repopilot 0.7.0 → 0.9.0

package/README.md

@@ -2,33 +2,40 @@
 
 [![Crates.io](https://img.shields.io/crates/v/repopilot.svg)](https://crates.io/crates/repopilot)
 [![npm](https://img.shields.io/npm/v/repopilot.svg)](https://www.npmjs.com/package/repopilot)
-[![Docs.rs](https://docs.rs/repopilot/badge.svg)](https://docs.rs/repopilot)
 [![CI](https://github.com/MykytaStel/repopilot/actions/workflows/ci.yaml/badge.svg)](https://github.com/MykytaStel/repopilot/actions)
 [![GitHub Release](https://img.shields.io/github/v/release/MykytaStel/repopilot)](https://github.com/MykytaStel/repopilot/releases)
 [![License](https://img.shields.io/crates/l/repopilot.svg)](LICENSE)
+[![GitHub Stars](https://img.shields.io/github/stars/MykytaStel/repopilot?style=social)](https://github.com/MykytaStel/repopilot)
 
-Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.
+Audit your repository locally, turn the results into AI-ready remediation context,
+and ship safer changes without sending source code to a hosted scanner.
 
-RepoPilot runs on your machine and does not upload your repository. It helps developers understand what changed, what became riskier, and where to review first.
+RepoPilot is a local-first CLI for architecture, security, code quality, testing,
+and framework health checks. It gives developers useful terminal reports, CI gates,
+SARIF for GitHub Code Scanning, and Markdown briefs that can be pasted into Claude
+Code, ChatGPT, Cursor, or another coding assistant.
 
 ## Why RepoPilot?
 
-Modern developers ship more code than they can carefully review, especially with AI-assisted workflows.
+Most linters and audit tools stop at the terminal. RepoPilot bridges the gap to your AI assistant:
 
-RepoPilot helps you understand:
+| | SonarQube / CodeClimate | ESLint / language linters | **RepoPilot** |
+|---|---|---|---|
+| Runs offline | ❌ | ✅ | ✅ |
+| No code upload | ❌ | ✅ | ✅ |
+| Cross-language architecture analysis | ✅ | ❌ | ✅ |
+| LLM-ready output | ❌ | ❌ | ✅ |
+| Fits in a model context window | ❌ | ❌ | ✅ |
+| CI gate on new findings only | ✅ | partial | ✅ |
 
-- what changed;
-- what became riskier;
-- which findings are new;
-- which findings already existed;
-- where to review first.
-
-RepoPilot runs locally and does not upload your repository.
+```bash
+repopilot ai context . | pbcopy   # macOS: paste into your coding assistant
+```
 
 ## Features
 
 - Repository scanning for projects, folders, and individual files
-- Gitignore-aware walking with built-in ignores for common build and service directories
+- Gitignore-aware walking with built-in ignores for common build, cache, vendor, and native platform directories
 - Architecture findings: oversized files, deep nesting, too many modules per directory
 - Coupling analysis: excessive fan-out, high-instability hubs, circular dependencies
 - Code quality findings: cyclomatic complexity density, long functions, TODO/FIXME/HACK markers
@@ -36,20 +43,24 @@ RepoPilot runs locally and does not upload your repository.
 - Testing findings: missing test folder, source files without test counterparts
 - Framework findings for JavaScript, React, React Native, and Expo projects
 - React Native architecture profile: project kind, New Architecture, Hermes, Codegen, platform mismatch, and package manager signals
-- Workspace scanning (`--workspace`) for npm, yarn, pnpm, and Cargo workspaces with per-package risk summary
+- Workspace scanning (`--workspace`) for npm, yarn, pnpm, and Cargo workspaces with per-package risk summary — parallel per-package scans
 - Evidence-backed findings with stable rule IDs, severity, file paths, line numbers, and snippets
 - 36 built-in rules with titles, descriptions, recommendations, and docs links
 - `repopilot.toml` configuration generated by `repopilot init`
+- Configuration presets (`--preset strict|balanced|lenient`) for quick threshold tuning
 - Baseline workflow for accepting existing findings in legacy repositories
 - CI-friendly failure thresholds with `--fail-on`
 - Git diff-aware review mode for prioritizing findings introduced by changed lines
 - Console, JSON, Markdown, HTML, and SARIF (2.1.0) scan output — SARIF includes per-result category and workspace package properties
-- First-party GitHub Action wrapper with optional SARIF upload
+- First-party GitHub Action wrapper for `scan`, `review`, `compare`, and `ai` workflows, with optional SARIF upload for scans
 - Compare mode for diffing two JSON scan reports
+- **`repopilot ai context`** — formats scan output as LLM-ready markdown, paste into Claude Code or ChatGPT to start remediating
+- **`repopilot ai plan`** — turns findings into a prioritized remediation plan
+- **`repopilot ai prompt`** — exports an AI-ready remediation prompt with RepoPilot context
 
 See [docs/rulesets.md](docs/rulesets.md) for the full list of rules and severity levels.
 
-## Installation
+## Install
 
 ```bash
 cargo install repopilot
@@ -61,11 +72,27 @@ Install with npm:
 npm install -g repopilot
 ```
 
+Install with Homebrew:
+
+```bash
+brew tap mykytastel/repopilot
+brew install repopilot
+```
+
+Install with curl (Linux/macOS):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/MykytaStel/repopilot/main/install.sh | bash
+```
+
+The curl installer verifies the GitHub Release SHA256 checksum and aborts if the checksum cannot be downloaded or verified.
+
 Upgrade:
 
 ```bash
 cargo install repopilot --force
 npm update -g repopilot
+brew update && brew upgrade repopilot
 ```
 
 Build from source:
@@ -81,13 +108,14 @@ cargo build --release
 ```bash
 repopilot init
 repopilot scan .
+repopilot ai context .
+repopilot review . --base origin/main --fail-on new-high
 ```
 
-React Native quick scan:
+Save a shareable report:
 
 ```bash
 repopilot scan . --format markdown --output repopilot-report.md
-repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on new-high
 ```
 
 Reduce scan noise while iterating:
@@ -95,27 +123,91 @@ Reduce scan noise while iterating:
 ```bash
 repopilot scan . --min-severity high
 repopilot scan . --workspace --min-severity medium
+repopilot scan . --exclude fixtures --max-file-size 1mb --max-files 500
+```
+
+By default, RepoPilot skips low-signal audit paths such as tests, fixtures, examples, generated files, and benchmarks. Use `--include-low-signal` when you want those paths analyzed too.
+
+## Local-First AI Workflow
+
+RepoPilot does not call LLM APIs. AI commands scan local files and produce Markdown
+that you decide where to paste.
+
+`repopilot ai context` scans a project and formats all findings as structured markdown ready to paste into Claude Code, Cursor, ChatGPT, or any LLM assistant. It includes a risk level, tech stack summary, findings grouped by category with evidence snippets and fix recommendations, and a token-count estimate.
+
+```bash
+# Paste into Claude Code or ChatGPT
+repopilot ai context .
+
+# Focus on security only, keep it short
+repopilot ai context . --focus security --budget 2k
+
+# Save to file
+repopilot ai context . --output repopilot-context.md
+
+# Pipe directly into clipboard (macOS)
+repopilot ai context . --no-header | pbcopy
+```
+
+## Example Output
+
 ```
+$ repopilot ai context .
+
+# RepoPilot Vibe Check — my-app
+
+**Risk Level:** 🟠 ELEVATED
+**Tech Stack:** React Native (New Arch), Expo, TypeScript
+**Size:** 94 files · 8,340 LOC · ~42k tokens
+**Health:** 18 findings · 2.2/kloc — 4 high, 9 medium
+
+## Security (2 high)
+1. [HIGH] Possible secret detected — `src/config/api.ts:12`
+   ```
+   const API_KEY = "sk_live_…"
+   ```
+   > **Fix:** Move to environment variables or a secrets manager.
 
-## AI-Assisted Workflow
+## Architecture (2 high)
+1. [HIGH] Circular dependency detected — `src/store/index.ts`
+   > **Fix:** Extract shared types to a separate module to break the cycle.
+
+## Top Recommendations
+1. **Move hardcoded API key** (src/config/api.ts:12) — use process.env or a vault
+2. **Break circular dependency** (src/store/index.ts) — extract shared types
+
+---
+*~3.8k tokens (budget: 4k) · scanned in 312ms — paste into Claude Code, Cursor, or ChatGPT*
+```
+
+Paste this into a coding assistant and ask for a focused patch. For larger
+repositories, start with one focus area instead of asking for every finding at
+once.
+
+## Recommended Remediation Loop
 
 RepoPilot is a local-first safety layer for AI-assisted and vibe-coded changes. Run it after generating or refactoring code to catch newly introduced high-risk findings, workspace hotspots, missing tests, and architecture drift without uploading source code to an external service.
 
 ```bash
+repopilot ai context . --focus security    # get an LLM brief for Claude Code
+repopilot ai plan . --focus security       # get a prioritized hardening plan
+repopilot ai prompt . --budget 8k          # generate a paste-ready remediation prompt
 repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on new-high
 repopilot scan . --workspace --min-severity medium --format markdown --output repopilot-report.md
 ```
 
-The v0.7.0 release does not add new `vibe`, `harden`, or AI prompt commands. Those are planned as deterministic post-0.7 workflows built on the existing scan and review data.
-
 ## Commands
 
 | Command | Alias | Description |
 |---------|-------|-------------|
 | `repopilot scan <path>` | `s` | Scan a project, folder, or file for findings |
 | `repopilot review [path]` | `r` | Review findings that touch changed Git diff lines |
+| `repopilot ai context <path>` | — | LLM-ready context from a scan |
+| `repopilot ai plan <path>` | — | Prioritized remediation plan |
+| `repopilot ai prompt <path>` | — | AI-ready remediation prompt |
 | `repopilot compare <before> <after>` | `cmp` | Compare two JSON scan reports and show what changed |
 | `repopilot baseline create <path>` | `bl` | Scan a path and store current findings as accepted debt |
+| `repopilot doctor [path]` | `d` | Diagnose audit readiness |
 | `repopilot init` | — | Generate a default `repopilot.toml` configuration file |
 
 Use `--help` on any command for the full description and examples:
@@ -164,7 +256,12 @@ ignore = [
   "dist",
   "build",
   ".next",
-  "coverage"
+  ".nuxt",
+  ".cache",
+  "coverage",
+  "vendor",
+  "Pods",
+  "DerivedData"
 ]
 max_file_bytes = 2097152
 
@@ -194,8 +291,16 @@ CLI threshold overrides:
 repopilot scan . --max-file-loc 500
 repopilot scan . --max-directory-modules 25
 repopilot scan . --max-directory-depth 6
+repopilot scan . --max-file-size 1mb
+repopilot scan . --max-files 1000
+repopilot scan . --exclude generated
+repopilot scan . --include-low-signal
 ```
 
+`--max-file-size` accepts raw bytes or `kb`, `mb`, and `gb` suffixes. `--exclude` matches an exact path relative to the scan root or a file/directory name; repeat it for multiple paths.
+
+JSON output includes scan input accounting fields: `files_discovered` for files found after ignore/exclude filters, `files_count` for analyzed text files, `files_skipped_low_signal` for default low-signal skips, and `binary_files_skipped` for unreadable/binary files.
+
 ## Baseline Workflow
 
 Existing repositories often have findings that cannot all be fixed before adopting a new audit tool. A baseline stores accepted existing findings so future scans can distinguish new findings from existing ones.
@@ -251,7 +356,7 @@ If your installed RepoPilot version does not support `--output`, redirect stdout
 repopilot scan . --format sarif > repopilot.sarif
 ```
 
-Use JSON when custom scripts need to parse RepoPilot results. Use Markdown for human-readable reports. Use SARIF for CI and code scanning integrations, including GitHub Code Scanning.
+Use JSON when custom scripts need to parse RepoPilot results. Console, Markdown, and HTML reports include the RepoPilot version, risk summary, top rules, and grouped findings for human review. Use SARIF for CI and code scanning integrations, including GitHub Code Scanning.
 
 See [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) for a copy-paste GitHub Actions workflow, required permissions, and local validation commands.
 
@@ -272,6 +377,7 @@ Use `--fail-on new-high` to fail CI only when new high or critical findings are
 When `--fail-on new-*` is used without `--baseline`, RepoPilot treats all current findings as new. For baseline-based adoption, commit an accepted baseline and scan against it in CI.
 
 To upload RepoPilot findings to GitHub Code Scanning, generate SARIF and use `github/codeql-action/upload-sarif`. The workflow must include `security-events: write`.
+The first-party action can also run `command: ai-context`, `command: ai-plan`, or `command: ai-prompt`; those commands emit Markdown and do not produce SARIF. Prefer typed action inputs such as `path`, `config`, `baseline`, `fail-on`, `focus`, `budget`, and `output`; `args` remains available for advanced flags.
 
 ```yaml
 name: RepoPilot
@@ -279,12 +385,16 @@ name: RepoPilot
 on:
   pull_request:
 
+permissions:
+  contents: read
+  security-events: write
+
 jobs:
   repopilot:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -299,7 +409,7 @@ jobs:
         run: repopilot scan . --format sarif --output repopilot.sarif
 
       - name: Upload to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         if: always()
         with:
           sarif_file: repopilot.sarif
@@ -309,9 +419,6 @@ jobs:
 
 These are planned ideas, not current features:
 
-- Vibe Check command for AI-assisted codebase readiness
-- Hardening Plan output based on existing findings
-- AI-agent prompt/context export
 - Change Risk Map
 - Better architecture drift detection
 - Optional per-platform npm binary packages for faster installs
@@ -320,12 +427,18 @@ These are planned ideas, not current features:
 
 | Document | Description |
 |---|---|
+| [docs/install.md](docs/install.md) | Installation options for Cargo, npm, Homebrew, curl, and source builds |
+| [docs/ai-workflows.md](docs/ai-workflows.md) | Claude Code, ChatGPT, Cursor, and AI remediation workflows |
+| [docs/security.md](docs/security.md) | Local-first trust model, installer security, and vulnerability reporting |
+| [docs/configuration.md](docs/configuration.md) | `repopilot.toml`, presets, ignore files, and baseline adoption |
+| [docs/language-support.md](docs/language-support.md) | Supported language/framework tiers, rule families, and limitations |
 | [docs/cli.md](docs/cli.md) | Complete CLI reference — all commands, flags, and exit codes |
 | [docs/commands.md](docs/commands.md) | Task-oriented command guide and common patterns |
 | [docs/rulesets.md](docs/rulesets.md) | Implemented audit rules, categories, and severity levels |
 | [docs/react-native.md](docs/react-native.md) | React Native and Expo detection, findings, and limitations |
 | [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) | GitHub Code Scanning SARIF workflow |
 | [docs/release.md](docs/release.md) | Manual release process |
+| [docs/release-checklist-0.9.md](docs/release-checklist-0.9.md) | 0.9.0 release readiness checklist |
 | [docs/distribution.md](docs/distribution.md) | Distribution channels |
 | [docs/github-ruleset.md](docs/github-ruleset.md) | GitHub branch ruleset configuration |
 | [CHANGELOG.md](CHANGELOG.md) | Version history |

package/package.json

@@ -1,38 +1,41 @@
 {
-  "name": "repopilot",
-  "version": "0.7.0",
-  "description": "Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.",
-  "license": "MIT OR Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/MykytaStel/repopilot.git"
-  },
-  "homepage": "https://github.com/MykytaStel/repopilot#readme",
-  "bugs": {
-    "url": "https://github.com/MykytaStel/repopilot/issues"
-  },
-  "bin": {
-    "repopilot": "bin/repopilot.js"
-  },
-  "scripts": {
-    "postinstall": "node scripts/install.js",
-    "test:npm": "node --test tests/npm_wrapper.test.js"
-  },
-  "files": [
-    "bin",
-    "scripts",
-    "README.md",
-    "LICENSE"
-  ],
-  "keywords": [
-    "cli",
-    "audit",
-    "code-review",
-    "static-analysis",
-    "architecture",
-    "react-native"
-  ],
-  "engines": {
-    "node": ">=18"
-  }
+	"name": "repopilot",
+	"version": "0.9.0",
+	"description": "Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.",
+	"license": "MIT OR Apache-2.0",
+	"repository": {
+		"type": "git",
+		"url": "git+https://github.com/MykytaStel/repopilot.git"
+	},
+	"homepage": "https://github.com/MykytaStel/repopilot#readme",
+	"bugs": {
+		"url": "https://github.com/MykytaStel/repopilot/issues"
+	},
+	"bin": {
+		"repopilot": "bin/repopilot.js"
+	},
+	"scripts": {
+		"postinstall": "node scripts/install.js",
+		"test": "npm run test:npm",
+		"test:npm": "node --test tests/npm_wrapper.test.js",
+		"release:check": "bash scripts/verify-release.sh",
+		"product:smoke": "bash scripts/smoke-product.sh"
+	},
+	"files": [
+		"bin",
+		"scripts",
+		"README.md",
+		"LICENSE"
+	],
+	"keywords": [
+		"cli",
+		"audit",
+		"code-review",
+		"static-analysis",
+		"architecture",
+		"react-native"
+	],
+	"engines": {
+		"node": ">=18"
+	}
 }

package/scripts/smoke-product.sh

@@ -0,0 +1,264 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+BINARY=""
+REPO_PATH="$ROOT_DIR"
+TMP_DIR=""
+TMP_CREATED=0
+KEEP_TMP=0
+RUN_LEGACY=1
+
+usage() {
+  cat <<'EOF'
+Usage: scripts/smoke-product.sh [OPTIONS]
+
+Run product-readiness smoke checks against RepoPilot.
+
+Options:
+  --binary PATH      Use an already built repopilot binary.
+  --repo PATH        Repository or project path to smoke test. Defaults to this repo.
+  --tmp-dir PATH     Directory for generated smoke artifacts. Defaults to mktemp.
+  --keep-tmp         Keep generated smoke artifacts when using a temporary directory.
+  --skip-legacy      Skip hidden 0.x compatibility command checks.
+  -h, --help         Show this help message.
+
+Examples:
+  scripts/smoke-product.sh
+  scripts/smoke-product.sh --binary ./target/release/repopilot
+  scripts/smoke-product.sh --repo /path/to/project --keep-tmp
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --binary)
+      BINARY="${2:-}"
+      shift 2
+      ;;
+    --repo)
+      REPO_PATH="${2:-}"
+      shift 2
+      ;;
+    --tmp-dir)
+      TMP_DIR="${2:-}"
+      shift 2
+      ;;
+    --keep-tmp)
+      KEEP_TMP=1
+      shift
+      ;;
+    --skip-legacy)
+      RUN_LEGACY=0
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [[ -z "$REPO_PATH" ]]; then
+  echo "--repo cannot be empty" >&2
+  exit 2
+fi
+
+REPO_PATH="$(cd "$REPO_PATH" && pwd)"
+
+if [[ -z "$BINARY" ]]; then
+  if [[ ! -x "$ROOT_DIR/target/debug/repopilot" ]]; then
+    echo "==> Building debug binary for product smoke checks" >&2
+    cargo build --manifest-path "$ROOT_DIR/Cargo.toml"
+  fi
+  BINARY="$ROOT_DIR/target/debug/repopilot"
+else
+  case "$BINARY" in
+    /*) ;;
+    *)
+      BINARY="$(cd "$(dirname "$BINARY")" && pwd)/$(basename "$BINARY")"
+      ;;
+  esac
+fi
+
+if [[ ! -x "$BINARY" ]]; then
+  echo "RepoPilot binary is not executable: $BINARY" >&2
+  exit 3
+fi
+
+if [[ -z "$TMP_DIR" ]]; then
+  TMP_DIR="$(mktemp -d)"
+  TMP_CREATED=1
+else
+  rm -rf "$TMP_DIR"
+  mkdir -p "$TMP_DIR"
+  TMP_DIR="$(cd "$TMP_DIR" && pwd)"
+fi
+
+cleanup() {
+  if [[ "$TMP_CREATED" -eq 1 && "$KEEP_TMP" -eq 0 ]]; then
+    rm -rf "$TMP_DIR"
+  fi
+}
+trap cleanup EXIT
+
+run_repopilot() {
+  echo "==> repopilot $*" >&2
+  (
+    cd "$REPO_PATH"
+    "$BINARY" "$@"
+  )
+}
+
+assert_non_empty() {
+  local file="$1"
+  if [[ ! -s "$file" ]]; then
+    echo "Expected non-empty file: $file" >&2
+    exit 3
+  fi
+}
+
+assert_contains() {
+  local file="$1"
+  local expected="$2"
+
+  if ! grep -Fq "$expected" "$file"; then
+    echo "Expected '$file' to contain: $expected" >&2
+    echo "---- file content ----" >&2
+    cat "$file" >&2 || true
+    echo "----------------------" >&2
+    exit 3
+  fi
+}
+
+validate_json_if_possible() {
+  local file="$1"
+
+  if command -v python3 >/dev/null 2>&1; then
+    python3 -m json.tool "$file" >/dev/null
+  fi
+}
+
+find_explain_file() {
+  local preferred="$REPO_PATH/src/main.rs"
+
+  if [[ -f "$preferred" ]]; then
+    printf '%s\n' "$preferred"
+    return 0
+  fi
+
+  local discovered=""
+  while IFS= read -r candidate; do
+    discovered="$candidate"
+    break
+  done < <(
+    find "$REPO_PATH" \
+      -path "$REPO_PATH/.git" -prune -o \
+      -path "$REPO_PATH/target" -prune -o \
+      -path "$REPO_PATH/node_modules" -prune -o \
+      -type f \( \
+        -name '*.rs' -o \
+        -name '*.ts' -o \
+        -name '*.tsx' -o \
+        -name '*.js' -o \
+        -name '*.jsx' -o \
+        -name '*.py' -o \
+        -name '*.go' \
+      \) \
+      -print
+  )
+
+  if [[ -n "$discovered" && -f "$discovered" ]]; then
+    printf '%s\n' "$discovered"
+    return 0
+  fi
+
+  printf '%s\n' "$REPO_PATH/Cargo.toml"
+}
+
+EXPLAIN_FILE="$(find_explain_file)"
+
+echo "==> RepoPilot product smoke suite"
+echo "Binary: $BINARY"
+echo "Repo:   $REPO_PATH"
+echo "Tmp:    $TMP_DIR"
+echo
+
+run_repopilot --version > "$TMP_DIR/version.txt"
+assert_non_empty "$TMP_DIR/version.txt"
+
+run_repopilot --help > "$TMP_DIR/help.txt"
+assert_non_empty "$TMP_DIR/help.txt"
+assert_contains "$TMP_DIR/help.txt" "scan"
+assert_contains "$TMP_DIR/help.txt" "review"
+assert_contains "$TMP_DIR/help.txt" "ai"
+assert_contains "$TMP_DIR/help.txt" "inspect"
+
+run_repopilot init --force --path "$TMP_DIR/repopilot.toml"
+assert_non_empty "$TMP_DIR/repopilot.toml"
+
+run_repopilot doctor . --format markdown --output "$TMP_DIR/doctor.md"
+assert_non_empty "$TMP_DIR/doctor.md"
+
+run_repopilot scan . --format json --output "$TMP_DIR/scan.json"
+assert_non_empty "$TMP_DIR/scan.json"
+validate_json_if_possible "$TMP_DIR/scan.json"
+
+run_repopilot scan . --format markdown --output "$TMP_DIR/scan.md"
+assert_non_empty "$TMP_DIR/scan.md"
+
+if git -C "$REPO_PATH" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  run_repopilot review . --format markdown --output "$TMP_DIR/review.md"
+  assert_non_empty "$TMP_DIR/review.md"
+else
+  echo "==> Skipping review smoke check because repo path is not inside a Git worktree" >&2
+fi
+
+run_repopilot ai context . --focus security --budget 2k --output "$TMP_DIR/ai-context.md"
+assert_non_empty "$TMP_DIR/ai-context.md"
+
+run_repopilot ai plan . --focus all --budget 2k --output "$TMP_DIR/ai-plan.md"
+assert_non_empty "$TMP_DIR/ai-plan.md"
+
+run_repopilot ai prompt . --focus quality --budget 2k --output "$TMP_DIR/ai-prompt.md"
+assert_non_empty "$TMP_DIR/ai-prompt.md"
+
+run_repopilot inspect knowledge --format json --output "$TMP_DIR/inspect-knowledge.json"
+assert_non_empty "$TMP_DIR/inspect-knowledge.json"
+validate_json_if_possible "$TMP_DIR/inspect-knowledge.json"
+
+run_repopilot inspect knowledge --section rules --format markdown --output "$TMP_DIR/inspect-knowledge-rules.md"
+assert_non_empty "$TMP_DIR/inspect-knowledge-rules.md"
+
+run_repopilot inspect explain "$EXPLAIN_FILE" --format json --output "$TMP_DIR/inspect-explain.json"
+assert_non_empty "$TMP_DIR/inspect-explain.json"
+validate_json_if_possible "$TMP_DIR/inspect-explain.json"
+
+if [[ "$RUN_LEGACY" -eq 1 ]]; then
+  run_repopilot vibe . --focus security --budget 2k --output "$TMP_DIR/legacy-vibe.md"
+  assert_non_empty "$TMP_DIR/legacy-vibe.md"
+
+  run_repopilot harden . --focus all --budget 2k --output "$TMP_DIR/legacy-harden.md"
+  assert_non_empty "$TMP_DIR/legacy-harden.md"
+
+  run_repopilot prompt . --focus quality --budget 2k --output "$TMP_DIR/legacy-prompt.md"
+  assert_non_empty "$TMP_DIR/legacy-prompt.md"
+
+  run_repopilot knowledge --format json --output "$TMP_DIR/legacy-knowledge.json"
+  assert_non_empty "$TMP_DIR/legacy-knowledge.json"
+  validate_json_if_possible "$TMP_DIR/legacy-knowledge.json"
+
+  run_repopilot explain "$EXPLAIN_FILE" --format json --output "$TMP_DIR/legacy-explain.json"
+  assert_non_empty "$TMP_DIR/legacy-explain.json"
+  validate_json_if_possible "$TMP_DIR/legacy-explain.json"
+fi
+
+echo
+echo "==> Product smoke suite passed"
+echo "Artifacts: $TMP_DIR"

package/scripts/verify-release.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT_DIR"
+
+echo "==> RepoPilot release verification"
+
+echo "==> Rust formatting"
+cargo fmt --all -- --check
+
+echo "==> Rust clippy"
+cargo clippy --all-targets --all-features -- -D warnings
+
+echo "==> Rust tests"
+cargo test --all
+
+echo "==> Rust dependency security audit"
+cargo audit
+
+echo "==> Cargo dependency policy"
+cargo deny check advisories licenses
+
+echo "==> Shell script syntax"
+scripts=()
+if [[ -f install.sh ]]; then
+  scripts+=(install.sh)
+fi
+if [[ -d scripts ]]; then
+  while IFS= read -r -d '' script; do
+    scripts+=("$script")
+  done < <(find scripts -maxdepth 1 -type f -name '*.sh' -print0)
+fi
+
+if ((${#scripts[@]} > 0)); then
+  for script in "${scripts[@]}"; do
+    bash -n "$script"
+  done
+
+  echo "==> ShellCheck"
+  shellcheck "${scripts[@]}"
+else
+  echo "==> No shell scripts found"
+fi
+
+echo "==> GitHub Actions validation"
+workflows=()
+if [[ -d .github/workflows ]]; then
+  while IFS= read -r -d '' workflow; do
+    workflows+=("$workflow")
+  done < <(find .github/workflows -maxdepth 1 -type f \( -name '*.yml' -o -name '*.yaml' \) -print0)
+fi
+
+if ((${#workflows[@]} > 0)); then
+  actionlint "${workflows[@]}"
+else
+  echo "==> No GitHub Actions workflows found"
+fi
+
+echo "==> CLI release smoke tests"
+cargo test --test cli_release_smoke
+
+echo "==> Cargo package contents"
+cargo package --list
+
+echo "==> Cargo publish dry-run"
+cargo publish --dry-run
+
+echo "==> npm wrapper tests"
+npm run test:npm
+
+echo "==> npm package dry-run"
+npm pack --dry-run
+
+echo "==> Build release binary"
+cargo build --release
+
+echo "==> Product readiness smoke suite"
+./scripts/smoke-product.sh \
+  --binary ./target/release/repopilot \
+  --repo . \
+  --tmp-dir /tmp/repopilot-release-smoke
+
+echo "==> Release verification passed"