feat: greptile-style review, pre-commit suggestions, rule engine fix

[ojowwalker77]

Summary

• Enhanced /matrix:review with Greptile-style output format (confidence scores, per-file analysis)
• Pre-commit review suggestions for git/jj commits (non-blocking)
• Fixed rule engine integration missing from edit/read/prompt hooks
• Deep research now saves to session directory instead of Downloads

Key Changes

• Greptile-style review: Confidence score (1-5), Important Files table, detailed file analysis
• Pre-commit hook: Detects git commit and jj commit/describe/new, suggests running review first
• Rule engine fix: User-defined rules now evaluated in PreToolUse:Edit, PreToolUse:Read, UserPromptSubmit
• Deep research path: $CLAUDE_SESSION_DIR with fallback to current directory

Test plan

• Run /matrix:review staged and verify Greptile-style output format
• Run git commit and verify suggestion message appears
• Run jj commit and verify jj detection works
• Add a user rule and verify it's evaluated in edit/read/prompt hooks
• Run /matrix:deep-research and verify output location

[github-actions]

Version files synced to 2.0.1 from CHANGELOG.md

[greptile-apps]

Greptile Overview

Greptile Summary

Adds Greptile-style review output format with confidence scores and per-file analysis tables to /matrix:review. Implements pre-commit hook that suggests running reviews before git/jj commits. Fixes rule engine integration that was previously missing from edit, read, and prompt hooks—user-defined rules now properly evaluate across all hook points.

Confidence Score: 2/5

• Has an important logic bug in pre-commit detection that bypasses security-critical package auditing
• The pre-commit review feature exits the hook early (line 314) before reaching package audit checks. This means if a user runs a command like npm install package && git commit -m "message", the commit detection triggers first and prevents the CVE/vulnerability scanning from running. Package auditing is security-critical and should not be bypassed by non-blocking suggestions. The rest of the changes are well-implemented (rule engine integration, config updates, documentation).
• src/hooks/pre-tool-bash.ts (logic bug causes security feature bypass)

Important Files Changed

File Analysis

Filename	Score	Overview
src/hooks/pre-tool-bash.ts	2/5	Adds pre-commit review suggestion and rule engine integration; potential issue with early exit preventing package audits when commit detected
src/hooks/pre-tool-edit.ts	4/5	Adds rule engine evaluation before cursed file checks; clean integration with proper ordering
src/hooks/pre-tool-read.ts	4/5	Adds rule engine evaluation before sensitive file detection; correct implementation with early exit handling
src/hooks/user-prompt-submit.ts	4/5	Adds rule engine evaluation at STEP 0 before prompt analysis; properly integrated with existing flow
src/config/index.ts	5/5	Adds gitCommitReview config with enabled flag and depth setting; clean type definitions and defaults

Sequence Diagram

sequenceDiagram
    participant User
    participant Claude
    participant PreToolBash as PreToolUse:Bash Hook
    participant RuleEngine
    participant CommitDetector as Commit Detector
    participant PackageAuditor as Package Auditor

    User->>Claude: Run command (e.g., "npm install pkg && git commit")
    Claude->>PreToolBash: Intercept Bash tool
    
    PreToolBash->>RuleEngine: STEP 1: Evaluate user rules
    alt Rules block command
        RuleEngine-->>PreToolBash: Blocked
        PreToolBash-->>Claude: Deny execution
        Claude-->>User: Show block message
    else Rules allow command
        RuleEngine-->>PreToolBash: Allowed/Warned
        
        PreToolBash->>CommitDetector: STEP 2: Check for commit command
        alt Is commit command
            CommitDetector-->>PreToolBash: Commit detected
            PreToolBash-->>Claude: Suggest review (exit 0)
            Claude-->>User: Show review suggestion
            Note over PackageAuditor: ❌ STEP 3 never reached<br/>Package audit bypassed
        else Not commit command
            CommitDetector-->>PreToolBash: Not a commit
            
            PreToolBash->>PackageAuditor: STEP 3: Check for packages
            alt Has packages to audit
                PackageAuditor-->>PreToolBash: Critical CVEs found
                PreToolBash-->>Claude: Ask user permission
                Claude-->>User: Show security warning
            else No packages
                PackageAuditor-->>PreToolBash: Nothing to audit
                PreToolBash-->>Claude: Allow execution
                Claude-->>User: Execute command
            end
        end
    end

Loading

[greptile-apps]

_{1 file reviewed, 1 comment}

_{Edit Code Review Agent Settings | Greptile}