repopilot 0.10.0 → 0.11.0

package/README.md

@@ -15,9 +15,10 @@ and framework health checks. It gives developers useful terminal reports, CI gat
 SARIF for GitHub Code Scanning, and Markdown briefs that can be pasted into Claude
 Code, ChatGPT, Cursor, or another coding assistant.
 
-Version `0.10.0` is an adoption and stability release: it focuses on cleaner
-rollout diagnostics, reproducible audit receipts, CI artifacts, and 0.x command
-compatibility while keeping all scans local.
+Version `0.11.0` is a signal quality and CI polish release: it reduces
+low-value self-audit findings, adds first-party Action parity for priority/rule
+filters, and tightens the `doctor -> scan/review -> ai context -> CI gate` loop
+while keeping all scans local.
 
 ## Why RepoPilot?
 
@@ -133,8 +134,10 @@ Once you want CI integration, baseline tracking, or tighter configuration:
 ```bash
 repopilot init                                              # generate repopilot.toml
 repopilot doctor .                                          # check CI / baseline readiness
+repopilot scan . --min-priority p2 --rule security.secret-candidate
+repopilot ai context . --focus security                     # prepare local AI context
 repopilot baseline create .                                 # accept existing findings as known debt
-repopilot review . --base origin/main --fail-on new-high    # CI gate on new findings only
+repopilot review . --base origin/main --fail-on-priority p1 # CI gate on high-priority risk
 ```
 
 Save a shareable report:
@@ -217,7 +220,7 @@ RepoPilot is a local-first safety layer for AI-assisted and vibe-coded changes.
 repopilot ai context . --focus security    # get an LLM brief for Claude Code
 repopilot ai plan . --focus security       # get a prioritized hardening plan
 repopilot ai prompt . --budget 8k          # generate a paste-ready remediation prompt
-repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on new-high
+repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on-priority p1
 repopilot scan . --workspace --min-severity medium --format markdown --output repopilot-report.md
 ```
 
@@ -381,7 +384,7 @@ If your installed RepoPilot version does not support `--output`, redirect stdout
 repopilot scan . --format sarif > repopilot.sarif
 ```
 
-Use JSON when custom scripts need to parse RepoPilot results. Console, Markdown, and HTML reports include the RepoPilot version, risk summary, top rules, and grouped findings for human review. Use SARIF for CI and code scanning integrations, including GitHub Code Scanning.
+Use JSON when custom scripts need to parse RepoPilot results. Console, Markdown, and HTML reports include the RepoPilot version, risk summary, top risk clusters, top rules, and grouped findings for human review. Use SARIF for CI and code scanning integrations, including GitHub Code Scanning.
 Use `--receipt <path>` with `scan` when CI or release processes need compact evidence of the exact RepoPilot version, git state, scan scope, finding counts, language counts, and health score.
 
 See [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) for a copy-paste GitHub Actions workflow, required permissions, and local validation commands.
@@ -403,7 +406,7 @@ Use `--fail-on new-high` to fail CI only when new high or critical findings are
 When `--fail-on new-*` is used without `--baseline`, RepoPilot treats all current findings as new. For baseline-based adoption, commit an accepted baseline and scan against it in CI.
 
 To upload RepoPilot findings to GitHub Code Scanning, generate SARIF and use `github/codeql-action/upload-sarif`. The workflow must include `security-events: write`.
-The first-party action can also run `command: ai-context`, `command: ai-plan`, or `command: ai-prompt`; those commands emit Markdown and do not produce SARIF. Prefer typed action inputs such as `path`, `config`, `baseline`, `fail-on`, `focus`, `budget`, `output`, and `receipt`; `args` remains available for advanced flags.
+The first-party action can also run `command: doctor`, `command: ai-context`, `command: ai-plan`, or `command: ai-prompt`; AI commands emit Markdown and do not produce SARIF. Prefer typed action inputs such as `path`, `config`, `baseline`, `fail-on`, `fail-on-priority`, `min-priority`, `rule`, `timing`, `focus`, `budget`, `output`, and `receipt`; `args` remains available for advanced flags.
 
 ```yaml
 name: RepoPilot
@@ -454,7 +457,6 @@ These are planned ideas, not current features:
 
 - Change Risk Map
 - Better architecture drift detection
-- Optional per-platform npm binary packages for faster installs
 
 ## Documentation
 
@@ -465,12 +467,15 @@ These are planned ideas, not current features:
 | [docs/security.md](docs/security.md) | Local-first trust model, installer security, and vulnerability reporting |
 | [docs/configuration.md](docs/configuration.md) | `repopilot.toml`, presets, ignore files, and baseline adoption |
 | [docs/language-support.md](docs/language-support.md) | Supported language/framework tiers, rule families, and limitations |
+| [docs/risk-engine.md](docs/risk-engine.md) | Risk scoring, priority buckets, signals, and calibration policy |
 | [docs/cli.md](docs/cli.md) | Complete CLI reference — all commands, flags, and exit codes |
 | [docs/commands.md](docs/commands.md) | Task-oriented command guide and common patterns |
 | [docs/rulesets.md](docs/rulesets.md) | Implemented audit rules, categories, and severity levels |
 | [docs/react-native.md](docs/react-native.md) | React Native and Expo detection, findings, and limitations |
 | [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) | GitHub Code Scanning SARIF workflow |
 | [docs/release.md](docs/release.md) | Manual release process |
+| [docs/release-announcement-0.11.md](docs/release-announcement-0.11.md) | 0.11.0 launch post and post-publish checks |
+| [docs/release-checklist-0.11.md](docs/release-checklist-0.11.md) | 0.11.0 release readiness checklist |
 | [docs/release-checklist-0.10.md](docs/release-checklist-0.10.md) | 0.10.0 release readiness checklist |
 | [docs/distribution.md](docs/distribution.md) | Distribution channels |
 | [docs/github-ruleset.md](docs/github-ruleset.md) | GitHub branch ruleset configuration |

package/bin/repopilot.js

@@ -4,29 +4,141 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { spawn } = require("node:child_process");
 
-function binaryName() {
-  return process.platform === "win32" ? "repopilot.exe" : "repopilot";
+const SUPPORTED_TARGETS = [
+  { platform: "darwin", arch: "arm64", packageName: "@repopilot/darwin-arm64", binary: "repopilot" },
+  { platform: "darwin", arch: "x64", packageName: "@repopilot/darwin-x64", binary: "repopilot" },
+  {
+    platform: "linux",
+    arch: "arm64",
+    libc: "glibc",
+    packageName: "@repopilot/linux-arm64-gnu",
+    binary: "repopilot",
+  },
+  {
+    platform: "linux",
+    arch: "x64",
+    libc: "glibc",
+    packageName: "@repopilot/linux-x64-gnu",
+    binary: "repopilot",
+  },
+  { platform: "win32", arch: "x64", packageName: "@repopilot/win32-x64-msvc", binary: "repopilot.exe" },
+];
+
+class UnsupportedPlatformError extends Error {
+  constructor(platform, arch, libc) {
+    const runtime = libc ? `${platform}/${arch}/${libc}` : `${platform}/${arch}`;
+    super(`Unsupported npm platform: ${runtime}`);
+    this.name = "UnsupportedPlatformError";
+    this.code = "ERR_REPOPILOT_UNSUPPORTED_PLATFORM";
+    this.platform = platform;
+    this.arch = arch;
+    this.libc = libc;
+  }
+}
+
+class MissingOptionalPackageError extends Error {
+  constructor(packageName, cause) {
+    super(`Missing optional native package: ${packageName}`);
+    this.name = "MissingOptionalPackageError";
+    this.code = "ERR_REPOPILOT_MISSING_OPTIONAL_PACKAGE";
+    this.packageName = packageName;
+    this.cause = cause;
+  }
+}
+
+function detectLibc(platform = process.platform) {
+  if (platform !== "linux") {
+    return undefined;
+  }
+
+  const report = typeof process.report?.getReport === "function" ? process.report.getReport() : undefined;
+  if (report?.header?.glibcVersionRuntime) {
+    return "glibc";
+  }
+  return "musl";
+}
+
+function platformPackage(platform = process.platform, arch = process.arch, libc = detectLibc(platform)) {
+  const match = SUPPORTED_TARGETS.find((target) => {
+    if (target.platform !== platform || target.arch !== arch) {
+      return false;
+    }
+    return target.platform !== "linux" || target.libc === libc;
+  });
+
+  if (!match) {
+    throw new UnsupportedPlatformError(platform, arch, platform === "linux" ? libc : undefined);
+  }
+  return match;
 }
 
-function bundledBinaryPath() {
-  return path.join(__dirname, "..", "vendor", binaryName());
+function packageRoot(packageName, resolver = require.resolve) {
+  try {
+    return path.dirname(resolver(`${packageName}/package.json`));
+  } catch (error) {
+    if (error && error.code === "MODULE_NOT_FOUND") {
+      throw new MissingOptionalPackageError(packageName, error);
+    }
+    throw error;
+  }
 }
 
-function resolveBinaryPath() {
-  if (process.env.REPOPILOT_BINARY_PATH) {
-    return process.env.REPOPILOT_BINARY_PATH;
+function resolveBinaryPath(options = {}) {
+  const env = options.env ?? process.env;
+  if (env.REPOPILOT_BINARY_PATH) {
+    return env.REPOPILOT_BINARY_PATH;
   }
-  return bundledBinaryPath();
+
+  const target = platformPackage(options.platform, options.arch, options.libc);
+  return path.join(packageRoot(target.packageName, options.resolver), "bin", target.binary);
+}
+
+function supportedTargetsText() {
+  return SUPPORTED_TARGETS.map((target) => {
+    const runtime = target.libc
+      ? `${target.platform}/${target.arch}/${target.libc}`
+      : `${target.platform}/${target.arch}`;
+    return `${runtime} (${target.packageName})`;
+  }).join(", ");
+}
+
+function formatResolveError(error) {
+  if (error.code === "ERR_REPOPILOT_UNSUPPORTED_PLATFORM") {
+    return [
+      "RepoPilot does not provide an npm native package for this platform.",
+      `Detected: ${error.libc ? `${error.platform}/${error.arch}/${error.libc}` : `${error.platform}/${error.arch}`}`,
+      `Supported npm targets: ${supportedTargetsText()}`,
+      "Install with cargo, Homebrew, GitHub Releases, or set REPOPILOT_BINARY_PATH to an existing repopilot binary.",
+    ].join("\n");
+  }
+
+  if (error.code === "ERR_REPOPILOT_MISSING_OPTIONAL_PACKAGE") {
+    return [
+      "RepoPilot optional native package was not installed.",
+      `Expected npm package: ${error.packageName}`,
+      "Reinstall without omitting optional dependencies, for example: npm install -g repopilot",
+      "If your environment blocks optional dependencies, install with cargo or set REPOPILOT_BINARY_PATH to an existing repopilot binary.",
+    ].join("\n");
+  }
+
+  return `Failed to resolve RepoPilot binary: ${error.message}`;
 }
 
 function main() {
-  const binary = resolveBinaryPath();
+  let binary;
+  try {
+    binary = resolveBinaryPath();
+  } catch (error) {
+    console.error(formatResolveError(error));
+    process.exit(1);
+  }
+
   if (!fs.existsSync(binary)) {
     console.error(
       [
         "RepoPilot binary was not found.",
         `Expected: ${binary}`,
-        "Run npm install again, install with cargo, or set REPOPILOT_BINARY_PATH to an existing repopilot binary.",
+        "Reinstall repopilot, install with cargo, or set REPOPILOT_BINARY_PATH to an existing repopilot binary.",
       ].join("\n")
     );
     process.exit(1);
@@ -55,7 +167,12 @@ if (require.main === module) {
 }
 
 module.exports = {
-  binaryName,
-  bundledBinaryPath,
+  SUPPORTED_TARGETS,
+  MissingOptionalPackageError,
+  UnsupportedPlatformError,
+  detectLibc,
+  formatResolveError,
+  platformPackage,
   resolveBinaryPath,
+  supportedTargetsText,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "repopilot",
-	"version": "0.10.0",
+	"version": "0.11.0",
 	"description": "Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.",
 	"license": "MIT OR Apache-2.0",
 	"repository": {
@@ -15,7 +15,6 @@
 		"repopilot": "bin/repopilot.js"
 	},
 	"scripts": {
-		"postinstall": "node scripts/install.js",
 		"test": "npm run test:npm",
 		"test:npm": "node --test tests/npm_wrapper.test.js",
 		"release:check": "bash scripts/verify-release.sh",
@@ -23,10 +22,16 @@
 	},
 	"files": [
 		"bin",
-		"scripts",
 		"README.md",
 		"LICENSE"
 	],
+	"optionalDependencies": {
+		"@repopilot/darwin-arm64": "0.11.0",
+		"@repopilot/darwin-x64": "0.11.0",
+		"@repopilot/linux-arm64-gnu": "0.11.0",
+		"@repopilot/linux-x64-gnu": "0.11.0",
+		"@repopilot/win32-x64-msvc": "0.11.0"
+	},
 	"keywords": [
 		"cli",
 		"audit",

package/scripts/install.js

@@ -1,141 +0,0 @@
-#!/usr/bin/env node
-
-const crypto = require("node:crypto");
-const fs = require("node:fs");
-const https = require("node:https");
-const os = require("node:os");
-const path = require("node:path");
-const { spawnSync } = require("node:child_process");
-
-const ROOT = path.join(__dirname, "..");
-const VENDOR_DIR = path.join(ROOT, "vendor");
-const PACKAGE_JSON = require(path.join(ROOT, "package.json"));
-
-function targetTriple(platform = process.platform, arch = process.arch) {
-  if (platform === "darwin" && arch === "x64") return "x86_64-apple-darwin";
-  if (platform === "darwin" && arch === "arm64") return "aarch64-apple-darwin";
-  if (platform === "linux" && arch === "x64") return "x86_64-unknown-linux-gnu";
-  if (platform === "linux" && arch === "arm64") return "aarch64-unknown-linux-gnu";
-  if (platform === "win32" && arch === "x64") return "x86_64-pc-windows-msvc";
-  throw new Error(`Unsupported platform: ${platform}/${arch}`);
-}
-
-function archiveExt(target) {
-  return target.endsWith("windows-msvc") ? "zip" : "tar.gz";
-}
-
-function assetName(version, target) {
-  return `repopilot-v${version}-${target}.${archiveExt(target)}`;
-}
-
-function releaseUrl(version, file) {
-  return `https://github.com/MykytaStel/repopilot/releases/download/v${version}/${file}`;
-}
-
-function download(url, destination) {
-  return new Promise((resolve, reject) => {
-    const file = fs.createWriteStream(destination);
-    https
-      .get(url, (response) => {
-        if (response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
-          file.close();
-          fs.rmSync(destination, { force: true });
-          download(response.headers.location, destination).then(resolve, reject);
-          return;
-        }
-        if (response.statusCode !== 200) {
-          file.close();
-          fs.rmSync(destination, { force: true });
-          reject(new Error(`Download failed (${response.statusCode}): ${url}`));
-          return;
-        }
-        response.pipe(file);
-        file.on("finish", () => file.close(resolve));
-      })
-      .on("error", (error) => {
-        file.close();
-        fs.rmSync(destination, { force: true });
-        reject(error);
-      });
-  });
-}
-
-function sha256(file) {
-  const hash = crypto.createHash("sha256");
-  hash.update(fs.readFileSync(file));
-  return hash.digest("hex");
-}
-
-function expectedChecksum(checksumText) {
-  const first = checksumText.trim().split(/\s+/)[0];
-  if (!/^[a-fA-F0-9]{64}$/.test(first)) {
-    throw new Error("Invalid checksum file format");
-  }
-  return first.toLowerCase();
-}
-
-function verifyChecksum(archivePath, checksumText) {
-  const expected = expectedChecksum(checksumText);
-  const actual = sha256(archivePath);
-  if (actual !== expected) {
-    throw new Error(`Checksum mismatch for ${path.basename(archivePath)}: expected ${expected}, got ${actual}`);
-  }
-}
-
-function extractArchive(archivePath, destination, target) {
-  fs.rmSync(destination, { recursive: true, force: true });
-  fs.mkdirSync(destination, { recursive: true });
-
-  const result = target.endsWith("windows-msvc")
-    ? spawnSync("powershell", ["-NoProfile", "-Command", `Expand-Archive -Force '${archivePath}' '${destination}'`], { stdio: "inherit" })
-    : spawnSync("tar", ["-xzf", archivePath, "-C", destination], { stdio: "inherit" });
-
-  if (result.status !== 0) {
-    throw new Error(`Failed to extract ${archivePath}`);
-  }
-}
-
-async function install() {
-  if (process.env.REPOPILOT_SKIP_DOWNLOAD === "1" || process.env.REPOPILOT_SKIP_DOWNLOAD === "true") {
-    console.log("Skipping RepoPilot binary download because REPOPILOT_SKIP_DOWNLOAD is set.");
-    return;
-  }
-
-  const target = targetTriple();
-  const version = PACKAGE_JSON.version;
-  const archive = assetName(version, target);
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "repopilot-"));
-  const archivePath = path.join(tmp, archive);
-  const checksumPath = `${archivePath}.sha256`;
-  const extractDir = path.join(tmp, "extract");
-  const binaryName = target.endsWith("windows-msvc") ? "repopilot.exe" : "repopilot";
-
-  try {
-    await download(releaseUrl(version, archive), archivePath);
-    await download(releaseUrl(version, `${archive}.sha256`), checksumPath);
-    verifyChecksum(archivePath, fs.readFileSync(checksumPath, "utf8"));
-    extractArchive(archivePath, extractDir, target);
-
-    fs.mkdirSync(VENDOR_DIR, { recursive: true });
-    fs.copyFileSync(path.join(extractDir, binaryName), path.join(VENDOR_DIR, binaryName));
-    fs.chmodSync(path.join(VENDOR_DIR, binaryName), 0o755);
-  } finally {
-    fs.rmSync(tmp, { recursive: true, force: true });
-  }
-}
-
-if (require.main === module) {
-  install().catch((error) => {
-    console.error(`Failed to install RepoPilot binary: ${error.message}`);
-    console.error("Set REPOPILOT_SKIP_DOWNLOAD=1 to skip download or REPOPILOT_BINARY_PATH to use an existing binary.");
-    process.exit(1);
-  });
-}
-
-module.exports = {
-  archiveExt,
-  assetName,
-  expectedChecksum,
-  targetTriple,
-  verifyChecksum,
-};

package/scripts/smoke-product.sh

@@ -1,266 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-
-BINARY=""
-REPO_PATH="$ROOT_DIR"
-TMP_DIR=""
-TMP_CREATED=0
-KEEP_TMP=0
-RUN_LEGACY=1
-
-usage() {
-  cat <<'EOF'
-Usage: scripts/smoke-product.sh [OPTIONS]
-
-Run product-readiness smoke checks against RepoPilot.
-
-Options:
-  --binary PATH      Use an already built repopilot binary.
-  --repo PATH        Repository or project path to smoke test. Defaults to this repo.
-  --tmp-dir PATH     Directory for generated smoke artifacts. Defaults to mktemp.
-  --keep-tmp         Keep generated smoke artifacts when using a temporary directory.
-  --skip-legacy      Skip hidden 0.x compatibility command checks.
-  -h, --help         Show this help message.
-
-Examples:
-  scripts/smoke-product.sh
-  scripts/smoke-product.sh --binary ./target/release/repopilot
-  scripts/smoke-product.sh --repo /path/to/project --keep-tmp
-EOF
-}
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --binary)
-      BINARY="${2:-}"
-      shift 2
-      ;;
-    --repo)
-      REPO_PATH="${2:-}"
-      shift 2
-      ;;
-    --tmp-dir)
-      TMP_DIR="${2:-}"
-      shift 2
-      ;;
-    --keep-tmp)
-      KEEP_TMP=1
-      shift
-      ;;
-    --skip-legacy)
-      RUN_LEGACY=0
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "Unknown argument: $1" >&2
-      usage >&2
-      exit 2
-      ;;
-  esac
-done
-
-if [[ -z "$REPO_PATH" ]]; then
-  echo "--repo cannot be empty" >&2
-  exit 2
-fi
-
-REPO_PATH="$(cd "$REPO_PATH" && pwd)"
-
-if [[ -z "$BINARY" ]]; then
-  if [[ ! -x "$ROOT_DIR/target/debug/repopilot" ]]; then
-    echo "==> Building debug binary for product smoke checks" >&2
-    cargo build --manifest-path "$ROOT_DIR/Cargo.toml"
-  fi
-  BINARY="$ROOT_DIR/target/debug/repopilot"
-else
-  case "$BINARY" in
-    /*) ;;
-    *)
-      BINARY="$(cd "$(dirname "$BINARY")" && pwd)/$(basename "$BINARY")"
-      ;;
-  esac
-fi
-
-if [[ ! -x "$BINARY" ]]; then
-  echo "RepoPilot binary is not executable: $BINARY" >&2
-  exit 3
-fi
-
-if [[ -z "$TMP_DIR" ]]; then
-  TMP_DIR="$(mktemp -d)"
-  TMP_CREATED=1
-else
-  rm -rf "$TMP_DIR"
-  mkdir -p "$TMP_DIR"
-  TMP_DIR="$(cd "$TMP_DIR" && pwd)"
-fi
-
-cleanup() {
-  if [[ "$TMP_CREATED" -eq 1 && "$KEEP_TMP" -eq 0 ]]; then
-    rm -rf "$TMP_DIR"
-  fi
-}
-trap cleanup EXIT
-
-run_repopilot() {
-  echo "==> repopilot $*" >&2
-  (
-    cd "$REPO_PATH"
-    "$BINARY" "$@"
-  )
-}
-
-assert_non_empty() {
-  local file="$1"
-  if [[ ! -s "$file" ]]; then
-    echo "Expected non-empty file: $file" >&2
-    exit 3
-  fi
-}
-
-assert_contains() {
-  local file="$1"
-  local expected="$2"
-
-  if ! grep -Fq "$expected" "$file"; then
-    echo "Expected '$file' to contain: $expected" >&2
-    echo "---- file content ----" >&2
-    cat "$file" >&2 || true
-    echo "----------------------" >&2
-    exit 3
-  fi
-}
-
-validate_json_if_possible() {
-  local file="$1"
-
-  if command -v python3 >/dev/null 2>&1; then
-    python3 -m json.tool "$file" >/dev/null
-  fi
-}
-
-find_explain_file() {
-  local preferred="$REPO_PATH/src/main.rs"
-
-  if [[ -f "$preferred" ]]; then
-    printf '%s\n' "$preferred"
-    return 0
-  fi
-
-  local discovered=""
-  while IFS= read -r candidate; do
-    discovered="$candidate"
-    break
-  done < <(
-    find "$REPO_PATH" \
-      -path "$REPO_PATH/.git" -prune -o \
-      -path "$REPO_PATH/target" -prune -o \
-      -path "$REPO_PATH/node_modules" -prune -o \
-      -type f \( \
-        -name '*.rs' -o \
-        -name '*.ts' -o \
-        -name '*.tsx' -o \
-        -name '*.js' -o \
-        -name '*.jsx' -o \
-        -name '*.py' -o \
-        -name '*.go' \
-      \) \
-      -print
-  )
-
-  if [[ -n "$discovered" && -f "$discovered" ]]; then
-    printf '%s\n' "$discovered"
-    return 0
-  fi
-
-  printf '%s\n' "$REPO_PATH/Cargo.toml"
-}
-
-EXPLAIN_FILE="$(find_explain_file)"
-
-echo "==> RepoPilot product smoke suite"
-echo "Binary: $BINARY"
-echo "Repo:   $REPO_PATH"
-echo "Tmp:    $TMP_DIR"
-echo
-
-run_repopilot --version > "$TMP_DIR/version.txt"
-assert_non_empty "$TMP_DIR/version.txt"
-
-run_repopilot --help > "$TMP_DIR/help.txt"
-assert_non_empty "$TMP_DIR/help.txt"
-assert_contains "$TMP_DIR/help.txt" "scan"
-assert_contains "$TMP_DIR/help.txt" "review"
-assert_contains "$TMP_DIR/help.txt" "ai"
-assert_contains "$TMP_DIR/help.txt" "inspect"
-
-run_repopilot init --force --path "$TMP_DIR/repopilot.toml"
-assert_non_empty "$TMP_DIR/repopilot.toml"
-
-run_repopilot doctor . --format markdown --output "$TMP_DIR/doctor.md"
-assert_non_empty "$TMP_DIR/doctor.md"
-
-run_repopilot scan . --format json --output "$TMP_DIR/scan.json" --receipt "$TMP_DIR/receipt.json"
-assert_non_empty "$TMP_DIR/scan.json"
-validate_json_if_possible "$TMP_DIR/scan.json"
-assert_non_empty "$TMP_DIR/receipt.json"
-validate_json_if_possible "$TMP_DIR/receipt.json"
-
-run_repopilot scan . --format markdown --output "$TMP_DIR/scan.md"
-assert_non_empty "$TMP_DIR/scan.md"
-
-if git -C "$REPO_PATH" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-  run_repopilot review . --format markdown --output "$TMP_DIR/review.md"
-  assert_non_empty "$TMP_DIR/review.md"
-else
-  echo "==> Skipping review smoke check because repo path is not inside a Git worktree" >&2
-fi
-
-run_repopilot ai context . --focus security --budget 2k --output "$TMP_DIR/ai-context.md"
-assert_non_empty "$TMP_DIR/ai-context.md"
-
-run_repopilot ai plan . --focus all --budget 2k --output "$TMP_DIR/ai-plan.md"
-assert_non_empty "$TMP_DIR/ai-plan.md"
-
-run_repopilot ai prompt . --focus quality --budget 2k --output "$TMP_DIR/ai-prompt.md"
-assert_non_empty "$TMP_DIR/ai-prompt.md"
-
-run_repopilot inspect knowledge --format json --output "$TMP_DIR/inspect-knowledge.json"
-assert_non_empty "$TMP_DIR/inspect-knowledge.json"
-validate_json_if_possible "$TMP_DIR/inspect-knowledge.json"
-
-run_repopilot inspect knowledge --section rules --format markdown --output "$TMP_DIR/inspect-knowledge-rules.md"
-assert_non_empty "$TMP_DIR/inspect-knowledge-rules.md"
-
-run_repopilot inspect explain "$EXPLAIN_FILE" --format json --output "$TMP_DIR/inspect-explain.json"
-assert_non_empty "$TMP_DIR/inspect-explain.json"
-validate_json_if_possible "$TMP_DIR/inspect-explain.json"
-
-if [[ "$RUN_LEGACY" -eq 1 ]]; then
-  run_repopilot vibe . --focus security --budget 2k --output "$TMP_DIR/legacy-vibe.md"
-  assert_non_empty "$TMP_DIR/legacy-vibe.md"
-
-  run_repopilot harden . --focus all --budget 2k --output "$TMP_DIR/legacy-harden.md"
-  assert_non_empty "$TMP_DIR/legacy-harden.md"
-
-  run_repopilot prompt . --focus quality --budget 2k --output "$TMP_DIR/legacy-prompt.md"
-  assert_non_empty "$TMP_DIR/legacy-prompt.md"
-
-  run_repopilot knowledge --format json --output "$TMP_DIR/legacy-knowledge.json"
-  assert_non_empty "$TMP_DIR/legacy-knowledge.json"
-  validate_json_if_possible "$TMP_DIR/legacy-knowledge.json"
-
-  run_repopilot explain "$EXPLAIN_FILE" --format json --output "$TMP_DIR/legacy-explain.json"
-  assert_non_empty "$TMP_DIR/legacy-explain.json"
-  validate_json_if_possible "$TMP_DIR/legacy-explain.json"
-fi
-
-echo
-echo "==> Product smoke suite passed"
-echo "Artifacts: $TMP_DIR"

package/scripts/verify-release.sh

@@ -1,84 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$ROOT_DIR"
-
-echo "==> RepoPilot release verification"
-
-echo "==> Rust formatting"
-cargo fmt --all -- --check
-
-echo "==> Rust clippy"
-cargo clippy --all-targets --all-features -- -D warnings
-
-echo "==> Rust tests"
-cargo test --all
-
-echo "==> Rust dependency security audit"
-cargo audit
-
-echo "==> Cargo dependency policy"
-cargo deny check advisories licenses
-
-echo "==> Shell script syntax"
-scripts=()
-if [[ -f install.sh ]]; then
-  scripts+=(install.sh)
-fi
-if [[ -d scripts ]]; then
-  while IFS= read -r -d '' script; do
-    scripts+=("$script")
-  done < <(find scripts -maxdepth 1 -type f -name '*.sh' -print0)
-fi
-
-if ((${#scripts[@]} > 0)); then
-  for script in "${scripts[@]}"; do
-    bash -n "$script"
-  done
-
-  echo "==> ShellCheck"
-  shellcheck "${scripts[@]}"
-else
-  echo "==> No shell scripts found"
-fi
-
-echo "==> GitHub Actions validation"
-workflows=()
-if [[ -d .github/workflows ]]; then
-  while IFS= read -r -d '' workflow; do
-    workflows+=("$workflow")
-  done < <(find .github/workflows -maxdepth 1 -type f \( -name '*.yml' -o -name '*.yaml' \) -print0)
-fi
-
-if ((${#workflows[@]} > 0)); then
-  actionlint "${workflows[@]}"
-else
-  echo "==> No GitHub Actions workflows found"
-fi
-
-echo "==> CLI release smoke tests"
-cargo test --test cli_release_smoke
-
-echo "==> Cargo package contents"
-cargo package --list
-
-echo "==> Cargo publish dry-run"
-cargo publish --dry-run
-
-echo "==> npm wrapper tests"
-npm run test:npm
-
-echo "==> npm package dry-run"
-npm pack --dry-run
-
-echo "==> Build release binary"
-cargo build --release
-
-echo "==> Product readiness smoke suite"
-./scripts/smoke-product.sh \
-  --binary ./target/release/repopilot \
-  --repo . \
-  --tmp-dir /tmp/repopilot-release-smoke
-
-echo "==> Release verification passed"