RepoDNA 1.4.4

RepoDNA v1.4.4 strengthens local-first evidence ranking, repository reviews,
API reliability, and cross-platform release integrity.

Highlights

• Native, offline evidence explanations support optional locally trained ranking and retrieval-quality baseline comparisons.
• Findings confidence filters and consistent CSV, JSON, and Markdown exports enable complete local review.
• Browser import path safeguards and corrupted-cache recovery prevent unsafe or damaged analysis inputs.
• Expanded local API response validation rejects malformed repository, scan, and project-card data.
• npm release publication rejects duplicate or foreign package names, empty stages, and invalid tags.
• Release-only HTTPS certificate-trust testing strengthens optional AI network security.

Security

• Add an explicit release-gate HTTPS certificate-trust smoke test using the
  optional AI provider's ureq/rustls dependency graph. Ordinary offline
  test runs skip this network-only check; the release workflow runs it
  without credentials or repository data.

Fixed

• Strengthen npm release publication preflight: reject empty staging trees,
  unrelated or duplicate package names, invalid versions and missing/duplicate
  dist-tag arguments. Respect both --tag beta and --tag=beta overrides
  without adding conflicting default tags. Include regression tests.

Added

• Evaluate the optional native evidence ranker against unchanged original
  evidence ordering on the same repository-disjoint holdout, reporting
  baseline MRR, precision@k, recall@k and NDCG@k alongside trained metrics,
  plus signed retrieval deltas and matching cutoff/group-count checks.

Added

• Filter findings by confidence (high, medium, low, or unavailable) and reset
  all active filters with one click; filtered CSV, JSON, and Markdown exports
  share the same complete matching selection.

Fixed

• Validate local API repository and scan-job responses, including nested items,
  counts and progress data; reject non-SVG responses to project card requests,
  with regression tests for malformed and valid responses.

Added

• Add a local annotation workflow for the RepoDNA evidence ranker: produce
  human-reviewable templates from real analysis artifacts, require explicit
  relevance labels, exclude source excerpts, reject duplicate evidence IDs
  when combining batches, and avoid overwriting existing annotation files.
  Include offline end-to-end CLI regression tests.

Added

• Add held-out retrieval metrics for the native evidence ranker: per-repository-and-query
  MRR, precision@k, recall@k and NDCG@k, with explicit counts for questions lacking
  relevant labeled evidence. Include retrieval results in local trainer output.

Added

• Add a CPU-only, locally trainable evidence-relevance ranker and offline CLI for
  fitting a small versioned JSON checkpoint from licensed, labeled examples.
  Enforce repository-disjoint holdouts, bound dataset and checkpoint sizes,
  validate numeric weights, and report explicitly labeled ranking metrics.
• Allow opt-in native explanation evidence reordering with a user-configured
  local checkpoint; cache provenance includes the weights hash. Without a
  checkpoint, the existing extractive evidence ordering is unchanged.
• Add synthetic training/holdout fixtures and regression tests for malformed
  checkpoints, citation stability, and spoofed evidence delimiters.

Added

• Introduce an opt-in built-in ai.provider = "native" evidence digest for
  repodna explain: offline, keyless, no external model runtime, and explicitly
  labeled as extractive rather than trained generative AI.
• Document the development and evaluation plan for a learned native model.

Added

• Export filtered findings as a standalone Markdown review with evidence,
  limitations, suppression context, and suggested follow-up steps. Escape
  repository-supplied Markdown/HTML and preserve the selected display order.

Fixed

• Ignore corrupted or incomplete recent-analysis entries recovered from browser
  storage while retaining valid locally saved analyses.

• Reject unsafe, duplicate or mixed-root paths in browser folder imports, including
  files returned in separate drag-and-drop reader batches. Add regression coverage
  for traversal, malformed paths and normal folder imports.

Added

• Export the current filtered Findings as structured JSON alongside spreadsheet-safe CSV.
  The JSON includes all matching findings, including results beyond the visible page,
  and preserves their full evidence for scripting and review without uploading data.

Tests

• Cover JSON findings export fidelity, nested evidence, empty results, and the web
  interface's enabled/disabled export controls.

Downloads

• repodna-1.4.4-<target>: the repodna command line, with the web interface of
  repodna serve built in. The Linux builds are static and run on any distribution.
• repodna-1.4.4-wasm32-wasip1.zip: RepoDNA's analysis, reports, and cards as
  WebAssembly, the program the web version runs, for WASI runtimes:
  wasmtime run --dir .::/my-project repodna.wasm analyze /my-project (without Git
  history).
• RepoDNA_1.4.4_amd64.deb, RepoDNA-1.4.4-1.x86_64.rpm,
  RepoDNA_1.4.4_universal.dmg, RepoDNA_1.4.4_x64_en-US.msi,
  RepoDNA_1.4.4_x64-setup.exe, and for Windows on Arm
  RepoDNA_1.4.4_arm64_en-US.msi and RepoDNA_1.4.4_arm64-setup.exe: the
  desktop app.
• ghcr.io/sanskarin/repodna:1.4.4: a container image with the command line and
  Git, for CI jobs: docker run --rm -v "$PWD:/work" ghcr.io/sanskarin/repodna analyze .
• ghcr.io/sanskarin/repodna-web:1.4.4: the web interface, served on port 8080, for
  your own network: docker run --rm -p 8080:8080 ghcr.io/sanskarin/repodna-web
• npm packages on npmjs.com and GitHub Packages: npm install --global @sanskarin/repodna
  installs the command line, with one package per platform;
  npx @sanskarin/repodna-web runs the web interface on this machine;
  npx @sanskarin/repodna-wasm analyze . analyzes with the WebAssembly program, on any
  system Node.js runs on, and runs it in browsers too;
  @sanskarin/repodna-schema and @sanskarin/repodna-visualization are the TypeScript
  libraries.
• repodna-1.4.4-winget-manifests.zip: WinGet community manifests for
  the Windows desktop app (Sanskar.RepoDNA) and CLI (Sanskar.RepoDNA.CLI).
  After Microsoft accepts the manifests, install and upgrade through winget.
• SHA256SUMS.txt: checksums of every file.
• Web version: https://sanskarin.github.io/RepoDNA/ — analyze a folder or an archive, or open analyses and the demo, in your browser: nothing to install, nothing uploaded.

The binaries are not code-signed, so macOS and Windows ask for confirmation the first time they start; see the installation guide.

More open-source projects by Sanskar, the creator of RepoDNA: https://sanskarin.github.io