repopilot 0.8.0 → 0.9.0

package/README.md

@@ -7,9 +7,13 @@
 [![License](https://img.shields.io/crates/l/repopilot.svg)](LICENSE)
 [![GitHub Stars](https://img.shields.io/github/stars/MykytaStel/repopilot?style=social)](https://github.com/MykytaStel/repopilot)
 
-Scan your repo. Paste the result into Claude Code or ChatGPT. Start fixing.
+Audit your repository locally, turn the results into AI-ready remediation context,
+and ship safer changes without sending source code to a hosted scanner.
 
-RepoPilot is a local-first CLI that audits architecture, security, code quality, and framework health — then formats everything as LLM-ready context you can drop directly into an AI assistant. No code leaves your machine.
+RepoPilot is a local-first CLI for architecture, security, code quality, testing,
+and framework health checks. It gives developers useful terminal reports, CI gates,
+SARIF for GitHub Code Scanning, and Markdown briefs that can be pasted into Claude
+Code, ChatGPT, Cursor, or another coding assistant.
 
 ## Why RepoPilot?
 
@@ -25,7 +29,7 @@ Most linters and audit tools stop at the terminal. RepoPilot bridges the gap to
 | CI gate on new findings only | ✅ | partial | ✅ |
 
 ```bash
-repopilot vibe . | pbcopy   # macOS: paste into Claude Code and start fixing
+repopilot ai context . | pbcopy   # macOS: paste into your coding assistant
 ```
 
 ## Features
@@ -48,15 +52,15 @@ repopilot vibe . | pbcopy   # macOS: paste into Claude Code and start fixing
 - CI-friendly failure thresholds with `--fail-on`
 - Git diff-aware review mode for prioritizing findings introduced by changed lines
 - Console, JSON, Markdown, HTML, and SARIF (2.1.0) scan output — SARIF includes per-result category and workspace package properties
-- First-party GitHub Action wrapper for `scan`, `review`, `compare`, `vibe`, `harden`, and `prompt`, with optional SARIF upload for scans
+- First-party GitHub Action wrapper for `scan`, `review`, `compare`, and `ai` workflows, with optional SARIF upload for scans
 - Compare mode for diffing two JSON scan reports
-- **`repopilot vibe`** — new in v0.8: formats scan output as LLM-ready markdown, paste into Claude Code or ChatGPT to start remediating
-- **`repopilot harden`** — new in v0.8: turns findings into a prioritized remediation plan
-- **`repopilot prompt`** — new in v0.8: exports an AI-ready remediation prompt with RepoPilot context
+- **`repopilot ai context`** — formats scan output as LLM-ready markdown, paste into Claude Code or ChatGPT to start remediating
+- **`repopilot ai plan`** — turns findings into a prioritized remediation plan
+- **`repopilot ai prompt`** — exports an AI-ready remediation prompt with RepoPilot context
 
 See [docs/rulesets.md](docs/rulesets.md) for the full list of rules and severity levels.
 
-## Installation
+## Install
 
 ```bash
 cargo install repopilot
@@ -71,20 +75,24 @@ npm install -g repopilot
 Install with Homebrew:
 
 ```bash
-brew install MykytaStel/repopilot/repopilot
+brew tap mykytastel/repopilot
+brew install repopilot
 ```
 
 Install with curl (Linux/macOS):
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/MykytaStel/repopilot/main/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/MykytaStel/repopilot/main/install.sh | bash
 ```
 
+The curl installer verifies the GitHub Release SHA256 checksum and aborts if the checksum cannot be downloaded or verified.
+
 Upgrade:
 
 ```bash
 cargo install repopilot --force
 npm update -g repopilot
+brew update && brew upgrade repopilot
 ```
 
 Build from source:
@@ -100,13 +108,14 @@ cargo build --release
 ```bash
 repopilot init
 repopilot scan .
+repopilot ai context .
+repopilot review . --base origin/main --fail-on new-high
 ```
 
-React Native quick scan:
+Save a shareable report:
 
 ```bash
 repopilot scan . --format markdown --output repopilot-report.md
-repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on new-high
 ```
 
 Reduce scan noise while iterating:
@@ -119,28 +128,31 @@ repopilot scan . --exclude fixtures --max-file-size 1mb --max-files 500
 
 By default, RepoPilot skips low-signal audit paths such as tests, fixtures, examples, generated files, and benchmarks. Use `--include-low-signal` when you want those paths analyzed too.
 
-## Vibe Check (new in v0.8)
+## Local-First AI Workflow
+
+RepoPilot does not call LLM APIs. AI commands scan local files and produce Markdown
+that you decide where to paste.
 
-`repopilot vibe` scans a project and formats all findings as structured markdown ready to paste into Claude Code, Cursor, ChatGPT, or any LLM assistant. It includes a risk level, tech stack summary, findings grouped by category with evidence snippets and fix recommendations, and a token-count estimate.
+`repopilot ai context` scans a project and formats all findings as structured markdown ready to paste into Claude Code, Cursor, ChatGPT, or any LLM assistant. It includes a risk level, tech stack summary, findings grouped by category with evidence snippets and fix recommendations, and a token-count estimate.
 
 ```bash
 # Paste into Claude Code or ChatGPT
-repopilot vibe .
+repopilot ai context .
 
 # Focus on security only, keep it short
-repopilot vibe . --focus security --budget 2k
+repopilot ai context . --focus security --budget 2k
 
 # Save to file
-repopilot vibe . --output vibe.md
+repopilot ai context . --output repopilot-context.md
 
 # Pipe directly into clipboard (macOS)
-repopilot vibe . --no-header | pbcopy
+repopilot ai context . --no-header | pbcopy
 ```
 
 ## Example Output
 
 ```
-$ repopilot vibe .
+$ repopilot ai context .
 
 # RepoPilot Vibe Check — my-app
 
@@ -168,16 +180,18 @@ $ repopilot vibe .
 *~3.8k tokens (budget: 4k) · scanned in 312ms — paste into Claude Code, Cursor, or ChatGPT*
 ```
 
-Paste this into Claude Code and ask: *"Fix all findings."*
+Paste this into a coding assistant and ask for a focused patch. For larger
+repositories, start with one focus area instead of asking for every finding at
+once.
 
-## AI-Assisted Workflow
+## Recommended Remediation Loop
 
 RepoPilot is a local-first safety layer for AI-assisted and vibe-coded changes. Run it after generating or refactoring code to catch newly introduced high-risk findings, workspace hotspots, missing tests, and architecture drift without uploading source code to an external service.
 
 ```bash
-repopilot vibe . --focus security          # get an LLM brief for Claude Code
-repopilot harden . --focus security        # get a prioritized hardening plan
-repopilot prompt . --budget 8k             # generate a paste-ready remediation prompt
+repopilot ai context . --focus security    # get an LLM brief for Claude Code
+repopilot ai plan . --focus security       # get a prioritized hardening plan
+repopilot ai prompt . --budget 8k          # generate a paste-ready remediation prompt
 repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on new-high
 repopilot scan . --workspace --min-severity medium --format markdown --output repopilot-report.md
 ```
@@ -186,13 +200,14 @@ repopilot scan . --workspace --min-severity medium --format markdown --output re
 
 | Command | Alias | Description |
 |---------|-------|-------------|
-| `repopilot vibe <path>` | `v` | **New in v0.8** — LLM-ready context from a scan |
-| `repopilot harden <path>` | `h` | **New in v0.8** — prioritized remediation plan |
-| `repopilot prompt <path>` | `p` | **New in v0.8** — AI-ready remediation prompt |
 | `repopilot scan <path>` | `s` | Scan a project, folder, or file for findings |
 | `repopilot review [path]` | `r` | Review findings that touch changed Git diff lines |
+| `repopilot ai context <path>` | — | LLM-ready context from a scan |
+| `repopilot ai plan <path>` | — | Prioritized remediation plan |
+| `repopilot ai prompt <path>` | — | AI-ready remediation prompt |
 | `repopilot compare <before> <after>` | `cmp` | Compare two JSON scan reports and show what changed |
 | `repopilot baseline create <path>` | `bl` | Scan a path and store current findings as accepted debt |
+| `repopilot doctor [path]` | `d` | Diagnose audit readiness |
 | `repopilot init` | — | Generate a default `repopilot.toml` configuration file |
 
 Use `--help` on any command for the full description and examples:
@@ -362,7 +377,7 @@ Use `--fail-on new-high` to fail CI only when new high or critical findings are
 When `--fail-on new-*` is used without `--baseline`, RepoPilot treats all current findings as new. For baseline-based adoption, commit an accepted baseline and scan against it in CI.
 
 To upload RepoPilot findings to GitHub Code Scanning, generate SARIF and use `github/codeql-action/upload-sarif`. The workflow must include `security-events: write`.
-The first-party action can also run `command: vibe`, `command: harden`, or `command: prompt`; those commands emit Markdown and do not produce SARIF.
+The first-party action can also run `command: ai-context`, `command: ai-plan`, or `command: ai-prompt`; those commands emit Markdown and do not produce SARIF. Prefer typed action inputs such as `path`, `config`, `baseline`, `fail-on`, `focus`, `budget`, and `output`; `args` remains available for advanced flags.
 
 ```yaml
 name: RepoPilot
@@ -412,12 +427,18 @@ These are planned ideas, not current features:
 
 | Document | Description |
 |---|---|
+| [docs/install.md](docs/install.md) | Installation options for Cargo, npm, Homebrew, curl, and source builds |
+| [docs/ai-workflows.md](docs/ai-workflows.md) | Claude Code, ChatGPT, Cursor, and AI remediation workflows |
+| [docs/security.md](docs/security.md) | Local-first trust model, installer security, and vulnerability reporting |
+| [docs/configuration.md](docs/configuration.md) | `repopilot.toml`, presets, ignore files, and baseline adoption |
+| [docs/language-support.md](docs/language-support.md) | Supported language/framework tiers, rule families, and limitations |
 | [docs/cli.md](docs/cli.md) | Complete CLI reference — all commands, flags, and exit codes |
 | [docs/commands.md](docs/commands.md) | Task-oriented command guide and common patterns |
 | [docs/rulesets.md](docs/rulesets.md) | Implemented audit rules, categories, and severity levels |
 | [docs/react-native.md](docs/react-native.md) | React Native and Expo detection, findings, and limitations |
 | [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) | GitHub Code Scanning SARIF workflow |
 | [docs/release.md](docs/release.md) | Manual release process |
+| [docs/release-checklist-0.9.md](docs/release-checklist-0.9.md) | 0.9.0 release readiness checklist |
 | [docs/distribution.md](docs/distribution.md) | Distribution channels |
 | [docs/github-ruleset.md](docs/github-ruleset.md) | GitHub branch ruleset configuration |
 | [CHANGELOG.md](CHANGELOG.md) | Version history |

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "repopilot",
-	"version": "0.8.0",
+	"version": "0.9.0",
 	"description": "Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.",
 	"license": "MIT OR Apache-2.0",
 	"repository": {
@@ -16,8 +16,10 @@
 	},
 	"scripts": {
 		"postinstall": "node scripts/install.js",
+		"test": "npm run test:npm",
 		"test:npm": "node --test tests/npm_wrapper.test.js",
-		"release:check": "bash scripts/verify-release.sh"
+		"release:check": "bash scripts/verify-release.sh",
+		"product:smoke": "bash scripts/smoke-product.sh"
 	},
 	"files": [
 		"bin",
@@ -36,4 +38,4 @@
 	"engines": {
 		"node": ">=18"
 	}
-}
+}

package/scripts/smoke-product.sh

@@ -0,0 +1,264 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+
+BINARY=""
+REPO_PATH="$ROOT_DIR"
+TMP_DIR=""
+TMP_CREATED=0
+KEEP_TMP=0
+RUN_LEGACY=1
+
+usage() {
+  cat <<'EOF'
+Usage: scripts/smoke-product.sh [OPTIONS]
+
+Run product-readiness smoke checks against RepoPilot.
+
+Options:
+  --binary PATH      Use an already built repopilot binary.
+  --repo PATH        Repository or project path to smoke test. Defaults to this repo.
+  --tmp-dir PATH     Directory for generated smoke artifacts. Defaults to mktemp.
+  --keep-tmp         Keep generated smoke artifacts when using a temporary directory.
+  --skip-legacy      Skip hidden 0.x compatibility command checks.
+  -h, --help         Show this help message.
+
+Examples:
+  scripts/smoke-product.sh
+  scripts/smoke-product.sh --binary ./target/release/repopilot
+  scripts/smoke-product.sh --repo /path/to/project --keep-tmp
+EOF
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --binary)
+      BINARY="${2:-}"
+      shift 2
+      ;;
+    --repo)
+      REPO_PATH="${2:-}"
+      shift 2
+      ;;
+    --tmp-dir)
+      TMP_DIR="${2:-}"
+      shift 2
+      ;;
+    --keep-tmp)
+      KEEP_TMP=1
+      shift
+      ;;
+    --skip-legacy)
+      RUN_LEGACY=0
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [[ -z "$REPO_PATH" ]]; then
+  echo "--repo cannot be empty" >&2
+  exit 2
+fi
+
+REPO_PATH="$(cd "$REPO_PATH" && pwd)"
+
+if [[ -z "$BINARY" ]]; then
+  if [[ ! -x "$ROOT_DIR/target/debug/repopilot" ]]; then
+    echo "==> Building debug binary for product smoke checks" >&2
+    cargo build --manifest-path "$ROOT_DIR/Cargo.toml"
+  fi
+  BINARY="$ROOT_DIR/target/debug/repopilot"
+else
+  case "$BINARY" in
+    /*) ;;
+    *)
+      BINARY="$(cd "$(dirname "$BINARY")" && pwd)/$(basename "$BINARY")"
+      ;;
+  esac
+fi
+
+if [[ ! -x "$BINARY" ]]; then
+  echo "RepoPilot binary is not executable: $BINARY" >&2
+  exit 3
+fi
+
+if [[ -z "$TMP_DIR" ]]; then
+  TMP_DIR="$(mktemp -d)"
+  TMP_CREATED=1
+else
+  rm -rf "$TMP_DIR"
+  mkdir -p "$TMP_DIR"
+  TMP_DIR="$(cd "$TMP_DIR" && pwd)"
+fi
+
+cleanup() {
+  if [[ "$TMP_CREATED" -eq 1 && "$KEEP_TMP" -eq 0 ]]; then
+    rm -rf "$TMP_DIR"
+  fi
+}
+trap cleanup EXIT
+
+run_repopilot() {
+  echo "==> repopilot $*" >&2
+  (
+    cd "$REPO_PATH"
+    "$BINARY" "$@"
+  )
+}
+
+assert_non_empty() {
+  local file="$1"
+  if [[ ! -s "$file" ]]; then
+    echo "Expected non-empty file: $file" >&2
+    exit 3
+  fi
+}
+
+assert_contains() {
+  local file="$1"
+  local expected="$2"
+
+  if ! grep -Fq "$expected" "$file"; then
+    echo "Expected '$file' to contain: $expected" >&2
+    echo "---- file content ----" >&2
+    cat "$file" >&2 || true
+    echo "----------------------" >&2
+    exit 3
+  fi
+}
+
+validate_json_if_possible() {
+  local file="$1"
+
+  if command -v python3 >/dev/null 2>&1; then
+    python3 -m json.tool "$file" >/dev/null
+  fi
+}
+
+find_explain_file() {
+  local preferred="$REPO_PATH/src/main.rs"
+
+  if [[ -f "$preferred" ]]; then
+    printf '%s\n' "$preferred"
+    return 0
+  fi
+
+  local discovered=""
+  while IFS= read -r candidate; do
+    discovered="$candidate"
+    break
+  done < <(
+    find "$REPO_PATH" \
+      -path "$REPO_PATH/.git" -prune -o \
+      -path "$REPO_PATH/target" -prune -o \
+      -path "$REPO_PATH/node_modules" -prune -o \
+      -type f \( \
+        -name '*.rs' -o \
+        -name '*.ts' -o \
+        -name '*.tsx' -o \
+        -name '*.js' -o \
+        -name '*.jsx' -o \
+        -name '*.py' -o \
+        -name '*.go' \
+      \) \
+      -print
+  )
+
+  if [[ -n "$discovered" && -f "$discovered" ]]; then
+    printf '%s\n' "$discovered"
+    return 0
+  fi
+
+  printf '%s\n' "$REPO_PATH/Cargo.toml"
+}
+
+EXPLAIN_FILE="$(find_explain_file)"
+
+echo "==> RepoPilot product smoke suite"
+echo "Binary: $BINARY"
+echo "Repo:   $REPO_PATH"
+echo "Tmp:    $TMP_DIR"
+echo
+
+run_repopilot --version > "$TMP_DIR/version.txt"
+assert_non_empty "$TMP_DIR/version.txt"
+
+run_repopilot --help > "$TMP_DIR/help.txt"
+assert_non_empty "$TMP_DIR/help.txt"
+assert_contains "$TMP_DIR/help.txt" "scan"
+assert_contains "$TMP_DIR/help.txt" "review"
+assert_contains "$TMP_DIR/help.txt" "ai"
+assert_contains "$TMP_DIR/help.txt" "inspect"
+
+run_repopilot init --force --path "$TMP_DIR/repopilot.toml"
+assert_non_empty "$TMP_DIR/repopilot.toml"
+
+run_repopilot doctor . --format markdown --output "$TMP_DIR/doctor.md"
+assert_non_empty "$TMP_DIR/doctor.md"
+
+run_repopilot scan . --format json --output "$TMP_DIR/scan.json"
+assert_non_empty "$TMP_DIR/scan.json"
+validate_json_if_possible "$TMP_DIR/scan.json"
+
+run_repopilot scan . --format markdown --output "$TMP_DIR/scan.md"
+assert_non_empty "$TMP_DIR/scan.md"
+
+if git -C "$REPO_PATH" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  run_repopilot review . --format markdown --output "$TMP_DIR/review.md"
+  assert_non_empty "$TMP_DIR/review.md"
+else
+  echo "==> Skipping review smoke check because repo path is not inside a Git worktree" >&2
+fi
+
+run_repopilot ai context . --focus security --budget 2k --output "$TMP_DIR/ai-context.md"
+assert_non_empty "$TMP_DIR/ai-context.md"
+
+run_repopilot ai plan . --focus all --budget 2k --output "$TMP_DIR/ai-plan.md"
+assert_non_empty "$TMP_DIR/ai-plan.md"
+
+run_repopilot ai prompt . --focus quality --budget 2k --output "$TMP_DIR/ai-prompt.md"
+assert_non_empty "$TMP_DIR/ai-prompt.md"
+
+run_repopilot inspect knowledge --format json --output "$TMP_DIR/inspect-knowledge.json"
+assert_non_empty "$TMP_DIR/inspect-knowledge.json"
+validate_json_if_possible "$TMP_DIR/inspect-knowledge.json"
+
+run_repopilot inspect knowledge --section rules --format markdown --output "$TMP_DIR/inspect-knowledge-rules.md"
+assert_non_empty "$TMP_DIR/inspect-knowledge-rules.md"
+
+run_repopilot inspect explain "$EXPLAIN_FILE" --format json --output "$TMP_DIR/inspect-explain.json"
+assert_non_empty "$TMP_DIR/inspect-explain.json"
+validate_json_if_possible "$TMP_DIR/inspect-explain.json"
+
+if [[ "$RUN_LEGACY" -eq 1 ]]; then
+  run_repopilot vibe . --focus security --budget 2k --output "$TMP_DIR/legacy-vibe.md"
+  assert_non_empty "$TMP_DIR/legacy-vibe.md"
+
+  run_repopilot harden . --focus all --budget 2k --output "$TMP_DIR/legacy-harden.md"
+  assert_non_empty "$TMP_DIR/legacy-harden.md"
+
+  run_repopilot prompt . --focus quality --budget 2k --output "$TMP_DIR/legacy-prompt.md"
+  assert_non_empty "$TMP_DIR/legacy-prompt.md"
+
+  run_repopilot knowledge --format json --output "$TMP_DIR/legacy-knowledge.json"
+  assert_non_empty "$TMP_DIR/legacy-knowledge.json"
+  validate_json_if_possible "$TMP_DIR/legacy-knowledge.json"
+
+  run_repopilot explain "$EXPLAIN_FILE" --format json --output "$TMP_DIR/legacy-explain.json"
+  assert_non_empty "$TMP_DIR/legacy-explain.json"
+  validate_json_if_possible "$TMP_DIR/legacy-explain.json"
+fi
+
+echo
+echo "==> Product smoke suite passed"
+echo "Artifacts: $TMP_DIR"

package/scripts/verify-release.sh

@@ -15,6 +15,48 @@ cargo clippy --all-targets --all-features -- -D warnings
 echo "==> Rust tests"
 cargo test --all
 
+echo "==> Rust dependency security audit"
+cargo audit
+
+echo "==> Cargo dependency policy"
+cargo deny check advisories licenses
+
+echo "==> Shell script syntax"
+scripts=()
+if [[ -f install.sh ]]; then
+  scripts+=(install.sh)
+fi
+if [[ -d scripts ]]; then
+  while IFS= read -r -d '' script; do
+    scripts+=("$script")
+  done < <(find scripts -maxdepth 1 -type f -name '*.sh' -print0)
+fi
+
+if ((${#scripts[@]} > 0)); then
+  for script in "${scripts[@]}"; do
+    bash -n "$script"
+  done
+
+  echo "==> ShellCheck"
+  shellcheck "${scripts[@]}"
+else
+  echo "==> No shell scripts found"
+fi
+
+echo "==> GitHub Actions validation"
+workflows=()
+if [[ -d .github/workflows ]]; then
+  while IFS= read -r -d '' workflow; do
+    workflows+=("$workflow")
+  done < <(find .github/workflows -maxdepth 1 -type f \( -name '*.yml' -o -name '*.yaml' \) -print0)
+fi
+
+if ((${#workflows[@]} > 0)); then
+  actionlint "${workflows[@]}"
+else
+  echo "==> No GitHub Actions workflows found"
+fi
+
 echo "==> CLI release smoke tests"
 cargo test --test cli_release_smoke
 
@@ -33,16 +75,10 @@ npm pack --dry-run
 echo "==> Build release binary"
 cargo build --release
 
-echo "==> Verify built binary"
-./target/release/repopilot --version
-./target/release/repopilot scan . --format markdown --output /tmp/repopilot-release-scan.md
-./target/release/repopilot vibe . --focus security --budget 2k --output /tmp/repopilot-release-vibe.md
-./target/release/repopilot harden . --focus all --budget 4k --output /tmp/repopilot-release-harden.md
-./target/release/repopilot prompt . --focus quality --budget 4k --output /tmp/repopilot-release-prompt.md
-
-test -s /tmp/repopilot-release-scan.md
-test -s /tmp/repopilot-release-vibe.md
-test -s /tmp/repopilot-release-harden.md
-test -s /tmp/repopilot-release-prompt.md
+echo "==> Product readiness smoke suite"
+./scripts/smoke-product.sh \
+  --binary ./target/release/repopilot \
+  --repo . \
+  --tmp-dir /tmp/repopilot-release-smoke
 
-echo "==> Release verification passed"
+echo "==> Release verification passed"