diffly-cli 0.4.0__tar.gz → 1.1.0__tar.gz

{diffly_cli-0.4.0 → diffly_cli-1.1.0}/CHANGELOG.md

@@ -2,7 +2,39 @@
 
 All notable changes to diffly are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and the project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [Unreleased]
+## [1.1.0] - 2026-08-23
+
+### Fixed
+
+- Fast keystroke bursts in the interactive review menu register every press: escape sequences stop at their terminator instead of swallowing neighboring keys.
+- Diff content lines beginning with `++` or `--` are counted, scanned for credentials, and analyzed instead of being mistaken for the file's header lines.
+- `diffly setup` no longer runs the update check twice in a row (once in `main()` and again inside the wizard it launches).
+- Pressing an arrow key in the interactive review menu no longer crashes with `NameError: name '_read_escape_sequence' is not defined`; the escape-sequence reader is defined again and a lone Escape still exits without blocking.
+
+### Changed
+
+- Verdicts rebalanced around merge-readiness: pending required checks and version-bump-only manifest edits are now review notes instead of quarantine gates, so healthy pull requests pass.
+- `BLOCK` is reserved for major signals only — failed required checks, or credential-like values added to production code. Credential-like values limited to tests, fixtures, or docs quarantine for confirmation instead of blocking.
+- `QUARANTINE` now targets newly added dependencies; lockfile refreshes and version bumps without new packages stay visible as notes.
+
+## [1.0.0] - 2026-08-22
+
+Diffly 1.0.0 is the first production-ready release of the deterministic pull-request triage workflow. It stabilizes the command-line experience, interactive review, local analysis, GitHub Action, and explanation behavior around a clear three-outcome policy: healthy pull requests pass, focused review gates quarantine, and severe failures block.
+
+### Added
+
+- Reliable opted-in explanations: Diffly uses the configured AI provider when available and otherwise renders a clearly labelled local explanation from deterministic review facts.
+- Automatic reuse of an authenticated `gh` session when `GITHUB_TOKEN` is not set.
+- A centred terminal experience across the guided wizard, loading transition, interactive review, diagnostics, and focused report.
+- Local analysis, stable JSON output, interactive review, GitHub Action integration, an update workflow, diagnostics, and guided setup as supported 1.0.0 workflows.
+
+### Changed
+
+- Rebalanced verdicts so `PASS` is the normal healthy outcome. Missing obvious test coverage, unavailable checks, and incomplete repository-tree hints remain visible as review notes instead of automatically forcing `QUARANTINE`.
+- `QUARANTINE` is reserved for concrete review gates: security-sensitive code, database schema or migrations, dependency changes, and pending required checks.
+- `BLOCK` is reserved for failed required checks and high-confidence credential exposure in a changed hunk.
+- The guided prompts and recovery messages now give clearer next steps.
+- Updated Diffly’s visual identity with the refreshed logo and terminal loading mark.
 
 ### Fixed
 

{diffly_cli-0.4.0 → diffly_cli-1.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: diffly-cli
-Version: 0.4.0
+Version: 1.1.0
 Summary: Deterministic triage for large GitHub pull requests
 Author: Vivaan Dhawan
 License: MIT License — diffly
@@ -128,7 +128,7 @@ Requires-Dist: pyyaml>=6; extra == 'dev'
 Description-Content-Type: text/markdown
 
 <p align="center">
-  <img src="assets/logo.png" alt="diffly logo" width="140">
+  <img src="assets/logo-v2.svg" alt="diffly logo" width="280">
 </p>
 
 # ⚡ diffly
@@ -141,7 +141,7 @@ Description-Content-Type: text/markdown
 
 <p align="center">
   <a href="https://github.com/VIVAAN-DHAWAN/diffly-cli/actions/workflows/ci.yml"><img src="https://img.shields.io/badge/CI-passing-brightgreen?style=for-the-badge&logo=githubactions" alt="CI"></a>
-  <a href="https://github.com/VIVAAN-DHAWAN/diffly-cli/releases/latest"><img src="https://img.shields.io/badge/release-v0.4.0-blue?style=for-the-badge" alt="Release"></a>
+  <a href="https://github.com/VIVAAN-DHAWAN/diffly-cli/releases/latest"><img src="https://img.shields.io/badge/release-v1.0.0-blue?style=for-the-badge" alt="Release"></a>
   <a href="https://www.python.org/"><img src="https://img.shields.io/badge/python-3.10%2B-3776AB?style=for-the-badge&logo=python&logoColor=white" alt="Python 3.10+"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green?style=for-the-badge" alt="License: MIT"></a>
 </p>
@@ -161,7 +161,6 @@ curl -fsSL https://raw.githubusercontent.com/VIVAAN-DHAWAN/diffly-cli/main/insta
 ```bash
 pip install diffly-cli
 ```
-
 **uv**
 ```bash
 uv tool install diffly-cli
@@ -270,6 +269,8 @@ For automation prefer `--json`: successful triage exits `0` regardless of verdic
 
 ### Optional AI explanation
 
+Every opted-in explanation is shown in the review. With an AI key, Diffly produces a bounded, redacted AI narrative; without one—or if the provider is unavailable—it creates a clearly labelled local explanation from deterministic review facts instead. Neither path can alter the verdict.
+
 ```bash
 export DIFFLY_LLM_API_KEY="your-key"
 export DIFFLY_LLM_BASE_URL="https://api.openai.com/v1"  # omit for the default endpoint
@@ -282,11 +283,11 @@ Default model is `gpt-5-mini`; override with `DIFFLY_LLM_MODEL` or `--llm-model`
 
 | Verdict | Rule |
 | --- | --- |
-| **BLOCK** | A required check failed, or the PR touches authentication, credentials, secrets, or security-sensitive files. |
-| **QUARANTINE** | Database schema/migrations, dependency changes, missing obvious test coverage for production files, or unavailable/pending checks. |
-| **PASS** | No rule fired and observed checks passed. `SHIP` remains accepted as a legacy alias. |
+| **BLOCK** | A required check failed, or production code appears to add a credential-like value. |
+| **QUARANTINE** | Security-sensitive code, database schema/migrations, or newly added dependencies need focused review. Credential-like values limited to tests, fixtures, or docs also quarantine rather than block. |
+| **PASS** | Healthy changes, ready to merge. Pending or unavailable checks, version-bump-only manifest edits, and missing obvious tests stay visible as review notes, not gates. `SHIP` remains accepted as a legacy alias. |
 
-Deliberately conservative: a verdict is a review gate, not a claim that a PR is correct or safe in every context.
+`PASS` is the normal healthy outcome. A verdict is a review signal, not a claim that a PR is correct or safe in every context.
 
 ## Real examples
 
@@ -304,7 +305,7 @@ Live AI-explainer reports (deterministic verdict preserved): [ruff phase 2](demo
 
 ## Current limitations
 
-The Phase 2 explainer requires an OpenAI-compatible API key and never influences the verdict. Tree-sitter parsing covers symbols and direct calls visible in changed hunks, not a full repository-wide call graph. Test-coverage detection is heuristic (filenames + repository tree). Unavailable checks are quarantined rather than assumed passing. Model context is bounded and may truncate on very large PRs.
+Tree-sitter parsing covers symbols and direct calls visible in changed hunks, not a full repository-wide call graph. Test-coverage detection is heuristic (filenames + repository tree), so it is presented as a review note rather than a verdict gate. AI model context is bounded and may truncate on very large PRs. A local explanation is used when AI generation is not available.
 
 ## Roadmap
 

{diffly_cli-0.4.0 → diffly_cli-1.1.0}/README.md

@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="assets/logo.png" alt="diffly logo" width="140">
+  <img src="assets/logo-v2.svg" alt="diffly logo" width="280">
 </p>
 
 # ⚡ diffly
@@ -12,7 +12,7 @@
 
 <p align="center">
   <a href="https://github.com/VIVAAN-DHAWAN/diffly-cli/actions/workflows/ci.yml"><img src="https://img.shields.io/badge/CI-passing-brightgreen?style=for-the-badge&logo=githubactions" alt="CI"></a>
-  <a href="https://github.com/VIVAAN-DHAWAN/diffly-cli/releases/latest"><img src="https://img.shields.io/badge/release-v0.4.0-blue?style=for-the-badge" alt="Release"></a>
+  <a href="https://github.com/VIVAAN-DHAWAN/diffly-cli/releases/latest"><img src="https://img.shields.io/badge/release-v1.0.0-blue?style=for-the-badge" alt="Release"></a>
   <a href="https://www.python.org/"><img src="https://img.shields.io/badge/python-3.10%2B-3776AB?style=for-the-badge&logo=python&logoColor=white" alt="Python 3.10+"></a>
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green?style=for-the-badge" alt="License: MIT"></a>
 </p>
@@ -32,7 +32,6 @@ curl -fsSL https://raw.githubusercontent.com/VIVAAN-DHAWAN/diffly-cli/main/insta
 ```bash
 pip install diffly-cli
 ```
-
 **uv**
 ```bash
 uv tool install diffly-cli
@@ -141,6 +140,8 @@ For automation prefer `--json`: successful triage exits `0` regardless of verdic
 
 ### Optional AI explanation
 
+Every opted-in explanation is shown in the review. With an AI key, Diffly produces a bounded, redacted AI narrative; without one—or if the provider is unavailable—it creates a clearly labelled local explanation from deterministic review facts instead. Neither path can alter the verdict.
+
 ```bash
 export DIFFLY_LLM_API_KEY="your-key"
 export DIFFLY_LLM_BASE_URL="https://api.openai.com/v1"  # omit for the default endpoint
@@ -153,11 +154,11 @@ Default model is `gpt-5-mini`; override with `DIFFLY_LLM_MODEL` or `--llm-model`
 
 | Verdict | Rule |
 | --- | --- |
-| **BLOCK** | A required check failed, or the PR touches authentication, credentials, secrets, or security-sensitive files. |
-| **QUARANTINE** | Database schema/migrations, dependency changes, missing obvious test coverage for production files, or unavailable/pending checks. |
-| **PASS** | No rule fired and observed checks passed. `SHIP` remains accepted as a legacy alias. |
+| **BLOCK** | A required check failed, or production code appears to add a credential-like value. |
+| **QUARANTINE** | Security-sensitive code, database schema/migrations, or newly added dependencies need focused review. Credential-like values limited to tests, fixtures, or docs also quarantine rather than block. |
+| **PASS** | Healthy changes, ready to merge. Pending or unavailable checks, version-bump-only manifest edits, and missing obvious tests stay visible as review notes, not gates. `SHIP` remains accepted as a legacy alias. |
 
-Deliberately conservative: a verdict is a review gate, not a claim that a PR is correct or safe in every context.
+`PASS` is the normal healthy outcome. A verdict is a review signal, not a claim that a PR is correct or safe in every context.
 
 ## Real examples
 
@@ -175,7 +176,7 @@ Live AI-explainer reports (deterministic verdict preserved): [ruff phase 2](demo
 
 ## Current limitations
 
-The Phase 2 explainer requires an OpenAI-compatible API key and never influences the verdict. Tree-sitter parsing covers symbols and direct calls visible in changed hunks, not a full repository-wide call graph. Test-coverage detection is heuristic (filenames + repository tree). Unavailable checks are quarantined rather than assumed passing. Model context is bounded and may truncate on very large PRs.
+Tree-sitter parsing covers symbols and direct calls visible in changed hunks, not a full repository-wide call graph. Test-coverage detection is heuristic (filenames + repository tree), so it is presented as a review note rather than a verdict gate. AI model context is bounded and may truncate on very large PRs. A local explanation is used when AI generation is not available.
 
 ## Roadmap
 

diffly_cli-1.1.0/assets/logo-v2.svg

@@ -0,0 +1,35 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512" role="img" aria-labelledby="title description">
+  <title id="title">Diffly logo</title>
+  <description id="description">A mint hexagonal code-diff mark with plus, slash, and minus symbols.</description>
+  <defs>
+    <linearGradient id="mint" x1="104" y1="88" x2="416" y2="424" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#B9FFCB"/>
+      <stop offset=".45" stop-color="#68E5A4"/>
+      <stop offset="1" stop-color="#2EB67D"/>
+    </linearGradient>
+    <linearGradient id="core" x1="138" y1="112" x2="375" y2="405" gradientUnits="userSpaceOnUse">
+      <stop stop-color="#16211F"/>
+      <stop offset="1" stop-color="#0A1114"/>
+    </linearGradient>
+    <filter id="glow" x="-30%" y="-30%" width="160%" height="160%">
+      <feGaussianBlur stdDeviation="5" result="blur"/>
+      <feMerge>
+        <feMergeNode in="blur"/>
+        <feMergeNode in="SourceGraphic"/>
+      </feMerge>
+    </filter>
+  </defs>
+
+  <path d="M256 52 431 153v206L256 460 81 359V153L256 52Z" fill="#0A1114"/>
+  <path d="M256 52 431 153v206L256 460 81 359V153L256 52Z" fill="none" stroke="url(#mint)" stroke-width="18" stroke-linejoin="round"/>
+  <path d="M256 91 397 172v168L256 421 115 340V172L256 91Z" fill="url(#core)" stroke="#6FE9AA" stroke-opacity=".56" stroke-width="4" stroke-linejoin="round"/>
+  <path d="M256 116 375 185v142L256 396 137 327V185L256 116Z" fill="none" stroke="#B9FFCB" stroke-opacity=".12" stroke-width="2" stroke-linejoin="round"/>
+
+  <g fill="url(#mint)" filter="url(#glow)">
+    <rect x="154" y="215" width="82" height="22" rx="11"/>
+    <rect x="184" y="185" width="22" height="82" rx="11"/>
+    <rect x="286" y="274" width="72" height="22" rx="11"/>
+    <path d="M271 177h25l-58 158h-25l58-158Z"/>
+  </g>
+
+</svg>

{diffly_cli-0.4.0 → diffly_cli-1.1.0}/docs/phase-2-contract.md

@@ -28,4 +28,4 @@ The explainer receives PR metadata, deterministic flags and verdict, changed-fil
 
 ## Testing target
 
-Phase 2 is complete only when redaction, schema validation, prompt construction, API failure fallback, deterministic-verdict immutability, CLI integration, and at least one live public pull-request explanation are verified.
+Phase 2 is complete only when redaction, schema validation, prompt construction, a clearly labelled local fallback, deterministic-verdict immutability, CLI integration, and at least one live public pull-request explanation are verified.

{diffly_cli-0.4.0 → diffly_cli-1.1.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "diffly-cli"
-version = "0.4.0"
+version = "1.1.0"
 description = "Deterministic triage for large GitHub pull requests"
 readme = "README.md"
 requires-python = ">=3.10"

{diffly_cli-0.4.0 → diffly_cli-1.1.0}/src/diffly_cli/__init__.py

@@ -1,3 +1,3 @@
 """Deterministic triage for large GitHub pull requests."""
 
-__version__ = "0.4.0"
+__version__ = "1.1.0"