repopilot 0.8.0 → 0.10.0

package/README.md

@@ -7,9 +7,17 @@
 [![License](https://img.shields.io/crates/l/repopilot.svg)](LICENSE)
 [![GitHub Stars](https://img.shields.io/github/stars/MykytaStel/repopilot?style=social)](https://github.com/MykytaStel/repopilot)
 
-Scan your repo. Paste the result into Claude Code or ChatGPT. Start fixing.
+Audit your repository locally, turn the results into AI-ready remediation context,
+and ship safer changes without sending source code to a hosted scanner.
 
-RepoPilot is a local-first CLI that audits architecture, security, code quality, and framework health — then formats everything as LLM-ready context you can drop directly into an AI assistant. No code leaves your machine.
+RepoPilot is a local-first CLI for architecture, security, code quality, testing,
+and framework health checks. It gives developers useful terminal reports, CI gates,
+SARIF for GitHub Code Scanning, and Markdown briefs that can be pasted into Claude
+Code, ChatGPT, Cursor, or another coding assistant.
+
+Version `0.10.0` is an adoption and stability release: it focuses on cleaner
+rollout diagnostics, reproducible audit receipts, CI artifacts, and 0.x command
+compatibility while keeping all scans local.
 
 ## Why RepoPilot?
 
@@ -25,38 +33,40 @@ Most linters and audit tools stop at the terminal. RepoPilot bridges the gap to
 | CI gate on new findings only | ✅ | partial | ✅ |
 
 ```bash
-repopilot vibe . | pbcopy   # macOS: paste into Claude Code and start fixing
+repopilot ai context . | pbcopy   # macOS: paste into your coding assistant
 ```
 
 ## Features
 
 - Repository scanning for projects, folders, and individual files
 - Gitignore-aware walking with built-in ignores for common build, cache, vendor, and native platform directories
-- Architecture findings: oversized files, deep nesting, too many modules per directory
+- Architecture findings: oversized files, deep nesting, deep relative imports, risky barrel files, too many modules per directory
 - Coupling analysis: excessive fan-out, high-instability hubs, circular dependencies
 - Code quality findings: cyclomatic complexity density, long functions, TODO/FIXME/HACK markers
 - Security findings: hardcoded secret candidates, committed private keys, committed `.env` files
 - Testing findings: missing test folder, source files without test counterparts
-- Framework findings for JavaScript, React, React Native, and Expo projects
+- Framework findings for JavaScript, React, React Native, Expo, and Django projects
 - React Native architecture profile: project kind, New Architecture, Hermes, Codegen, platform mismatch, and package manager signals
 - Workspace scanning (`--workspace`) for npm, yarn, pnpm, and Cargo workspaces with per-package risk summary — parallel per-package scans
 - Evidence-backed findings with stable rule IDs, severity, file paths, line numbers, and snippets
-- 36 built-in rules with titles, descriptions, recommendations, and docs links
+- 46 built-in rules with titles, descriptions, recommendations, and docs links
 - `repopilot.toml` configuration generated by `repopilot init`
 - Configuration presets (`--preset strict|balanced|lenient`) for quick threshold tuning
 - Baseline workflow for accepting existing findings in legacy repositories
 - CI-friendly failure thresholds with `--fail-on`
 - Git diff-aware review mode for prioritizing findings introduced by changed lines
+- Doctor adoption guidance for config, baseline, CI gate, report, and receipt readiness
+- Audit receipt JSON from `repopilot scan --receipt` for reproducible scan evidence
 - Console, JSON, Markdown, HTML, and SARIF (2.1.0) scan output — SARIF includes per-result category and workspace package properties
-- First-party GitHub Action wrapper for `scan`, `review`, `compare`, `vibe`, `harden`, and `prompt`, with optional SARIF upload for scans
+- First-party GitHub Action wrapper for `scan`, `review`, `compare`, and `ai` workflows, with optional SARIF upload and receipt output for scans
 - Compare mode for diffing two JSON scan reports
-- **`repopilot vibe`** — new in v0.8: formats scan output as LLM-ready markdown, paste into Claude Code or ChatGPT to start remediating
-- **`repopilot harden`** — new in v0.8: turns findings into a prioritized remediation plan
-- **`repopilot prompt`** — new in v0.8: exports an AI-ready remediation prompt with RepoPilot context
+- **`repopilot ai context`** — formats scan output as LLM-ready markdown, paste into Claude Code or ChatGPT to start remediating
+- **`repopilot ai plan`** — turns findings into a prioritized remediation plan
+- **`repopilot ai prompt`** — exports an AI-ready remediation prompt with RepoPilot context
 
 See [docs/rulesets.md](docs/rulesets.md) for the full list of rules and severity levels.
 
-## Installation
+## Install
 
 ```bash
 cargo install repopilot
@@ -71,20 +81,24 @@ npm install -g repopilot
 Install with Homebrew:
 
 ```bash
-brew install MykytaStel/repopilot/repopilot
+brew tap mykytastel/repopilot
+brew install repopilot
 ```
 
 Install with curl (Linux/macOS):
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/MykytaStel/repopilot/main/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/MykytaStel/repopilot/main/install.sh | bash
 ```
 
+The curl installer verifies the GitHub Release SHA256 checksum and aborts if the checksum cannot be downloaded or verified.
+
 Upgrade:
 
 ```bash
 cargo install repopilot --force
 npm update -g repopilot
+brew update && brew upgrade repopilot
 ```
 
 Build from source:
@@ -97,16 +111,36 @@ cargo build --release
 
 ## Quick Start
 
+No config needed. Run this in any repository and see findings immediately:
+
 ```bash
-repopilot init
 repopilot scan .
 ```
 
-React Native quick scan:
+Then get an AI-ready brief to paste into Claude Code, Cursor, or ChatGPT:
 
 ```bash
-repopilot scan . --format markdown --output repopilot-report.md
-repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on new-high
+repopilot ai context . | pbcopy   # macOS — copies to clipboard
+repopilot ai context .            # print to terminal
+```
+
+That's the two-minute loop. Scan, read the output, paste the context into your assistant, fix.
+
+### Going deeper
+
+Once you want CI integration, baseline tracking, or tighter configuration:
+
+```bash
+repopilot init                                              # generate repopilot.toml
+repopilot doctor .                                          # check CI / baseline readiness
+repopilot baseline create .                                 # accept existing findings as known debt
+repopilot review . --base origin/main --fail-on new-high    # CI gate on new findings only
+```
+
+Save a shareable report:
+
+```bash
+repopilot scan . --format markdown --output repopilot-report.md --receipt .repopilot/receipt.json
 ```
 
 Reduce scan noise while iterating:
@@ -119,28 +153,31 @@ repopilot scan . --exclude fixtures --max-file-size 1mb --max-files 500
 
 By default, RepoPilot skips low-signal audit paths such as tests, fixtures, examples, generated files, and benchmarks. Use `--include-low-signal` when you want those paths analyzed too.
 
-## Vibe Check (new in v0.8)
+## Local-First AI Workflow
 
-`repopilot vibe` scans a project and formats all findings as structured markdown ready to paste into Claude Code, Cursor, ChatGPT, or any LLM assistant. It includes a risk level, tech stack summary, findings grouped by category with evidence snippets and fix recommendations, and a token-count estimate.
+RepoPilot does not call LLM APIs. AI commands scan local files and produce Markdown
+that you decide where to paste.
+
+`repopilot ai context` scans a project and formats all findings as structured markdown ready to paste into Claude Code, Cursor, ChatGPT, or any LLM assistant. It includes a risk level, tech stack summary, findings grouped by category with evidence snippets and fix recommendations, and a token-count estimate.
 
 ```bash
 # Paste into Claude Code or ChatGPT
-repopilot vibe .
+repopilot ai context .
 
 # Focus on security only, keep it short
-repopilot vibe . --focus security --budget 2k
+repopilot ai context . --focus security --budget 2k
 
 # Save to file
-repopilot vibe . --output vibe.md
+repopilot ai context . --output repopilot-context.md
 
 # Pipe directly into clipboard (macOS)
-repopilot vibe . --no-header | pbcopy
+repopilot ai context . --no-header | pbcopy
 ```
 
 ## Example Output
 
 ```
-$ repopilot vibe .
+$ repopilot ai context .
 
 # RepoPilot Vibe Check — my-app
 
@@ -168,16 +205,18 @@ $ repopilot vibe .
 *~3.8k tokens (budget: 4k) · scanned in 312ms — paste into Claude Code, Cursor, or ChatGPT*
 ```
 
-Paste this into Claude Code and ask: *"Fix all findings."*
+Paste this into a coding assistant and ask for a focused patch. For larger
+repositories, start with one focus area instead of asking for every finding at
+once.
 
-## AI-Assisted Workflow
+## Recommended Remediation Loop
 
 RepoPilot is a local-first safety layer for AI-assisted and vibe-coded changes. Run it after generating or refactoring code to catch newly introduced high-risk findings, workspace hotspots, missing tests, and architecture drift without uploading source code to an external service.
 
 ```bash
-repopilot vibe . --focus security          # get an LLM brief for Claude Code
-repopilot harden . --focus security        # get a prioritized hardening plan
-repopilot prompt . --budget 8k             # generate a paste-ready remediation prompt
+repopilot ai context . --focus security    # get an LLM brief for Claude Code
+repopilot ai plan . --focus security       # get a prioritized hardening plan
+repopilot ai prompt . --budget 8k          # generate a paste-ready remediation prompt
 repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on new-high
 repopilot scan . --workspace --min-severity medium --format markdown --output repopilot-report.md
 ```
@@ -186,13 +225,14 @@ repopilot scan . --workspace --min-severity medium --format markdown --output re
 
 | Command | Alias | Description |
 |---------|-------|-------------|
-| `repopilot vibe <path>` | `v` | **New in v0.8** — LLM-ready context from a scan |
-| `repopilot harden <path>` | `h` | **New in v0.8** — prioritized remediation plan |
-| `repopilot prompt <path>` | `p` | **New in v0.8** — AI-ready remediation prompt |
 | `repopilot scan <path>` | `s` | Scan a project, folder, or file for findings |
 | `repopilot review [path]` | `r` | Review findings that touch changed Git diff lines |
+| `repopilot ai context <path>` | — | LLM-ready context from a scan |
+| `repopilot ai plan <path>` | — | Prioritized remediation plan |
+| `repopilot ai prompt <path>` | — | AI-ready remediation prompt |
 | `repopilot compare <before> <after>` | `cmp` | Compare two JSON scan reports and show what changed |
 | `repopilot baseline create <path>` | `bl` | Scan a path and store current findings as accepted debt |
+| `repopilot doctor [path]` | `d` | Diagnose audit readiness |
 | `repopilot init` | — | Generate a default `repopilot.toml` configuration file |
 
 Use `--help` on any command for the full description and examples:
@@ -342,6 +382,7 @@ repopilot scan . --format sarif > repopilot.sarif
 ```
 
 Use JSON when custom scripts need to parse RepoPilot results. Console, Markdown, and HTML reports include the RepoPilot version, risk summary, top rules, and grouped findings for human review. Use SARIF for CI and code scanning integrations, including GitHub Code Scanning.
+Use `--receipt <path>` with `scan` when CI or release processes need compact evidence of the exact RepoPilot version, git state, scan scope, finding counts, language counts, and health score.
 
 See [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) for a copy-paste GitHub Actions workflow, required permissions, and local validation commands.
 
@@ -362,7 +403,7 @@ Use `--fail-on new-high` to fail CI only when new high or critical findings are
 When `--fail-on new-*` is used without `--baseline`, RepoPilot treats all current findings as new. For baseline-based adoption, commit an accepted baseline and scan against it in CI.
 
 To upload RepoPilot findings to GitHub Code Scanning, generate SARIF and use `github/codeql-action/upload-sarif`. The workflow must include `security-events: write`.
-The first-party action can also run `command: vibe`, `command: harden`, or `command: prompt`; those commands emit Markdown and do not produce SARIF.
+The first-party action can also run `command: ai-context`, `command: ai-plan`, or `command: ai-prompt`; those commands emit Markdown and do not produce SARIF. Prefer typed action inputs such as `path`, `config`, `baseline`, `fail-on`, `focus`, `budget`, `output`, and `receipt`; `args` remains available for advanced flags.
 
 ```yaml
 name: RepoPilot
@@ -388,7 +429,7 @@ jobs:
         run: cargo install repopilot
 
       - name: Run RepoPilot
-        run: repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high
+        run: repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high --receipt repopilot-receipt.json
 
       - name: Run RepoPilot (SARIF)
         run: repopilot scan . --format sarif --output repopilot.sarif
@@ -398,6 +439,13 @@ jobs:
         if: always()
         with:
           sarif_file: repopilot.sarif
+
+      - name: Upload audit receipt
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: repopilot-receipt
+          path: repopilot-receipt.json
 ```
 
 ## Roadmap
@@ -412,12 +460,18 @@ These are planned ideas, not current features:
 
 | Document | Description |
 |---|---|
+| [docs/install.md](docs/install.md) | Installation options for Cargo, npm, Homebrew, curl, and source builds |
+| [docs/ai-workflows.md](docs/ai-workflows.md) | Claude Code, ChatGPT, Cursor, and AI remediation workflows |
+| [docs/security.md](docs/security.md) | Local-first trust model, installer security, and vulnerability reporting |
+| [docs/configuration.md](docs/configuration.md) | `repopilot.toml`, presets, ignore files, and baseline adoption |
+| [docs/language-support.md](docs/language-support.md) | Supported language/framework tiers, rule families, and limitations |
 | [docs/cli.md](docs/cli.md) | Complete CLI reference — all commands, flags, and exit codes |
 | [docs/commands.md](docs/commands.md) | Task-oriented command guide and common patterns |
 | [docs/rulesets.md](docs/rulesets.md) | Implemented audit rules, categories, and severity levels |
 | [docs/react-native.md](docs/react-native.md) | React Native and Expo detection, findings, and limitations |
 | [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) | GitHub Code Scanning SARIF workflow |
 | [docs/release.md](docs/release.md) | Manual release process |
+| [docs/release-checklist-0.10.md](docs/release-checklist-0.10.md) | 0.10.0 release readiness checklist |
 | [docs/distribution.md](docs/distribution.md) | Distribution channels |
 | [docs/github-ruleset.md](docs/github-ruleset.md) | GitHub branch ruleset configuration |
 | [CHANGELOG.md](CHANGELOG.md) | Version history |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "repopilot",
-	"version": "0.8.0",
+	"version": "0.10.0",
 	"description": "Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.",
 	"license": "MIT OR Apache-2.0",
 	"repository": {
@@ -16,8 +16,10 @@
 	},
 	"scripts": {
 		"postinstall": "node scripts/install.js",
+		"test": "npm run test:npm",
 		"test:npm": "node --test tests/npm_wrapper.test.js",
-		"release:check": "bash scripts/verify-release.sh"
+		"release:check": "bash scripts/verify-release.sh",
+		"product:smoke": "bash scripts/smoke-product.sh"
 	},
 	"files": [
 		"bin",
@@ -36,4 +38,4 @@
 	"engines": {
 		"node": ">=18"
 	}
-}
+}

package/scripts/smoke-product.sh

@@ -0,0 +1,266 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+BINARY=""
+REPO_PATH="$ROOT_DIR"
+TMP_DIR=""
+TMP_CREATED=0
+KEEP_TMP=0
+RUN_LEGACY=1
+
+usage() {
+  cat <<'EOF'
+Usage: scripts/smoke-product.sh [OPTIONS]
+
+Run product-readiness smoke checks against RepoPilot.
+
+Options:
+  --binary PATH      Use an already built repopilot binary.
+  --repo PATH        Repository or project path to smoke test. Defaults to this repo.
+  --tmp-dir PATH     Directory for generated smoke artifacts. Defaults to mktemp.
+  --keep-tmp         Keep generated smoke artifacts when using a temporary directory.
+  --skip-legacy      Skip hidden 0.x compatibility command checks.
+  -h, --help         Show this help message.
+
+Examples:
+  scripts/smoke-product.sh
+  scripts/smoke-product.sh --binary ./target/release/repopilot
+  scripts/smoke-product.sh --repo /path/to/project --keep-tmp
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --binary)
+      BINARY="${2:-}"
+      shift 2
+      ;;
+    --repo)
+      REPO_PATH="${2:-}"
+      shift 2
+      ;;
+    --tmp-dir)
+      TMP_DIR="${2:-}"
+      shift 2
+      ;;
+    --keep-tmp)
+      KEEP_TMP=1
+      shift
+      ;;
+    --skip-legacy)
+      RUN_LEGACY=0
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [[ -z "$REPO_PATH" ]]; then
+  echo "--repo cannot be empty" >&2
+  exit 2
+fi
+
+REPO_PATH="$(cd "$REPO_PATH" && pwd)"
+
+if [[ -z "$BINARY" ]]; then
+  if [[ ! -x "$ROOT_DIR/target/debug/repopilot" ]]; then
+    echo "==> Building debug binary for product smoke checks" >&2
+    cargo build --manifest-path "$ROOT_DIR/Cargo.toml"
+  fi
+  BINARY="$ROOT_DIR/target/debug/repopilot"
+else
+  case "$BINARY" in
+    /*) ;;
+    *)
+      BINARY="$(cd "$(dirname "$BINARY")" && pwd)/$(basename "$BINARY")"
+      ;;
+  esac
+fi
+
+if [[ ! -x "$BINARY" ]]; then
+  echo "RepoPilot binary is not executable: $BINARY" >&2
+  exit 3
+fi
+
+if [[ -z "$TMP_DIR" ]]; then
+  TMP_DIR="$(mktemp -d)"
+  TMP_CREATED=1
+else
+  rm -rf "$TMP_DIR"
+  mkdir -p "$TMP_DIR"
+  TMP_DIR="$(cd "$TMP_DIR" && pwd)"
+fi
+
+cleanup() {
+  if [[ "$TMP_CREATED" -eq 1 && "$KEEP_TMP" -eq 0 ]]; then
+    rm -rf "$TMP_DIR"
+  fi
+}
+trap cleanup EXIT
+
+run_repopilot() {
+  echo "==> repopilot $*" >&2
+  (
+    cd "$REPO_PATH"
+    "$BINARY" "$@"
+  )
+}
+
+assert_non_empty() {
+  local file="$1"
+  if [[ ! -s "$file" ]]; then
+    echo "Expected non-empty file: $file" >&2
+    exit 3
+  fi
+}
+
+assert_contains() {
+  local file="$1"
+  local expected="$2"
+
+  if ! grep -Fq "$expected" "$file"; then
+    echo "Expected '$file' to contain: $expected" >&2
+    echo "---- file content ----" >&2
+    cat "$file" >&2 || true
+    echo "----------------------" >&2
+    exit 3
+  fi
+}
+
+validate_json_if_possible() {
+  local file="$1"
+
+  if command -v python3 >/dev/null 2>&1; then
+    python3 -m json.tool "$file" >/dev/null
+  fi
+}
+
+find_explain_file() {
+  local preferred="$REPO_PATH/src/main.rs"
+
+  if [[ -f "$preferred" ]]; then
+    printf '%s\n' "$preferred"
+    return 0
+  fi
+
+  local discovered=""
+  while IFS= read -r candidate; do
+    discovered="$candidate"
+    break
+  done < <(
+    find "$REPO_PATH" \
+      -path "$REPO_PATH/.git" -prune -o \
+      -path "$REPO_PATH/target" -prune -o \
+      -path "$REPO_PATH/node_modules" -prune -o \
+      -type f \( \
+        -name '*.rs' -o \
+        -name '*.ts' -o \
+        -name '*.tsx' -o \
+        -name '*.js' -o \
+        -name '*.jsx' -o \
+        -name '*.py' -o \
+        -name '*.go' \
+      \) \
+      -print
+  )
+
+  if [[ -n "$discovered" && -f "$discovered" ]]; then
+    printf '%s\n' "$discovered"
+    return 0
+  fi
+
+  printf '%s\n' "$REPO_PATH/Cargo.toml"
+}
+
+EXPLAIN_FILE="$(find_explain_file)"
+
+echo "==> RepoPilot product smoke suite"
+echo "Binary: $BINARY"
+echo "Repo:   $REPO_PATH"
+echo "Tmp:    $TMP_DIR"
+echo
+
+run_repopilot --version > "$TMP_DIR/version.txt"
+assert_non_empty "$TMP_DIR/version.txt"
+
+run_repopilot --help > "$TMP_DIR/help.txt"
+assert_non_empty "$TMP_DIR/help.txt"
+assert_contains "$TMP_DIR/help.txt" "scan"
+assert_contains "$TMP_DIR/help.txt" "review"
+assert_contains "$TMP_DIR/help.txt" "ai"
+assert_contains "$TMP_DIR/help.txt" "inspect"
+
+run_repopilot init --force --path "$TMP_DIR/repopilot.toml"
+assert_non_empty "$TMP_DIR/repopilot.toml"
+
+run_repopilot doctor . --format markdown --output "$TMP_DIR/doctor.md"
+assert_non_empty "$TMP_DIR/doctor.md"
+
+run_repopilot scan . --format json --output "$TMP_DIR/scan.json" --receipt "$TMP_DIR/receipt.json"
+assert_non_empty "$TMP_DIR/scan.json"
+validate_json_if_possible "$TMP_DIR/scan.json"
+assert_non_empty "$TMP_DIR/receipt.json"
+validate_json_if_possible "$TMP_DIR/receipt.json"
+
+run_repopilot scan . --format markdown --output "$TMP_DIR/scan.md"
+assert_non_empty "$TMP_DIR/scan.md"
+
+if git -C "$REPO_PATH" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  run_repopilot review . --format markdown --output "$TMP_DIR/review.md"
+  assert_non_empty "$TMP_DIR/review.md"
+else
+  echo "==> Skipping review smoke check because repo path is not inside a Git worktree" >&2
+fi
+
+run_repopilot ai context . --focus security --budget 2k --output "$TMP_DIR/ai-context.md"
+assert_non_empty "$TMP_DIR/ai-context.md"
+
+run_repopilot ai plan . --focus all --budget 2k --output "$TMP_DIR/ai-plan.md"
+assert_non_empty "$TMP_DIR/ai-plan.md"
+
+run_repopilot ai prompt . --focus quality --budget 2k --output "$TMP_DIR/ai-prompt.md"
+assert_non_empty "$TMP_DIR/ai-prompt.md"
+
+run_repopilot inspect knowledge --format json --output "$TMP_DIR/inspect-knowledge.json"
+assert_non_empty "$TMP_DIR/inspect-knowledge.json"
+validate_json_if_possible "$TMP_DIR/inspect-knowledge.json"
+
+run_repopilot inspect knowledge --section rules --format markdown --output "$TMP_DIR/inspect-knowledge-rules.md"
+assert_non_empty "$TMP_DIR/inspect-knowledge-rules.md"
+
+run_repopilot inspect explain "$EXPLAIN_FILE" --format json --output "$TMP_DIR/inspect-explain.json"
+assert_non_empty "$TMP_DIR/inspect-explain.json"
+validate_json_if_possible "$TMP_DIR/inspect-explain.json"
+
+if [[ "$RUN_LEGACY" -eq 1 ]]; then
+  run_repopilot vibe . --focus security --budget 2k --output "$TMP_DIR/legacy-vibe.md"
+  assert_non_empty "$TMP_DIR/legacy-vibe.md"
+
+  run_repopilot harden . --focus all --budget 2k --output "$TMP_DIR/legacy-harden.md"
+  assert_non_empty "$TMP_DIR/legacy-harden.md"
+
+  run_repopilot prompt . --focus quality --budget 2k --output "$TMP_DIR/legacy-prompt.md"
+  assert_non_empty "$TMP_DIR/legacy-prompt.md"
+
+  run_repopilot knowledge --format json --output "$TMP_DIR/legacy-knowledge.json"
+  assert_non_empty "$TMP_DIR/legacy-knowledge.json"
+  validate_json_if_possible "$TMP_DIR/legacy-knowledge.json"
+
+  run_repopilot explain "$EXPLAIN_FILE" --format json --output "$TMP_DIR/legacy-explain.json"
+  assert_non_empty "$TMP_DIR/legacy-explain.json"
+  validate_json_if_possible "$TMP_DIR/legacy-explain.json"
+fi
+
+echo
+echo "==> Product smoke suite passed"
+echo "Artifacts: $TMP_DIR"

package/scripts/verify-release.sh

@@ -15,6 +15,48 @@ cargo clippy --all-targets --all-features -- -D warnings
 echo "==> Rust tests"
 cargo test --all
 
+echo "==> Rust dependency security audit"
+cargo audit
+
+echo "==> Cargo dependency policy"
+cargo deny check advisories licenses
+
+echo "==> Shell script syntax"
+scripts=()
+if [[ -f install.sh ]]; then
+  scripts+=(install.sh)
+fi
+if [[ -d scripts ]]; then
+  while IFS= read -r -d '' script; do
+    scripts+=("$script")
+  done < <(find scripts -maxdepth 1 -type f -name '*.sh' -print0)
+fi
+
+if ((${#scripts[@]} > 0)); then
+  for script in "${scripts[@]}"; do
+    bash -n "$script"
+  done
+
+  echo "==> ShellCheck"
+  shellcheck "${scripts[@]}"
+else
+  echo "==> No shell scripts found"
+fi
+
+echo "==> GitHub Actions validation"
+workflows=()
+if [[ -d .github/workflows ]]; then
+  while IFS= read -r -d '' workflow; do
+    workflows+=("$workflow")
+  done < <(find .github/workflows -maxdepth 1 -type f \( -name '*.yml' -o -name '*.yaml' \) -print0)
+fi
+
+if ((${#workflows[@]} > 0)); then
+  actionlint "${workflows[@]}"
+else
+  echo "==> No GitHub Actions workflows found"
+fi
+
 echo "==> CLI release smoke tests"
 cargo test --test cli_release_smoke
 
@@ -33,16 +75,10 @@ npm pack --dry-run
 echo "==> Build release binary"
 cargo build --release
 
-echo "==> Verify built binary"
-./target/release/repopilot --version
-./target/release/repopilot scan . --format markdown --output /tmp/repopilot-release-scan.md
-./target/release/repopilot vibe . --focus security --budget 2k --output /tmp/repopilot-release-vibe.md
-./target/release/repopilot harden . --focus all --budget 4k --output /tmp/repopilot-release-harden.md
-./target/release/repopilot prompt . --focus quality --budget 4k --output /tmp/repopilot-release-prompt.md
-
-test -s /tmp/repopilot-release-scan.md
-test -s /tmp/repopilot-release-vibe.md
-test -s /tmp/repopilot-release-harden.md
-test -s /tmp/repopilot-release-prompt.md
+echo "==> Product readiness smoke suite"
+./scripts/smoke-product.sh \
+  --binary ./target/release/repopilot \
+  --repo . \
+  --tmp-dir /tmp/repopilot-release-smoke
 
-echo "==> Release verification passed"
+echo "==> Release verification passed"