view release on metacpan or  search on metacpan

Changes  view on Meta::CPAN

Revision history for Cavil::CLI

0.03   2026-09-08
        - Repurposed from a code-search / plagiarism client into a legal-review client. "check" now uploads the
          project's working tree to Cavil, waits for the standard legal review (unpack, index, analyze), and
          reports its licensing risk; the code-search "baseline" command, local fingerprinting and result cache
          are gone, along with their Cavil::Matcher, Mojo::SQLite, Text::Glob and Cpanel::JSON::XS dependencies.
        - The uploaded archive is the working tree as it sits on disk, including installed vendored dependencies
          (node_modules and the like) that .gitignore usually hides but a full legal review must cover; only .git
          and explicit excludes are dropped. Use --respect-gitignore for the leaner case, --exclude-path or a
          .cavilignore file to drop more.
        - The CI gate is the report's licensing risk: --fail-on-risk defaults to the instance's acceptable risk
          plus one, so a project the instance would accept passes without any per-project configuration. --sbom
          and --notice download the SPDX SBOM and NOTICE attribution file.

0.02   2026-08-31
        - Removed --token, and --url is now accepted only by "config". A token passed as an argument is
          world-readable in ps output and stays in shell history, and once the token can only come from the
          saved config or CAVIL_API_KEY, --url elsewhere would have aimed that token at a different server.
          Server and token are now resolved together from one source, never mixed, for the same reason.
        - New "baseline" command: record a tree's current matches as accepted in a committed
          .cavil-baseline.json, so later checks report only what is not in it. Most projects carry some copies
          they have already decided about, and repeating them every run is how the report stops being read.
          Entries are pinned to the file's content and to what it matched (so an edit brings the finding back),
          never hide a risk higher than the one accepted, and are still counted in the tally and named in a
          footer. Use --no-baseline to report everything, or --baseline to point at another file.
        - The default risk gate is now 4 (strong copyleft) rather than 5. Risk 4 is where reciprocity applies
          to the derivative work, so code absorbed at that level obliges the codebase around it; at the old
          default a copied GPL function passed the gate as a mere note. Projects that already ship copyleft
          can restore the previous behaviour with "--fail-on-risk 5".

0.01   2026-08-29
        - First release: a command-line client for Cavil that checks whether the code in a git change set or a
          directory already exists in what Cavil has indexed (open source and commercial), reporting its
          license and risk for a developer's laptop or CI.