repopilot 0.6.0 → 0.8.0

package/README.md

@@ -2,33 +2,36 @@
 
 [![Crates.io](https://img.shields.io/crates/v/repopilot.svg)](https://crates.io/crates/repopilot)
 [![npm](https://img.shields.io/npm/v/repopilot.svg)](https://www.npmjs.com/package/repopilot)
-[![Docs.rs](https://docs.rs/repopilot/badge.svg)](https://docs.rs/repopilot)
 [![CI](https://github.com/MykytaStel/repopilot/actions/workflows/ci.yaml/badge.svg)](https://github.com/MykytaStel/repopilot/actions)
 [![GitHub Release](https://img.shields.io/github/v/release/MykytaStel/repopilot)](https://github.com/MykytaStel/repopilot/releases)
 [![License](https://img.shields.io/crates/l/repopilot.svg)](LICENSE)
+[![GitHub Stars](https://img.shields.io/github/stars/MykytaStel/repopilot?style=social)](https://github.com/MykytaStel/repopilot)
 
-Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.
+Scan your repo. Paste the result into Claude Code or ChatGPT. Start fixing.
 
-RepoPilot runs on your machine and does not upload your repository. It helps developers understand what changed, what became riskier, and where to review first.
+RepoPilot is a local-first CLI that audits architecture, security, code quality, and framework health — then formats everything as LLM-ready context you can drop directly into an AI assistant. No code leaves your machine.
 
 ## Why RepoPilot?
 
-Modern developers ship more code than they can carefully review, especially with AI-assisted workflows.
+Most linters and audit tools stop at the terminal. RepoPilot bridges the gap to your AI assistant:
 
-RepoPilot helps you understand:
+| | SonarQube / CodeClimate | ESLint / language linters | **RepoPilot** |
+|---|---|---|---|
+| Runs offline | ❌ | ✅ | ✅ |
+| No code upload | ❌ | ✅ | ✅ |
+| Cross-language architecture analysis | ✅ | ❌ | ✅ |
+| LLM-ready output | ❌ | ❌ | ✅ |
+| Fits in a model context window | ❌ | ❌ | ✅ |
+| CI gate on new findings only | ✅ | partial | ✅ |
 
-- what changed;
-- what became riskier;
-- which findings are new;
-- which findings already existed;
-- where to review first.
-
-RepoPilot runs locally and does not upload your repository.
+```bash
+repopilot vibe . | pbcopy   # macOS: paste into Claude Code and start fixing
+```
 
 ## Features
 
 - Repository scanning for projects, folders, and individual files
-- Gitignore-aware walking with built-in ignores for common build and service directories
+- Gitignore-aware walking with built-in ignores for common build, cache, vendor, and native platform directories
 - Architecture findings: oversized files, deep nesting, too many modules per directory
 - Coupling analysis: excessive fan-out, high-instability hubs, circular dependencies
 - Code quality findings: cyclomatic complexity density, long functions, TODO/FIXME/HACK markers
@@ -36,16 +39,22 @@ RepoPilot runs locally and does not upload your repository.
 - Testing findings: missing test folder, source files without test counterparts
 - Framework findings for JavaScript, React, React Native, and Expo projects
 - React Native architecture profile: project kind, New Architecture, Hermes, Codegen, platform mismatch, and package manager signals
-- Workspace framework detection through `package.json` workspaces
+- Workspace scanning (`--workspace`) for npm, yarn, pnpm, and Cargo workspaces with per-package risk summary — parallel per-package scans
 - Evidence-backed findings with stable rule IDs, severity, file paths, line numbers, and snippets
+- 36 built-in rules with titles, descriptions, recommendations, and docs links
 - `repopilot.toml` configuration generated by `repopilot init`
+- Configuration presets (`--preset strict|balanced|lenient`) for quick threshold tuning
 - Baseline workflow for accepting existing findings in legacy repositories
 - CI-friendly failure thresholds with `--fail-on`
 - Git diff-aware review mode for prioritizing findings introduced by changed lines
-- Console, JSON, Markdown, HTML, and SARIF scan output
+- Console, JSON, Markdown, HTML, and SARIF (2.1.0) scan output — SARIF includes per-result category and workspace package properties
+- First-party GitHub Action wrapper for `scan`, `review`, `compare`, `vibe`, `harden`, and `prompt`, with optional SARIF upload for scans
 - Compare mode for diffing two JSON scan reports
+- **`repopilot vibe`** — new in v0.8: formats scan output as LLM-ready markdown, paste into Claude Code or ChatGPT to start remediating
+- **`repopilot harden`** — new in v0.8: turns findings into a prioritized remediation plan
+- **`repopilot prompt`** — new in v0.8: exports an AI-ready remediation prompt with RepoPilot context
 
-See [docs/rulesets.md](docs/rulesets.md) for the implemented rules and severity levels.
+See [docs/rulesets.md](docs/rulesets.md) for the full list of rules and severity levels.
 
 ## Installation
 
@@ -59,6 +68,18 @@ Install with npm:
 npm install -g repopilot
 ```
 
+Install with Homebrew:
+
+```bash
+brew install MykytaStel/repopilot/repopilot
+```
+
+Install with curl (Linux/macOS):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/MykytaStel/repopilot/main/install.sh | sh
+```
+
 Upgrade:
 
 ```bash
@@ -88,10 +109,86 @@ repopilot scan . --format markdown --output repopilot-report.md
 repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on new-high
 ```
 
+Reduce scan noise while iterating:
+
+```bash
+repopilot scan . --min-severity high
+repopilot scan . --workspace --min-severity medium
+repopilot scan . --exclude fixtures --max-file-size 1mb --max-files 500
+```
+
+By default, RepoPilot skips low-signal audit paths such as tests, fixtures, examples, generated files, and benchmarks. Use `--include-low-signal` when you want those paths analyzed too.
+
+## Vibe Check (new in v0.8)
+
+`repopilot vibe` scans a project and formats all findings as structured markdown ready to paste into Claude Code, Cursor, ChatGPT, or any LLM assistant. It includes a risk level, tech stack summary, findings grouped by category with evidence snippets and fix recommendations, and a token-count estimate.
+
+```bash
+# Paste into Claude Code or ChatGPT
+repopilot vibe .
+
+# Focus on security only, keep it short
+repopilot vibe . --focus security --budget 2k
+
+# Save to file
+repopilot vibe . --output vibe.md
+
+# Pipe directly into clipboard (macOS)
+repopilot vibe . --no-header | pbcopy
+```
+
+## Example Output
+
+```
+$ repopilot vibe .
+
+# RepoPilot Vibe Check — my-app
+
+**Risk Level:** 🟠 ELEVATED
+**Tech Stack:** React Native (New Arch), Expo, TypeScript
+**Size:** 94 files · 8,340 LOC · ~42k tokens
+**Health:** 18 findings · 2.2/kloc — 4 high, 9 medium
+
+## Security (2 high)
+1. [HIGH] Possible secret detected — `src/config/api.ts:12`
+   ```
+   const API_KEY = "sk_live_…"
+   ```
+   > **Fix:** Move to environment variables or a secrets manager.
+
+## Architecture (2 high)
+1. [HIGH] Circular dependency detected — `src/store/index.ts`
+   > **Fix:** Extract shared types to a separate module to break the cycle.
+
+## Top Recommendations
+1. **Move hardcoded API key** (src/config/api.ts:12) — use process.env or a vault
+2. **Break circular dependency** (src/store/index.ts) — extract shared types
+
+---
+*~3.8k tokens (budget: 4k) · scanned in 312ms — paste into Claude Code, Cursor, or ChatGPT*
+```
+
+Paste this into Claude Code and ask: *"Fix all findings."*
+
+## AI-Assisted Workflow
+
+RepoPilot is a local-first safety layer for AI-assisted and vibe-coded changes. Run it after generating or refactoring code to catch newly introduced high-risk findings, workspace hotspots, missing tests, and architecture drift without uploading source code to an external service.
+
+```bash
+repopilot vibe . --focus security          # get an LLM brief for Claude Code
+repopilot harden . --focus security        # get a prioritized hardening plan
+repopilot prompt . --budget 8k             # generate a paste-ready remediation prompt
+repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on new-high
+repopilot scan . --workspace --min-severity medium --format markdown --output repopilot-report.md
+```
+
 ## Commands
 
 | Command | Alias | Description |
 |---------|-------|-------------|
+| `repopilot vibe <path>` | `v` | **New in v0.8** — LLM-ready context from a scan |
+| `repopilot harden <path>` | `h` | **New in v0.8** — prioritized remediation plan |
+| `repopilot prompt <path>` | `p` | **New in v0.8** — AI-ready remediation prompt |
 | `repopilot scan <path>` | `s` | Scan a project, folder, or file for findings |
 | `repopilot review [path]` | `r` | Review findings that touch changed Git diff lines |
 | `repopilot compare <before> <after>` | `cmp` | Compare two JSON scan reports and show what changed |
@@ -144,7 +241,12 @@ ignore = [
   "dist",
   "build",
   ".next",
-  "coverage"
+  ".nuxt",
+  ".cache",
+  "coverage",
+  "vendor",
+  "Pods",
+  "DerivedData"
 ]
 max_file_bytes = 2097152
 
@@ -174,8 +276,16 @@ CLI threshold overrides:
 repopilot scan . --max-file-loc 500
 repopilot scan . --max-directory-modules 25
 repopilot scan . --max-directory-depth 6
+repopilot scan . --max-file-size 1mb
+repopilot scan . --max-files 1000
+repopilot scan . --exclude generated
+repopilot scan . --include-low-signal
 ```
 
+`--max-file-size` accepts raw bytes or `kb`, `mb`, and `gb` suffixes. `--exclude` matches an exact path relative to the scan root or a file/directory name; repeat it for multiple paths.
+
+JSON output includes scan input accounting fields: `files_discovered` for files found after ignore/exclude filters, `files_count` for analyzed text files, `files_skipped_low_signal` for default low-signal skips, and `binary_files_skipped` for unreadable/binary files.
+
 ## Baseline Workflow
 
 Existing repositories often have findings that cannot all be fixed before adopting a new audit tool. A baseline stores accepted existing findings so future scans can distinguish new findings from existing ones.
@@ -231,7 +341,7 @@ If your installed RepoPilot version does not support `--output`, redirect stdout
 repopilot scan . --format sarif > repopilot.sarif
 ```
 
-Use JSON when custom scripts need to parse RepoPilot results. Use Markdown for human-readable reports. Use SARIF for CI and code scanning integrations, including GitHub Code Scanning.
+Use JSON when custom scripts need to parse RepoPilot results. Console, Markdown, and HTML reports include the RepoPilot version, risk summary, top rules, and grouped findings for human review. Use SARIF for CI and code scanning integrations, including GitHub Code Scanning.
 
 See [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) for a copy-paste GitHub Actions workflow, required permissions, and local validation commands.
 
@@ -252,6 +362,7 @@ Use `--fail-on new-high` to fail CI only when new high or critical findings are
 When `--fail-on new-*` is used without `--baseline`, RepoPilot treats all current findings as new. For baseline-based adoption, commit an accepted baseline and scan against it in CI.
 
 To upload RepoPilot findings to GitHub Code Scanning, generate SARIF and use `github/codeql-action/upload-sarif`. The workflow must include `security-events: write`.
+The first-party action can also run `command: vibe`, `command: harden`, or `command: prompt`; those commands emit Markdown and do not produce SARIF.
 
 ```yaml
 name: RepoPilot
@@ -259,12 +370,16 @@ name: RepoPilot
 on:
   pull_request:
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   repopilot:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -279,7 +394,7 @@ jobs:
         run: repopilot scan . --format sarif --output repopilot.sarif
 
       - name: Upload to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: repopilot.sarif
@@ -290,10 +405,8 @@ jobs:
 These are planned ideas, not current features:
 
 - Change Risk Map
-- AI-ready review context export
 - Better architecture drift detection
-- First-party GitHub Action integration
-- Deeper React Native dependency health analysis
+- Optional per-platform npm binary packages for faster installs
 
 ## Documentation
 

package/package.json

@@ -1,38 +1,39 @@
 {
-  "name": "repopilot",
-  "version": "0.6.0",
-  "description": "Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.",
-  "license": "MIT OR Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/MykytaStel/repopilot.git"
-  },
-  "homepage": "https://github.com/MykytaStel/repopilot#readme",
-  "bugs": {
-    "url": "https://github.com/MykytaStel/repopilot/issues"
-  },
-  "bin": {
-    "repopilot": "bin/repopilot.js"
-  },
-  "scripts": {
-    "postinstall": "node scripts/install.js",
-    "test:npm": "node --test tests/npm_wrapper.test.js"
-  },
-  "files": [
-    "bin",
-    "scripts",
-    "README.md",
-    "LICENSE"
-  ],
-  "keywords": [
-    "cli",
-    "audit",
-    "code-review",
-    "static-analysis",
-    "architecture",
-    "react-native"
-  ],
-  "engines": {
-    "node": ">=18"
-  }
-}
+	"name": "repopilot",
+	"version": "0.8.0",
+	"description": "Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.",
+	"license": "MIT OR Apache-2.0",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/MykytaStel/repopilot.git"
+	},
+	"homepage": "https://github.com/MykytaStel/repopilot#readme",
+	"bugs": {
+		"url": "https://github.com/MykytaStel/repopilot/issues"
+	},
+	"bin": {
+		"repopilot": "bin/repopilot.js"
+	},
+	"scripts": {
+		"postinstall": "node scripts/install.js",
+		"test:npm": "node --test tests/npm_wrapper.test.js",
+		"release:check": "bash scripts/verify-release.sh"
+	},
+	"files": [
+		"bin",
+		"scripts",
+		"README.md",
+		"LICENSE"
+	],
+	"keywords": [
+		"cli",
+		"audit",
+		"code-review",
+		"static-analysis",
+		"architecture",
+		"react-native"
+	],
+	"engines": {
+		"node": ">=18"
+	}
+}

package/scripts/verify-release.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+echo "==> RepoPilot release verification"
+
+echo "==> Rust formatting"
+cargo fmt --all -- --check
+
+echo "==> Rust clippy"
+cargo clippy --all-targets --all-features -- -D warnings
+
+echo "==> Rust tests"
+cargo test --all
+
+echo "==> CLI release smoke tests"
+cargo test --test cli_release_smoke
+
+echo "==> Cargo package contents"
+cargo package --list
+
+echo "==> Cargo publish dry-run"
+cargo publish --dry-run
+
+echo "==> npm wrapper tests"
+npm run test:npm
+
+echo "==> npm package dry-run"
+npm pack --dry-run
+
+echo "==> Build release binary"
+cargo build --release
+
+echo "==> Verify built binary"
+./target/release/repopilot --version
+./target/release/repopilot scan . --format markdown --output /tmp/repopilot-release-scan.md
+./target/release/repopilot vibe . --focus security --budget 2k --output /tmp/repopilot-release-vibe.md
+./target/release/repopilot harden . --focus all --budget 4k --output /tmp/repopilot-release-harden.md
+./target/release/repopilot prompt . --focus quality --budget 4k --output /tmp/repopilot-release-prompt.md
+
+test -s /tmp/repopilot-release-scan.md
+test -s /tmp/repopilot-release-vibe.md
+test -s /tmp/repopilot-release-harden.md
+test -s /tmp/repopilot-release-prompt.md
+
+echo "==> Release verification passed"