Deeds 0.5.0: judged on Clef, and measurably better on code it has never seen

A better judge, measured. Deeds now judges commits with Cloudflare's Clef model on Workers AI, in your own Cloudflare account. The question system behind it was rebuilt through an evaluation climb against labelled commits, and checked once at the end on 256 commits from eight public repositories that no part of the climb ever touched.

On 256 unseen commits	0.4.0	0.5.0
Overall accuracy	0.843	0.871
Caps	0.777	0.819
Fixes	0.878	0.901
Tends	0.873	0.894
False caps	8	12

Accuracy is balanced accuracy against labels two independent reviewers agreed on. 0.5.0 is better on all three deeds. It credits a few more caps where the reviewers saw none (12 of 256 commits, against 8), which is the trade we are working on next.

How it works. Code reads exact facts from the diff, Clef answers up to 44 narrow questions in 13 stages, each stage asked only when an earlier answer calls for it, and 112 written rules decide the cap, the fix and the tend. The model never makes the final call. The README map shows every stage and question.

Security. A commit's diff is redacted before it leaves your machine, and 0.5.0 also blanks long mixed-case strings shaped like keys. On the security test corpus, 0.5.0 recognises every security fix as a fix (28 of 28), including all four commits from issue #7. It also calls 5 of 38 upkeep commits fixes where the reviewers saw none, against 3 for 0.4.0.

Thanks to everyone whose pull requests landed in this release: #3, #4 and #6.

Upgrade: curl -fsSL https://raw.githubusercontent.com/danielmiessler/deeds/main/install.sh | sh, or update the deeds plugin in Claude Code. Deeds now needs a Cloudflare account ID and API token (CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN); the README's Install section shows where to find them. Results cached by earlier versions are not reused; the first run on a repo judges it again.

Deeds 0.4.0: a sharper judge, and how it works

A sharper judge. Deeds now judges each commit with a staged question system. Code reads 37 exact facts from the diff. Jev answers up to 28 narrow questions in two waves, and the second wave is asked only when the first one calls for it. Then 102 written rules, first match wins, decide the cap, the fix and the tend. The model never makes the final call.

How it works. The README has a map of the four layers and a table of every question the rules read, with the mistake each one is there to catch.

Security. Every fix from 0.3.3 carries over. A diff cut for size now says it was cut, so a large commit is never read as complete.

Upgrade: curl -fsSL https://raw.githubusercontent.com/danielmiessler/deeds/main/install.sh | sh, or update the deeds plugin in Claude Code. Results cached by earlier versions are not reused; the first run on a repo judges it again.

Deeds 0.3.3: security fixes from a private report

Security fixes from a private report by elhoim (David André). Thank you.

• A bunfig.toml in the repo being analyzed can no longer preload code: every launcher pins the CLI's own config.
• The macOS sandbox re-exec no longer loads the repo's .env, and the git that extract runs gets a clean environment.
• Author names, paths and cap names are escaped before they reach the terminal.
• Redaction covers OpenPGP, SSH2 and PuTTY private keys and passwords of any shape, escaped quotes included.
• Diffs are cut at a line boundary, so a secret is never split before it is redacted.
• The skill pre-approves only analyze, help and version. --html and --out stay inside the working directory and never write through a symlink, unless you pass --allow-any-output.
• Clones skip the git-lfs smudge filter.
• git log output is parsed so an author name cannot shift fields or abort a run.
• In --mode full the diff is fenced as untrusted data, and a commit yields at most one deed of each kind.

Install: curl -fsSL https://raw.githubusercontent.com/danielmiessler/deeds/main/install.sh | sh

Deeds 0.3.2: commits dated by when they landed

• A commit is now dated by when it landed (its committer date), the same date --since and --until select on. A change written long before it merged, as in a review queue, counts in the week it reached the product.
• An HTML report for a GitHub repo is titled owner/name.
• The examples and README use a real 90-day run of golang/go.

Install: curl -fsSL https://raw.githubusercontent.com/danielmiessler/deeds/main/install.sh | sh

Deeds 0.3.1: fixes for big and non-TypeScript repos

• Fixed: when many commits were read at once, the code parser could start twice and break its grammars, so Rust, Go and Python commits failed with "Incompatible language version 0". Upgrade from 0.3.0.
• Repos are cloned with their file contents, so reading a commit no longer goes back to GitHub. Clones made by earlier versions are converted once (needs git 2.36 or later).
• Test files no longer name a cap when product code changed.

Install: curl -fsSL https://raw.githubusercontent.com/danielmiessler/deeds/main/install.sh | sh

Deeds 0.3.0: colour and HTML reports

• The terminal report is in colour on a terminal, with bars per kind, and a long window is shown by month. --color and --no-color override; NO_COLOR is honoured.
• --html <file> writes a self-contained report page: totals with weekly sparklines, a week-by-week chart, authors and every cap by name. It fetches nothing and opens offline.
• Examples are a real all-history run of github.com/danielmiessler/LifeOS (see examples/).

Install: curl -fsSL https://raw.githubusercontent.com/danielmiessler/deeds/main/install.sh | sh

Deeds 0.2.0: a Jev key is all you need

Every commit is now judged by Jev. Code reads each diff into exact facts, Jev answers a short set of typed questions, and a fixed policy turns them into caps, fixes and tends. No OpenAI or Anthropic key is needed; --mode full stays as an optional reference read.

• Default judge: Jev, on your own TYPESAFE_API_KEY (or keys.typesafe in ~/.config/deeds/config.json).
• Cap names now come from the code: the route, command, UI handler or export a commit added.
• New: deeds analyze-many for many repos in one run.
• The launchers no longer load a .env file from the working directory.
• Real example runs in examples/.

Install: curl -fsSL https://raw.githubusercontent.com/danielmiessler/deeds/main/install.sh | sh

Deeds 0.1.1

Security fixes and a clearer README.

• A private key cut off before its END line (a diff over 60 KB, or a hunk that stops inside the key) is now redacted before the diff is sent.
• A GitHub target whose owner or repo is . or .. is refused, so a clone can't land outside ~/.cache/deeds/repos.
• The README explains what deeds are and shows a real report.

Install or update: curl -fsSL https://raw.githubusercontent.com/danielmiessler/deeds/main/install.sh | sh

Deeds 0.1.0

First release: the deeds CLI (fast and full modes), the Claude Code plugin, and the checksummed installer.