL')
   .option('--include <paths>', 'Comma-separated list of file paths glob patterns to include')
   .option('--exclude <paths>', 'Comma-separated list of file paths glob patterns to exclude')
@@ -135,6 +137,8 @@ program
     let baseBranch = null;
     let baseCommit = null;
 
+    // Precedence: --base > --base-commit > other scope flags. The base modes already diff
+    // against the working tree, so they include uncommitted and untracked changes too.
     if (options.base) {
       scanType = 'base-branch';
       baseBranch = options.base;

package/src/mcp/server.js

@@ -639,8 +639,8 @@ export function createMcpServer() {
           .optional()
           .describe('Review scope. Default "uncommitted".'),
         lastNCommits: z.number().int().positive().max(5).optional(),
-        baseBranch: z.string().optional(),
-        baseCommit: z.string().optional(),
+        baseBranch: z.string().optional().describe('Branch for scope "base-branch". Reviews committed, uncommitted and untracked changes since the merge-base with this branch.'),
+        baseCommit: z.string().optional().describe('Commit for scope "base-commit". Reviews committed, uncommitted and untracked changes since this commit.'),
         include: z.array(z.string()).optional().describe('Glob patterns to include.'),
         exclude: z.array(z.string()).optional().describe('Glob patterns to exclude.'),
       },

package/src/utils/gitDiffHelper.js

@@ -1,9 +1,11 @@
 import fs from 'fs/promises';
+import { constants as fsConstants } from 'fs';
 import path from 'path';
 import { promisify } from 'util';
-import { exec } from 'child_process';
+import { exec, execFile } from 'child_process';
 
 const execAsync = promisify(exec);
+const execFileAsync = promisify(execFile);
 
 /**
  * Expand untracked paths from `git status --porcelain`.
@@ -460,41 +462,90 @@ class GitDiffHelper {
 
     // Handle untracked files by generating synthetic "new file" diffs since git diff can't see them
     for (const file of expandedUntrackedFiles) {
-      try {
-        const absolutePath = path.resolve(this.gitRoot, file);
-        const content = await fs.readFile(absolutePath, 'utf8');
-        const lines = content.split('\n');
-
-        let patchStr = `diff --git a/${file} b/${file}\n`;
-        patchStr += `new file mode 100644\n`;
-        patchStr += `index 0000000..${this._generateRandomHash()}\n`;
-        patchStr += `--- /dev/null\n`;
-        patchStr += `+++ b/${file}\n`;
-        patchStr += `@@ -0,0 +1,${lines.length} @@\n`;
-        lines.forEach(line => { patchStr += `+${line}\n`; });
-
-        diffs.push({
-          base_file_str: '',
-          head_file_str: content,
-          patch_str: patchStr,
-          filename_str: file,
-          edit_type_str: 'ADDED',
-          old_filename_str: null,
-          num_plus_lines_str: String(lines.length),
-          num_minus_lines_str: '0',
-          tokens_str: String(content.split(/\s+/).length),
-          start_line_str: '1',
-          end_line_str: String(lines.length),
-        });
-      } catch (error) {
-        // Skip files that can't be read
-      }
+      const diff = await this._buildUntrackedFileDiff(file);
+      if (diff) diffs.push(diff);
     }
 
     this.baseCommit = originalBaseCommit;
     return diffs;
   }
 
+  /**
+   * Read a working-tree file. Returns null if it resolves outside the repository (a symlink
+   * pointing elsewhere) or isn't a regular file, so those contents are never uploaded.
+   */
+  async _readRepoFile(relPath) {
+    const realRoot = await fs.realpath(this.gitRoot);
+    const isInside = p => {
+      const rel = path.relative(realRoot, p);
+      return !!rel && rel !== '..' && !rel.startsWith('..' + path.sep) && !path.isAbsolute(rel);
+    };
+    const realPath = await fs.realpath(path.resolve(this.gitRoot, relPath));
+    if (!isInside(realPath)) return null;
+
+    // Open first and then check what was actually opened, so a symlink swapped in after the
+    // check above can't redirect the read. O_NONBLOCK keeps a FIFO from blocking the open.
+    const { O_RDONLY, O_NOFOLLOW = 0, O_NONBLOCK = 0 } = fsConstants;
+    const handle = await fs.open(realPath, O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+    try {
+      const opened = await handle.stat();
+      if (!opened.isFile()) return null;
+      // The opened file must still be the file at this path, and the path must still resolve
+      // inside the repo (a parent directory may have been swapped for a symlink)
+      const nowPath = await fs.realpath(realPath);
+      const now = await fs.stat(nowPath);
+      if (!isInside(nowPath) || now.dev !== opened.dev || now.ino !== opened.ino) return null;
+      return await handle.readFile('utf8');
+    } finally {
+      await handle.close();
+    }
+  }
+
+  /**
+   * Build a synthetic "new file" diff for an untracked file, which git diff can't see.
+   * Returns null if the file can't be read.
+   */
+  async _buildUntrackedFileDiff(file) {
+    try {
+      let content = await this._readRepoFile(file).catch(() => null);
+      let mode = '100644';
+      if (content === null) {
+        // A symlink we won't follow (it points outside the repo or nowhere): show the link
+        // itself, as git would once it's committed, using its target path and never the
+        // target's contents
+        const absolutePath = path.resolve(this.gitRoot, file);
+        if (!(await fs.lstat(absolutePath)).isSymbolicLink()) return null;
+        content = await fs.readlink(absolutePath);
+        mode = '120000';
+      }
+      const lines = content.split('\n');
+
+      let patchStr = `diff --git a/${file} b/${file}\n`;
+      patchStr += `new file mode ${mode}\n`;
+      patchStr += `index 0000000..${this._generateRandomHash()}\n`;
+      patchStr += `--- /dev/null\n`;
+      patchStr += `+++ b/${file}\n`;
+      patchStr += `@@ -0,0 +1,${lines.length} @@\n`;
+      lines.forEach(line => { patchStr += `+${line}\n`; });
+
+      return {
+        base_file_str: '',
+        head_file_str: content,
+        patch_str: patchStr,
+        filename_str: file,
+        edit_type_str: 'ADDED',
+        old_filename_str: null,
+        num_plus_lines_str: String(lines.length),
+        num_minus_lines_str: '0',
+        tokens_str: String(content.split(/\s+/).length),
+        start_line_str: '1',
+        end_line_str: String(lines.length),
+      };
+    } catch (error) {
+      return null;
+    }
+  }
+
   async _getStagedChanges() {
     const { stdout: stagedFiles } = await execAsync(
       'git diff --name-only --cached HEAD',
@@ -525,7 +576,8 @@ class GitDiffHelper {
 
   /**
    * Get diff against a specific base branch.
-   * Finds the merge-base between the given branch and HEAD, then diffs from there.
+   * Finds the merge-base between the given branch and HEAD, then diffs it against the
+   * working tree (committed + staged + unstaged + untracked).
    */
   async _getBaseBranchDiff(branch) {
     if (!this.gitRoot) {
@@ -539,8 +591,7 @@ class GitDiffHelper {
     let resolvedRef;
     for (const candidate of [branch, `origin/${branch}`]) {
       try {
-        const { stdout } = await execAsync(`git rev-parse ${candidate}`, { cwd: this.gitRoot });
-        resolvedRef = stdout.trim();
+        resolvedRef = await this._resolveCommitSha(candidate);
         break;
       } catch (err) {
         // try next
@@ -561,32 +612,12 @@ class GitDiffHelper {
       base = resolvedRef;
     }
 
-    const { stdout: changedFiles } = await execAsync(
-      `git diff --name-only ${base} HEAD`,
-      { cwd: this.gitRoot }
-    );
-
-    const files = changedFiles.split('\n').map(f => f.trim()).filter(Boolean);
-    if (files.length === 0) return [];
-
-    const originalBaseCommit = this.baseCommit;
-    try {
-      this.baseCommit = base;
-      this._headRef = 'HEAD';
-
-      const diffs = await Promise.all(
-        files.map(fp => this.getDiffInfoForFile(fp))
-      );
-      return diffs.flat();
-    } finally {
-      this.baseCommit = originalBaseCommit;
-      this._headRef = null;
-    }
+    return this._getWorkingTreeDiffAgainst(base);
   }
 
   /**
    * Get diff against a specific base commit.
-   * Diffs from the given commit to HEAD.
+   * Diffs from the given commit to the working tree (committed + staged + unstaged + untracked).
    */
   async _getBaseCommitDiff(commit) {
     if (!this.gitRoot) {
@@ -599,29 +630,63 @@ class GitDiffHelper {
     // Resolve the commit ref (supports HEAD~3, sha, tag, etc.)
     let resolvedCommit;
     try {
-      const { stdout } = await execAsync(`git rev-parse ${commit}`, { cwd: this.gitRoot });
-      resolvedCommit = stdout.trim();
+      resolvedCommit = await this._resolveCommitSha(commit);
     } catch (err) {
       throw new Error(`Could not resolve commit: ${commit}`);
     }
 
+    return this._getWorkingTreeDiffAgainst(resolvedCommit);
+  }
+
+  /**
+   * Resolve a user-supplied ref (from the CLI or MCP) to a commit SHA without going through a
+   * shell, so later git commands only ever see the SHA. Throws if it doesn't name a commit.
+   */
+  async _resolveCommitSha(ref) {
+    // A leading "-" would be parsed as a git option (e.g. --output=<file>)
+    if (ref.startsWith('-')) throw new Error(`Invalid ref: ${ref}`);
+    const { stdout } = await execFileAsync(
+      'git',
+      ['rev-parse', '--verify', '--quiet', `${ref}^{commit}`],
+      { cwd: this.gitRoot }
+    );
+    return stdout.trim();
+  }
+
+  /**
+   * Diff a base commit against the working tree: commits since base, staged and unstaged
+   * changes (including staged new files), plus untracked files not ignored by .gitignore.
+   * Content is read from disk so it matches the patch, which getFileDiff also takes against
+   * the working tree.
+   */
+  async _getWorkingTreeDiffAgainst(base) {
+    // No HEAD argument: compares base to the working tree, which covers tracked files that
+    // were committed, staged or edited since base
     const { stdout: changedFiles } = await execAsync(
-      `git diff --name-only ${resolvedCommit} HEAD`,
+      `git diff --name-only ${base}`,
+      { cwd: this.gitRoot }
+    );
+    const { stdout: untrackedStr } = await execAsync(
+      'git ls-files --others --exclude-standard',
       { cwd: this.gitRoot }
     );
 
     const files = changedFiles.split('\n').map(f => f.trim()).filter(Boolean);
-    if (files.length === 0) return [];
+    const untrackedFiles = untrackedStr.split('\n').map(f => f.trim()).filter(Boolean);
+    if (files.length === 0 && untrackedFiles.length === 0) return [];
 
     const originalBaseCommit = this.baseCommit;
     try {
-      this.baseCommit = resolvedCommit;
-      this._headRef = 'HEAD';
+      this.baseCommit = base;
+      this._headRef = null;
 
       const diffs = await Promise.all(
         files.map(fp => this.getDiffInfoForFile(fp))
       );
-      return diffs.flat();
+      const untrackedDiffs = await Promise.all(
+        untrackedFiles.map(fp => this._buildUntrackedFileDiff(fp))
+      );
+      return [...diffs.flat(), ...untrackedDiffs.filter(Boolean)];
     } finally {
       this.baseCommit = originalBaseCommit;
       this._headRef = null;
@@ -762,35 +827,8 @@ class GitDiffHelper {
 
       // Handle untracked files with synthetic diffs
       for (const file of expandedUntrackedFiles) {
-        try {
-          const absolutePath = path.resolve(this.gitRoot, file);
-          const content = await fs.readFile(absolutePath, 'utf8');
-          const lines = content.split('\n');
-
-          let patchStr = `diff --git a/${file} b/${file}\n`;
-          patchStr += `new file mode 100644\n`;
-          patchStr += `index 0000000..${this._generateRandomHash()}\n`;
-          patchStr += `--- /dev/null\n`;
-          patchStr += `+++ b/${file}\n`;
-          patchStr += `@@ -0,0 +1,${lines.length} @@\n`;
-          lines.forEach(line => { patchStr += `+${line}\n`; });
-
-          diffs.push({
-            base_file_str: '',
-            head_file_str: content,
-            patch_str: patchStr,
-            filename_str: file,
-            edit_type_str: 'ADDED',
-            old_filename_str: null,
-            num_plus_lines_str: String(lines.length),
-            num_minus_lines_str: '0',
-            tokens_str: String(content.split(/\s+/).length),
-            start_line_str: '1',
-            end_line_str: String(lines.length),
-          });
-        } catch (err) {
-          // skip
-        }
+        const diff = await this._buildUntrackedFileDiff(file);
+        if (diff) diffs.push(diff);
       }
     } finally {
       this.baseCommit = originalBaseCommit;
@@ -1028,8 +1066,8 @@ class GitDiffHelper {
     } catch (err) {
       // Handle untracked files
       try {
-        const absoluteFilePath = path.resolve(this.gitRoot, filePath);
-        const headFileStr = await fs.readFile(absoluteFilePath, 'utf8');
+        const headFileStr = await this._readRepoFile(filePath);
+        if (headFileStr === null) throw new Error('Not a regular file inside the repository');
         const lines = headFileStr.split('\n');
 
         let patchStr = `diff --git a/${filePath} b/${filePath}\n`;
@@ -1086,9 +1124,9 @@ class GitDiffHelper {
         { cwd: this.gitRoot }
       ).then(r => r.stdout).catch(() => '');
     } else {
-      headFileStr = await fs.readFile(
-        path.join(this.gitRoot, filePath), 'utf8'
-      ).catch(() => '');
+      headFileStr = await this._readRepoFile(filePath)
+        .then(content => content ?? '')
+        .catch(() => '');
     }
 
     // Get patch