repopilot 0.21.0 → 0.22.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +18 -2
- package/package.json +6 -6
package/README.md
CHANGED
|
@@ -54,6 +54,20 @@ checkout) is caught the same way.
|
|
|
54
54
|
> flow is a path to verify, not a confirmed vulnerability. Use it beside
|
|
55
55
|
> tests, linters, and dedicated security tools.
|
|
56
56
|
|
|
57
|
+
## Catch broken code, not just risky code
|
|
58
|
+
|
|
59
|
+
A tidy-looking rename and file move — nothing a diff review would flag on its
|
|
60
|
+
own — quietly breaks two callers that still expect the old names. No compiler
|
|
61
|
+
runs; both are AST-plus-resolver proofs.
|
|
62
|
+
|
|
63
|
+
<p align="center">
|
|
64
|
+
<img src="https://raw.githubusercontent.com/MykytaStel/repopilot/main/docs/demos/05-broken-code.gif" alt="repopilot review catching a removed export still imported and an unresolved local import in a tidy-looking rename" width="800">
|
|
65
|
+
</p>
|
|
66
|
+
|
|
67
|
+
```bash
|
|
68
|
+
scripts/demo-broken-code-review.sh
|
|
69
|
+
```
|
|
70
|
+
|
|
57
71
|
## Why not an LLM reviewer?
|
|
58
72
|
|
|
59
73
|
- **Deterministic.** Same diff in, same signals out. You can gate a pipeline
|
|
@@ -90,8 +104,10 @@ Review groups evidence into tiers: security boundaries (access control,
|
|
|
90
104
|
request trust, deploy surface, supply chain, secrets), behavioral changes
|
|
91
105
|
(network, subprocess, filesystem, SQL, removed error handling or auth),
|
|
92
106
|
algorithmic shifts, taint-lite flows (changed request/process input reaching
|
|
93
|
-
SQL, exec, filesystem-write, or network sinks),
|
|
94
|
-
|
|
107
|
+
SQL, exec, filesystem-write, or network sinks), broken local imports and
|
|
108
|
+
exports (a deleted or renamed file still imported, a removed export still
|
|
109
|
+
called under its old name — no compiler required), and blast radius (files
|
|
110
|
+
that import what changed).
|
|
95
111
|
|
|
96
112
|
Signals are advisory by default. Gate CI on the high-confidence tier:
|
|
97
113
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "repopilot",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.22.0",
|
|
4
4
|
"description": "Local-first CLI for reviewing Git changes, security boundaries, and blast radius before merge.",
|
|
5
5
|
"license": "MIT OR Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -30,11 +30,11 @@
|
|
|
30
30
|
"LICENSE"
|
|
31
31
|
],
|
|
32
32
|
"optionalDependencies": {
|
|
33
|
-
"@repopilot/darwin-arm64": "0.
|
|
34
|
-
"@repopilot/darwin-x64": "0.
|
|
35
|
-
"@repopilot/linux-arm64-gnu": "0.
|
|
36
|
-
"@repopilot/linux-x64-gnu": "0.
|
|
37
|
-
"@repopilot/win32-x64-msvc": "0.
|
|
33
|
+
"@repopilot/darwin-arm64": "0.22.0",
|
|
34
|
+
"@repopilot/darwin-x64": "0.22.0",
|
|
35
|
+
"@repopilot/linux-arm64-gnu": "0.22.0",
|
|
36
|
+
"@repopilot/linux-x64-gnu": "0.22.0",
|
|
37
|
+
"@repopilot/win32-x64-msvc": "0.22.0"
|
|
38
38
|
},
|
|
39
39
|
"keywords": [
|
|
40
40
|
"cli",
|