gitpr-cli 1.2.0__py3-none-any.whl → 1.4.0__py3-none-any.whl

{gitpr_cli-1.2.0.dist-info → gitpr_cli-1.4.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitpr-cli
-Version: 1.2.0
+Version: 1.4.0
 Summary: AI-powered PR automation, commit messages, and code review (Gemini, DeepSeek, and Ollama)
 Author-email: Natan Fiuza <contato@natanfiuza.dev.br>
 Requires-Python: >=3.10
@@ -15,6 +15,7 @@ Requires-Dist: pyyaml
 Requires-Dist: textual
 Requires-Dist: requests
 Requires-Dist: mcp>=1.0.0
+Requires-Dist: packaging>=23.0
 Dynamic: license-file
 
 
@@ -24,6 +25,10 @@ Dynamic: license-file
   <img src="https://raw.githubusercontent.com/natanfiuza/gitpr/main/docs/logo.png" alt="GitPR Logo" width="150">
 </p>
 
+<p align="center">
+  <a href="https://gitpr.natanfiuza.dev.br/"><img src="https://img.shields.io/badge/GitPR-quality--checked-blue" alt="GitPR"></a>
+</p>
+
 GitPR CLI is a command-line automation tool that uses **Google Gemini**, **DeepSeek**, and **Ollama** artificial intelligence to analyze your code changes (git diff) or entire files. The tool automatically generates commit messages in the *Conventional Commits* standard, detailed Pull Request descriptions, and deep Code Reviews aimed at reducing technical debt.
 
 🌐 **Website:** [gitpr.natanfiuza.dev.br](https://gitpr.natanfiuza.dev.br/) · 📂 **Repository:** [https://github.com/gitpr-cli/gitpr.git](https://github.com/gitpr-cli/gitpr.git)
@@ -40,7 +45,18 @@ Install GitPR CLI using `pip`:
 pip install gitpr-cli
 ```
 
-### **2. Initializing in a Repository**
+### **2. Seeing It Work (No Configuration)**
+
+GitPR ships a guided tour over an example diff. It needs no API key, no Git repository and no connection:
+
+```bash
+gitpr demo
+```
+
+> **Guided Tour:** Six screens walking through a real example — the diff, the commit message, the code review and the pull request description — with the answers recorded once and replayed. Add `--no-tui` for plain text, `--scenario security-issue` for the other example.  
+> 📖 **Full Documentation:** [https://gitpr.natanfiuza.dev.br/docs/demo?lang=en_us](https://gitpr.natanfiuza.dev.br/docs/demo?lang=en_us)
+
+### **3. Initializing in a Repository**
 
 To set up GitPR in a folder of a new repository, run:
 
@@ -113,15 +129,19 @@ Pytest will automatically detect files inside the `tests/` folder and display a
 
 ### From Source Code
 
-1. Clone the repository: `git clone https://github.com/gitpr-cli/gitpr.git.git`
+1. Clone the repository: `git clone https://github.com/gitpr-cli/gitpr.git`
 
 2. Enter the folder: `cd gitpr`
 
-3. Set up the environment:
+3. Install in editable mode:
 ```bash
-pipenv install google-genai openai python-dotenv click cryptography
+pip install -e .
 ```
-4. Run: pipenv run python src/main.py
+4. Run: `gitpr`
+
+> Prefer an isolated environment? Install the dependencies with `pipenv install google-genai openai python-dotenv click cryptography` and run `pipenv run python src/main.py` instead.
+>
+> **Note on the update gate:** a source install reports the version found in your checkout, so a tree behind the published release is stopped at startup. See [Installing GitPR from Source](docs/tutorial/install-from-source.md).
 
 ## **💻 How to Use**
 
@@ -137,9 +157,22 @@ The tool will sync with the remote (`git fetch`), compare your changes with the
 ### **Advanced Options and Commands**
 You can pass the following *flags* for specific actions:
 
+* `gitpr demo`: **Guided tour** over an example diff that ships with the tool — the commit message, the code review and the pull request description, produced by the real pipeline on a recorded example. Needs no API key, no Git repository and no connection, which makes it the first thing to run on a new machine. Use `--scenario <name>` for another example, `--lang <code>` for another language, `--no-tui` for plain text. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/demo.md)
+* `gitpr badge`: **Adoption badge for your README.** Prints the Markdown snippet — `--readme` prints only the line, `--style` picks the shields.io style (`flat`, `flat-square`, `for-the-badge`). Nothing is written to your README. Published pull requests carry a badge of their own, with the linter counts of the diff; `GITPR_BADGE=false` turns it off. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/badge.md)
+* `gitpr config`: **Interactive configuration screen.** Opens a master-detail TUI to view, edit, search, and validate all settings stored in `~/.gitpr/.env` (with secret encryption and live validation). 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/config-tui.md)
+* `gitpr release`: **Changelog and Release Notes generator.** Scans commits since the previous version, categorizes them according to Conventional Commits, suggests a semantic version bump, generates an AI executive summary, and optionally publishes the release to your forge. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/release-notes.md)
+* `gitpr fix [<finding_id>]`: **Review findings patch application & rollback.** Turns findings from the last code review (`gitpr -r`) into safe, reviewable unified diffs. Includes safety classification (`safe`, `review_required`, `experimental`), `--all-safe` batching, `--force` validation, and `--rollback <patch-id>`. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/fix-command.md)
+* `gitpr split`: **Atomic commit splitter.** Reads uncommitted working tree changes, groups hunks by intent using AI, and proposes ordered atomic commits without altering your working tree files (`--dry-run`, `--apply`). 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/split-command.md)
+* `gitpr tests generate`: **AI test suite generation & scaffolding.** Analyzes your diff, a target file (`--file`), or a review finding (`--finding`) and generates complete, executable test suites (supporting pytest, jest, vitest, phpunit, pest). Use `--apply` to write to disk.
+* `gitpr mentor [<finding_id>]`: **Junior Mentor Pedagogical Explanations.** Breaks down code review findings with educational context ("why this matters", real-world analogy, guided questions, and key takeaway) to foster growth and mentor developers. Works standalone over the latest review findings or with `--finding <id>`. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/mentor-mode.md)
+* `gitpr explain`: **Reviewer Guide generator.** Generates a concise summary explaining what changed, why it changed, where reviewers should focus, and potential regression risks. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/pull-request-publication.md)
+* `gitpr review-pr <pr_number>`: **Remote Pull Request review.** Fetches and reviews an open pull request directly from the forge (GitHub, GitLab, Bitbucket, Azure DevOps) without checking out the branch locally. Use `--post-comment` to post the review directly to the PR. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/review-pr.md)
+* `gitpr risk`: **Local Risk Scoring for Diffs.** Computes a deterministic, explainable risk score (0.0 to 100.0) and badge (`LOW 🟢`, `MEDIUM 🟡`, `HIGH 🟠`, `CRITICAL 🔴`) using local repository signals (critical paths, missing tests, migrations, bug history, and static findings). Use `--file <path>`, `--format json`, `--base <ref>`, or `--no-history`. Automatically included in code reviews (`GITPR_RISK_INCLUDE_IN_REVIEW=true`). 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/risk-scoring.md)
+* `gitpr policy`: **Shared quality policy for the repository.** Adopts a versioned YAML **Policy Pack** — review skills, linter rules, severity overrides, critical paths, risk weights and PR/commit conventions — and records the choice in `.gitpr/policy.lock.yml`, so the review, the linter and the risk score all run under the same policy, with a checksum per pack. `list`, `validate`, `show`, `use`, `init`, `install`, `off`. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/policy-packs.md)
+* `gitpr baseline`: **Baseline and auditable suppressions for legacy adoption.** Records the findings a repository already has in `.gitpr/baseline.json`, so a run classifies every finding as `new`, `existing`, `resolved`, `ignored` or `accepted_debt` and **only `new` blocks**. Every suppression carries a reason, and accepted debt carries an owner and an optional deadline. `create`, `show`, `validate`, `update`, `suppress`, `unsuppress`. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/baseline-suppressions.md)
 * `-c` or `--commit`: Runs a local `git diff` and displays **only the suggested commit message**.
-* `-r` or `--review`: Performs a detailed **Code Review** of local changes.
-* `-f` or `--fullreview`: Performs a **Full Code Review** analyzing all changes since the remote branch.
+* `-r` or `--review`: Performs a detailed **Code Review** of local changes. Use with `--mentor` to append pedagogical mentoring explanations for each finding.
+* `-f` or `--fullreview`: Performs a **Full Code Review** analyzing all changes since the remote branch. Use with `--mentor` to append pedagogical mentoring explanations.
 * `-i <file>` or `--input <file>`: **Full File Audit.** Must be used together with `-r` or `-f`; it ignores git history and does a Code Review of the entire file. Excellent for acting as a consultant on legacy code refactoring.
 * `--provider <gemini|deepseek|ollama>`: Forces the use of a specific AI only for this execution, ignoring your default saved in `.env`.
 * `--lang <code>`: Forces the interface language for this execution (e.g.: `en_us`, `pt_br`). Overrides `GITPR_LANG` in `.env` without persisting the change.
@@ -147,8 +180,11 @@ You can pass the following *flags* for specific actions:
 * `-l` or `--linter`: Runs **only the local static linter** (no AI calls). Ideal for use in CI/CD pipelines to block non-compliant code.
 * `--status`: Lists uncommitted file changes categorized as **new**, **modified**, and **deleted** — fast, no AI, no network. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/git-status.md)
 * `--no-unstaged-check`: Skips the unstaged files verification before AI processing for a single invocation. Equivalent to `GITPR_SKIP_UNSTAGED_CHECK=true` for one run. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/git-status.md)
+* `--no-suggest-reviewers`: Disables the suggested reviewers computation in the interactive PR publisher (default ON). 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/suggested-reviewers.md)
+* `--explain`: Includes the Reviewer Guide section ("Explain my PR") in the Pull Request description.
+* `--init`: **Interactive SCM forge wizard.** Detects the repository's forge (GitHub, GitLab, Bitbucket Cloud, Azure DevOps), configures the provider, and stores the access token encrypted. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/scm-multiforge.md)
 * `--linter-setup`: **Interactive external linter wizard.** Guides you through installing and configuring external linters (ESLint, PHPCS, Stylelint) as a Checkstyle XML bridge. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/linter-regras-customizadas.md)
-* `--mcp`: Starts GitPR as an **MCP server** (Model Context Protocol) on stdio transport. Enables integration with VS Code, Cursor, Claude Desktop, and other MCP-compatible editors — exposing all GitPR AI capabilities as 14 annotated tools, 18 resources, and 7 pre-built prompts directly inside your IDE. Also available as the standalone `gitpr-mcp` command.
+* `--mcp`: Starts GitPR as an **MCP server** (Model Context Protocol) on stdio transport. Enables integration with VS Code, Cursor, Claude Desktop, and other MCP-compatible editors — exposing all GitPR AI capabilities as 16 annotated tools, 19 resources, and 7 pre-built prompts directly inside your IDE. Also available as the standalone `gitpr-mcp` command.
 * `--plugins`: Lists all **globally installed plugins** — custom linter packs from `~/.gitpr/plugins/linter/` and MCP prompt templates from `~/.gitpr/plugins/prompts/`. These plugins apply across all your projects without duplication. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/plugins-system.md)
 * `--install`: **Interactive Setup Wizard.** Runs a guided 4-step setup: downloads skill templates, installs Git hooks, configures MCP for detected editors, and checks/requests your AI provider API key. Each step asks for confirmation before proceeding.
 * `-ih` or `--installhooks`: Automatically installs **local Git Hooks** (`pre-commit` and `prepare-commit-msg`) in your repository.
@@ -157,7 +193,7 @@ You can pass the following *flags* for specific actions:
   * **New Code Issue (`gitpr -is`):** Reads the current `git diff`. **Why use:** Ideal for quickly documenting the task you just finished programming, before committing.
   * **Epic/Release Issue (`gitpr -is -ht`):** Reads the full history of the current branch (Git Log + PR Cache). **Why use:** Ideal for generating consolidated documentation of an entire release or a large *feature* that took several days/commits to complete.
   * **Archaeological/Technical Debt Issue (`gitpr -is -b file:lines`):** Reads the timeline of a specific business rule. **Why use:** Ideal for documenting technical debt, explaining how a legacy code block evolved and why it needs to be refactored.
-	* **PR Publisher (default):** Running `gitpr` generates the PR description with AI, saves the `.md` file to `.gitpr/reports/pr_desc/`, and opens an interactive terminal interface (TUI) to review, edit, and publish the Pull Request directly to GitHub via REST API. Before generation, it checks for unstaged files and offers a modal to manage them. Use `--no-publish` to save only the PR file locally without opening the publisher, or `--no-edit` to auto-commit pending changes (with lint validation), auto-push, and publish immediately — handling existing PR updates, optional auto-merge, and clear error feedback when merge conflicts occur. Use `--base <branch>` to change the target branch. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/pull-request-publication.md)
+* **PR Publisher (default):** Running `gitpr` generates the PR description with AI, saves the `.md` file to `.gitpr/reports/pr_desc/`, and opens an interactive terminal interface (TUI) to review, edit, and publish the Pull Request directly to GitHub, GitLab, Bitbucket, or Azure DevOps via REST API. Before generation, it checks for unstaged files, calculates suggested reviewers, and offers a modal to manage them. Use `--no-publish` to save only the PR file locally without opening the publisher, or `--no-edit` to auto-commit pending changes (with lint validation), auto-push, and publish immediately — handling existing PR updates, optional auto-merge, and clear error feedback when merge conflicts occur. Use `--base <branch>` to change the target branch. 📖 [Full docs](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/pull-request-publication.md)
 * `-h` or `--help`: Shows the general help with all options. Use together with another flag for **contextual help** (e.g.: `gitpr -h --issue`, `gitpr -h --linter`) with a direct link to the detailed documentation of each feature.
 * `-u` or `--update`: Checks the latest version of GitPR on PyPI and shows how to update it (Auto-Updater).
 
@@ -171,7 +207,7 @@ When your diff is too large for a single AI call (over ~90k estimated tokens), G
 
 📚 Full documentation: [docs/map-reduce-diff.md](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/map-reduce-diff.md)
 
-## 🛡️ Local Linter (Static Analysis)
+## 🛡️ Local Linter (Static Analysis & Security)
 
 GitPR CLI allows you to define strict rules that will be validated instantly during `--review` or `--fullreview`, without depending on AI. This is ideal for preventing common errors (like `console.log` or test IPs) from reaching the repository.
 
@@ -192,9 +228,9 @@ rules:
 
 The Linter analyzes only the **added lines** in your `git diff`, ensuring a focused and extremely fast execution. If there are violations, they will appear highlighted at the top of your review file.
 
-### External Linters (Checkstyle Bridge)
+### External Linters & SAST Bridges (Checkstyle Bridge)
 
-If your project already uses tools like ESLint, PHP_CodeSniffer or Stylelint, GitPR can act as a bridge — running them in the background and filtering errors **only for the lines you changed** in your current diff. Any linter that emits reports in the `checkstyle` format is supported.
+If your project already uses tools like ESLint, PHP_CodeSniffer, Stylelint, Semgrep, Gitleaks, or Bandit, GitPR can act as a bridge — running them in the background and filtering errors **only for the lines you changed** in your current diff. Any linter or SAST scanner that emits reports in the `checkstyle` format is supported. In addition, GitPR includes embedded secret scanning rules to catch leaked API keys, tokens, and credentials before they leave your machine.
 
 Instead of configuring the YAML manually, use the interactive wizard:
 
@@ -204,7 +240,75 @@ gitpr --linter-setup
 
 The wizard shows pre-configured presets (PHPCS, ESLint, Stylelint — controlled remotely via `templates/gitpr.linter-presets.json`), guides you through the native installation command (e.g.: `npm install --save-dev eslint`), and injects the correct `external_linters` block into your `.gitpr.linter.yml`.
 
-Every run — manual via `--linter` or automatic before commits — consolidates the Regex Rules and External Linters into a single Markdown report saved at `.gitpr/reports/linter/` (customizable via `OUTPUT_FILE_NAME_LINTER`). The report is generated only when violations are found — clean runs create no files.
+Every run — manual via `--linter` or automatic before commits — consolidates the Regex Rules, Embedded Security Rules, and External Linters into a single Markdown report saved at `.gitpr/reports/linter/` (customizable via `OUTPUT_FILE_NAME_LINTER`). The report is generated only when violations are found — clean runs create no files.
+
+## ⚡ Local Risk Scoring (gitpr risk)
+
+GitPR computes a local, deterministic, and explainable risk score (from `0.0` to `100.0`) for individual modified files and the pull request as a whole. It requires no network calls, consumes zero AI tokens, and evaluates repository and Git signals offline:
+
+* **Critical Paths & Security (`+25`):** Authentication, billing, credentials, and sensitive operational modules.
+* **Database & Infra (`+20`):** Migrations, schema definitions, CI/CD workflows, Docker, and Kubernetes configs.
+* **Missing Tests (`+15`):** Executable production code modified without matching test updates in the diff.
+* **History Signals (`+10` to `+20`):** Files associated with recent bug fixes, reverts, or high commit churn.
+* **Findings:** Blocker (`+25`) or critical (`+15`) findings reported by static linters and secret scanners.
+* **Test Presence (`-10`):** Mitigating credit when test files are added or modified alongside code changes.
+
+### Risk Levels & Badges
+
+| Level | Score Range | Badge | Meaning |
+|---|---|---|---|
+| **LOW** | 0.0 – 24.0 | `LOW 🟢` | Routine changes with low regression likelihood |
+| **MEDIUM** | 25.0 – 49.0 | `MEDIUM 🟡` | Moderate changes requiring normal review vigilance |
+| **HIGH** | 50.0 – 79.0 | `HIGH 🟠` | Significant changes touching critical areas or lacking tests |
+| **CRITICAL** | 80.0 – 100.0 | `CRITICAL 🔴` | High regression exposure, blockers, or sensitive architectural impacts |
+
+### Aggregation Formula (50 / 30 / 20)
+
+The aggregate PR score combines:
+* **50%**: Maximum individual file score
+* **30%**: Weighted average of file scores by lines changed
+* **20%**: Aggregated critical evidence score
+
+### Review Integration
+
+When enabled (`GITPR_RISK_INCLUDE_IN_REVIEW=true` in `~/.gitpr/.env`), GitPR automatically appends a `## ⚡ Risk Assessment` section to generated code review reports (`-r`, `-f`, `gitpr review-pr`) and primes the AI review prompt with critical risk areas.
+
+```bash
+gitpr risk                        # Compute risk for current diff
+gitpr risk --file src/auth.py     # Decompose risk for a single file
+gitpr risk --format json          # Output JSON for CI/CD pipelines
+gitpr risk --base main            # Evaluate against specific git base ref
+```
+
+📖 **Full documentation:** [docs/risk-scoring.md](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/risk-scoring.md)
+
+## 🧾 Adopting GitPR in a Legacy Repository (gitpr baseline)
+
+Adopting GitPR in a repository that already carries hundreds of findings is the moment the tool is least useful: the gate fails on problems nobody in this change introduced, and the alternatives are turning it off or spending a sprint fixing code nobody is touching. A **baseline** is the record of what the repository already has, committed to Git, so that every run classifies what it finds instead of starting from zero.
+
+```bash
+gitpr baseline create                    # Record the findings of the current diff
+gitpr baseline show                      # The findings, the decisions and the counts
+gitpr baseline validate                  # Every defect in the file — exit 1 on any
+gitpr baseline update                    # Re-record today's diff, keeping decisions
+gitpr baseline suppress <id> --reason "…"    # A decision about one finding
+gitpr baseline unsuppress <id>           # Take a decision back
+```
+
+A suppression is not a silent filter: it carries a **reason**, an author and a date, and accepted debt carries an **owner** and an optional **deadline**. `--scope finding|line|file|rule` widens a decision beyond one finding, and anything wider than a single finding lives in `.gitpr/baseline.overrides.yml`, where it is reviewed with the code. A checksum over the record catches an edit made outside GitPR — `gitpr baseline validate` names the divergence instead of applying the file. A **Policy Pack** may carry a `baseline:` block of its own, applied in memory and attributed to the pack.
+
+Four variables in `~/.gitpr/.env`, also editable through `gitpr config` in the section **Baseline**:
+
+| Key | Default | Effect |
+|---|---|---|
+| `GITPR_BASELINE_ENABLED` | `true` | `false` → no run reads the baseline: the behaviour of every earlier version, byte for byte |
+| `GITPR_BASELINE_PATH` | *(empty)* | `.gitpr/baseline.json`; a relative path resolves from the repository root |
+| `GITPR_BASELINE_REQUIRE_LOCKFILE_CHECKSUM_MATCH` | `true` | A divergent checksum makes the record unusable: the blocking flows refuse and exit non-zero |
+| `GITPR_BASELINE_ALLOW_LOCAL_OVERRIDES` | `true` | `false` → `.gitpr/baseline.overrides.yml` is not read |
+
+Only a `new` error-level finding exits non-zero, and only `new` findings carry risk points — everything else reaches the risk report as zero-point evidence with its status. The baseline is never sent to the AI, and no entry stores code or a secret: the file is committed, so only a digest of the offending line is kept.
+
+📖 **Full documentation:** [docs/baseline-suppressions.md](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/baseline-suppressions.md)
 
 ## 🤝 Co-Author Signature
 
@@ -218,6 +322,22 @@ The trailer is appended programmatically (never by the AI) in all flows: console
 
 📖 **Full documentation:** [docs/commit-message-ia.md](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/commit-message-ia.md)
 
+## 🏷️ Pull Request Badge
+
+Every pull request GitPR publishes carries a badge at the foot of the body, with what the local linter counted on that very diff:
+
+```text
+GitPR | 0 errors · 2 warnings
+```
+
+It is built from a real measurement, never from a claim: red when a blocking finding is there, yellow for advice, green when the rules found nothing — and **no badge at all when no linter rules are configured**, because a green badge over a diff nobody checked would say something GitPR cannot back. It is on by default; `GITPR_BADGE=false` turns it off, and `gitpr --skill` is what gives it rules to count.
+
+For your own README there is a static badge. `gitpr badge --readme` prints the line and writes nothing — pasting it is your call:
+
+[![GitPR](https://img.shields.io/badge/GitPR-quality--checked-blue)](https://gitpr.natanfiuza.dev.br/)
+
+📖 **Full documentation:** [docs/badge.md](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/badge.md)
+
 ## 🧠 Multi-Model Architecture (AI-Agnostic)
 
 GitPR is not tied to a single Artificial Intelligence. During initial setup, the user can choose their default engine. We currently support:
@@ -237,6 +357,7 @@ Instead of hiding AI instructions in the source code, GitPR uses local Markdown
 * `.gitpr.filereview.md`: Defines strict cohesion and coupling rules for full file auditing (used with `--input`).
 * `.gitpr.issue.md`: Defines the structure and level of detail required for generating standardized Issues (used with `--issue`).
 * `.gitpr.blame.md`: Defines the focus of archaeological analysis for legacy code tracing (used with `--blame`).
+* `.gitpr.mentor.md`: Defines pedagogical coaching style, analogy framing, and tone for Junior Mentor Mode (used with `gitpr mentor` or `--mentor`).
 
 ## 🌐 Internationalization (i18n)
 
@@ -430,6 +551,8 @@ If you want to implement GitPR as an automated quality barrier in your team, che
 
 ### Core Features
 
+* [**Guided Tour (gitpr demo)**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/demo.md) — How the `gitpr demo` subcommand walks through the commit message, the code review and the pull request description over a recorded example, with no API key, no repository and no network.
+* [**Pull Request Badge**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/badge.md) — What the badge GitPR attaches to published pull requests says, where it is attached, when it is left out, and how to print the static one for your own README.
 * [**Pull Request (Default Mode)**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/pr-descricao-padrao.md) — Complete flow for generating PR descriptions without flags.
 * [**Pull Request Publisher TUI**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/pull-request-publication.md) — How to review and publish Pull Requests directly to GitHub from the terminal.
 * [**AI Code Review**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/code-review-ia.md) — Guide to review modes (`--review`, `--fullreview`), file auditing (`--input`) and remote pull request review (`gitpr review-pr`).
@@ -438,11 +561,19 @@ If you want to implement GitPR as an automated quality barrier in your team, che
 * [**Issue Generation and TUI Interface**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/issue-tui-help.md) — How to use the terminal graphical interface (TUI) and the 3 context engines to manage structured Issues.
 * [**Code Archaeologist (Git Blame)**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/blame-arqueologo.md) — How to trace the origin of business rules with `git blame` and AI.
 * [**Skills and Templates System**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/skill-template.md) — How to customize AI behavior with `.gitpr.*.md` files.
-* [**Release Notes & Changelog (gitpr release)**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/release-notes.md) — How the `gitpr release` subcommand generates the changelog / release notes of a repository, suggests the next semantic version and publishes releases on the forge.
+* [**Release Notes & Changelog (gitpr release)**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/release-notes.md) — How the `gitpr release` subcommand generates the changelog / release notes of a repository from the delta of the previous version, links every commit, pull request and contributor, suggests the next semantic version and publishes releases on the forge.
 * [**Fix Command (gitpr fix)**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/fix-command.md) — How the `gitpr fix` subcommand turns the findings of the last review into patches you read before they touch your tree, classifies each one by safety, and undoes an applied patch on demand.
+* [**Split Command (gitpr split)**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/split-command.md) — How the `gitpr split` subcommand reads a working tree holding several concerns, groups the hunks by intent with AI, and turns them into ordered atomic commits without ever writing to your files.
+* [**Local Risk Scoring (gitpr risk)**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/risk-scoring.md) — How the `gitpr risk` command evaluates regression risk, decomposes signals (50/30/20 formula), and highlights high-risk areas in code reviews offline.
+* [**Policy Packs (gitpr policy)**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/policy-packs.md) — How a repository adopts a versioned Policy Pack that carries skills, linter rules, severity overrides, critical paths and risk weights together, the precedence ladder that combines packs, the lockfile the team commits, and the three failures that abort instead of silently degrading.
+* [**Baseline & Auditable Suppressions (gitpr baseline)**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/baseline-suppressions.md) — How a legacy repository records the findings it already has, how a run classifies them as `new`, `existing`, `resolved`, `ignored` or `accepted_debt`, why only `new` blocks, what the fingerprint hashes and what it deliberately leaves out, the four scopes of a suppression, the checksum that catches a hand edit, and the `baseline:` block a Policy Pack may carry.
 
 ### Configuration & Infrastructure
 
+* [**Interactive Configuration TUI (gitpr config)**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/config-tui.md) — Master-detail terminal interface to view, edit, and validate settings in `~/.gitpr/.env`.
+* [**Multi-Forge SCM Integration**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/scm-multiforge.md) — Unified SCM provider layer for GitHub, GitLab, Bitbucket Cloud, and Azure DevOps with `--init` wizard.
+* [**Suggested Reviewers**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/suggested-reviewers.md) — Automatic reviewer suggestion via Git blame of added lines mapped to forge logins.
+* [**Usage Telemetry & Audit Log**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/usage-log.md) — Local invocation logging and audit history for tracking CLI executions.
 * [**Install Wizard**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/install-wizard.md) — Step-by-step guided setup for configuring GitPR in a new project.
 * [**AI Providers**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/providers-ia.md) — Configuration and selection between Google Gemini, DeepSeek, and Ollama.
 * [**Auto-Updater**](https://github.com/gitpr-cli/gitpr.git/blob/main/docs/auto-update.md) — How GitPR's automatic update and the mandatory update block work.

gitpr_cli-1.4.0.dist-info/RECORD

@@ -0,0 +1,163 @@
+gitpr_cli-1.4.0.dist-info/licenses/LICENSE,sha256=UQzLC6mwqb-ZNDkBBAqOxC-SMQcEID0gaM6oFcu6u48,27030
+src/__init__.py,sha256=WZW9x8P5CYnru29UiarFa8q1nQzuwYWyIodSOlruCWI,29
+src/ai_providers.py,sha256=QyFEOsXyA59lZziO5bl-4nlYFJpxBcxU9aLhcTBnkWE,14633
+src/blame_engine.py,sha256=Zov1hxrt7Dcmf56ovJKz3QmHIfzDKtSub2iItXeg9-A,17104
+src/cache.py,sha256=GC2ZT0ThAtH22aRRZapIeauATv_nqBfiRsXjqeMhAiI,6368
+src/changelog_builder.py,sha256=8GicvIhREWo3B8XhQugVi2_OWzhN_ik_2GxpxmiJVTg,9650
+src/chat_memory.py,sha256=PcohnyspAfIwwwbsp9U2Wk_1AylJMFEMoWqRSJe_w30,8949
+src/commit_classifier.py,sha256=pgZRj8JvkCBgwgzDFNjjNKJKzddVB4HoPBcFM1F0zjE,6742
+src/config.py,sha256=5bs6jxxg-CwmtGfJB2eoMUbwRddOnc_MCcadOOcMbHg,53637
+src/config_schema.py,sha256=z-JC5rULAVkaQG4ppmVcdeNKLGpuXFqglzvCBgZjHVo,43308
+src/core.py,sha256=rw_S8_QEv6kljpC6X4CEJLPjKtd91SogtH5G9-c2_PA,84823
+src/diff_parser.py,sha256=62X69ves4tlzNgVKXNsfWdOMwqn2h16RkUOPqszMU7k,11252
+src/doc_links.py,sha256=DuovU-RF9kjbisBdEoGAsuavQ2y0MYDhqy6Sz6vbrGI,1157
+src/github_api.py,sha256=ILm7e03UP80swc3XuJvIJJvhLp81-V_3kQQ1EuAcN8Q,3836
+src/i18n.py,sha256=PdUmtZlH1zogbiDc3j6xiwtnvUd7XiNbiS-xKjYK4WM,4844
+src/issue_engine.py,sha256=XwW9C5uX84eOWWZMerm0DvE8LpLRcjhrLsXtt7yftak,10872
+src/ledger.py,sha256=s10Sm0qcA1b916X7m8d2osDThCmSK0UQnmUrkyj8Eao,43663
+src/linter_engine.py,sha256=hIxht8M09Fnm6NiJZOqjI6dyqnFoHUDVA8Ve4dWZV4s,25214
+src/linter_wizard.py,sha256=7J_nQFghVwCaKG6QI3K45KcOaxHSH1oTCAvP_6tnCQM,7424
+src/main.py,sha256=jgRHRpbTYkhCaamnXJacThdXPih2iE3005GVhbqYWW8,210498
+src/mcp_server.py,sha256=rLkN8rJAjqSaguCXksbQsLBYu8XKkWdXKps_zl6dwOQ,99398
+src/metrics.py,sha256=M4Yqa__giuhmkElT-XOWrTfHGsjK_URVLhIZvErD2f0,39560
+src/net.py,sha256=f0MOkXyIxi4HVetsybtWpV_yHjiC17T2JMWySBdoV2I,2774
+src/release_engine.py,sha256=xgsoZUYnFohxemwzRSPymoLvgYsK0Y4HRRtZaItkZEg,37433
+src/reviewer_resolution.py,sha256=lZ3csSJHN6Y5TJ3U3p9uuXikOgG7fH4qqx7X9-4F7pc,5754
+src/reviewer_suggestion.py,sha256=jk9FAyp7WkkJbi-yepz7LDF1_tSHxJEEjcajMKF5HdY,8501
+src/security.py,sha256=fkWy-r4tdISH0xOyWZyR8ZCFyLuYqu8fn9sKsIeNAso,1351
+src/security_ruleset.py,sha256=L754S4RlVoZGWm0nuCoeli9-49mKydZpwi31V319DQ0,4337
+src/spinner.py,sha256=63pEotiDa3TVwBr-sn0MJoDPQ_uWJTTwINXieJIDDKc,8964
+src/suggest_reviewers.py,sha256=-wRe0HYksx4FWQZ-eDvU9Ghdk5gqtEt457KQP7sE31Y,5181
+src/tui_issue.py,sha256=WEFxT4kzWQ_KbSDsOnS_iuYXasZySB-68jryGNm0peg,10331
+src/updater.py,sha256=mjlTehzEo4u23dOezGA-iMrw1GzAENUqQuZx7JZJLHs,4771
+src/usage_log.py,sha256=FdfSmZKL_I5BcG750rD4gl3pNHx0jqV8Shij5XkAnzc,4381
+src/version_bump.py,sha256=OjqJe9OL1-1dT5od7-SgU5ZN_dTtR_aKX_oSjSY64YQ,2954
+src/application/__init__.py,sha256=0GADzpCB3CdCzw-d3az0DVOtTvXfCppt-0hY-Js5a1U,29
+src/application/use_cases/__init__.py,sha256=7rwBoDbGxnsjVe32j7yj9yCA9g2E-DWGeokOfDbl_O0,284
+src/application/use_cases/activate_policy_pack.py,sha256=lsR_AbIEykN7xWBB7qWNJpstnYFm3FKH117VZJx9jlM,4505
+src/application/use_cases/baseline_gate.py,sha256=akVGhWKen5Cv_JExHu05yH6ahEc0AiPRc-rCStzKbkw,16319
+src/application/use_cases/baseline_summary.py,sha256=SBcSv8EPjacckKOZjBpwjq07TRS9hY8CvUgUGxuknvc,10291
+src/application/use_cases/calculate_risk.py,sha256=oh327qPomI_sO8JXErAHATafu_21KQKV4O_LLLHQ-tk,13204
+src/application/use_cases/compare_against_baseline.py,sha256=qgidzsloF5b84LXGb42ae4bDdRGBbGTRepLm1Yb9FmA,1875
+src/application/use_cases/create_baseline.py,sha256=LpXHlF9IkD4P4FL4VKJOh5YyCgfAD6hjt_0bQLy1pqI,25928
+src/application/use_cases/generate_mentor_explanation.py,sha256=KNj5cDm-i7aPJxxbbLm4Hvtv7g5CI59-pbX7tHPcEtM,9428
+src/application/use_cases/generate_pr_explanation.py,sha256=5BYUPgGBdR29P-9zt75IcKO4KOwGhZnapws7Y6A4574,3202
+src/application/use_cases/generate_test_file.py,sha256=WlHnhwCWHe-XBrL9m1xvJOkn1wqr8vnsE3s3x9wgUi0,8615
+src/application/use_cases/install_policy_pack.py,sha256=U1XvkHt0elXvyM2VRc6TPNukhUomSI2BSWj09hmLC_8,2745
+src/application/use_cases/resolve_effective_policy.py,sha256=nTbjRR4di1GnCRV7l3yDNw27CQV3heAd45sftHxNyNc,7563
+src/application/use_cases/suppress_finding.py,sha256=juj2jjk2BLjrAcx6WTKJNr5VMTJQ4Gb3GaEjDNGjM64,17809
+src/application/use_cases/validate_policy_pack.py,sha256=g8jt8HYUcGae69tzfT84A22usbvF9JB3T2ZoG5oyw0A,9643
+src/branding/__init__.py,sha256=6ORCsJHtd422jUiQNMCf6eL8kwW4QMf6dJ9Z4Gf9bEc,80
+src/branding/badge_builder.py,sha256=ZO-rXMPoSPYodvILfY2wHufYs0ZQwgFxSs0SkHd6m4A,4899
+src/branding/badge_data.py,sha256=eamUtEKeg3NwF9MCipb5EXFlwL8vgJnR6yUw2TrFlEw,1925
+src/demo/__init__.py,sha256=lF-kdDOqylPXRiuSmT3XwqdghMlRIiOuzpNYs7ElGiE,370
+src/demo/demo_runner.py,sha256=lqnJZB27GSJan7bwV3Gf1wnCBYn7Wws_DEOFdB5PADc,10721
+src/demo/fake_ai_provider.py,sha256=9slMebDqKvHv6wmhms_YhEqPhQJBlxYwAiCzehpkR3A,4038
+src/demo/scenarios/__init__.py,sha256=t8PRSdgNM9f0tb53lBSkehiQ_liI-azts7BdhMdUZrs,4041
+src/demo/scenarios/laravel_bug_fix.py,sha256=lU3XoKaGvcDIlMmzZFeWvEI6tGjgz5bWGflBbUNvgHU,20461
+src/demo/scenarios/security_issue.py,sha256=sI8YykXcYOkpgHygAOX6pYLHwSkHZoE5OjrYsRqOCXQ,23821
+src/domain/baseline/__init__.py,sha256=g-zsXskjG1FY4ok0N4CRWxRLPh-fowr-2_sTiFj9kLA,3802
+src/domain/baseline/baseline_comparator.py,sha256=dB8ydnKFiSSq4qPalLKq4RNpDi27ZB6mSx42fBhE5WA,8702
+src/domain/baseline/baseline_fingerprint.py,sha256=06i-rxVcElr0md4eveKycl7etsHaECdI9vOZ_TAWPYQ,4370
+src/domain/baseline/baseline_manifest.py,sha256=jYy_AHBNP6adFr8FNfZtqQmdZteGNzTlToXHg-BP3RI,10429
+src/domain/baseline/baseline_types.py,sha256=_su74m5HuBu0Z5jxm_elva_CX7EP_6025lbX5EjH2o8,11220
+src/domain/baseline/suppression_policy.py,sha256=GNZ0WN7ww4HcUq82vtiqd8Ere7EuP51VuSCoPzEkLOU,22489
+src/domain/finding/__init__.py,sha256=Y9n2tmT8zybkv3zkBAoI_2k8C4ode2CWHm6l28BhH9w,166
+src/domain/finding/finding_types.py,sha256=Nocd7SmXMAk3q0gVM6yeh2AW6rmJS6CxOCOIQsmsF-Y,833
+src/domain/linter/__init__.py,sha256=WoLci3LhRc7S2IlytrveRPbEQVrAwI4bqazVmGP08Ak,236
+src/domain/linter/sast_finding_mapper.py,sha256=C7SdwVz7-pJNCPeF5kchWjAmL4qs4m1yJQoAKrO-omM,3336
+src/domain/mentor/__init__.py,sha256=4Ii3I9g-fQWv5wgxd5xe5sRdtTinF0Uvqd_b1CxL9ao,357
+src/domain/mentor/mentor_explanation_builder.py,sha256=VGvHEWQuneZDA8epa2txRD5w2U4vU6rgVzmxM5tChg0,6776
+src/domain/policy/__init__.py,sha256=rXn1lKH67Lx-p-9imYIjwqfEp3XAPLxq7djSWFusOIs,3501
+src/domain/policy/policy_checksum.py,sha256=SIwVmMpb3FH1ziWBc9NJN6jqDqBLoagdf-QGO-Qf6N0,2282
+src/domain/policy/policy_compatibility.py,sha256=rd90TLg4wyB9gI-RKMI94NxwxeFk9uKxBsJ9Tm9QM3c,8267
+src/domain/policy/policy_manifest.py,sha256=hXIM4u-tKYXTcEu0rBEGJYBuv4dysn9NEjhxXVPSkk4,26292
+src/domain/policy/policy_resolver.py,sha256=5oTVHysPIwRJibRtRp3U3zOJpS07EBRfkhsmpfI6wcE,28883
+src/domain/policy/policy_types.py,sha256=lhGxapRFAPiVCjmZtwZ9EVViSkDYCJ6UiKNVsaPKvDw,9875
+src/domain/pr/__init__.py,sha256=O9C2dQpbMnbF3mOXTMUvHPmIAF0G-QxhDlVXjB_wShs,274
+src/domain/pr/explain_section_builder.py,sha256=RMPErD_X8nLhbfCwxHCBmI3AFLilO_eNPpEDZE6pyns,3799
+src/domain/risk/__init__.py,sha256=9vbLfhIomCarCbEw_DCZzri9lzV-lFIXBN-FAq6oSPY,283
+src/domain/risk/risk_calculator.py,sha256=zjIoLIRdXi3pHNbq0QcRwOznArtNtQQWV8ReLaW6Zn4,5037
+src/domain/risk/risk_explanation.py,sha256=YuPMBT27x7rnZnmvttIWBsfbTjsIXjMUEP9WLU4VlvE,3005
+src/domain/risk/risk_rules.py,sha256=2hueo89tvHOpLcCfKVEro8Z8AMgVeyUYG8xf6wcpcAI,8705
+src/domain/risk/risk_types.py,sha256=O3l6woRgnpocGffucFiI22LoOrxM-qS70HDg2hSHGO4,4041
+src/domain/tests_generation/__init__.py,sha256=OcHvtEilwu_8z_PV_prq2x_GGBGxmlsCW2XM1xU8dl0,251
+src/domain/tests_generation/framework_detector.py,sha256=DyJZcttvpRkZMEx8a9X3ksveJ-PNub49XXNzqERQSU4,4439
+src/domain/tests_generation/test_content_types.py,sha256=jnPywEMAGtm340e8V1kuHbx9Nxa9nhC7mKnubduxEZM,1019
+src/domain/tests_generation/test_scaffold_builder.py,sha256=NkTbYswWiuWikLfz6nRi34zU8e7HvzMzkbj3q2W__Ws,3800
+src/fix/__init__.py,sha256=haZFtazOc4v9SmtqBtyPNUvYrEQXNaChTIZiOpZlNSc,937
+src/fix/apply_fix.py,sha256=yMinMW50Fw62V-k7hRwN1lsikCJbz6xV5iX4IH0sdxY,17912
+src/fix/fix_history.py,sha256=pHXHpt-SstitbLDmlPloDVKlH79FUD8hqKjVK5xKLMA,5626
+src/fix/patch_applier.py,sha256=3tIXwp8yPwelngXvhmQhvCYVpEOPfvCUwrnG_B9Yf0c,1235
+src/fix/patch_extractor.py,sha256=gEiwSvxGNHM74TnubTN22NBpbXDwvNpB2vMqgpF7hQQ,2514
+src/fix/patch_provenance.py,sha256=sF934ntcZjJCTzzhtuR2Pi-vMUdXFElKcuw5riwPnUk,3195
+src/fix/patch_safety_classifier.py,sha256=StZvh_0Y-ZCdf_LwFoVAdfhpi0b7v1TOxTRoG86_63M,4121
+src/fix/rollback_fix.py,sha256=rMBYewuvlhJOFdo-Ke_SPfu1O-yd6NJzEYiO5o-LcKk,2501
+src/infrastructure/__init__.py,sha256=zTIcY3cscsdkXogSGXoJbH0mVGFbKYTRK32fg26wr9U,81
+src/infrastructure/baseline/__init__.py,sha256=VCnAq7MgyvIAwjd2jznSEvyY42Xg5tmnz4VWBxFA5YI,614
+src/infrastructure/baseline/local_baseline_repository.py,sha256=lE9f2D-6XBPRNi5e32jUA6aG6TUxgAN12ihz-tH3KaM,13460
+src/infrastructure/git/__init__.py,sha256=j9zQUXKNp5NcOzTK-qHGNh75YkufGlw5rgH1wgRknX4,87
+src/infrastructure/git/identity.py,sha256=fClwWTkGIypquE19dUjwwDQCifdsGQmmRMgVobuBIa8,5722
+src/infrastructure/git/patch_applier.py,sha256=RgbrpAp-6x401Eydz6yLMTOXKn5E9LQzV9ZB_n7E90M,7988
+src/infrastructure/git/risk_history_reader.py,sha256=EqIvVPqw5gCFHnHSjIioMSg3BTSk9fXvynZJi0ajfyY,2733
+src/infrastructure/git/selective_stager.py,sha256=sMRPZmq2EWipcabCCETeMu_0in66BFSzQAqZ7h1y2hc,8038
+src/infrastructure/git/test_matcher.py,sha256=wsbMrPAdBqfRz8W_DNjdIE1yQi3Y56Mi9Jfv0DOeMos,2586
+src/infrastructure/linter/external/__init__.py,sha256=6qz3sZ-ObiSOiTfakgGoIRefJnHaWSh4M9Hvh1XNWxw,317
+src/infrastructure/linter/external/bandit_bridge.py,sha256=gTixkOj0wERfe4Bp53w1hjpSrEH4F6bxCfEwYX0Cy0M,4330
+src/infrastructure/linter/external/base_bridge.py,sha256=sHiKZnLitCMoMhMy9tVXVggIQWhE5IcpECYx_JQ_FnY,3063
+src/infrastructure/linter/external/gitleaks_bridge.py,sha256=rgsYTcfvHDeekWuXU2D73apq-4NyMlVi_E5S5cHbOWU,5881
+src/infrastructure/linter/external/semgrep_bridge.py,sha256=gifKH4T22ZunoYRZROD2mwv46CCYgGLT6ikmO9VnnrM,4504
+src/infrastructure/policy/__init__.py,sha256=37VsNF-kYx3Z7UQQo_LT8nQhrfU-v4JUwaLGBKgU11Y,1039
+src/infrastructure/policy/local_policy_repository.py,sha256=bBRWrz8cDJB34c_QwVnCUFK4NESjQTKUiPPuJ4uDpII,5644
+src/infrastructure/policy/policy_pack_loader.py,sha256=sutt_l-_SGBkR0VAaeZ9YwFPC4WAcX4H89J7E7_Br8s,9319
+src/infrastructure/scm/__init__.py,sha256=kNiYljRCJRwi5WoPckn8NbZt6qbEQZFMwaBY3-kepRo,1825
+src/infrastructure/scm/azure_devops_provider.py,sha256=L9nKlwayUj80jZxOeeGFKbgos3He-lVRVh5U7Nkoopg,17920
+src/infrastructure/scm/base.py,sha256=wbHFUNBtxXrRcEBiT0qmgBScWr-Ep_eJSIeP279KOQI,13921
+src/infrastructure/scm/bitbucket_provider.py,sha256=ooHt7qilk_LHwOSJK81WMm-ZPBZJomyIZL5NEWeMoak,15151
+src/infrastructure/scm/factory.py,sha256=Qeearq8eWnF_4boI68rVBkoGEiS-xRGD4V-O_FF0204,3856
+src/infrastructure/scm/github_provider.py,sha256=Ju1QzU6oiUft1hGT1zqaIx1vUJIr0oy3GCYm3y0YfcM,19342
+src/infrastructure/scm/gitlab_provider.py,sha256=06jWqEk_A8ERYf0KalGxXdLZBL4ZemYz9KuDMiK7YcY,16595
+src/infrastructure/scm/web_links.py,sha256=9DHFCwYc6TVzO3INe0rvEicgoD2-kxQSrgq3vt_p5Ow,3621
+src/policy_packs/laravel-quality/CHANGELOG.md,sha256=ztrTTZhzScFdPEWOSkQoQ7vnaTu5LkqyJZc43k6G8qg,1129
+src/policy_packs/laravel-quality/README.md,sha256=GSeluNUTR80dwhm1qZrrYFaaPjrdhTkWmfJdv3hDWes,1811
+src/policy_packs/laravel-quality/linter.yml,sha256=OoJg-i5jDnaXwVYd_nZe2HMinVt0n2op7KvUzG7fqKQ,3130
+src/policy_packs/laravel-quality/policy.yml,sha256=z41BBUM_rAWLTIstNoI3E5pa4Y_Uy21lsrPBWOuH_VY,3703
+src/policy_packs/node-quality/README.md,sha256=eGb8bZBBwniM4fKBDQoHhrpXxcijHpxEiwffJupgvZg,1286
+src/policy_packs/node-quality/linter.yml,sha256=LqKDpnIcO4jSe2VihaEAfncevZNl9fJYQF7n_vpNLAw,2817
+src/policy_packs/node-quality/policy.yml,sha256=MVXsPk-AYx2mchum0lOnKQqCfy_3HdkVPogAas-Qcmk,3137
+src/policy_packs/php-security/README.md,sha256=7R7NrqoEN0WjVCJf6l38zxurBI9af7veWj9NvI1XTAc,1456
+src/policy_packs/php-security/linter.yml,sha256=3aSXdmLZCkVwE7vRl4doXEO1yohc9A-GLmcRCWk-UTY,3191
+src/policy_packs/php-security/policy.yml,sha256=sycGc-AhsHrx_kYwcbaVwAO5gMmj9zmC-9YdjBpMg0A,3183
+src/policy_packs/vue-quality/README.md,sha256=hHKAPxNMfkBOdqe4lhL5-LLYEUM82mJ10zdhxP4yQxE,1264
+src/policy_packs/vue-quality/linter.yml,sha256=UFZY6G7N7G484mStiQVL0u9p6yzoVPzdvdYTHc5ABpc,2458
+src/policy_packs/vue-quality/policy.yml,sha256=WMfnCoWxWAqwrPn28QJ1oOvY0emoxoLEXmxzGlDLq_4,3021
+src/review/__init__.py,sha256=XVyQZFf6UAqIKi8Gb1pQ4dKjcrC50soUvNuKu1DBspc,687
+src/review/diff_normalizer.py,sha256=PRXQ7b81EBH1nx_8_Tm9G7Kjdax_6hIVtFgEixicT0E,3551
+src/review/diff_source.py,sha256=O8bIlff0Zr7wPMzCKAVk_LF2pMDr3sc9KAuyA3OvHG0,2664
+src/review/remote_pr.py,sha256=BswcOgZA1GZdfQ1NXKA9lWsZA60fKmUUndMIG97CJg0,13319
+src/review/render.py,sha256=Wrfp3gPfzT7_IS-yScABYI2ptSb0ntoJkpEw27xpzhA,3111
+src/split/__init__.py,sha256=JuXxPxoG1NrWtLAQARSBh59tsNXvrUoS-T-vHcHeDPM,912
+src/split/apply_split_plan.py,sha256=-ESEEl973Ai9czEOVfS697Dy196QX8EKbVrNZlgrQhY,10678
+src/split/generate_split_plan.py,sha256=I370yLCxqeZRemIIcLswYVI07fet5JJMRxxht21HlOA,8786
+src/split/hunk_grouper.py,sha256=rNH64CJQ80ue6YjTTaVxwtQug1tY6yCjEEScjj8wL2o,14249
+src/split/hunk_parser.py,sha256=Lvmpd8qPYT2a0pw-XCSvUJqm_b9P5tAw9Kj_DlbBWTk,10010
+src/split/split_plan.py,sha256=rim_iUlyQO8EpqXjN-YzRFv5mbo2pwZlXdrkuZ7PGxM,6419
+src/ui/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+src/ui/chat_app.py,sha256=O21d4-_6u87pHeFKtBJbTpQxkBQWmaNa617CO0f4-0Q,26777
+src/ui/config_app.py,sha256=xgppZbEBFrFijgLGo1b1PN1vTGCg8xpI8gpMYBv2KzU,73417
+src/ui/help_screen.py,sha256=EvbP8kFZ6Sdehi7bJ6Wo_YcTTk5MTkgneeidWwefYrA,1890
+src/ui/issue_app.py,sha256=eINMmamloeopbtwyS1rCPwosaHeZW5oLebnEV4TfamY,9281
+src/ui/linter_app.py,sha256=Y5vwU7D5PQIR_HaY6t40jZy7Guc8z2w-auyosCQqoro,1566
+src/ui/metrics_app.py,sha256=r5JSS70Fkir0qQ4Q03T6c1R2-WGrvYMNTlHMhjAR2Tc,16303
+src/ui/metrics_migration_app.py,sha256=-56HhWZhtVpGCO53NhUnOpZI9bDesfwy2_w7f31cMsU,5923
+src/ui/pr_publish_app.py,sha256=cZ9xr1TSZF6fjvQPlAdSjzSNykufHF1l7hsmo3Ib2j0,67311
+src/ui/pr_publish_help.py,sha256=fBiUtD97ngxbSfAvPVGGXU19r5kbALCKyi4QeKqyQ2c,1891
+src/ui/demo/__init__.py,sha256=PGXenIwpS1lVDE164CZ55q8_65XtJq5H300NIpnqOh0,58
+src/ui/demo/demo_app.py,sha256=EDeuqxh_v9KrPhib49TyirmFlHZN7I5NQkg9AjDGhcs,3074
+src/ui/demo/demo_help_screen.py,sha256=m8SuvhzGmkMsahUBA6Aq7ull4W65nS0KOX4hLx-GGps,2056
+src/ui/demo/demo_screens.py,sha256=3Ntp-A7OB43yEtniRqV1UKWc-p5lHRyxeadpe8bxJpM,1937
+gitpr_cli-1.4.0.dist-info/METADATA,sha256=UElFetNIOs54YQZ92CqK1LxNKFSAp-0VG-azLmnsgF0,51335
+gitpr_cli-1.4.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+gitpr_cli-1.4.0.dist-info/entry_points.txt,sha256=TstGnMUzdOI5qNmpM97EPDBPuMqOZxoo6EoLxHSOMSQ,71
+gitpr_cli-1.4.0.dist-info/top_level.txt,sha256=74rtVfumQlgAPzR5_2CgYN24MB0XARCg0t-gzk6gTrM,4
+gitpr_cli-1.4.0.dist-info/RECORD,,

src/application/__init__.py

@@ -0,0 +1,2 @@
+# Application layer markers
+

src/application/use_cases/__init__.py

@@ -0,0 +1,8 @@
+from src.application.use_cases.generate_test_file import generate_test_file, validate_test_syntax
+from src.application.use_cases.generate_pr_explanation import generate_pr_explanation
+
+__all__ = [
+    "generate_test_file",
+    "validate_test_syntax",
+    "generate_pr_explanation",
+]

src/application/use_cases/activate_policy_pack.py

@@ -0,0 +1,122 @@
+"""Use case: record which pack a repository follows.
+
+The record is ``.gitpr/policy.lock.yml``, a file meant to be committed: it is
+what makes the policy the same for everyone on the team and what lets a later
+run notice that a pack changed under it.
+
+Activation is **one pack per repository**. Choosing a second one replaces the
+first rather than adding to it, so there is never a question about which pack
+owns a value — the graph below the root is reached through ``extends``, and only
+through it.
+
+Building the lockfile and writing it are separate functions because the CLI has
+to show the user what will be written *before* asking whether to write it. A
+command that writes first and asks afterwards is not asking.
+"""
+
+import os
+from datetime import datetime, timezone
+from typing import Any
+
+from src.domain.policy import set_active_policy
+from src.domain.policy.policy_resolver import resolve_graph
+from src.i18n import __
+from src.infrastructure.policy.local_policy_repository import (
+    LOCKFILE_SCHEMA_VERSION,
+    lockfile_path,
+    write_lockfile,
+)
+from src.infrastructure.policy.policy_pack_loader import (
+    load_pack_by_reference,
+    make_loader,
+)
+
+from src.application.use_cases.validate_policy_pack import split_reference
+
+
+def _relative_to_repo(absolute: str, repo_path: str) -> str | None:
+    """*absolute* as a repository-relative POSIX path, or None when outside.
+
+    Only packs that live inside the repository are recorded by path. A pack in
+    ``~/.gitpr/policies/`` is recorded by name and version instead, so the
+    lockfile stays valid for a teammate who has it installed somewhere else.
+    """
+    try:
+        relative = os.path.relpath(absolute, repo_path)
+    except ValueError:
+        # Different drives on Windows.
+        return None
+    parts = relative.split(os.sep)
+    if not relative or parts[0] == "..":
+        return None
+    return relative.replace(os.sep, "/")
+
+
+def _lockfile_entry(pack: Any, repo_path: str) -> dict[str, Any]:
+    entry: dict[str, Any] = {
+        "name": pack.reference.name,
+        "version": pack.reference.version,
+        "source": pack.reference.source.value,
+        "checksum": pack.reference.checksum,
+    }
+    if pack.reference.path:
+        relative = _relative_to_repo(pack.reference.path, repo_path)
+        if relative:
+            entry["path"] = relative
+    return entry
+
+
+def build_lockfile(root_reference: str, repo_path: str | None = None) -> dict[str, Any]:
+    """Resolves *root_reference* and the lockfile that would pin it.
+
+    Raises ``PolicyError`` when the pack cannot be found or its graph does not
+    resolve, and writes nothing. The CLI calls this first, shows the result, and
+    only then decides whether to call :func:`activate_policy_pack`.
+    """
+    from src.updater import __version__
+
+    repo = os.path.abspath(repo_path or os.getcwd())
+    name, version_range = split_reference(root_reference)
+    root = load_pack_by_reference(name, version_range, repo)
+    packs = resolve_graph(root, make_loader(repo))
+
+    return {
+        "schema_version": LOCKFILE_SCHEMA_VERSION,
+        "gitpr_version": __version__,
+        "activated_at": datetime.now(timezone.utc).isoformat(timespec="seconds"),
+        "root": _lockfile_entry(root, repo),
+        "packs": [_lockfile_entry(pack, repo) for pack in packs],
+    }
+
+
+def activate_policy_pack(root_reference: str, repo_path: str | None = None) -> str:
+    """Pins *root_reference* for the repository and returns the lockfile path."""
+    data = build_lockfile(root_reference, repo_path)
+    return write_lockfile(data, repo_path)
+
+
+def deactivate_policy_pack(repo_path: str | None = None) -> bool:
+    """Removes the lockfile. Returns whether there was one to remove.
+
+    The overrides file and the packs themselves are left alone: they are the
+    user's material, and a decision to stop following a pack is not a decision to
+    delete it.
+    """
+    target = lockfile_path(repo_path)
+    if not os.path.isfile(target):
+        return False
+    os.remove(target)
+    set_active_policy(None)
+    return True
+
+
+def describe_lockfile(data: dict[str, Any]) -> str:
+    """A one-line summary for the confirmation prompt."""
+    root = data.get("root") or {}
+    dependencies = [p for p in data.get("packs", []) if p.get("name") != root.get("name")]
+    return __(
+        "{pack}@{version} with {count} dependency pack(s)",
+        pack=root.get("name", "?"),
+        version=root.get("version", "?"),
+        count=len(dependencies),
+    )