openpitstop 1.9.0 → 1.10.0

package/package.json

@@ -1,69 +1,70 @@
-{
-  "name": "openpitstop",
-  "version": "1.9.0",
-  "description": "Deterministic scans + your coding agent's own reasoning, in one autonomous quality loop. Adds a /pitstop slash-command to any AI coding tool.",
-  "license": "MIT",
-  "author": "Krish-1507",
-  "keywords": [
-    "cli",
-    "pitstop",
-    "code-quality",
-    "code-review",
-    "ai",
-    "autonomous",
-    "agent",
-    "scan",
-    "verify"
-  ],
-  "type": "module",
-  "bin": {
-    "openpitstop": "dist/cli.js",
-    "pitstop": "dist/cli.js"
-  },
-  "files": [
-    "dist",
-    "scripts",
-    "templates",
-    "demo-repo",
-    "demo-repo-integrity",
-    "demo-repo-fintech",
-    "demo-repo-generators",
-    "README.md",
-    "PRIVACY.md",
-    "LICENSE"
-  ],
-  "engines": {
-    "node": ">=22"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Krish-1507/OpenPitStop.git"
-  },
-  "homepage": "https://github.com/Krish-1507/OpenPitStop#readme",
-  "bugs": {
-    "url": "https://github.com/Krish-1507/OpenPitStop/issues"
-  },
-  "scripts": {
-    "build": "tsc",
-    "dev": "tsx watch src/cli.ts",
-    "smoke": "node dist/cli.js scan demo-repo",
-    "test": "node --import tsx --test \"test/*.test.ts\"",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
-    "prepublishOnly": "npm run build"
-  },
-  "dependencies": {
-    "@babel/parser": "^7.25.0",
-    "boxen": "^7.1.1",
-    "chalk": "^5.3.0",
-    "cli-table3": "^0.6.5",
-    "commander": "^12.1.0",
-    "execa": "^10.0.1",
-    "nock": "^14.0.17",
-    "ora": "^8.1.0"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "tsx": "^4.19.0",
-    "typescript": "^5.6.0"
-  }
-}
+{
+  "name": "openpitstop",
+  "version": "1.10.0",
+  "description": "Repo-aware engineering workflows for coding CLIs: understand, plan, check architecture, test security, and verify changes with local evidence.",
+  "license": "MIT",
+  "author": "Krish-1507",
+  "keywords": [
+    "cli",
+    "pitstop",
+    "code-quality",
+    "code-review",
+    "ai",
+    "autonomous",
+    "agent",
+    "scan",
+    "verify"
+  ],
+  "type": "module",
+  "bin": {
+    "openpitstop": "dist/cli.js",
+    "pitstop": "dist/cli.js"
+  },
+  "files": [
+    "dist",
+    "scripts/cheat-demo.cjs",
+    "templates",
+    "demo-repo",
+    "demo-repo-integrity",
+    "demo-repo-fintech",
+    "demo-repo-generators",
+    "README.md",
+    "PRIVACY.md",
+    "LICENSE",
+    "docs/release-controls.md"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Krish-1507/OpenPitStop.git"
+  },
+  "homepage": "https://github.com/Krish-1507/OpenPitStop#readme",
+  "bugs": {
+    "url": "https://github.com/Krish-1507/OpenPitStop/issues"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsx watch src/cli.ts",
+    "smoke": "node dist/cli.js scan demo-repo",
+    "test": "node --import tsx --test \"test/*.test.ts\"",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.test.json",
+    "prepublishOnly": "npm run build"
+  },
+  "dependencies": {
+    "@babel/parser": "^7.25.0",
+    "boxen": "^7.1.1",
+    "chalk": "^5.3.0",
+    "cli-table3": "^0.6.5",
+    "commander": "^12.1.0",
+    "execa": "^10.0.1",
+    "nock": "^14.0.17",
+    "ora": "^8.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsx": "^4.19.0",
+    "typescript": "^5.6.0"
+  }
+}

package/templates/pitstop.command.md

@@ -1,5 +1,5 @@
 ---
-description: "OpenPitStop — the honest referee for AI coding agents. Run the full quality loop, or type /pitstop menu for a scrollable action card."
+description: "Understand, secure and verify your repo. Say /pitstop find vulnerabilities in this repo."
 ---
 
 # /pitstop
@@ -11,12 +11,24 @@ description: "OpenPitStop — the honest referee for AI coding agents. Run the f
 If the user typed **nothing** after `/pitstop`, load the procedure (below) and run the full
 quality loop against this repo (the current working directory).
 
-If the user typed `menu`, tell them to run `/pitstop menu` and stop — the menu command shows
-a scrollable action card.
+If the user typed `menu`, load the installed pitstop-menu command and render its action card.
 
 If the user typed a natural-language request instead of a command (e.g. "make this safe",
-"why is my score low", "what should I do next"), run `pitstop ask "<text>"` to resolve it to
-the exact command, then run that command as if they had typed it directly.
+"why is my score low", "what should I do next"), pass that text as a single, safely quoted
+argument to `pitstop ask`. It executes recognized checks internally; do not run the
+printed command a second time. Use `--dry-run` to preview. Live attacks, source patches,
+installation and paid agent runs need `--execute`; add it only when the user's request
+authorizes that action. Unknown or constrained requests return exit 2 without execution:
+Use the host agent to interpret an unsupported request, preserve every constraint, and choose documented Pitstop commands only when their effects are within the user-authorized scope. Ask a short clarification if the scope is still ambiguous. Do not interpolate user text into a shell.
+
+Examples (execute, then summarize findings and next actions):
+- `/pitstop find vulnerabilities in this repo` → `pitstop ask "find vulnerabilities in this repo"`
+- `/pitstop attack my app` → `pitstop ask "attack my app" --execute`
+- `/pitstop find and fix vulnerabilities in this repo` → `pitstop ask "find and fix vulnerabilities in this repo" --execute`
+- `/pitstop review my changes` → `pitstop ask "review my changes"`
+
+Do not start an external coding agent for a static scan. Its checks use no model credits.
+Do not weaken isolation or bypass missing Docker; explain the install/pull hint if live testing aborts.
 
 Otherwise (a flag or path), load the full procedure and run it on this repo. Execute this and
 read the **full output** before doing anything else — that output *is* the OpenPitStop