Changelog
One line per change, newest on top: YYYY-MM-DD — what was done.
2026-10-24 — guidance.own takes patterns: some of a repository’s own guidance files, and no other — for guidance written for another job (developers’ process) than the one agents do through the server
2026-10-24 — the docs site moved to https://rrm.pipelab.dev (short, like swm and dtk); the old repo-reader.pipelab.dev answers 301 there, keeping the path — 0.1.0’s PyPI metadata points at it
2026-10-24 — the site’s landing page on the pattern of detectkit’s: a hero with a real agent-and-server exchange, sections showing what the tools actually print (history, search, mirrors and groups, safety, guidance, clients), “what it is — and isn’t”; light and dark; made-up data only; milestone 5 done
2026-10-24 — 0.1.0, the first release: the package on PyPI (uvx repo-reader-mcp, pip install repo-reader-mcp), published by trusted publishing from the publish workflow on a tag v* (tests run first, the tag must name the version); the guide installs it with uvx; README links absolute for PyPI
2026-10-24 — the third refuting review’s findings closed (search and secrets): a regex could read a secret out a character at a time — a line holding a hidden value now never matches a regex, a plain text only clear of it, the answer as git would have given it without the dropped lines; log by message the same; keys on one line, in diffs and Redis-style URL passwords hidden; a marker in code no longer hides what follows; credential files and log no longer walk whole trees and histories; more credential names; answers kept within their limit; milestone 4 done
2026-10-24 — secrets found in files hidden in every answer and error (providers’ token formats, URL passwords, private keys — a block whole where the file is at hand —, values of settings named for secrets, passwords in prose), the count said; a guessed secret can’t be confirmed by search, grep or a log by message; files named for credentials (.env, *.pem, id_rsa, …) never served nor fetched unless serve_credential_files: true
2026-10-24 — search across repositories (default branches) and grep in one at any ref, with context or files only: git grep given the served files by name, so nothing include / exclude keep out is ever searched; 0.2–0.4 s over 18 real repositories; real Claude Code answered a cross-repository question with it
2026-10-24 — the docs site is live at https://repo-reader.pipelab.dev (pipelab’s repo-reader-web), redeployed on every push to main; milestone 3 done
2026-10-24 — missing contents of a partial clone recognised as newer git (2.44+, CI’s) reports them
2026-10-24 — the docs site: website/ (Astro + Starlight) built from docs/ and the changelog — every page of the guide on it, held by a test; an nginx image pushed to GHCR by the website workflow, which asks pipelab to redeploy
2026-10-24 — groups leave forks out unless forks: true; two repositories of a group sharing a name (GitLab’s subgroups) are both served, named by their path below the owner
2026-10-24 — groups of repositories (github: owner/pattern, gitlab: group/**/pattern, skip, host) listed by the host’s API before every sync — new ones join, archived ones leave, the last listing kept on disk; Streamable HTTP (--http, stateless, JSON answers) behind a bearer token or a gateway; links to the host’s pages in answers (GitHub, GitLab, Bitbucket, links:); a second refuting review’s 10 findings closed; 236 tests, 59 protections each failing its test when removed; real Claude Code and the MCP Inspector answering over HTTP through an 18-repository public GitHub group; the guide’s groups section and team page; milestone 2 done
2026-10-24 — remote repositories mirrored from any git URL: bare partial clones in the server’s cache folder, a token by variable name in git’s environment only (to its host only, no redirect followed), a sync at start and every mirrors.every_minutes that follows force-pushes, refs to narrow what is kept, contents fetched only for served paths (on purpose before a tool needs an older one), blame following renames as far as served files allow, --sync; every reading command pinned off the network whatever the machine’s git configuration says, no attributes or mailmap read from a commit, no hooks; a mirror per configuration; a refuting review’s 11 findings closed (one a diff leak since milestone 1); 187 tests, 33 protections each failing its test when removed; real Claude Code answering through a mirrored public GitHub repository; the guide’s remote-repositories page
2026-10-24 — commit dates shown the same whatever git’s version (newer git writes UTC as Z; CI caught it)
2026-10-24 — repositories’ guidance for agents: AGENTS.md / CLAUDE.md / .claude/rules / .cursor/rules / skills found on the default branch, text and files from the configuration, from another repository, listed: false; every answer about a repository says it has guidance (MCP keeps no session), short scoped rules ride with answers about their paths; read_guidance; --check lists it and warns; a history leaves out commits that changed only what is not served; real Claude Code followed guidance it could not have guessed; milestone 1 done
2026-10-24 — milestone 1’s reading: the YAML configuration and its check (--check), eight read-only tools over local repositories (list_repos, list_refs, read_file, list_files, log, show_commit, diff, blame), include / exclude, every git output capped; 108 tests on made-up repositories, every protection failing its test when removed; a refuting review (blame’s ignore-revs file closed); real Claude Code answering over stdio; the guide’s tools, configuration, safety and getting-started pages; remote repositories now milestone 2, groups planned
2026-10-24 — ready to start: the guide’s rule with a test (every tool in docs/reference/tools.md), /close checks the guide; the site moved to milestone 2; the hosting (pipelab) and where a company’s requirements come from written in CLAUDE.md; context and parallel-work rules
2026-10-24 — docs/ is the public documentation’s source (a site to come, Astro + Starlight like detectkit’s, hosted through pipelab); design, plan, decisions, research moved to dev/
2026-10-24 — groundwork: the repository, README, design, plan, decisions, research, the session flow; a skeleton server (stdio, about) with tests, ruff and CI