v0.3.1

Documentation fix for the snapshot safety net introduced in v0.3.0. No behavior change to the review itself.

The snapshot does not cover untracked files

git stash create snapshots tracked modifications only, so a fix to a file git has never seen sits outside the safety net. That mostly lines up with the threat it guards against - git checkout -- . cannot destroy untracked files either, so the protected set and the exposed set match. Two cases fall through, and neither was written down:

• git clean -fd deletes untracked files with no recovery path. It was already on the ban list; now the reason is stated.
• A fix that creates a new file is untracked and unprotected. Keeping edits inside the review scope should make this rare, but when it happens the summary has to say so rather than implying coverage.

Recovery pointed at the wrong snapshot

The integrity check still told you to recover from the step 0 snapshot. That one is taken before any fix exists, so it cannot restore them - it restores the state without them, which is what the clobber already produced. Recovery now uses the newest post-fix SHA, with git checkout <sha> -- <path>.

v0.3.0

Safety and correctness fixes for /deep-review:auto, plus an end to the assumption that every repo has CI.

Uncommitted fixes are no longer destroyed mid-run

auto applies fixes and leaves them uncommitted across the whole fix loop while also dispatching verification agents. An agent that "resets to a clean state" with git checkout -- . destroyed every fix applied so far, and git status looked clean afterwards because reverting to HEAD is indistinguishable from never having edited.

A subagent does not inherit the parent command's allowed-tools - it gets its own broad tool set - so omitting git checkout from the frontmatter prevented nothing. The fix is a prompt-level ban stated in every dispatched agent's prompt, covering the whole checkout/restore/reset/clean/stash/revert family.

Backed by two further guards:

• A git stash create snapshot taken before the first fix and re-taken after each one. The pre-fix snapshot protects your existing uncommitted work; the post-fix snapshots protect the fixes. A snapshot taken before a fix exists cannot restore it.
• An end-of-run integrity check that walks the applied-fix list and confirms each is still present. The clean-tree check was a precondition being treated as an invariant; nothing re-verified it.

Fixes are backed out with an edit restoring the original text, never a git restore, which cannot tell a fix from unrelated uncommitted work.

No more assuming CI exists

Both commands told you to skip build checks because "CI runs these separately". On a repo that deliberately has no CI and verifies through a local gate, that discarded the cheapest-to-catch findings with nothing downstream to catch them.

• Detects .github/workflows, and when absent reports linter/typechecker findings instead of dropping them.
• Detects the local gate, preferring a command named in CLAUDE.md over any heuristic, and handling extensionless gates such as scripts/check.
• auto runs the gate before fixing as well as after, so a failure can be attributed rather than blamed on the run.
• A fix that is correct but trips a formatting rule is reformatted and re-run rather than reverted.

auto works outside the PR-with-clean-tree case

• Reviews a branch with no PR, reporting in-session.
• Runs on a dirty tree, splitting the baseline against the review scope so in-scope files stay fixable while unrelated work in flight is never touched.

Trailer policy inverted

The generated-with trailer is now opt-in on a confirmed-private repo. It previously failed open: a skipped or errored visibility check leaked it onto public repos.

v0.2.0

What's new in 0.2.0

A substantial sharpening of the review procedure for both commands.

/deep-review:review

• Two-axis triage. Every issue is now scored on confidence (0-100, is it real?) and severity (critical/major/minor, does it matter?), and tiered from both - so a high-confidence typo no longer outranks a probable data-loss bug.
• Verification pass. Impactful-but-uncertain issues (critical/major, confidence < 60) now get a dedicated agent that resolves them: confirm and promote, refute and drop, or flag with a "verify: " note - instead of being silently demoted.
• Better scoring. The scorer receives the actual diff hunk and CLAUDE.md contents, so it verifies rather than guesses.
• Dedup before scoring and reviewer agents scaled to PR size.
• Presentation. Output leads with a verdict and per-tier counts; the posted comment uses a summary table with lower tiers in collapsible sections, and an inline confidence prefix per issue.

/deep-review:auto

• Double-checks every issue against the real code before fixing; fixes only what it can confirm, skips the rest with a recorded reason.
• Same size scaling and table-based summary comment.

Both

• Shared canonical reference (reference/review-shared.md) for the reviewer roster, rubrics, false-positive list, link format, and output style, so the two commands stay in sync.
• The trailer is now conditional and dropped on public repos.

Full changelog: v0.1.1...v0.2.0

v0.1.1

Hardening release.

• /deep-review:auto is now disable-model-invocation: true so the no-confirmation auto-fix-and-post command cannot be invoked autonomously by the model.
• /deep-review:review gains Bash(git branch:*) so the no-argument current-branch resolution does not trigger an unexpected permission prompt.
• Fixed escaped newlines in the auto no-issues fallback comment.

v0.1.0

Initial release. Two commands: /deep-review:review (triage all issues, no 80 cutoff, confirm then post) and /deep-review:auto (skip scoring, auto-fix working tree, post summary).