Skip to content

v1.2.0 — Durable Deep Analysis, Graph Exports & Large-Repository Support

Latest

Choose a tag to compare

@AnasBabari AnasBabari released this 01 Sep 20:54
· 175 commits to main since this release

🌟 What's New in v1.2.0

1. ⚡ Durable Public Deep Analysis

  • Durable workflow engine: Public repositories are analyzed in a persistent, reconnectable workflow with progress events, cancellation, and status reporting, instead of a single request.
  • Canonical v2 analysis pipeline: A dedicated graph pipeline produces deterministic versioned artifacts covering architecture components, flows, communities, and explicit coverage/completeness metadata.

2. 🗺️ Deterministic Graph Exports

  • JSON, CSV, and Cypher serializers under a deterministic export contract.
  • Architecture TXT report for tickets, reviews, and offline handoff.
  • Parquet bundles behind a per-environment feature gate.
  • Caching: seven-day Vercel Blob cache for public commit-addressed exports plus an opt-in browser IndexedDB cache; when the server cache is unavailable, a browser worker generates the export locally and explains the fallback.

3. 🏗️ Large-Repository Handling

  • Large-repository explorer: bounded graph compaction (8,000 nodes / 12,000 edges in the artifact; 240 rendered on the live canvas) with preservation of the full inventory and explicit truncation metadata.
  • Git-tree acquisition: repositories above a size threshold are inventoried via GitHub's commit-tree APIs instead of a single oversized ZIP, with bounded retry and truncation handling.
  • Raised durable limits: 20,000 candidate files / 100,000 archive entries / 128 MB archive / 192 MB extracted for public durable analysis; browser/private analysis keeps 10,000 files / 20,000 entries / 25 MB / 100 MB.

4. 🔐 Private-Repository Access & Ingestion Hardening

  • GitHub App access as the preferred least-privilege path: when configured, deployments use per-installation contents:read + metadata:read; the legacy OAuth repo scope (broader access) remains only as a compatibility fallback for deployments not configured for App mode.
  • Transient private analysis: private deep scans run in ephemeral browser workers over a bounded streaming archive endpoint; source is parsed in memory and never persisted.
  • True bounded streaming decompression via fflate (64 KiB chunks, EOCD structural validation, live byte accounting across every emitted byte).
  • Quarantine semantics: suspicious compression-ratio entries are terminated and discarded with a suspicious_compression_ratio diagnostic while safe files continue — never silently dropped, never globally fatal for an otherwise valid repository.
  • Production fail-closed rate limiting through Upstash Redis (5 public / 20 authenticated analyses per 10 minutes); the in-memory window is dev-only.

5. 🧬 Tree-sitter Foundation & Cross-Engine Contract

  • Tree-sitter parsing for Python, JavaScript, TypeScript, TSX, and Go, with bounded AST budgets (25,000 nodes, depth 128) and automatic tree cleanup; the legacy regex analyzer remains a graceful fallback for JavaScript/TypeScript.
  • Canonical versioned schemas (v1.1.0 contract, v2.0.0 graph) with fail-closed runtime validation and a CSP-safe browser validator.
  • Fail-hard cross-engine parity: CI runs the TypeScript and Python engines over the same fixtures; a missing, crashing, or diverging Python engine fails the build. Local contributors may opt out with REPODNA_ALLOW_PYTHON_PARITY_SKIP=1 — CI never sets it.
  • Experimental Go analysis: symbols, imports, calls, net/http and Gin/Echo/gorilla-mux route patterns, and architecture graphing — explicitly labelled experimental pending entrypoint recognition and router-attribution hardening.

6. 🎨 Code Graph Explorer & UI

  • Technical Code Graph explorer tab with semantic code relationships, live constellation interactions, clarified route/cycle states, a minimap, and an Obsidian-style browsing experience.
  • Unified scan coverage and inventory-driven size classification; a durable public-scan counter on the landing hero.
  • Responsive landing/hero polish, draggable-architecture refinements, and PostHog EU privacy-safe analytics.

7. 🧹 Engineering & Process

  • npm canonicalised: package-lock.json is the authoritative lockfile, "packageManager" is declared, and the pnpm lockfile/workspace were removed.
  • CONTRIBUTING.md expanded into a full contributor contract: CI-vs-local quality gates, fixtures and golden assertions, cross-engine parity rules, security-sensitive invariants, and supported-versus-experimental language tiers.

📊 Verification & Test Metrics

  • TypeScript/unit suite: 277 / 277 Vitest tests passing ✅
  • Python core engine: 31 / 31 unittest tests passing ✅
  • CI: engine, visualizer, fail-hard cross-engine parity, and Playwright browser-smoke jobs all green ✅

Full release notes: docs/RELEASE_NOTES.md