greptile 3.5.3 → 3.6.0

package/CHANGELOG.md

@@ -4,6 +4,52 @@ All notable changes to the Greptile CLI.
 
 ## Unreleased
 
+## 3.6.0 - 2026-09-25
+
+### Added
+
+- `greptile review --plus` and `greptile review --apex` run a review at plus
+  or apex effort. The two flags are mutually exclusive and cannot be combined
+  with `--resume`. Output shows the effort level; JSON output adds `effort`.
+- Exit code `6` when a feature is not enabled for your account. The CLI prints
+  a `notice:` instead of an error.
+
+## 3.5.4 - 2026-09-21
+
+### Changed
+
+- Review summaries now lead with confidence and a concise safety assessment,
+  followed by the generated summary and any supplied instructions. Reviews
+  with no findings also show up to seven "What we checked" items when available.
+  Terminal and plain-text output omit the separate security-summary section;
+  JSON output retains `securitySummary` and the full `confidenceReasoning`.
+- Organization review settings now follow the active SCM summary layout.
+  For the new layout, the editor and settings list label the issues section
+  "Findings" and hide collapse/open controls for findings and confidence.
+  Legacy servers retain the existing controls, and the setting keys still work
+  with `get`, `set`, and `unset`.
+- `greptile review` no longer refuses reviews that touch more than 500 files;
+  the remaining preflight limits (50 `.greptile` config files, payload size)
+  are unchanged.
+- Help text and descriptions for authentication, `init`, `config`, `settings`,
+  `review`, `skills`, `update`, and Fix bridge commands now spell out
+  accepted inputs, produced outputs, and how to follow up on a review.
+- `greptile update` recognises a bundle vendored by the Codex plugin as well
+  as the Claude Code plugin and points you at the plugin's own update path
+  instead of trying to upgrade in place.
+
+### Fixed
+
+- Both comment and diff layouts keep the review summary and diagram above
+  findings, using the same summary layout.
+- Usage telemetry now reports `cli_command_completed` (command name,
+  duration, exit code) and `cli_transport_error` (failure kind and count
+  only) events, batched during execution, so failed and invalid invocations
+  are counted. A failing first run still does not enable anonymous telemetry
+  or print its disclosure. The README documents the new events and the
+  distinction from service-side API records. The final telemetry flush waits
+  at most 100 ms, reduced from 400 ms.
+
 ## 3.5.3 - 2026-09-18
 
 ### Changed

package/README.md

@@ -47,30 +47,54 @@ Comments appear in the terminal as they come in.
 
 ## Commands
 
-| Command                     | What it does                                                          |
-| --------------------------- | --------------------------------------------------------------------- |
-| `greptile review`           | Review the current branch against its base.                           |
-| `greptile review show [ID]` | Reopen a previous review. Omit the ID to pick from a list.            |
-| `greptile review status`    | Report the most recent review status for a commit (HEAD by default).  |
-| `greptile init`             | Enable Greptile on the current repository when you have admin access. |
-| `greptile login`            | Sign in through your browser, or with `--api-key`.                    |
-| `greptile logout`           | Remove stored credentials.                                            |
-| `greptile whoami`           | Show who you are signed in as and your organizations.                 |
-| `greptile settings`         | Manage CLI preferences, repositories, review settings, and team.      |
-| `greptile skills`           | Install the Greptile agent skills for your AI coding agents.          |
-| `greptile fix`              | Set up or remove Fix in Claude Code on macOS.                         |
-| `greptile update`           | Update the CLI to the latest version.                                 |
-
-Run any command with `--help` for its full flag list.
+| Command                     | What it does                                                             |
+| --------------------------- | ------------------------------------------------------------------------ |
+| `greptile review`           | Review committed changes from the branch merge base through `HEAD`.      |
+| `greptile review show [ID]` | Fetch one review by UUID, or choose/list recent local history.           |
+| `greptile review status`    | Report the latest saved review for a commit with scriptable exits.       |
+| `greptile config [PATH]`    | Resolve the review config for the repository or one file.                |
+| `greptile init`             | Enable the current repository with an OAuth-signed-in admin account.     |
+| `greptile login`            | Sign in through your browser, or with `--api-key`.                       |
+| `greptile logout`           | Remove stored credentials.                                               |
+| `greptile whoami`           | Show who you are signed in as and your organizations.                    |
+| `greptile settings`         | Manage local preferences, organization review settings, repos, and team. |
+| `greptile skills`           | List, install, and update Greptile-authored agent skills.                |
+| `greptile fix`              | Set up or remove Fix in Claude Code on macOS.                            |
+| `greptile update`           | Update the CLI to the latest version.                                    |
+
+Run any command with `--help` for its installed flag list. This README documents the unreleased CLI 3.5.4;
+the installed help wins if it differs.
 
 ## Reviewing
 
-Review against a specific base branch:
+`greptile review` compares the merge base of the selected base and `HEAD` with `HEAD`. It sends
+committed, non-binary changes only. Uncommitted and binary files stay local and produce warnings.
+
+Terminal output starts with a box containing confidence, a short verdict, and the change summary.
+Clean reviews include a list of available checks. Any diagram follows the box, before findings
+and diffs. Plain text output omits the box. JSON output keeps the full `confidenceReasoning`
+and `securitySummary` fields.
+
+Review against a specific base branch or add one-run instructions:
 
 ```sh
 greptile review -b main
+greptile review --instructions "focus on retry cancellation"
 ```
 
+Choose review effort for a new run:
+
+```sh
+greptile review          # base
+greptile review --plus   # plus
+greptile review --apex   # apex
+```
+
+`--plus` and `--apex` are mutually exclusive and cannot be combined with `--resume`.
+They require the organization's effort feature and an effort-specific routing rule. If either
+is unavailable, the review fails without running a fallback. Results include the effective
+effort. Saved settings do not change effort.
+
 Show findings beside the changed code instead of as a comment list:
 
 ```sh
@@ -87,7 +111,7 @@ Reopen an earlier review:
 
 ```sh
 greptile review show          # pick from recent reviews
-greptile review show abc123   # open one by ID
+greptile review show b3e4f72a-1d6c-4f81-9c0e-2a7d3b9e5f10
 ```
 
 List recent reviews non-interactively (for scripts and agents):
@@ -101,7 +125,7 @@ Check whether the current commit has been reviewed (for a pre-push hook):
 
 ```sh
 greptile review status              # checks HEAD
-greptile review status --commit abc123
+greptile review status --commit 9f2c6a43d99b9de72f4f7853b4d4cb650ed451b8
 greptile review status --json
 ```
 
@@ -121,10 +145,48 @@ esac
 
 ```sh
 greptile review --json > review.json   # structured JSON
-greptile review --text                 # plain text (default when piped)
-greptile review --agent                # alias for --text, for AI agents
+greptile review --text                 # force plain text, overriding saved output mode
+greptile review --agent                # plain text, without interactive sign-in or setup
 ```
 
+A completed review prints one JSON object. This fictional example uses the exact emitted fields:
+
+```json
+{
+  "summary": "The retry path now preserves cancellation.",
+  "confidence": 4,
+  "confidenceReasoning": "The change is focused, with one cleanup suggestion.",
+  "securitySummary": null,
+  "instructions": "focus on retry cancellation",
+  "comments": [
+    {
+      "id": "comment-7312",
+      "path": "src/retry.ts",
+      "startLine": 42,
+      "endLine": 42,
+      "side": "new",
+      "severity": "P2",
+      "securityIssue": false,
+      "category": "comment",
+      "body": "Clear the timer after the request settles.",
+      "verifiedEvidence": null,
+      "suggestion": "clearTimeout(timer)",
+      "hunk": {
+        "header": "@@ -39,6 +39,7 @@ async function retry() {",
+        "oldRange": { "start": 39, "lines": 6 },
+        "newRange": { "start": 39, "lines": 7 },
+        "before": "return result",
+        "after": "clearTimeout(timer)"
+      }
+    }
+  ]
+}
+```
+
+`comments` is empty on a review with no findings. A successful review exits `0` even when it has
+findings. After a dispatched review is interrupted or cannot finish locally, stderr gives its UUID
+and the follow-up command `greptile review show <UUID>`.
+
 Exit codes are stable for scripting; see [Reference](#reference).
 
 > ℹ️ **Note:** `greptile review show` with no ID now prints the recent-reviews
@@ -160,6 +222,10 @@ When `GREPTILE_API_KEY` is set, it takes precedence over a stored sign-in.
 
 > ℹ️ **Note:** API keys are scoped to an organization, not a person, so reviews run under the organization's identity. Use OAuth sign-in if you want per-developer attribution.
 
+`greptile init` and the organization-management surfaces use account OAuth. They reject API-key
+authentication because repository and organization changes must be attributed to a signed-in user.
+Run `greptile login` first, or make those changes in the dashboard.
+
 ## Sensitive files
 
 Before sending anything, `greptile review` holds back changed files that look like they contain secrets, so a mistakenly committed `.env` file or private key stays on your machine. When files are held back, the review prints a one-line note naming them. A file is held back when:
@@ -217,11 +283,43 @@ greptile settings unset review.layout      # back to the default
 | `review.context` | `0` to `60` (default `15`)               | `--context`                                            |
 | `review.width`   | `40` to `240` (default: terminal width)  | `--width`                                              |
 | `telemetry`      | `true`, `false` (unset until you decide) | — (see [Telemetry](#telemetry))                        |
+| `apiBaseUrl`     | HTTPS origin, with no path               | Self-hosted API target                                 |
+| `webBaseUrl`     | HTTPS origin, with no path               | Self-hosted dashboard target                           |
 
 A flag passed on the command line always wins over a saved setting for that run.
 
 Settings live in `~/.config/greptile/settings.json` (or `$XDG_CONFIG_HOME/greptile/settings.json`); `greptile settings path` prints the exact location. The file includes a `$schema` reference to a published JSON Schema, so editors can validate and autocomplete it if you edit it by hand.
 
+The settings file contains preferences and deployment origins, never credentials. OAuth and stored
+API-key credentials live separately in `~/.greptile/auth.json`; do not print or copy that file.
+
+Organization review settings use `org.*` keys and are stored on the server. Pass `--org <slug-or-id>`
+when you administer more than one organization; with exactly one eligible organization it is selected
+automatically. For example:
+
+```sh
+greptile settings list --org acme-platform --json
+greptile settings get org.review.strictness --org acme-platform --json
+greptile settings set org.review.triggerOnUpdates true --org acme-platform
+greptile settings unset org.review.strictness --org acme-platform
+```
+
+`unset` removes a local key, but for an `org.*` key it writes the documented server default. The
+organization keys cover review strictness, update reviews, PR-description updates, Fix with AI buttons,
+coding-agent buttons, and each PR-summary section's inclusion, collapsibility, and initial state. Run
+`greptile settings --help` for the installed key list.
+
+Member operations are server-backed and available to every organization member where the server
+allows the action. Listing a roster is member-readable; pending invitations are shown only to admins.
+Members may invite the `member` role, while inviting admins and revoking invitations require admin
+permission.
+
+```sh
+greptile settings members list --org acme-platform --json
+greptile settings members invite dev@example.com --role member --org acme-platform
+greptile settings members revoke dev@example.com --org acme-platform
+```
+
 ## Agent skills
 
 Skills are instructions AI coding agents read. Greptile provides two for the CLI:
@@ -240,6 +338,7 @@ greptile skills install --global      # all your projects, no prompt
 greptile skills install greploop      # just one
 greptile skills install --force       # replace installed copies
 greptile skills update                # update installed copies
+greptile skills update --json         # report updated, current, incompatible, and retired entries
 ```
 
 Skills are written to `.agents/skills/<name>/`, which Codex, Cursor, Gemini CLI, Copilot and other
@@ -252,6 +351,8 @@ are available. Run `greptile skills update` to apply them.
 
 An installed skill is left alone unless you pass `--force`, so local edits are kept. A skill left
 incomplete by a failed write is repaired on the next install. Updates replace stale installed files.
+Bare `greptile skills` is the same as `greptile skills list`: it reports installed copies from the
+current project root and your home directory; it does not fetch the catalog.
 
 ## Diagrams
 
@@ -295,12 +396,22 @@ greptile reports anonymous usage events to help us see which commands people
 run and where they get stuck. The events are lifecycle signals —
 `cli_first_run`, `cli_login_started`, `cli_login_failed`,
 `cli_onboarding_started`, `cli_skill_installed`, `cli_skill_updated`,
-`cli_review_blocked`, `cli_update_completed` — carrying how you installed the
+`cli_review_blocked`, `cli_update_completed`, `cli_command_completed`, and
+`cli_transport_error` — carrying how you installed the
 CLI, your OS and architecture, whether the run was interactive, and which agent
 surface it ran under if any. Never your code, repository or branch names, file
 paths, or review content. Event-specific fields are fixed values: `method`,
 `exit_code`, `reason`, the version strings on an update, and the name of the
 Greptile-authored skill on `cli_skill_installed` and `cli_skill_updated`.
+Command completion includes the registered command name, duration in milliseconds,
+and exit code, including invalid input and failed commands when telemetry is
+already eligible. A fresh nonzero exit does not initialize anonymous
+telemetry or append its disclosure to stderr; that failure is omitted until a
+prior opt-in, notice, or normal workflow makes telemetry eligible. Help, version,
+and internal helpers are excluded. Transport failures include only their kind and
+count for that command: network, TLS, timeout, cancellation, or an oversized
+response. They never include URLs, error messages, arguments, or credentials.
+Events are batched during execution; the final network flush waits at most 100 ms.
 
 There are two tiers, and they are treated differently:
 
@@ -314,9 +425,9 @@ Until you answer that prompt, greptile stays anonymous — including in runs tha
 cannot show it at all, such as every run inside an AI coding agent. Once you
 have answered, your answer is what applies: accept, and later agent and script
 runs are account-linked too, because the decision is yours and not the
-terminal's. Declining silences both tiers, not just the linked one.
+terminal's. Declining silences both tiers of client-generated usage events.
 
-Any one of these turns it off:
+Any one of these turns off client-generated usage events:
 
 ```sh
 greptile settings set telemetry false   # persistent
@@ -324,8 +435,13 @@ export GREPTILE_TELEMETRY_DISABLED=1    # this shell
 export DO_NOT_TRACK=1                   # this shell, and every tool that honors it
 ```
 
-It is also off automatically when `CI` is set, and a CLI pointed at a
-self-hosted Greptile sends no telemetry at all.
+Client-generated usage events are also off automatically when `CI` is set or
+the CLI points at a self-hosted Greptile.
+
+These settings control the client-generated events listed above. Greptile
+separately records service-side API usage and review events. Those records can
+include the authenticated account and organization and are not disabled by the
+CLI's telemetry setting or environment switches.
 
 ## Reference
 
@@ -334,15 +450,43 @@ self-hosted Greptile sends no telemetry at all.
 ```sh
 greptile login [--api-key] | logout | whoami
 greptile review [-b BRANCH] [--layout comments|diff | --diff] [--resume] [--include PATH...]
-                [--json | --text | --agent] [--context LINES] [--width COLUMNS] [--no-color]
+                [--instructions TEXT] [--plus | --apex] [--json | --text | --agent] [--context LINES]
+                [--width COLUMNS] [--color | --no-color]
 greptile review show [ID]   # same output flags as review
 greptile review status [--commit REF] [--json | --text | --agent]
-greptile settings list | get KEY | set KEY VALUE | unset KEY | path
+greptile config [PATH] [--json]
+greptile init [--json]
+greptile settings list [--json] [--org [SLUG_OR_ID]]
+greptile settings get KEY [--json] [--org [SLUG_OR_ID]]
+greptile settings set KEY VALUE [--org [SLUG_OR_ID]]
+greptile settings unset KEY [--org [SLUG_OR_ID]]
+greptile settings members [list] [--json] [--org [SLUG_OR_ID]]
+greptile settings members invite EMAIL... [--role member|admin] [--org [SLUG_OR_ID]]
+greptile settings members revoke EMAIL_OR_ID [--org [SLUG_OR_ID]]
+greptile settings path
 greptile skills list [--json] | install [NAME...] [-g] [-f] [--json] | update [--json]
 greptile fix install | status [--json] | uninstall [--remove-mappings]
 greptile update
 ```
 
+Bare groups have useful defaults: `greptile review` starts a review, non-interactive
+`greptile settings` lists local settings, `greptile settings members` lists the roster, bare
+`greptile skills` lists installed skills, and bare `greptile fix` reports Fix service health.
+
+### Compatibility and non-public commands
+
+`greptile review run` is a hidden compatibility alias for `greptile review`. `greptile onboard` is
+deprecated and hidden; interactive setup now starts when needed. The hidden `__bridge-open` and
+`__bridge-server` commands are implementation details of Fix in Claude Code and are not user entry
+points.
+
+CLI 3.4.1 and later also contain the gated `greptile environment` private beta, registered only
+when `GREPTILE_CVMS_PRIVATE_BETA=true`. It manages repository build environments, setup scripts,
+TREX instructions, secret or visible variables, builds and logs, simulations, invalidation, and
+deletion. Access and server support are required. Run `greptile environment --help` on an enabled
+installation for its authoritative surface; secret values must be supplied by a masked prompt,
+stdin, or dotenv input, never as command arguments. Secret values are never shown again.
+
 ### Environment variables
 
 | Variable                      | What it does                                                          |
@@ -362,17 +506,19 @@ greptile update
 | Code  | Meaning                                                                          |
 | ----- | -------------------------------------------------------------------------------- |
 | `0`   | Review finished, or (`review status`) the commit has a completed review.         |
-| `1`   | Couldn't finish, or (`review status`) no review exists / signed out / no origin. |
-| `2`   | Invalid invocation (not inside a git repo, unknown flag, unresolvable commit).   |
+| `1`   | Couldn't finish, or (`review status`) no review exists / signed out / no remote. |
+| `2`   | Invalid invocation, flag value, review UUID, path, or commit reference.          |
 | `3`   | `review status` only: a review for the commit is still running.                  |
 | `4`   | `review status` only: the most recent review failed.                             |
 | `5`   | `review status` only: the most recent review was cancelled.                      |
+| `6`   | The feature isn't enabled for this account; stderr has a `notice:` line.         |
 | `130` | Interrupted with Ctrl-C.                                                         |
 
 ### Files
 
-| Path                               | Contents                                   |
-| ---------------------------------- | ------------------------------------------ |
-| `~/.greptile/auth.json`            | Credentials (refreshed automatically).     |
-| `~/.config/greptile/settings.json` | Saved settings (`greptile settings path`). |
-| `~/.cache/greptile/`               | Downloaded diagram renderer.               |
+| Path                               | Contents                                             |
+| ---------------------------------- | ---------------------------------------------------- |
+| `~/.greptile/auth.json`            | Credentials (refreshed automatically).               |
+| `~/.greptile/reviews.json`         | Account- and repository-scoped local review history. |
+| `~/.config/greptile/settings.json` | Saved settings (`greptile settings path`).           |
+| `~/.cache/greptile/`               | Downloaded diagram renderer.                         |