diffly v1.1.0

Verdict rebalance — PASS for healthy PRs

The headline change: verdicts now match merge-readiness.

Signal	Before	Now
Required checks failed	BLOCK	BLOCK
Credential-like value in production code	BLOCK	BLOCK
Credential-like value in tests/fixtures/docs	BLOCK	QUARANTINE
Newly added dependency (net of removals)	QUARANTINE	QUARANTINE
Version bump / lockfile refresh only	QUARANTINE	PASS + note
Pending required checks	QUARANTINE	PASS + note
Security-sensitive code, DB/migrations	QUARANTINE	QUARANTINE

Fixed

• Arrow keys in the interactive review menu no longer crash with NameError, fast keystroke bursts register every press (escape sequences stop at their terminator), a lone Escape never blocks, and keys typed while the menu renders are no longer discarded on Python 3.14+ (tty.setcbreak is pinned to TCSANOW).
• Diff content lines beginning with ++ or -- are counted, credential-scanned, and analyzed instead of being mistaken for the file's ---/+++ header lines — a postgresql://… credential on such a line can no longer hide from EXPOSED_SECRET.
• diffly setup no longer runs the update check twice in a row.
• EOF/Ctrl-D exits the interactive menu cleanly instead of spinning.

Changed

• Policy text in the report, README, and JSON reasoning reflects the new routing. Flag codes and the JSON schema are unchanged, so existing automation keeps working.

Full changelog: https://github.com/VIVAAN-DHAWAN/diffly-cli/blob/main/CHANGELOG.md

Diffly CLI v1.0.0

Diffly CLI v1.0.0

Diffly CLI 1.0.0 is the first production-ready release of deterministic pull-request triage. It turns pull-request evidence—changed files, symbols, direct callers, tests, checks, and risk signals—into a clear review decision without making the verdict depend on an LLM.

Highlights

• Verdicts that match the evidence. PASS is now the normal result for healthy pull requests. QUARANTINE is reserved for concrete review gates such as security-sensitive code, database schema or migration changes, dependency changes, or pending checks. BLOCK is reserved for failed required checks and high-confidence credential exposure.
• Reliable explanations. When you opt in, Diffly always includes an explanation in the review: a bounded, redacted AI narrative when a provider is configured, or a clearly labelled local explanation when it is not. Explanations never alter the deterministic verdict.
• A focused terminal workflow. The guided wizard, loading transition, keyboard-driven review, and report output have been redesigned for a centred, readable terminal experience with clearer prompts and recovery messages.
• Works where you work. Review GitHub pull requests, analyze local changes offline, consume stable JSON in CI, or use the bundled GitHub Action. Diffly also reuses your authenticated GitHub CLI session when available.

Upgrade

pip install --upgrade diffly-cli

Or run diffly update from an existing 0.4.0+ installation.

Confidence

Version 1.0.0 is backed by the project test suite and cross-version CI coverage for Python 3.10–3.13. Diffly is production-ready as a deterministic review signal: it helps teams focus their review effort, but it does not replace human review or guarantee that a pull request is defect-free.

Thank you to everyone who tested Diffly before 1.0.0. This release establishes a dependable foundation for reviewing pull requests with more context and less noise.

v0.4.0

Full Changelog: v0.3.0...v0.4.0

diffly v0.3.0

Highlights

New: diffly local — offline triage for any folder

Analyze git changes on your own disk with zero network access — works for private, archived, or removed repositories:

diffly local                      # uncommitted working-tree changes
diffly local ~/code/private-repo  # any checkout on disk
diffly local --base main          # compare your branch against main

Same deterministic pipeline as PR triage: changed-file inventory, Tree-sitter symbol detection, blast-radius map, and risk rules. Untracked files are included; CI-check rules are skipped as not applicable.

UX overhaul

• Centered terminal composition across the wizard, setup walkthrough, interactive review, doctor, and version screens
• Wizard prompts for a Repository URL with explicit format hints (owner/repo or paste any GitHub / pull-request URL)
• Loading spinners with progress messaging during fetch and explanation phases
• Pasting a full pull-request URL skips the number prompt entirely

Fixed: explanations were invisible

The interactive view never rendered the generated explanation even when produced. It is now a toggleable section in the interactive screen, with clear setup guidance when no LLM key is configured.

Engine fixes

• CHECKS_PENDING evidence lists real check names instead of the literal state string
• \\ No newline at end of file markers no longer skew changed-line attribution
• Action comment publishing uses typed GitHubApiError instead of string-matching error text
• JSON output is pure again — banners suppressed under --json
• Bare diffly no longer hangs in non-TTY environments; Windows imports fixed via lazy termios loading

License & community files

• LICENSE expanded from bare MIT to a documented four-part license (same MIT grant + definitions, contribution terms, verdict disclaimers, extended warranty/liability, general terms)
• Added CONTRIBUTING.md, SECURITY.md, CHANGELOG.md

Full changelog: https://github.com/VIVAAN-DHAWAN/diffly-cli/blob/main/CHANGELOG.md

Diffly_cli_v0.2.1

What's Changed

• Harden triage for large and incomplete GitHub responses by @VIVAAN-DHAWAN in #3

Full Changelog: v0.1.0...v0.2.1

v0.1.0

diffly-cli v0.1.0

diffly-cli is a deterministic, terminal-first triage tool for large GitHub pull requests. It emits a conservative SHIP, QUARANTINE, or BLOCK verdict from pull-request metadata, changed files, checks, dependency/database/security signals, test-coverage evidence, and a bounded blast-radius map.

Included

• Python CLI support for analyzing a single GitHub pull request with Markdown, JSON, or file output.
• Deterministic risk policy with explicit rules for failed checks, security-sensitive paths, database/schema changes, dependencies, missing obvious test coverage, and unavailable checks.
• Optional Phase 2 literate-diff explainer using an OpenAI-compatible BYOK endpoint. Context is bounded and redacted, structured output is validated, and generated prose cannot change the deterministic verdict.
• Composite GitHub Action that runs on pull_request events and creates or updates one PR comment with the verdict, risk flags, reasoning, and collapsible blast-radius summary.
• Public benchmark documentation and live terminal captures for VS Code, Kubernetes, and Ruff pull requests.

The deterministic result is a review gate, not a safety certification. The optional explainer is disabled without a configured key and is never authoritative over the rule-based verdict.