repopilot 0.14.0 → 0.16.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +63 -185
  2. package/package.json +11 -8
package/README.md CHANGED
@@ -5,237 +5,121 @@
5
5
  [![CI](https://github.com/MykytaStel/repopilot/actions/workflows/ci.yaml/badge.svg)](https://github.com/MykytaStel/repopilot/actions)
6
6
  [![GitHub Release](https://img.shields.io/github/v/release/MykytaStel/repopilot)](https://github.com/MykytaStel/repopilot/releases)
7
7
  [![License](https://img.shields.io/crates/l/repopilot.svg)](LICENSE)
8
- [![GitHub Stars](https://img.shields.io/github/stars/MykytaStel/repopilot?style=social)](https://github.com/MykytaStel/repopilot)
9
8
 
10
- **Local-first repository audits for safer human and AI-assisted code changes.**
9
+ **Review what you or an AI agent changed before you merge.**
11
10
 
12
- RepoPilot is a fast Rust CLI that scans a repository locally, ranks evidence-backed risks, supports baseline adoption, reviews branches, and creates AI-ready remediation context without uploading source code.
11
+ RepoPilot is a fast, local-first Rust CLI for Git change review. It flags
12
+ security-boundary changes, behavioral and algorithmic shifts, taint-lite flows,
13
+ and blast radius so maintainers can focus on the parts of a diff that deserve
14
+ extra attention. It is deterministic, runs entirely on your machine, and can be
15
+ called by coding agents over MCP. Nothing is uploaded.
13
16
 
14
17
  ```text
15
- scan -> review risk -> baseline adoption -> CI evidence -> local AI context
18
+ git diff -> boundary + behavior + taint + blast radius -> review or CI gate
16
19
  ```
17
20
 
18
- RepoPilot is not a replacement for language linters, formatters, type checkers, or dedicated security scanners. It complements them with repository-level evidence: secrets, runtime footguns, architecture risk, review blast radius, baseline status, and report formats that work in CI.
21
+ <p align="center">
22
+ <img src="https://raw.githubusercontent.com/MykytaStel/repopilot/main/docs/demos/02-review.gif" alt="RepoPilot reviewing a branch change" width="800">
23
+ </p>
19
24
 
20
- ## Install
21
-
22
- Choose one install method.
25
+ > RepoPilot reports structural evidence, not a security verdict. Use it beside
26
+ > tests, linters, type checkers, and dedicated security tools.
23
27
 
24
- Cargo:
28
+ ## Install
25
29
 
26
30
  ```bash
27
31
  cargo install repopilot
28
- ```
29
-
30
- npm:
31
-
32
- ```bash
32
+ # or
33
33
  npm install -g repopilot
34
34
  ```
35
35
 
36
- Homebrew:
37
-
38
- ```bash
39
- brew tap mykytastel/repopilot
40
- brew install repopilot
41
- ```
42
-
43
- Installer:
44
-
45
- ```bash
46
- curl -fsSL https://raw.githubusercontent.com/MykytaStel/repopilot/main/install.sh | bash
47
- ```
48
-
49
- From source:
50
-
51
- ```bash
52
- git clone https://github.com/MykytaStel/repopilot.git
53
- cd repopilot
54
- cargo build --release
55
- ```
56
-
57
- More: [docs/install.md](docs/install.md).
36
+ Homebrew, curl, GitHub Releases, and source builds are documented in
37
+ [Installation](https://github.com/MykytaStel/repopilot/blob/main/docs/install.md).
58
38
 
59
- ## Quick Start
39
+ ## Review A Change
60
40
 
61
- Run a local scan:
41
+ Review the working tree against `HEAD`:
62
42
 
63
43
  ```bash
64
- repopilot scan .
65
- repopilot doctor .
66
- ```
67
-
68
- Adopt RepoPilot in an existing repository without failing CI on old debt:
69
-
70
- ```bash
71
- repopilot baseline create . --output .repopilot/baseline.json
72
- repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high
44
+ repopilot review .
73
45
  ```
74
46
 
75
- Review a branch:
47
+ Review a branch before merge:
76
48
 
77
49
  ```bash
78
50
  repopilot review . --base origin/main
79
51
  ```
80
52
 
81
- Generate local AI context:
53
+ RepoPilot groups review evidence into confidence tiers:
82
54
 
83
- ```bash
84
- repopilot ai context . --budget 4k
85
- ```
55
+ - security boundaries: access control, request trust, deploy surface, supply
56
+ chain, and secret configuration;
57
+ - behavioral changes: network, subprocess, filesystem, SQL, dependencies,
58
+ migrations, removed error handling, or removed auth checks;
59
+ - algorithmic changes: deeper nesting, nested loops, growth, or recursion;
60
+ - taint-lite flows: changed request or process input reaching SQL, exec,
61
+ filesystem-write, or outbound-network sinks;
62
+ - blast radius: files that import a changed file.
86
63
 
87
- Save CI evidence:
64
+ All review signals ship at `preview`. They are advisory by default; enable the
65
+ explicit high-confidence gate with:
88
66
 
89
67
  ```bash
90
- repopilot scan . --format markdown --output repopilot-report.md
91
- repopilot scan . --format json --output repopilot-report.json --receipt .repopilot/receipt.json
92
- repopilot scan . --format sarif --output repopilot.sarif
68
+ repopilot review . --base origin/main --fail-on-review definitely
93
69
  ```
94
70
 
95
- ## Use with AI agents (MCP)
96
-
97
- RepoPilot ships a local [Model Context Protocol](https://modelcontextprotocol.io) server so AI coding agents (Claude Code, Cursor, …) can call it as a tool — auditing what the agent just changed, without anything leaving your machine.
71
+ For a complete agent run:
98
72
 
99
73
  ```bash
100
- claude mcp add repopilot -- repopilot mcp
74
+ repopilot snapshot
75
+ # let the agent or developer work
76
+ repopilot review --since-snapshot
101
77
  ```
102
78
 
103
- The server runs locally over stdio (JSON-RPC, no network, no AI calls) and exposes four tools:
104
-
105
- - `repopilot_review_change` — audit the current Git changes: in-diff vs out-of-diff findings plus blast radius.
106
- - `repopilot_scan` — full repository audit as a JSON report.
107
- - `repopilot_context` — a budgeted, AI-ready Markdown brief of the repo.
108
- - `repopilot_explain_file` — how a single file is classified and which rules apply.
109
-
110
- More: [docs/mcp.md](docs/mcp.md).
79
+ ## Full Repository Audit
111
80
 
112
- ## What It Checks
113
-
114
- | Area | Examples |
115
- |---|---|
116
- | Security | secret candidates, private keys, committed `.env` files |
117
- | Runtime risk | Rust panic/unwrap paths, JavaScript/Python/Go/JVM/.NET process exits |
118
- | Architecture | circular dependencies, excessive fan-out, instability hubs |
119
- | Review risk | changed files, branch context, blast radius |
120
- | Adoption | baselines, new-vs-existing findings, CI gates |
121
- | Evidence | JSON, Markdown, SARIF, receipts, report envelopes |
122
- | AI context | local, budgeted, evidence-backed Markdown for coding assistants |
123
-
124
- ## Trust Mode
125
-
126
- Default scans are intentionally quiet. They keep high-trust security, runtime, and import-graph findings visible while summarizing broad maintainability and testing suggestions as strict-only noise.
127
-
128
- ```bash
129
- repopilot scan . # compact default output
130
- repopilot scan . --output-style full
131
- repopilot scan . --profile strict # full audit output
132
- ```
133
-
134
- Use strict mode for cleanup passes, rule development, and release hardening. Use the default profile for day-to-day local checks and CI gates.
135
-
136
- More: [docs/trust-mode.md](docs/trust-mode.md).
137
-
138
- ## Core Commands
139
-
140
- ```text
141
- scan | review | baseline | compare | doctor | inspect | ai | init | cache | mcp
142
- ```
143
-
144
- Common workflows:
81
+ The broader scan remains available for repository adoption and CI:
145
82
 
146
83
  ```bash
147
84
  repopilot scan .
148
- repopilot review . --base origin/main
149
85
  repopilot baseline create .
150
- repopilot compare before.json after.json
151
- repopilot inspect rules
152
- repopilot inspect eval-rules --format json
153
- repopilot ai context .
86
+ repopilot scan . \
87
+ --baseline .repopilot/baseline.json \
88
+ --fail-on new-high
154
89
  ```
155
90
 
156
- More: [docs/commands.md](docs/commands.md) and [docs/cli.md](docs/cli.md).
91
+ Default scans hide broad maintainability noise. Use `--profile strict` for the
92
+ full audit surface.
157
93
 
158
- ## Baseline Adoption
94
+ ## AI Agents And MCP
159
95
 
160
- A baseline records current findings as accepted existing debt. Future scans can fail only on newly introduced risk:
96
+ RepoPilot exposes local review, scan, context, and explain tools over stdio:
161
97
 
162
98
  ```bash
163
- repopilot baseline create . --output .repopilot/baseline.json
164
- git add .repopilot/baseline.json
165
- repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high
99
+ claude mcp add repopilot -- repopilot mcp --root .
166
100
  ```
167
101
 
168
- Review baseline updates like code changes. A baseline is not a suppression file; it is a CI adoption contract.
169
-
170
- ## Rule Quality
171
-
172
- Rules move through a lifecycle:
173
-
174
- ```text
175
- experimental -> preview -> stable
176
- ```
177
-
178
- Before a rule becomes stable or default-visible, it should have metadata, true-positive and false-positive fixtures, stable finding IDs, concrete evidence, false-positive notes, recommendations, and clean local evaluation:
179
-
180
- ```bash
181
- repopilot inspect eval-rules --format json
182
- ```
183
-
184
- More: [docs/rule-quality-gate.md](docs/rule-quality-gate.md).
185
-
186
- ## Local-First
187
-
188
- RepoPilot does not upload source code, run a hosted scanner, call LLM APIs implicitly, send telemetry, or require a SaaS account.
189
-
190
- AI commands only format local scan evidence as Markdown for tools such as Claude Code, ChatGPT, Cursor, Zed, or another assistant.
191
-
192
- ## Reports
102
+ The MCP server is synchronous, root-confined, and makes no network or LLM calls.
103
+ See [MCP server](https://github.com/MykytaStel/repopilot/blob/main/docs/mcp.md).
193
104
 
194
- | Format | Use case |
195
- |---|---|
196
- | Console | fast local feedback |
197
- | Markdown | PR comments and human-readable reports |
198
- | JSON | automation and internal tooling |
199
- | SARIF | GitHub Code Scanning |
200
- | HTML | shareable local reports |
201
- | Receipt | compact release/CI evidence |
105
+ ## Distribution
202
106
 
203
- More: [docs/reports.md](docs/reports.md).
107
+ Official CLI channels are crates.io, npm, Homebrew, and GitHub Releases.
204
108
 
205
- ## CI
206
-
207
- Minimal baseline-aware gate:
208
-
209
- ```bash
210
- repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high
211
- ```
212
-
213
- GitHub Code Scanning:
214
-
215
- ```bash
216
- repopilot scan . --format sarif --output repopilot.sarif
217
- ```
218
-
219
- Release smoke:
220
-
221
- ```bash
222
- ./scripts/smoke-product.sh
223
- ```
224
-
225
- More: [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md).
109
+ Platform-specific VSIX files are attached to GitHub Releases as a **preview**
110
+ integration. RepoPilot is not currently published to the VS Code Marketplace or
111
+ PyPI.
226
112
 
227
113
  ## Documentation
228
114
 
229
- | Document | Purpose |
230
- |---|---|
231
- | [Install](docs/install.md) | Cargo, npm, Homebrew, curl, and source builds |
232
- | [Commands](docs/commands.md) | Task-oriented workflows |
233
- | [CLI](docs/cli.md) | Complete command and flag reference |
234
- | [Configuration](docs/configuration.md) | `repopilot.toml`, presets, ignores, and baselines |
235
- | [Rulesets](docs/rulesets.md) | Built-in rules, lifecycle, severity, and confidence |
236
- | [Trust Mode](docs/trust-mode.md) | Default vs strict visibility policy |
237
- | [Reports](docs/reports.md) | JSON, SARIF, Markdown, HTML, receipts, and schema fields |
238
- | [Release Process](docs/release.md) | Local and CI release gates |
115
+ - [Documentation index](https://github.com/MykytaStel/repopilot/blob/main/docs/README.md)
116
+ - [Common workflows](https://github.com/MykytaStel/repopilot/blob/main/docs/commands.md)
117
+ - [CLI reference](https://github.com/MykytaStel/repopilot/blob/main/docs/cli.md)
118
+ - [Configuration](https://github.com/MykytaStel/repopilot/blob/main/docs/configuration.md)
119
+ - [Reports and schemas](https://github.com/MykytaStel/repopilot/blob/main/docs/reports.md)
120
+ - [GitHub pull request integration](https://github.com/MykytaStel/repopilot/blob/main/docs/integrations/github-code-scanning.md)
121
+ - [Signal contract](https://github.com/MykytaStel/repopilot/blob/main/docs/engineering/signal-contract.md)
122
+ - [Release process](https://github.com/MykytaStel/repopilot/blob/main/docs/release.md)
239
123
 
240
124
  ## Development
241
125
 
@@ -243,16 +127,10 @@ More: [docs/integrations/github-code-scanning.md](docs/integrations/github-code-
243
127
  cargo fmt --all -- --check
244
128
  cargo clippy --all-targets --all-features -- -D warnings
245
129
  cargo test --all
246
- npm run test:npm
130
+ npm run release:contract
247
131
  ./scripts/smoke-product.sh
248
132
  ```
249
133
 
250
- Run rule evaluation from source:
251
-
252
- ```bash
253
- cargo run -- inspect eval-rules --format json
254
- ```
255
-
256
134
  ## License
257
135
 
258
- RepoPilot is licensed under **MIT OR Apache-2.0**.
136
+ RepoPilot is licensed under **MIT OR Apache-2.0**.
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "repopilot",
3
- "version": "0.14.0",
4
- "description": "Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.",
3
+ "version": "0.16.0",
4
+ "description": "Local-first CLI for reviewing Git changes, security boundaries, and blast radius before merge.",
5
5
  "license": "MIT OR Apache-2.0",
6
6
  "repository": {
7
7
  "type": "git",
@@ -18,7 +18,10 @@
18
18
  "test": "npm run test:npm",
19
19
  "test:npm": "node --test tests/npm_wrapper.test.js",
20
20
  "release:check": "bash scripts/verify-release.sh",
21
- "product:smoke": "bash scripts/smoke-product.sh"
21
+ "product:smoke": "bash scripts/smoke-product.sh",
22
+ "release:contract": "python3 scripts/release-contract.py check",
23
+ "review:performance": "node scripts/check-review-performance.js",
24
+ "vscode:check": "npm --prefix editors/vscode run check"
22
25
  },
23
26
  "files": [
24
27
  "bin",
@@ -26,11 +29,11 @@
26
29
  "LICENSE"
27
30
  ],
28
31
  "optionalDependencies": {
29
- "@repopilot/darwin-arm64": "0.14.0",
30
- "@repopilot/darwin-x64": "0.14.0",
31
- "@repopilot/linux-arm64-gnu": "0.14.0",
32
- "@repopilot/linux-x64-gnu": "0.14.0",
33
- "@repopilot/win32-x64-msvc": "0.14.0"
32
+ "@repopilot/darwin-arm64": "0.16.0",
33
+ "@repopilot/darwin-x64": "0.16.0",
34
+ "@repopilot/linux-arm64-gnu": "0.16.0",
35
+ "@repopilot/linux-x64-gnu": "0.16.0",
36
+ "@repopilot/win32-x64-msvc": "0.16.0"
34
37
  },
35
38
  "keywords": [
36
39
  "cli",