Full AI review on pull requests, and contracts across more stacks

This cycle shipped on both sides at once. On repowise.dev, the PR bot learned to review a pull request with a model. The open-source release, 0.53.0, teaches workspaces to read the stacks most services are actually written in.

Full AI review on pull requests

On repowise.dev.

The bot settings page now opens on one question: what should the bot do on each pull request? There are three answers.

• Signals is the free bot you already had, every signal computed without a model.
• AI triage has a model read the findings the bot already computed and raise the ones worth a second look.
• Full AI review reads every line the change wrote, looks up the callers, importers and definitions around it across the repository, and writes its points. A second, separate pass checks each point against the lines it cites before anything is posted.

Signals stays free on public repositories. AI triage and Full AI review are part of Pro and are billed from credits, the same balance chat, docs and MCP use. Pro includes $5 of credits a month, about 50 full reviews. Choose a mode for each repository in PR Bot settings.

The pull request page names the pass that ran. For a full review it shows how many repository lookups it made, and it lists the points that were written but withheld, with the check that removed each one.

Each mode is priced per push from your repository's own volume, and the price never quotes above your monthly limit. AI spend this month sits beside the limit once a model is on. The per-signal thresholds became one sensitivity control (Quiet, Balanced, Thorough), and everything else moved under Advanced. Settings save one key at a time, so a change in the dashboard no longer overwrites what .repowise/bot.yaml sets.

Workspaces read more stacks

A workspace is only as useful as the contracts it can read, and outside Python and TypeScript servers it read most stacks one call at a time.

Laravel is read the way the framework serves it. Route groups keep their prefixes, resource and apiResource expand, and routes/api.php is served under /api unless the app says otherwise. On a five-service TypeScript and Laravel workspace, all 39 cross-service HTTP links now match exactly, against 7 before.

NestJS controllers are served under their global prefix, version and controller prefix. axios, ky, got and ofetch calls are read directly or through an instance created with a base URL, including one exported from another file. Angular HttpClient calls are read with the base folded in from the environment file the service imports. Tables are read from Prisma, TypeORM, Sequelize, Drizzle and Knex.

Queues, pub/sub and sockets used to link only when both ends spelled the same literal name. Laravel jobs, BullMQ, SQS and SNS, Redis, NATS, Kafka, RabbitMQ bindings, socket.io and Laravel broadcasting are read now, and two ends link only when they can share a broker.

The workspace pages open their evidence in place. A contract opens in a drawer with its consumers and the tests to run when it changes. A co-changing file pair shows each file's recent history and whether a contract explains the pair. On the System Map, blast radius, breaking changes, conformance and the cyclic core are one lens control that recolours the map. On repowise.dev, architecture rules, repo tags, aliases and contract matching are edited in workspace settings.

Performance plans claim only what they can back

A plan now says proven only when the loop itself shows that the rewrite returns what the loop returned. Filesystem and subprocess repetition, which has no batch operation to point at, moved to a new expected state instead of waiting in the queue as investigate. On the repowise repository itself, that moved 523 of 629 rows.

Two new markers see shapes the old detectors could not. lazy_load_in_loop flags an ORM relationship loaded once per row in SQLAlchemy and Django, and names the fix. unbounded_read_reduced_in_memory flags a query with no limit whose rows are then deduplicated in code.

PHP reads correctly

Grouped use imports expand per class, same-namespace references become edges, and Laravel, TYPO3 and Symfony entry points count as live. On laravel/framework, dead-code rows drop from 680 to 392, and graph build time from 3.4s to 2.4s.

Also in this release

• The Architecture page opens on a Files view that draws each strong link between communities as one band, and hovering a file draws its real imports and co-change partners.
• Pascal gains loop, performance and DUnit assertion coverage.
• A Rust impl block now has the visibility of the type it implements. Before, every impl in every Rust repository was recorded as private.
• import json no longer resolves to a repository's own json.py.
• The security scan finds AWS, GitHub, Slack, Google and Stripe credentials and PEM private keys by their shape, not only by the variable name they are assigned to. A stored snippet never keeps a credential value: a long value used to be cut before it was masked, which left its head in plain text.
• On repowise.dev, AI explanations on the docs pages are kept through a push and can refresh after each push, all under one quiet control instead of an amber warning.

Upgrading

pip install --upgrade repowise

Nothing needs re-indexing. The health analyzer version moved, so the first update re-scores the repository once, and the next repowise update --workspace re-extracts workspace contracts with the new readers.