repopilot 0.11.0 → 0.13.0

package/README.md

@@ -7,102 +7,46 @@
 [![License](https://img.shields.io/crates/l/repopilot.svg)](LICENSE)
 [![GitHub Stars](https://img.shields.io/github/stars/MykytaStel/repopilot?style=social)](https://github.com/MykytaStel/repopilot)
 
-Audit your repository locally, turn the results into AI-ready remediation context,
-and ship safer changes without sending source code to a hosted scanner.
+**Local-first repository audits for safer human and AI-assisted code changes.**
 
-RepoPilot is a local-first CLI for architecture, security, code quality, testing,
-and framework health checks. It gives developers useful terminal reports, CI gates,
-SARIF for GitHub Code Scanning, and Markdown briefs that can be pasted into Claude
-Code, ChatGPT, Cursor, or another coding assistant.
+RepoPilot is a fast Rust CLI that scans a repository locally, ranks evidence-backed risks, supports baseline adoption, reviews branches, and creates AI-ready remediation context without uploading source code.
 
-Version `0.11.0` is a signal quality and CI polish release: it reduces
-low-value self-audit findings, adds first-party Action parity for priority/rule
-filters, and tightens the `doctor -> scan/review -> ai context -> CI gate` loop
-while keeping all scans local.
-
-## Why RepoPilot?
-
-Most linters and audit tools stop at the terminal. RepoPilot bridges the gap to your AI assistant:
-
-| | SonarQube / CodeClimate | ESLint / language linters | **RepoPilot** |
-|---|---|---|---|
-| Runs offline | ❌ | ✅ | ✅ |
-| No code upload | ❌ | ✅ | ✅ |
-| Cross-language architecture analysis | ✅ | ❌ | ✅ |
-| LLM-ready output | ❌ | ❌ | ✅ |
-| Fits in a model context window | ❌ | ❌ | ✅ |
-| CI gate on new findings only | ✅ | partial | ✅ |
-
-```bash
-repopilot ai context . | pbcopy   # macOS: paste into your coding assistant
+```text
+scan -> review risk -> baseline adoption -> CI evidence -> local AI context
 ```
 
-## Features
-
-- Repository scanning for projects, folders, and individual files
-- Gitignore-aware walking with built-in ignores for common build, cache, vendor, and native platform directories
-- Architecture findings: oversized files, deep nesting, deep relative imports, risky barrel files, too many modules per directory
-- Coupling analysis: excessive fan-out, high-instability hubs, circular dependencies
-- Code quality findings: cyclomatic complexity density, long functions, TODO/FIXME/HACK markers
-- Security findings: hardcoded secret candidates, committed private keys, committed `.env` files
-- Testing findings: missing test folder, source files without test counterparts
-- Framework findings for JavaScript, React, React Native, Expo, and Django projects
-- React Native architecture profile: project kind, New Architecture, Hermes, Codegen, platform mismatch, and package manager signals
-- Workspace scanning (`--workspace`) for npm, yarn, pnpm, and Cargo workspaces with per-package risk summary — parallel per-package scans
-- Evidence-backed findings with stable rule IDs, severity, file paths, line numbers, and snippets
-- 46 built-in rules with titles, descriptions, recommendations, and docs links
-- `repopilot.toml` configuration generated by `repopilot init`
-- Configuration presets (`--preset strict|balanced|lenient`) for quick threshold tuning
-- Baseline workflow for accepting existing findings in legacy repositories
-- CI-friendly failure thresholds with `--fail-on`
-- Git diff-aware review mode for prioritizing findings introduced by changed lines
-- Doctor adoption guidance for config, baseline, CI gate, report, and receipt readiness
-- Audit receipt JSON from `repopilot scan --receipt` for reproducible scan evidence
-- Console, JSON, Markdown, HTML, and SARIF (2.1.0) scan output — SARIF includes per-result category and workspace package properties
-- First-party GitHub Action wrapper for `scan`, `review`, `compare`, and `ai` workflows, with optional SARIF upload and receipt output for scans
-- Compare mode for diffing two JSON scan reports
-- **`repopilot ai context`** — formats scan output as LLM-ready markdown, paste into Claude Code or ChatGPT to start remediating
-- **`repopilot ai plan`** — turns findings into a prioritized remediation plan
-- **`repopilot ai prompt`** — exports an AI-ready remediation prompt with RepoPilot context
-
-See [docs/rulesets.md](docs/rulesets.md) for the full list of rules and severity levels.
+RepoPilot is not a replacement for language linters, formatters, type checkers, or dedicated security scanners. It complements them with repository-level evidence: secrets, runtime footguns, architecture risk, review blast radius, baseline status, and report formats that work in CI.
 
 ## Install
 
+Choose one install method.
+
+Cargo:
+
 ```bash
 cargo install repopilot
 ```
 
-Install with npm:
+npm:
 
 ```bash
 npm install -g repopilot
 ```
 
-Install with Homebrew:
+Homebrew:
 
 ```bash
 brew tap mykytastel/repopilot
 brew install repopilot
 ```
 
-Install with curl (Linux/macOS):
+Installer:
 
 ```bash
 curl -fsSL https://raw.githubusercontent.com/MykytaStel/repopilot/main/install.sh | bash
 ```
 
-The curl installer verifies the GitHub Release SHA256 checksum and aborts if the checksum cannot be downloaded or verified.
-
-Upgrade:
-
-```bash
-cargo install repopilot --force
-npm update -g repopilot
-brew update && brew upgrade repopilot
-```
-
-Build from source:
+From source:
 
 ```bash
 git clone https://github.com/MykytaStel/repopilot.git
@@ -110,377 +54,188 @@ cd repopilot
 cargo build --release
 ```
 
+More: [docs/install.md](docs/install.md).
+
 ## Quick Start
 
-No config needed. Run this in any repository and see findings immediately:
+Run a local scan:
 
 ```bash
 repopilot scan .
+repopilot doctor .
 ```
 
-Then get an AI-ready brief to paste into Claude Code, Cursor, or ChatGPT:
+Adopt RepoPilot in an existing repository without failing CI on old debt:
 
 ```bash
-repopilot ai context . | pbcopy   # macOS — copies to clipboard
-repopilot ai context .            # print to terminal
+repopilot baseline create . --output .repopilot/baseline.json
+repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high
 ```
 
-That's the two-minute loop. Scan, read the output, paste the context into your assistant, fix.
-
-### Going deeper
-
-Once you want CI integration, baseline tracking, or tighter configuration:
+Review a branch:
 
 ```bash
-repopilot init                                              # generate repopilot.toml
-repopilot doctor .                                          # check CI / baseline readiness
-repopilot scan . --min-priority p2 --rule security.secret-candidate
-repopilot ai context . --focus security                     # prepare local AI context
-repopilot baseline create .                                 # accept existing findings as known debt
-repopilot review . --base origin/main --fail-on-priority p1 # CI gate on high-priority risk
+repopilot review . --base origin/main
 ```
 
-Save a shareable report:
+Generate local AI context:
 
 ```bash
-repopilot scan . --format markdown --output repopilot-report.md --receipt .repopilot/receipt.json
+repopilot ai context . --budget 4k
 ```
 
-Reduce scan noise while iterating:
+Save CI evidence:
 
 ```bash
-repopilot scan . --min-severity high
-repopilot scan . --workspace --min-severity medium
-repopilot scan . --exclude fixtures --max-file-size 1mb --max-files 500
+repopilot scan . --format markdown --output repopilot-report.md
+repopilot scan . --format json --output repopilot-report.json --receipt .repopilot/receipt.json
+repopilot scan . --format sarif --output repopilot.sarif
 ```
 
-By default, RepoPilot skips low-signal audit paths such as tests, fixtures, examples, generated files, and benchmarks. Use `--include-low-signal` when you want those paths analyzed too.
+## What It Checks
 
-## Local-First AI Workflow
+| Area | Examples |
+|---|---|
+| Security | secret candidates, private keys, committed `.env` files |
+| Runtime risk | Rust panic/unwrap paths, JavaScript/Python/Go/JVM/.NET process exits |
+| Architecture | circular dependencies, excessive fan-out, instability hubs |
+| Review risk | changed files, branch context, blast radius |
+| Adoption | baselines, new-vs-existing findings, CI gates |
+| Evidence | JSON, Markdown, SARIF, receipts, report envelopes |
+| AI context | local, budgeted, evidence-backed Markdown for coding assistants |
 
-RepoPilot does not call LLM APIs. AI commands scan local files and produce Markdown
-that you decide where to paste.
+## Trust Mode
 
-`repopilot ai context` scans a project and formats all findings as structured markdown ready to paste into Claude Code, Cursor, ChatGPT, or any LLM assistant. It includes a risk level, tech stack summary, findings grouped by category with evidence snippets and fix recommendations, and a token-count estimate.
+Default scans are intentionally quiet. They keep high-trust security, runtime, and import-graph findings visible while summarizing broad maintainability and testing suggestions as strict-only noise.
 
 ```bash
-# Paste into Claude Code or ChatGPT
-repopilot ai context .
-
-# Focus on security only, keep it short
-repopilot ai context . --focus security --budget 2k
-
-# Save to file
-repopilot ai context . --output repopilot-context.md
-
-# Pipe directly into clipboard (macOS)
-repopilot ai context . --no-header | pbcopy
-```
-
-## Example Output
-
+repopilot scan .                  # compact default output
+repopilot scan . --output-style full
+repopilot scan . --profile strict # full audit output
 ```
-$ repopilot ai context .
-
-# RepoPilot Vibe Check — my-app
 
-**Risk Level:** 🟠 ELEVATED
-**Tech Stack:** React Native (New Arch), Expo, TypeScript
-**Size:** 94 files · 8,340 LOC · ~42k tokens
-**Health:** 18 findings · 2.2/kloc — 4 high, 9 medium
+Use strict mode for cleanup passes, rule development, and release hardening. Use the default profile for day-to-day local checks and CI gates.
 
-## Security (2 high)
-1. [HIGH] Possible secret detected — `src/config/api.ts:12`
-   ```
-   const API_KEY = "sk_live_…"
-   ```
-   > **Fix:** Move to environment variables or a secrets manager.
+More: [docs/trust-mode.md](docs/trust-mode.md).
 
-## Architecture (2 high)
-1. [HIGH] Circular dependency detected — `src/store/index.ts`
-   > **Fix:** Extract shared types to a separate module to break the cycle.
+## Core Commands
 
-## Top Recommendations
-1. **Move hardcoded API key** (src/config/api.ts:12) — use process.env or a vault
-2. **Break circular dependency** (src/store/index.ts) — extract shared types
-
----
-*~3.8k tokens (budget: 4k) · scanned in 312ms — paste into Claude Code, Cursor, or ChatGPT*
+```text
+scan | review | baseline | compare | doctor | inspect | ai | init | cache
 ```
 
-Paste this into a coding assistant and ask for a focused patch. For larger
-repositories, start with one focus area instead of asking for every finding at
-once.
-
-## Recommended Remediation Loop
-
-RepoPilot is a local-first safety layer for AI-assisted and vibe-coded changes. Run it after generating or refactoring code to catch newly introduced high-risk findings, workspace hotspots, missing tests, and architecture drift without uploading source code to an external service.
+Common workflows:
 
 ```bash
-repopilot ai context . --focus security    # get an LLM brief for Claude Code
-repopilot ai plan . --focus security       # get a prioritized hardening plan
-repopilot ai prompt . --budget 8k          # generate a paste-ready remediation prompt
-repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on-priority p1
-repopilot scan . --workspace --min-severity medium --format markdown --output repopilot-report.md
+repopilot scan .
+repopilot review . --base origin/main
+repopilot baseline create .
+repopilot compare before.json after.json
+repopilot inspect rules
+repopilot inspect eval-rules --format json
+repopilot ai context .
 ```
 
-## Commands
+More: [docs/commands.md](docs/commands.md) and [docs/cli.md](docs/cli.md).
 
-| Command | Alias | Description |
-|---------|-------|-------------|
-| `repopilot scan <path>` | `s` | Scan a project, folder, or file for findings |
-| `repopilot review [path]` | `r` | Review findings that touch changed Git diff lines |
-| `repopilot ai context <path>` | — | LLM-ready context from a scan |
-| `repopilot ai plan <path>` | — | Prioritized remediation plan |
-| `repopilot ai prompt <path>` | — | AI-ready remediation prompt |
-| `repopilot compare <before> <after>` | `cmp` | Compare two JSON scan reports and show what changed |
-| `repopilot baseline create <path>` | `bl` | Scan a path and store current findings as accepted debt |
-| `repopilot doctor [path]` | `d` | Diagnose audit readiness |
-| `repopilot init` | — | Generate a default `repopilot.toml` configuration file |
+## Baseline Adoption
 
-Use `--help` on any command for the full description and examples:
+A baseline records current findings as accepted existing debt. Future scans can fail only on newly introduced risk:
 
 ```bash
-repopilot --help
-repopilot scan --help
-repopilot review --help
-repopilot baseline create --help
+repopilot baseline create . --output .repopilot/baseline.json
+git add .repopilot/baseline.json
+repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high
 ```
 
-## Configuration
+Review baseline updates like code changes. A baseline is not a suppression file; it is a CI adoption contract.
 
-RepoPilot automatically reads `repopilot.toml` from the current working directory when running `scan`.
+## Rule Quality
 
-Configuration precedence:
+Rules move through a lifecycle:
 
 ```text
-CLI args > repopilot.toml > built-in defaults
+experimental -> preview -> stable
 ```
 
-Generate a default config:
+Before a rule becomes stable or default-visible, it should have metadata, true-positive and false-positive fixtures, stable finding IDs, concrete evidence, false-positive notes, recommendations, and clean local evaluation:
 
 ```bash
-repopilot init
-repopilot init --force
-repopilot init --path ./repopilot.toml
+repopilot inspect eval-rules --format json
 ```
 
-Use an explicit config path:
+More: [docs/rule-quality-gate.md](docs/rule-quality-gate.md).
 
-```bash
-repopilot scan . --config repopilot.toml
-```
+## Local-First
 
-Example `repopilot.toml`:
-
-```toml
-[scan]
-ignore = [
-  ".git",
-  ".github",
-  ".repopilot",
-  "target",
-  "node_modules",
-  "dist",
-  "build",
-  ".next",
-  ".nuxt",
-  ".cache",
-  "coverage",
-  "vendor",
-  "Pods",
-  "DerivedData"
-]
-max_file_bytes = 2097152
-
-[architecture]
-max_file_lines = 300
-huge_file_lines = 1000
-max_directory_modules = 20
-max_directory_depth = 5
-max_function_lines = 50
-max_fan_out = 15
-instability_hub_min_fan_in = 5
-instability_hub_min_instability_pct = 75
-
-[testing]
-detect_missing_tests = true
-
-[security]
-detect_secret_like_names = true
-
-[output]
-default_format = "console"
-```
+RepoPilot does not upload source code, run a hosted scanner, call LLM APIs implicitly, send telemetry, or require a SaaS account.
 
-CLI threshold overrides:
+AI commands only format local scan evidence as Markdown for tools such as Claude Code, ChatGPT, Cursor, Zed, or another assistant.
 
-```bash
-repopilot scan . --max-file-loc 500
-repopilot scan . --max-directory-modules 25
-repopilot scan . --max-directory-depth 6
-repopilot scan . --max-file-size 1mb
-repopilot scan . --max-files 1000
-repopilot scan . --exclude generated
-repopilot scan . --include-low-signal
-```
+## Reports
 
-`--max-file-size` accepts raw bytes or `kb`, `mb`, and `gb` suffixes. `--exclude` matches an exact path relative to the scan root or a file/directory name; repeat it for multiple paths.
+| Format | Use case |
+|---|---|
+| Console | fast local feedback |
+| Markdown | PR comments and human-readable reports |
+| JSON | automation and internal tooling |
+| SARIF | GitHub Code Scanning |
+| HTML | shareable local reports |
+| Receipt | compact release/CI evidence |
 
-JSON output includes scan input accounting fields: `files_discovered` for files found after ignore/exclude filters, `files_count` for analyzed text files, `files_skipped_low_signal` for default low-signal skips, and `binary_files_skipped` for unreadable/binary files.
+More: [docs/reports.md](docs/reports.md).
 
-## Baseline Workflow
+## CI
 
-Existing repositories often have findings that cannot all be fixed before adopting a new audit tool. A baseline stores accepted existing findings so future scans can distinguish new findings from existing ones.
+Minimal baseline-aware gate:
 
 ```bash
-repopilot baseline create .
-repopilot scan . --baseline .repopilot/baseline.json
 repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high
 ```
 
-By default, `baseline create` writes `.repopilot/baseline.json` and creates the `.repopilot/` directory if needed. Use `--output ./baseline.json` for a custom path. Existing baseline files are not overwritten unless you pass `--force`.
-
-Baseline files store accepted existing findings. Future scans can mark findings as `new` or `existing`, which is useful for legacy repositories and CI. Do not refresh a baseline blindly unless the team accepts those findings as technical debt.
-
-## Review Workflow
-
-Use `review` when you want RepoPilot to focus on findings that touch changed Git diff lines.
-
-```bash
-repopilot review .
-repopilot review . --format json --output review.json
-repopilot review . --baseline .repopilot/baseline.json --fail-on new-high
-```
-
-By default, `review` compares the working tree against `HEAD`, including staged, unstaged, and untracked files. For branch or CI review, pass a base ref:
-
-```bash
-repopilot review . --base origin/main
-repopilot review . --base origin/main --head HEAD --format markdown
-```
-
-Review mode still scans the repository with the normal rules, but separates findings into in-diff and out-of-diff groups. When import coupling data is available, it also shows blast radius: files that import changed files and may need extra review. When `--fail-on` is used, the CI gate evaluates only in-diff findings.
-
-## Output Formats
+GitHub Code Scanning:
 
 ```bash
-repopilot scan . --format console
-repopilot scan . --format json --output report.json
-repopilot scan . --format markdown --output report.md
-repopilot scan . --format html --output report.html
 repopilot scan . --format sarif --output repopilot.sarif
 ```
 
-### SARIF output
+Release smoke:
 
 ```bash
-repopilot scan . --format sarif --output repopilot.sarif
+./scripts/smoke-product.sh
 ```
 
-If your installed RepoPilot version does not support `--output`, redirect stdout instead:
+More: [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md).
 
-```bash
-repopilot scan . --format sarif > repopilot.sarif
-```
-
-Use JSON when custom scripts need to parse RepoPilot results. Console, Markdown, and HTML reports include the RepoPilot version, risk summary, top risk clusters, top rules, and grouped findings for human review. Use SARIF for CI and code scanning integrations, including GitHub Code Scanning.
-Use `--receipt <path>` with `scan` when CI or release processes need compact evidence of the exact RepoPilot version, git state, scan scope, finding counts, language counts, and health score.
+## Documentation
 
-See [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) for a copy-paste GitHub Actions workflow, required permissions, and local validation commands.
+| Document | Purpose |
+|---|---|
+| [Install](docs/install.md) | Cargo, npm, Homebrew, curl, and source builds |
+| [Commands](docs/commands.md) | Task-oriented workflows |
+| [CLI](docs/cli.md) | Complete command and flag reference |
+| [Configuration](docs/configuration.md) | `repopilot.toml`, presets, ignores, and baselines |
+| [Rulesets](docs/rulesets.md) | Built-in rules, lifecycle, severity, and confidence |
+| [Trust Mode](docs/trust-mode.md) | Default vs strict visibility policy |
+| [Reports](docs/reports.md) | JSON, SARIF, Markdown, HTML, receipts, and schema fields |
+| [Release Process](docs/release.md) | Local and CI release gates |
 
-Compare two JSON reports:
+## Development
 
 ```bash
-repopilot scan . --format json --output before.json
-repopilot scan . --format json --output after.json
-repopilot compare before.json after.json
-repopilot compare before.json after.json --format markdown
-repopilot compare before.json after.json --format json --output diff.json
+cargo fmt --all -- --check
+cargo clippy --all-targets --all-features -- -D warnings
+cargo test --all
+npm run test:npm
+./scripts/smoke-product.sh
 ```
 
-## CI Usage
+Run rule evaluation from source:
 
-Use `--fail-on new-high` to fail CI only when new high or critical findings are introduced. Supported new-finding thresholds are `new-low`, `new-medium`, `new-high`, and `new-critical`.
-
-When `--fail-on new-*` is used without `--baseline`, RepoPilot treats all current findings as new. For baseline-based adoption, commit an accepted baseline and scan against it in CI.
-
-To upload RepoPilot findings to GitHub Code Scanning, generate SARIF and use `github/codeql-action/upload-sarif`. The workflow must include `security-events: write`.
-The first-party action can also run `command: doctor`, `command: ai-context`, `command: ai-plan`, or `command: ai-prompt`; AI commands emit Markdown and do not produce SARIF. Prefer typed action inputs such as `path`, `config`, `baseline`, `fail-on`, `fail-on-priority`, `min-priority`, `rule`, `timing`, `focus`, `budget`, `output`, and `receipt`; `args` remains available for advanced flags.
-
-```yaml
-name: RepoPilot
-
-on:
-  pull_request:
-
-permissions:
-  contents: read
-  security-events: write
-
-jobs:
-  repopilot:
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v5
-
-      - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
-
-      - name: Install RepoPilot
-        run: cargo install repopilot
-
-      - name: Run RepoPilot
-        run: repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high --receipt repopilot-receipt.json
-
-      - name: Run RepoPilot (SARIF)
-        run: repopilot scan . --format sarif --output repopilot.sarif
-
-      - name: Upload to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@v4
-        if: always()
-        with:
-          sarif_file: repopilot.sarif
-
-      - name: Upload audit receipt
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: repopilot-receipt
-          path: repopilot-receipt.json
+```bash
+cargo run -- inspect eval-rules --format json
 ```
 
-## Roadmap
-
-These are planned ideas, not current features:
-
-- Change Risk Map
-- Better architecture drift detection
-
-## Documentation
-
-| Document | Description |
-|---|---|
-| [docs/install.md](docs/install.md) | Installation options for Cargo, npm, Homebrew, curl, and source builds |
-| [docs/ai-workflows.md](docs/ai-workflows.md) | Claude Code, ChatGPT, Cursor, and AI remediation workflows |
-| [docs/security.md](docs/security.md) | Local-first trust model, installer security, and vulnerability reporting |
-| [docs/configuration.md](docs/configuration.md) | `repopilot.toml`, presets, ignore files, and baseline adoption |
-| [docs/language-support.md](docs/language-support.md) | Supported language/framework tiers, rule families, and limitations |
-| [docs/risk-engine.md](docs/risk-engine.md) | Risk scoring, priority buckets, signals, and calibration policy |
-| [docs/cli.md](docs/cli.md) | Complete CLI reference — all commands, flags, and exit codes |
-| [docs/commands.md](docs/commands.md) | Task-oriented command guide and common patterns |
-| [docs/rulesets.md](docs/rulesets.md) | Implemented audit rules, categories, and severity levels |
-| [docs/react-native.md](docs/react-native.md) | React Native and Expo detection, findings, and limitations |
-| [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) | GitHub Code Scanning SARIF workflow |
-| [docs/release.md](docs/release.md) | Manual release process |
-| [docs/release-announcement-0.11.md](docs/release-announcement-0.11.md) | 0.11.0 launch post and post-publish checks |
-| [docs/release-checklist-0.11.md](docs/release-checklist-0.11.md) | 0.11.0 release readiness checklist |
-| [docs/release-checklist-0.10.md](docs/release-checklist-0.10.md) | 0.10.0 release readiness checklist |
-| [docs/distribution.md](docs/distribution.md) | Distribution channels |
-| [docs/github-ruleset.md](docs/github-ruleset.md) | GitHub branch ruleset configuration |
-| [CHANGELOG.md](CHANGELOG.md) | Version history |
-
 ## License
 
-RepoPilot is licensed under MIT OR Apache-2.0.
+RepoPilot is licensed under **MIT OR Apache-2.0**.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "repopilot",
-	"version": "0.11.0",
+	"version": "0.13.0",
 	"description": "Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.",
 	"license": "MIT OR Apache-2.0",
 	"repository": {
@@ -26,11 +26,11 @@
 		"LICENSE"
 	],
 	"optionalDependencies": {
-		"@repopilot/darwin-arm64": "0.11.0",
-		"@repopilot/darwin-x64": "0.11.0",
-		"@repopilot/linux-arm64-gnu": "0.11.0",
-		"@repopilot/linux-x64-gnu": "0.11.0",
-		"@repopilot/win32-x64-msvc": "0.11.0"
+		"@repopilot/darwin-arm64": "0.13.0",
+		"@repopilot/darwin-x64": "0.13.0",
+		"@repopilot/linux-arm64-gnu": "0.13.0",
+		"@repopilot/linux-x64-gnu": "0.13.0",
+		"@repopilot/win32-x64-msvc": "0.13.0"
 	},
 	"keywords": [
 		"cli",