Repository navigation
🌟 What's New in v1.2.0
1. ⚡ Durable Public Deep Analysis
- Durable workflow engine: Public repositories are analyzed in a persistent, reconnectable workflow with progress events, cancellation, and status reporting, instead of a single request.
- Canonical v2 analysis pipeline: A dedicated graph pipeline produces deterministic versioned artifacts covering architecture components, flows, communities, and explicit coverage/completeness metadata.
2. 🗺️ Deterministic Graph Exports
- JSON, CSV, and Cypher serializers under a deterministic export contract.
- Architecture TXT report for tickets, reviews, and offline handoff.
- Parquet bundles behind a per-environment feature gate.
- Caching: seven-day Vercel Blob cache for public commit-addressed exports plus an opt-in browser IndexedDB cache; when the server cache is unavailable, a browser worker generates the export locally and explains the fallback.
3. 🏗️ Large-Repository Handling
- Large-repository explorer: bounded graph compaction (8,000 nodes / 12,000 edges in the artifact; 240 rendered on the live canvas) with preservation of the full inventory and explicit truncation metadata.
- Git-tree acquisition: repositories above a size threshold are inventoried via GitHub's commit-tree APIs instead of a single oversized ZIP, with bounded retry and truncation handling.
- Raised durable limits: 20,000 candidate files / 100,000 archive entries / 128 MB archive / 192 MB extracted for public durable analysis; browser/private analysis keeps 10,000 files / 20,000 entries / 25 MB / 100 MB.
4. 🔐 Private-Repository Access & Ingestion Hardening
- GitHub App access as the preferred least-privilege path: when configured, deployments use per-installation
contents:read+metadata:read; the legacy OAuthreposcope (broader access) remains only as a compatibility fallback for deployments not configured for App mode. - Transient private analysis: private deep scans run in ephemeral browser workers over a bounded streaming archive endpoint; source is parsed in memory and never persisted.
- True bounded streaming decompression via
fflate(64 KiB chunks, EOCD structural validation, live byte accounting across every emitted byte). - Quarantine semantics: suspicious compression-ratio entries are terminated and discarded with a
suspicious_compression_ratiodiagnostic while safe files continue — never silently dropped, never globally fatal for an otherwise valid repository. - Production fail-closed rate limiting through Upstash Redis (5 public / 20 authenticated analyses per 10 minutes); the in-memory window is dev-only.
5. 🧬 Tree-sitter Foundation & Cross-Engine Contract
- Tree-sitter parsing for Python, JavaScript, TypeScript, TSX, and Go, with bounded AST budgets (25,000 nodes, depth 128) and automatic tree cleanup; the legacy regex analyzer remains a graceful fallback for JavaScript/TypeScript.
- Canonical versioned schemas (v1.1.0 contract, v2.0.0 graph) with fail-closed runtime validation and a CSP-safe browser validator.
- Fail-hard cross-engine parity: CI runs the TypeScript and Python engines over the same fixtures; a missing, crashing, or diverging Python engine fails the build. Local contributors may opt out with
REPODNA_ALLOW_PYTHON_PARITY_SKIP=1— CI never sets it. - Experimental Go analysis: symbols, imports, calls,
net/httpand Gin/Echo/gorilla-mux route patterns, and architecture graphing — explicitly labelled experimental pending entrypoint recognition and router-attribution hardening.
6. 🎨 Code Graph Explorer & UI
- Technical Code Graph explorer tab with semantic code relationships, live constellation interactions, clarified route/cycle states, a minimap, and an Obsidian-style browsing experience.
- Unified scan coverage and inventory-driven size classification; a durable public-scan counter on the landing hero.
- Responsive landing/hero polish, draggable-architecture refinements, and PostHog EU privacy-safe analytics.
7. 🧹 Engineering & Process
- npm canonicalised:
package-lock.jsonis the authoritative lockfile,"packageManager"is declared, and the pnpm lockfile/workspace were removed. - CONTRIBUTING.md expanded into a full contributor contract: CI-vs-local quality gates, fixtures and golden assertions, cross-engine parity rules, security-sensitive invariants, and supported-versus-experimental language tiers.
📊 Verification & Test Metrics
- TypeScript/unit suite: 277 / 277 Vitest tests passing ✅
- Python core engine: 31 / 31 unittest tests passing ✅
- CI: engine, visualizer, fail-hard cross-engine parity, and Playwright browser-smoke jobs all green ✅
Full release notes: docs/RELEASE_NOTES.md