repopilot 0.9.0 → 0.11.0

package/README.md

@@ -15,6 +15,11 @@ and framework health checks. It gives developers useful terminal reports, CI gat
 SARIF for GitHub Code Scanning, and Markdown briefs that can be pasted into Claude
 Code, ChatGPT, Cursor, or another coding assistant.
 
+Version `0.11.0` is a signal quality and CI polish release: it reduces
+low-value self-audit findings, adds first-party Action parity for priority/rule
+filters, and tightens the `doctor -> scan/review -> ai context -> CI gate` loop
+while keeping all scans local.
+
 ## Why RepoPilot?
 
 Most linters and audit tools stop at the terminal. RepoPilot bridges the gap to your AI assistant:
@@ -36,23 +41,25 @@ repopilot ai context . | pbcopy   # macOS: paste into your coding assistant
 
 - Repository scanning for projects, folders, and individual files
 - Gitignore-aware walking with built-in ignores for common build, cache, vendor, and native platform directories
-- Architecture findings: oversized files, deep nesting, too many modules per directory
+- Architecture findings: oversized files, deep nesting, deep relative imports, risky barrel files, too many modules per directory
 - Coupling analysis: excessive fan-out, high-instability hubs, circular dependencies
 - Code quality findings: cyclomatic complexity density, long functions, TODO/FIXME/HACK markers
 - Security findings: hardcoded secret candidates, committed private keys, committed `.env` files
 - Testing findings: missing test folder, source files without test counterparts
-- Framework findings for JavaScript, React, React Native, and Expo projects
+- Framework findings for JavaScript, React, React Native, Expo, and Django projects
 - React Native architecture profile: project kind, New Architecture, Hermes, Codegen, platform mismatch, and package manager signals
 - Workspace scanning (`--workspace`) for npm, yarn, pnpm, and Cargo workspaces with per-package risk summary — parallel per-package scans
 - Evidence-backed findings with stable rule IDs, severity, file paths, line numbers, and snippets
-- 36 built-in rules with titles, descriptions, recommendations, and docs links
+- 46 built-in rules with titles, descriptions, recommendations, and docs links
 - `repopilot.toml` configuration generated by `repopilot init`
 - Configuration presets (`--preset strict|balanced|lenient`) for quick threshold tuning
 - Baseline workflow for accepting existing findings in legacy repositories
 - CI-friendly failure thresholds with `--fail-on`
 - Git diff-aware review mode for prioritizing findings introduced by changed lines
+- Doctor adoption guidance for config, baseline, CI gate, report, and receipt readiness
+- Audit receipt JSON from `repopilot scan --receipt` for reproducible scan evidence
 - Console, JSON, Markdown, HTML, and SARIF (2.1.0) scan output — SARIF includes per-result category and workspace package properties
-- First-party GitHub Action wrapper for `scan`, `review`, `compare`, and `ai` workflows, with optional SARIF upload for scans
+- First-party GitHub Action wrapper for `scan`, `review`, `compare`, and `ai` workflows, with optional SARIF upload and receipt output for scans
 - Compare mode for diffing two JSON scan reports
 - **`repopilot ai context`** — formats scan output as LLM-ready markdown, paste into Claude Code or ChatGPT to start remediating
 - **`repopilot ai plan`** — turns findings into a prioritized remediation plan
@@ -105,17 +112,38 @@ cargo build --release
 
 ## Quick Start
 
+No config needed. Run this in any repository and see findings immediately:
+
 ```bash
-repopilot init
 repopilot scan .
-repopilot ai context .
-repopilot review . --base origin/main --fail-on new-high
+```
+
+Then get an AI-ready brief to paste into Claude Code, Cursor, or ChatGPT:
+
+```bash
+repopilot ai context . | pbcopy   # macOS — copies to clipboard
+repopilot ai context .            # print to terminal
+```
+
+That's the two-minute loop. Scan, read the output, paste the context into your assistant, fix.
+
+### Going deeper
+
+Once you want CI integration, baseline tracking, or tighter configuration:
+
+```bash
+repopilot init                                              # generate repopilot.toml
+repopilot doctor .                                          # check CI / baseline readiness
+repopilot scan . --min-priority p2 --rule security.secret-candidate
+repopilot ai context . --focus security                     # prepare local AI context
+repopilot baseline create .                                 # accept existing findings as known debt
+repopilot review . --base origin/main --fail-on-priority p1 # CI gate on high-priority risk
 ```
 
 Save a shareable report:
 
 ```bash
-repopilot scan . --format markdown --output repopilot-report.md
+repopilot scan . --format markdown --output repopilot-report.md --receipt .repopilot/receipt.json
 ```
 
 Reduce scan noise while iterating:
@@ -192,7 +220,7 @@ RepoPilot is a local-first safety layer for AI-assisted and vibe-coded changes.
 repopilot ai context . --focus security    # get an LLM brief for Claude Code
 repopilot ai plan . --focus security       # get a prioritized hardening plan
 repopilot ai prompt . --budget 8k          # generate a paste-ready remediation prompt
-repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on new-high
+repopilot review . --base origin/main --baseline .repopilot/baseline.json --fail-on-priority p1
 repopilot scan . --workspace --min-severity medium --format markdown --output repopilot-report.md
 ```
 
@@ -356,7 +384,8 @@ If your installed RepoPilot version does not support `--output`, redirect stdout
 repopilot scan . --format sarif > repopilot.sarif
 ```
 
-Use JSON when custom scripts need to parse RepoPilot results. Console, Markdown, and HTML reports include the RepoPilot version, risk summary, top rules, and grouped findings for human review. Use SARIF for CI and code scanning integrations, including GitHub Code Scanning.
+Use JSON when custom scripts need to parse RepoPilot results. Console, Markdown, and HTML reports include the RepoPilot version, risk summary, top risk clusters, top rules, and grouped findings for human review. Use SARIF for CI and code scanning integrations, including GitHub Code Scanning.
+Use `--receipt <path>` with `scan` when CI or release processes need compact evidence of the exact RepoPilot version, git state, scan scope, finding counts, language counts, and health score.
 
 See [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) for a copy-paste GitHub Actions workflow, required permissions, and local validation commands.
 
@@ -377,7 +406,7 @@ Use `--fail-on new-high` to fail CI only when new high or critical findings are
 When `--fail-on new-*` is used without `--baseline`, RepoPilot treats all current findings as new. For baseline-based adoption, commit an accepted baseline and scan against it in CI.
 
 To upload RepoPilot findings to GitHub Code Scanning, generate SARIF and use `github/codeql-action/upload-sarif`. The workflow must include `security-events: write`.
-The first-party action can also run `command: ai-context`, `command: ai-plan`, or `command: ai-prompt`; those commands emit Markdown and do not produce SARIF. Prefer typed action inputs such as `path`, `config`, `baseline`, `fail-on`, `focus`, `budget`, and `output`; `args` remains available for advanced flags.
+The first-party action can also run `command: doctor`, `command: ai-context`, `command: ai-plan`, or `command: ai-prompt`; AI commands emit Markdown and do not produce SARIF. Prefer typed action inputs such as `path`, `config`, `baseline`, `fail-on`, `fail-on-priority`, `min-priority`, `rule`, `timing`, `focus`, `budget`, `output`, and `receipt`; `args` remains available for advanced flags.
 
 ```yaml
 name: RepoPilot
@@ -403,7 +432,7 @@ jobs:
         run: cargo install repopilot
 
       - name: Run RepoPilot
-        run: repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high
+        run: repopilot scan . --baseline .repopilot/baseline.json --fail-on new-high --receipt repopilot-receipt.json
 
       - name: Run RepoPilot (SARIF)
         run: repopilot scan . --format sarif --output repopilot.sarif
@@ -413,6 +442,13 @@ jobs:
         if: always()
         with:
           sarif_file: repopilot.sarif
+
+      - name: Upload audit receipt
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: repopilot-receipt
+          path: repopilot-receipt.json
 ```
 
 ## Roadmap
@@ -421,7 +457,6 @@ These are planned ideas, not current features:
 
 - Change Risk Map
 - Better architecture drift detection
-- Optional per-platform npm binary packages for faster installs
 
 ## Documentation
 
@@ -432,13 +467,16 @@ These are planned ideas, not current features:
 | [docs/security.md](docs/security.md) | Local-first trust model, installer security, and vulnerability reporting |
 | [docs/configuration.md](docs/configuration.md) | `repopilot.toml`, presets, ignore files, and baseline adoption |
 | [docs/language-support.md](docs/language-support.md) | Supported language/framework tiers, rule families, and limitations |
+| [docs/risk-engine.md](docs/risk-engine.md) | Risk scoring, priority buckets, signals, and calibration policy |
 | [docs/cli.md](docs/cli.md) | Complete CLI reference — all commands, flags, and exit codes |
 | [docs/commands.md](docs/commands.md) | Task-oriented command guide and common patterns |
 | [docs/rulesets.md](docs/rulesets.md) | Implemented audit rules, categories, and severity levels |
 | [docs/react-native.md](docs/react-native.md) | React Native and Expo detection, findings, and limitations |
 | [docs/integrations/github-code-scanning.md](docs/integrations/github-code-scanning.md) | GitHub Code Scanning SARIF workflow |
 | [docs/release.md](docs/release.md) | Manual release process |
-| [docs/release-checklist-0.9.md](docs/release-checklist-0.9.md) | 0.9.0 release readiness checklist |
+| [docs/release-announcement-0.11.md](docs/release-announcement-0.11.md) | 0.11.0 launch post and post-publish checks |
+| [docs/release-checklist-0.11.md](docs/release-checklist-0.11.md) | 0.11.0 release readiness checklist |
+| [docs/release-checklist-0.10.md](docs/release-checklist-0.10.md) | 0.10.0 release readiness checklist |
 | [docs/distribution.md](docs/distribution.md) | Distribution channels |
 | [docs/github-ruleset.md](docs/github-ruleset.md) | GitHub branch ruleset configuration |
 | [CHANGELOG.md](CHANGELOG.md) | Version history |

package/bin/repopilot.js

@@ -4,29 +4,141 @@ const fs = require("node:fs");
 const path = require("node:path");
 const { spawn } = require("node:child_process");
 
-function binaryName() {
-  return process.platform === "win32" ? "repopilot.exe" : "repopilot";
+const SUPPORTED_TARGETS = [
+  { platform: "darwin", arch: "arm64", packageName: "@repopilot/darwin-arm64", binary: "repopilot" },
+  { platform: "darwin", arch: "x64", packageName: "@repopilot/darwin-x64", binary: "repopilot" },
+  {
+    platform: "linux",
+    arch: "arm64",
+    libc: "glibc",
+    packageName: "@repopilot/linux-arm64-gnu",
+    binary: "repopilot",
+  },
+  {
+    platform: "linux",
+    arch: "x64",
+    libc: "glibc",
+    packageName: "@repopilot/linux-x64-gnu",
+    binary: "repopilot",
+  },
+  { platform: "win32", arch: "x64", packageName: "@repopilot/win32-x64-msvc", binary: "repopilot.exe" },
+];
+
+class UnsupportedPlatformError extends Error {
+  constructor(platform, arch, libc) {
+    const runtime = libc ? `${platform}/${arch}/${libc}` : `${platform}/${arch}`;
+    super(`Unsupported npm platform: ${runtime}`);
+    this.name = "UnsupportedPlatformError";
+    this.code = "ERR_REPOPILOT_UNSUPPORTED_PLATFORM";
+    this.platform = platform;
+    this.arch = arch;
+    this.libc = libc;
+  }
+}
+
+class MissingOptionalPackageError extends Error {
+  constructor(packageName, cause) {
+    super(`Missing optional native package: ${packageName}`);
+    this.name = "MissingOptionalPackageError";
+    this.code = "ERR_REPOPILOT_MISSING_OPTIONAL_PACKAGE";
+    this.packageName = packageName;
+    this.cause = cause;
+  }
+}
+
+function detectLibc(platform = process.platform) {
+  if (platform !== "linux") {
+    return undefined;
+  }
+
+  const report = typeof process.report?.getReport === "function" ? process.report.getReport() : undefined;
+  if (report?.header?.glibcVersionRuntime) {
+    return "glibc";
+  }
+  return "musl";
+}
+
+function platformPackage(platform = process.platform, arch = process.arch, libc = detectLibc(platform)) {
+  const match = SUPPORTED_TARGETS.find((target) => {
+    if (target.platform !== platform || target.arch !== arch) {
+      return false;
+    }
+    return target.platform !== "linux" || target.libc === libc;
+  });
+
+  if (!match) {
+    throw new UnsupportedPlatformError(platform, arch, platform === "linux" ? libc : undefined);
+  }
+  return match;
 }
 
-function bundledBinaryPath() {
-  return path.join(__dirname, "..", "vendor", binaryName());
+function packageRoot(packageName, resolver = require.resolve) {
+  try {
+    return path.dirname(resolver(`${packageName}/package.json`));
+  } catch (error) {
+    if (error && error.code === "MODULE_NOT_FOUND") {
+      throw new MissingOptionalPackageError(packageName, error);
+    }
+    throw error;
+  }
 }
 
-function resolveBinaryPath() {
-  if (process.env.REPOPILOT_BINARY_PATH) {
-    return process.env.REPOPILOT_BINARY_PATH;
+function resolveBinaryPath(options = {}) {
+  const env = options.env ?? process.env;
+  if (env.REPOPILOT_BINARY_PATH) {
+    return env.REPOPILOT_BINARY_PATH;
   }
-  return bundledBinaryPath();
+
+  const target = platformPackage(options.platform, options.arch, options.libc);
+  return path.join(packageRoot(target.packageName, options.resolver), "bin", target.binary);
+}
+
+function supportedTargetsText() {
+  return SUPPORTED_TARGETS.map((target) => {
+    const runtime = target.libc
+      ? `${target.platform}/${target.arch}/${target.libc}`
+      : `${target.platform}/${target.arch}`;
+    return `${runtime} (${target.packageName})`;
+  }).join(", ");
+}
+
+function formatResolveError(error) {
+  if (error.code === "ERR_REPOPILOT_UNSUPPORTED_PLATFORM") {
+    return [
+      "RepoPilot does not provide an npm native package for this platform.",
+      `Detected: ${error.libc ? `${error.platform}/${error.arch}/${error.libc}` : `${error.platform}/${error.arch}`}`,
+      `Supported npm targets: ${supportedTargetsText()}`,
+      "Install with cargo, Homebrew, GitHub Releases, or set REPOPILOT_BINARY_PATH to an existing repopilot binary.",
+    ].join("\n");
+  }
+
+  if (error.code === "ERR_REPOPILOT_MISSING_OPTIONAL_PACKAGE") {
+    return [
+      "RepoPilot optional native package was not installed.",
+      `Expected npm package: ${error.packageName}`,
+      "Reinstall without omitting optional dependencies, for example: npm install -g repopilot",
+      "If your environment blocks optional dependencies, install with cargo or set REPOPILOT_BINARY_PATH to an existing repopilot binary.",
+    ].join("\n");
+  }
+
+  return `Failed to resolve RepoPilot binary: ${error.message}`;
 }
 
 function main() {
-  const binary = resolveBinaryPath();
+  let binary;
+  try {
+    binary = resolveBinaryPath();
+  } catch (error) {
+    console.error(formatResolveError(error));
+    process.exit(1);
+  }
+
   if (!fs.existsSync(binary)) {
     console.error(
       [
         "RepoPilot binary was not found.",
         `Expected: ${binary}`,
-        "Run npm install again, install with cargo, or set REPOPILOT_BINARY_PATH to an existing repopilot binary.",
+        "Reinstall repopilot, install with cargo, or set REPOPILOT_BINARY_PATH to an existing repopilot binary.",
       ].join("\n")
     );
     process.exit(1);
@@ -55,7 +167,12 @@ if (require.main === module) {
 }
 
 module.exports = {
-  binaryName,
-  bundledBinaryPath,
+  SUPPORTED_TARGETS,
+  MissingOptionalPackageError,
+  UnsupportedPlatformError,
+  detectLibc,
+  formatResolveError,
+  platformPackage,
   resolveBinaryPath,
+  supportedTargetsText,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "repopilot",
-	"version": "0.9.0",
+	"version": "0.11.0",
 	"description": "Local-first CLI for repository audit, architecture risk detection, baseline tracking, and CI-friendly code review.",
 	"license": "MIT OR Apache-2.0",
 	"repository": {
@@ -15,7 +15,6 @@
 		"repopilot": "bin/repopilot.js"
 	},
 	"scripts": {
-		"postinstall": "node scripts/install.js",
 		"test": "npm run test:npm",
 		"test:npm": "node --test tests/npm_wrapper.test.js",
 		"release:check": "bash scripts/verify-release.sh",
@@ -23,10 +22,16 @@
 	},
 	"files": [
 		"bin",
-		"scripts",
 		"README.md",
 		"LICENSE"
 	],
+	"optionalDependencies": {
+		"@repopilot/darwin-arm64": "0.11.0",
+		"@repopilot/darwin-x64": "0.11.0",
+		"@repopilot/linux-arm64-gnu": "0.11.0",
+		"@repopilot/linux-x64-gnu": "0.11.0",
+		"@repopilot/win32-x64-msvc": "0.11.0"
+	},
 	"keywords": [
 		"cli",
 		"audit",

package/scripts/install.js

@@ -1,141 +0,0 @@
-#!/usr/bin/env node
-
-const crypto = require("node:crypto");
-const fs = require("node:fs");
-const https = require("node:https");
-const os = require("node:os");
-const path = require("node:path");
-const { spawnSync } = require("node:child_process");
-
-const ROOT = path.join(__dirname, "..");
-const VENDOR_DIR = path.join(ROOT, "vendor");
-const PACKAGE_JSON = require(path.join(ROOT, "package.json"));
-
-function targetTriple(platform = process.platform, arch = process.arch) {
-  if (platform === "darwin" && arch === "x64") return "x86_64-apple-darwin";
-  if (platform === "darwin" && arch === "arm64") return "aarch64-apple-darwin";
-  if (platform === "linux" && arch === "x64") return "x86_64-unknown-linux-gnu";
-  if (platform === "linux" && arch === "arm64") return "aarch64-unknown-linux-gnu";
-  if (platform === "win32" && arch === "x64") return "x86_64-pc-windows-msvc";
-  throw new Error(`Unsupported platform: ${platform}/${arch}`);
-}
-
-function archiveExt(target) {
-  return target.endsWith("windows-msvc") ? "zip" : "tar.gz";
-}
-
-function assetName(version, target) {
-  return `repopilot-v${version}-${target}.${archiveExt(target)}`;
-}
-
-function releaseUrl(version, file) {
-  return `https://github.com/MykytaStel/repopilot/releases/download/v${version}/${file}`;
-}
-
-function download(url, destination) {
-  return new Promise((resolve, reject) => {
-    const file = fs.createWriteStream(destination);
-    https
-      .get(url, (response) => {
-        if (response.statusCode >= 300 && response.statusCode < 400 && response.headers.location) {
-          file.close();
-          fs.rmSync(destination, { force: true });
-          download(response.headers.location, destination).then(resolve, reject);
-          return;
-        }
-        if (response.statusCode !== 200) {
-          file.close();
-          fs.rmSync(destination, { force: true });
-          reject(new Error(`Download failed (${response.statusCode}): ${url}`));
-          return;
-        }
-        response.pipe(file);
-        file.on("finish", () => file.close(resolve));
-      })
-      .on("error", (error) => {
-        file.close();
-        fs.rmSync(destination, { force: true });
-        reject(error);
-      });
-  });
-}
-
-function sha256(file) {
-  const hash = crypto.createHash("sha256");
-  hash.update(fs.readFileSync(file));
-  return hash.digest("hex");
-}
-
-function expectedChecksum(checksumText) {
-  const first = checksumText.trim().split(/\s+/)[0];
-  if (!/^[a-fA-F0-9]{64}$/.test(first)) {
-    throw new Error("Invalid checksum file format");
-  }
-  return first.toLowerCase();
-}
-
-function verifyChecksum(archivePath, checksumText) {
-  const expected = expectedChecksum(checksumText);
-  const actual = sha256(archivePath);
-  if (actual !== expected) {
-    throw new Error(`Checksum mismatch for ${path.basename(archivePath)}: expected ${expected}, got ${actual}`);
-  }
-}
-
-function extractArchive(archivePath, destination, target) {
-  fs.rmSync(destination, { recursive: true, force: true });
-  fs.mkdirSync(destination, { recursive: true });
-
-  const result = target.endsWith("windows-msvc")
-    ? spawnSync("powershell", ["-NoProfile", "-Command", `Expand-Archive -Force '${archivePath}' '${destination}'`], { stdio: "inherit" })
-    : spawnSync("tar", ["-xzf", archivePath, "-C", destination], { stdio: "inherit" });
-
-  if (result.status !== 0) {
-    throw new Error(`Failed to extract ${archivePath}`);
-  }
-}
-
-async function install() {
-  if (process.env.REPOPILOT_SKIP_DOWNLOAD === "1" || process.env.REPOPILOT_SKIP_DOWNLOAD === "true") {
-    console.log("Skipping RepoPilot binary download because REPOPILOT_SKIP_DOWNLOAD is set.");
-    return;
-  }
-
-  const target = targetTriple();
-  const version = PACKAGE_JSON.version;
-  const archive = assetName(version, target);
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "repopilot-"));
-  const archivePath = path.join(tmp, archive);
-  const checksumPath = `${archivePath}.sha256`;
-  const extractDir = path.join(tmp, "extract");
-  const binaryName = target.endsWith("windows-msvc") ? "repopilot.exe" : "repopilot";
-
-  try {
-    await download(releaseUrl(version, archive), archivePath);
-    await download(releaseUrl(version, `${archive}.sha256`), checksumPath);
-    verifyChecksum(archivePath, fs.readFileSync(checksumPath, "utf8"));
-    extractArchive(archivePath, extractDir, target);
-
-    fs.mkdirSync(VENDOR_DIR, { recursive: true });
-    fs.copyFileSync(path.join(extractDir, binaryName), path.join(VENDOR_DIR, binaryName));
-    fs.chmodSync(path.join(VENDOR_DIR, binaryName), 0o755);
-  } finally {
-    fs.rmSync(tmp, { recursive: true, force: true });
-  }
-}
-
-if (require.main === module) {
-  install().catch((error) => {
-    console.error(`Failed to install RepoPilot binary: ${error.message}`);
-    console.error("Set REPOPILOT_SKIP_DOWNLOAD=1 to skip download or REPOPILOT_BINARY_PATH to use an existing binary.");
-    process.exit(1);
-  });
-}
-
-module.exports = {
-  archiveExt,
-  assetName,
-  expectedChecksum,
-  targetTriple,
-  verifyChecksum,
-};

package/scripts/smoke-product.sh

@@ -1,264 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-
-BINARY=""
-REPO_PATH="$ROOT_DIR"
-TMP_DIR=""
-TMP_CREATED=0
-KEEP_TMP=0
-RUN_LEGACY=1
-
-usage() {
-  cat <<'EOF'
-Usage: scripts/smoke-product.sh [OPTIONS]
-
-Run product-readiness smoke checks against RepoPilot.
-
-Options:
-  --binary PATH      Use an already built repopilot binary.
-  --repo PATH        Repository or project path to smoke test. Defaults to this repo.
-  --tmp-dir PATH     Directory for generated smoke artifacts. Defaults to mktemp.
-  --keep-tmp         Keep generated smoke artifacts when using a temporary directory.
-  --skip-legacy      Skip hidden 0.x compatibility command checks.
-  -h, --help         Show this help message.
-
-Examples:
-  scripts/smoke-product.sh
-  scripts/smoke-product.sh --binary ./target/release/repopilot
-  scripts/smoke-product.sh --repo /path/to/project --keep-tmp
-EOF
-}
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --binary)
-      BINARY="${2:-}"
-      shift 2
-      ;;
-    --repo)
-      REPO_PATH="${2:-}"
-      shift 2
-      ;;
-    --tmp-dir)
-      TMP_DIR="${2:-}"
-      shift 2
-      ;;
-    --keep-tmp)
-      KEEP_TMP=1
-      shift
-      ;;
-    --skip-legacy)
-      RUN_LEGACY=0
-      shift
-      ;;
-    -h|--help)
-      usage
-      exit 0
-      ;;
-    *)
-      echo "Unknown argument: $1" >&2
-      usage >&2
-      exit 2
-      ;;
-  esac
-done
-
-if [[ -z "$REPO_PATH" ]]; then
-  echo "--repo cannot be empty" >&2
-  exit 2
-fi
-
-REPO_PATH="$(cd "$REPO_PATH" && pwd)"
-
-if [[ -z "$BINARY" ]]; then
-  if [[ ! -x "$ROOT_DIR/target/debug/repopilot" ]]; then
-    echo "==> Building debug binary for product smoke checks" >&2
-    cargo build --manifest-path "$ROOT_DIR/Cargo.toml"
-  fi
-  BINARY="$ROOT_DIR/target/debug/repopilot"
-else
-  case "$BINARY" in
-    /*) ;;
-    *)
-      BINARY="$(cd "$(dirname "$BINARY")" && pwd)/$(basename "$BINARY")"
-      ;;
-  esac
-fi
-
-if [[ ! -x "$BINARY" ]]; then
-  echo "RepoPilot binary is not executable: $BINARY" >&2
-  exit 3
-fi
-
-if [[ -z "$TMP_DIR" ]]; then
-  TMP_DIR="$(mktemp -d)"
-  TMP_CREATED=1
-else
-  rm -rf "$TMP_DIR"
-  mkdir -p "$TMP_DIR"
-  TMP_DIR="$(cd "$TMP_DIR" && pwd)"
-fi
-
-cleanup() {
-  if [[ "$TMP_CREATED" -eq 1 && "$KEEP_TMP" -eq 0 ]]; then
-    rm -rf "$TMP_DIR"
-  fi
-}
-trap cleanup EXIT
-
-run_repopilot() {
-  echo "==> repopilot $*" >&2
-  (
-    cd "$REPO_PATH"
-    "$BINARY" "$@"
-  )
-}
-
-assert_non_empty() {
-  local file="$1"
-  if [[ ! -s "$file" ]]; then
-    echo "Expected non-empty file: $file" >&2
-    exit 3
-  fi
-}
-
-assert_contains() {
-  local file="$1"
-  local expected="$2"
-
-  if ! grep -Fq "$expected" "$file"; then
-    echo "Expected '$file' to contain: $expected" >&2
-    echo "---- file content ----" >&2
-    cat "$file" >&2 || true
-    echo "----------------------" >&2
-    exit 3
-  fi
-}
-
-validate_json_if_possible() {
-  local file="$1"
-
-  if command -v python3 >/dev/null 2>&1; then
-    python3 -m json.tool "$file" >/dev/null
-  fi
-}
-
-find_explain_file() {
-  local preferred="$REPO_PATH/src/main.rs"
-
-  if [[ -f "$preferred" ]]; then
-    printf '%s\n' "$preferred"
-    return 0
-  fi
-
-  local discovered=""
-  while IFS= read -r candidate; do
-    discovered="$candidate"
-    break
-  done < <(
-    find "$REPO_PATH" \
-      -path "$REPO_PATH/.git" -prune -o \
-      -path "$REPO_PATH/target" -prune -o \
-      -path "$REPO_PATH/node_modules" -prune -o \
-      -type f \( \
-        -name '*.rs' -o \
-        -name '*.ts' -o \
-        -name '*.tsx' -o \
-        -name '*.js' -o \
-        -name '*.jsx' -o \
-        -name '*.py' -o \
-        -name '*.go' \
-      \) \
-      -print
-  )
-
-  if [[ -n "$discovered" && -f "$discovered" ]]; then
-    printf '%s\n' "$discovered"
-    return 0
-  fi
-
-  printf '%s\n' "$REPO_PATH/Cargo.toml"
-}
-
-EXPLAIN_FILE="$(find_explain_file)"
-
-echo "==> RepoPilot product smoke suite"
-echo "Binary: $BINARY"
-echo "Repo:   $REPO_PATH"
-echo "Tmp:    $TMP_DIR"
-echo
-
-run_repopilot --version > "$TMP_DIR/version.txt"
-assert_non_empty "$TMP_DIR/version.txt"
-
-run_repopilot --help > "$TMP_DIR/help.txt"
-assert_non_empty "$TMP_DIR/help.txt"
-assert_contains "$TMP_DIR/help.txt" "scan"
-assert_contains "$TMP_DIR/help.txt" "review"
-assert_contains "$TMP_DIR/help.txt" "ai"
-assert_contains "$TMP_DIR/help.txt" "inspect"
-
-run_repopilot init --force --path "$TMP_DIR/repopilot.toml"
-assert_non_empty "$TMP_DIR/repopilot.toml"
-
-run_repopilot doctor . --format markdown --output "$TMP_DIR/doctor.md"
-assert_non_empty "$TMP_DIR/doctor.md"
-
-run_repopilot scan . --format json --output "$TMP_DIR/scan.json"
-assert_non_empty "$TMP_DIR/scan.json"
-validate_json_if_possible "$TMP_DIR/scan.json"
-
-run_repopilot scan . --format markdown --output "$TMP_DIR/scan.md"
-assert_non_empty "$TMP_DIR/scan.md"
-
-if git -C "$REPO_PATH" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-  run_repopilot review . --format markdown --output "$TMP_DIR/review.md"
-  assert_non_empty "$TMP_DIR/review.md"
-else
-  echo "==> Skipping review smoke check because repo path is not inside a Git worktree" >&2
-fi
-
-run_repopilot ai context . --focus security --budget 2k --output "$TMP_DIR/ai-context.md"
-assert_non_empty "$TMP_DIR/ai-context.md"
-
-run_repopilot ai plan . --focus all --budget 2k --output "$TMP_DIR/ai-plan.md"
-assert_non_empty "$TMP_DIR/ai-plan.md"
-
-run_repopilot ai prompt . --focus quality --budget 2k --output "$TMP_DIR/ai-prompt.md"
-assert_non_empty "$TMP_DIR/ai-prompt.md"
-
-run_repopilot inspect knowledge --format json --output "$TMP_DIR/inspect-knowledge.json"
-assert_non_empty "$TMP_DIR/inspect-knowledge.json"
-validate_json_if_possible "$TMP_DIR/inspect-knowledge.json"
-
-run_repopilot inspect knowledge --section rules --format markdown --output "$TMP_DIR/inspect-knowledge-rules.md"
-assert_non_empty "$TMP_DIR/inspect-knowledge-rules.md"
-
-run_repopilot inspect explain "$EXPLAIN_FILE" --format json --output "$TMP_DIR/inspect-explain.json"
-assert_non_empty "$TMP_DIR/inspect-explain.json"
-validate_json_if_possible "$TMP_DIR/inspect-explain.json"
-
-if [[ "$RUN_LEGACY" -eq 1 ]]; then
-  run_repopilot vibe . --focus security --budget 2k --output "$TMP_DIR/legacy-vibe.md"
-  assert_non_empty "$TMP_DIR/legacy-vibe.md"
-
-  run_repopilot harden . --focus all --budget 2k --output "$TMP_DIR/legacy-harden.md"
-  assert_non_empty "$TMP_DIR/legacy-harden.md"
-
-  run_repopilot prompt . --focus quality --budget 2k --output "$TMP_DIR/legacy-prompt.md"
-  assert_non_empty "$TMP_DIR/legacy-prompt.md"
-
-  run_repopilot knowledge --format json --output "$TMP_DIR/legacy-knowledge.json"
-  assert_non_empty "$TMP_DIR/legacy-knowledge.json"
-  validate_json_if_possible "$TMP_DIR/legacy-knowledge.json"
-
-  run_repopilot explain "$EXPLAIN_FILE" --format json --output "$TMP_DIR/legacy-explain.json"
-  assert_non_empty "$TMP_DIR/legacy-explain.json"
-  validate_json_if_possible "$TMP_DIR/legacy-explain.json"
-fi
-
-echo
-echo "==> Product smoke suite passed"
-echo "Artifacts: $TMP_DIR"

package/scripts/verify-release.sh

@@ -1,84 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
-cd "$ROOT_DIR"
-
-echo "==> RepoPilot release verification"
-
-echo "==> Rust formatting"
-cargo fmt --all -- --check
-
-echo "==> Rust clippy"
-cargo clippy --all-targets --all-features -- -D warnings
-
-echo "==> Rust tests"
-cargo test --all
-
-echo "==> Rust dependency security audit"
-cargo audit
-
-echo "==> Cargo dependency policy"
-cargo deny check advisories licenses
-
-echo "==> Shell script syntax"
-scripts=()
-if [[ -f install.sh ]]; then
-  scripts+=(install.sh)
-fi
-if [[ -d scripts ]]; then
-  while IFS= read -r -d '' script; do
-    scripts+=("$script")
-  done < <(find scripts -maxdepth 1 -type f -name '*.sh' -print0)
-fi
-
-if ((${#scripts[@]} > 0)); then
-  for script in "${scripts[@]}"; do
-    bash -n "$script"
-  done
-
-  echo "==> ShellCheck"
-  shellcheck "${scripts[@]}"
-else
-  echo "==> No shell scripts found"
-fi
-
-echo "==> GitHub Actions validation"
-workflows=()
-if [[ -d .github/workflows ]]; then
-  while IFS= read -r -d '' workflow; do
-    workflows+=("$workflow")
-  done < <(find .github/workflows -maxdepth 1 -type f \( -name '*.yml' -o -name '*.yaml' \) -print0)
-fi
-
-if ((${#workflows[@]} > 0)); then
-  actionlint "${workflows[@]}"
-else
-  echo "==> No GitHub Actions workflows found"
-fi
-
-echo "==> CLI release smoke tests"
-cargo test --test cli_release_smoke
-
-echo "==> Cargo package contents"
-cargo package --list
-
-echo "==> Cargo publish dry-run"
-cargo publish --dry-run
-
-echo "==> npm wrapper tests"
-npm run test:npm
-
-echo "==> npm package dry-run"
-npm pack --dry-run
-
-echo "==> Build release binary"
-cargo build --release
-
-echo "==> Product readiness smoke suite"
-./scripts/smoke-product.sh \
-  --binary ./target/release/repopilot \
-  --repo . \
-  --tmp-dir /tmp/repopilot-release-smoke
-
-echo "==> Release verification passed"