repopilot 0.22.0 → 0.23.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +17 -3
- package/package.json +8 -7
package/README.md
CHANGED
|
@@ -24,9 +24,17 @@ drops a permission check and pipes request input into a shell.
|
|
|
24
24
|
<img src="https://raw.githubusercontent.com/MykytaStel/repopilot/main/docs/demos/03-agent-review.gif" alt="repopilot review flagging a removed auth check and a request-to-shell taint flow in a one-file diff" width="800">
|
|
25
25
|
</p>
|
|
26
26
|
|
|
27
|
-
One command, `repopilot review .`, and the diff answers for itself
|
|
27
|
+
One command, `repopilot review .`, and the diff answers for itself — one
|
|
28
|
+
verdict, the reasons behind it, and one next action, then the evidence:
|
|
28
29
|
|
|
29
30
|
```text
|
|
31
|
+
Decision: REVIEW (Change Proof: REVIEW)
|
|
32
|
+
Reasons:
|
|
33
|
+
- Definitely-sensitive review signal(s) require confirmation.
|
|
34
|
+
- A changed boundary has no corresponding test change.
|
|
35
|
+
…
|
|
36
|
+
Next action: Resolve or confirm the high-priority findings and sensitive signals listed below before merge.
|
|
37
|
+
|
|
30
38
|
⚑ access control changed — wagtail/images/views/images.py
|
|
31
39
|
⚑ auth check removed — wagtail/images/views/images.py:264
|
|
32
40
|
Authentication/authorization check removed (auth calls: 1 -> 0)
|
|
@@ -54,6 +62,11 @@ checkout) is caught the same way.
|
|
|
54
62
|
> flow is a path to verify, not a confirmed vulnerability. Use it beside
|
|
55
63
|
> tests, linters, and dedicated security tools.
|
|
56
64
|
|
|
65
|
+
`VERIFIED` is only awarded when checks you configure and select with
|
|
66
|
+
`--verify` pass on the reviewed revision; `repopilot init --suggestions-output
|
|
67
|
+
repopilot-suggestions.toml` proposes them for your stack without applying
|
|
68
|
+
anything. Add `--detail full` for provenance, legacy readiness, and ownership.
|
|
69
|
+
|
|
57
70
|
## Catch broken code, not just risky code
|
|
58
71
|
|
|
59
72
|
A tidy-looking rename and file move — nothing a diff review would flag on its
|
|
@@ -118,8 +131,9 @@ repopilot review . --base origin/main --fail-on-review definitely
|
|
|
118
131
|
Every review also resolves to one merge-readiness verdict — `ready`,
|
|
119
132
|
`review`, or `blocked` — built from findings, review signals, CODEOWNERS,
|
|
120
133
|
and blast radius, with deterministic reason codes and suggested owners.
|
|
121
|
-
Console, Markdown, JSON, MCP, and the GitHub Action summary all read the
|
|
122
|
-
|
|
134
|
+
Console, Markdown, JSON, MCP, and the GitHub Action summary all read the same
|
|
135
|
+
ChangeProof and evidence records; machine projections keep the legacy fields
|
|
136
|
+
for compatibility.
|
|
123
137
|
|
|
124
138
|
## Compare risk across runs
|
|
125
139
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "repopilot",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.23.0",
|
|
4
4
|
"description": "Local-first CLI for reviewing Git changes, security boundaries, and blast radius before merge.",
|
|
5
5
|
"license": "MIT OR Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -22,7 +22,8 @@
|
|
|
22
22
|
"release:contract": "python3 scripts/release-contract.py check",
|
|
23
23
|
"test:release-contract": "python3 -m unittest discover -s scripts/tests -p 'test_*.py'",
|
|
24
24
|
"review:performance": "node scripts/check-review-performance.js",
|
|
25
|
-
"scan:performance": "node scripts/check-scan-performance.js"
|
|
25
|
+
"scan:performance": "node scripts/check-scan-performance.js",
|
|
26
|
+
"scan:resource": "python3 scripts/scan_resource_matrix.py"
|
|
26
27
|
},
|
|
27
28
|
"files": [
|
|
28
29
|
"bin",
|
|
@@ -30,11 +31,11 @@
|
|
|
30
31
|
"LICENSE"
|
|
31
32
|
],
|
|
32
33
|
"optionalDependencies": {
|
|
33
|
-
"@repopilot/darwin-arm64": "0.
|
|
34
|
-
"@repopilot/darwin-x64": "0.
|
|
35
|
-
"@repopilot/linux-arm64-gnu": "0.
|
|
36
|
-
"@repopilot/linux-x64-gnu": "0.
|
|
37
|
-
"@repopilot/win32-x64-msvc": "0.
|
|
34
|
+
"@repopilot/darwin-arm64": "0.23.0",
|
|
35
|
+
"@repopilot/darwin-x64": "0.23.0",
|
|
36
|
+
"@repopilot/linux-arm64-gnu": "0.23.0",
|
|
37
|
+
"@repopilot/linux-x64-gnu": "0.23.0",
|
|
38
|
+
"@repopilot/win32-x64-msvc": "0.23.0"
|
|
38
39
|
},
|
|
39
40
|
"keywords": [
|
|
40
41
|
"cli",
|