feat(#196): expand fix/verify capabilities — multi-language formatters, cascade callers, secrets scanning

CLAUDE.md

@@ -38,14 +38,14 @@ All via `repomap <subcommand> [--project <path>]`.
 | `impact --files <f...> --with-symbols` | Pre-edit blast radius + edit planning; `--compact` concise; `--top-n <N>` |
 | `call-chain --symbol <name>`           | Caller/callee context + references                                       |
 | `affected --files <f...>`              | CI test discovery: which test files are affected by source changes        |
-| `verify [--quick] [--no-diff]`         | Post-edit evidence gate + orphan symbols + graph diff; `--risk-threshold HIGH\|MED\|LOW` |
+| `verify [--quick] [--no-diff]`         | Post-edit evidence gate + orphan symbols + graph diff + cascade callers + secrets scan; `--risk-threshold HIGH\|MED\|LOW`; `--no-cascade`; `--no-secrets` |
 | `check`                                | Compiler/type/lint diagnostics                                           |
 | `routes [--with-consumers]`             | HTTP/API route inventory + consumer mapping                              |
 | `cache save`                           | Graph baseline save for diff comparison (auto-prunes stale sessions)      |
 | `cache prune`                          | Manually remove stale session caches (`--ttl-days N`)                     |
 | `lsp setup`                            | Auto-install LSP servers for detected languages                          |
 | `doctor [--no-lsp]`                    | Validate runtime + LSP status (default)                                  |
-| `fix [--dry-run]`                      | Auto-fix: ruff --fix + eslint --fix                                      |
+| `fix [--dry-run]`                      | Auto-fix: multi-language formatters (ruff, biome, prettier, eslint, gofmt, cargo fmt) with nearest-wins config detection |
 | `ready`                                | Pre-commit readiness check (verify + check + format)                     |
 
 ```bash

README.md

@@ -10,8 +10,8 @@
 
 - **Where to start**: `overview`, `query` (synonym expansion), `routes`
 - **What will break**: `impact` (incl. type-level), `call-chain` (incl. references)
-- **What was missed**: `verify` (contract risk + missed-files + orphan symbols), `check`
-- **Auto-fix & ready**: `fix` (ruff + eslint auto-fix), `ready` (pre-commit check)
+- **What was missed**: `verify` (contract risk + missed-files + orphan symbols + cascade callers + secrets scan), `check`
+- **Auto-fix & ready**: `fix` (multi-language formatters: ruff, biome, prettier, eslint, gofmt, cargo fmt), `ready` (pre-commit check)
 - **Encoding auto-detect**: UTF-8 → GBK → GB2312 fallback for legacy projects
 - **Adaptive search**: never returns empty — keyword expansion → hotspot fallback
 
@@ -111,13 +111,13 @@ LSP-backed commands automatically use local LSP servers when available. All comm
 | `affected --files <f...>` | Discover tests affected by source changes; `--stdin` for pipe mode; `--filter` for custom pattern |
 | `call-chain --symbol <name>` | Callers, callees, and references with configurable depth; `--direction`; `--json` |
 | `routes [--json] [--with-consumers]` | HTTP/API route inventory (FastAPI, Express, Axum, Spring Boot) |
-| `verify [--quick] [--no-diff]` | Post-edit evidence gate: git changes, risk, diagnostics, orphan symbols, graph diff; `--risk-threshold HIGH\|MED\|LOW` |
+| `verify [--quick] [--no-diff]` | Post-edit evidence gate: git changes, risk, diagnostics, orphan symbols, graph diff, cascade callers, secrets scan; `--risk-threshold HIGH\|MED\|LOW`; `--no-cascade`; `--no-secrets` |
 | `check` | Compiler/type/lint diagnostics (tsc, pyright, ruff, cargo check, go vet) |
 | `cache save` | Graph baseline save for diff comparison (auto-prunes stale sessions) |
 | `cache prune` | Manually remove stale session caches (`--ttl-days N`) |
 | `doctor [--no-lsp]` | Health check: parsers, runtime, LSP status (default) |
 | `lsp setup [--dry-run]` | Auto-install missing LSP servers for detected languages |
-| `fix [--dry-run]` | Auto-fix: ruff --fix + eslint --fix |
+| `fix [--dry-run]` | Auto-fix: multi-language formatters (ruff, biome, prettier, eslint, gofmt, cargo fmt) with config-gated nearest-wins detection |
 | `ready` | Pre-commit readiness: verify + check + format in one command |
 
 ---
@@ -146,7 +146,7 @@ repomap check                                         # compiler diagnostics
 
 ## Origin
 
-`repomap`'s core idea comes from **[aider](https://github.com/Aider-AI/aider)** — tree-sitter + PageRank for coding-agent codebase awareness. LSP integration patterns draw from **[serena](https://github.com/oraios/serena)**, including server auto-detection, search result formatting, and hierarchical symbol indexing.
+`repomap`'s core idea comes from **[aider](https://github.com/Aider-AI/aider)** — tree-sitter + PageRank for coding-agent codebase awareness. LSP integration patterns draw from **[serena](https://github.com/oraios/serena)**, including server auto-detection, search result formatting, and hierarchical symbol indexing. Multi-language formatter dispatch and secrets scanning patterns draw from **[pi-lens](https://github.com/apmantza/pi-lens)**, a TypeScript extension pack for pi coding agent.
 
 ---
 

README.zh-CN.md

@@ -10,8 +10,8 @@
 
 - **从哪里开始**：`overview`、`query`（同义词扩展）、`routes`
 - **什么会被破坏**：`impact`（含类型级）、`call-chain`（含引用信息）
-- **遗漏了什么**：`verify`（合约风险 + 漏改检测 + 孤儿符号）、`check`
-- **自动修复与就绪检查**：`fix`（ruff + eslint 自动修复）、`ready`（提交前检查）
+- **遗漏了什么**：`verify`（合约风险 + 漏改检测 + 孤儿符号 + 级联调用方 + 密钥扫描）、`check`
+- **自动修复与就绪检查**：`fix`（多语言格式化：ruff、biome、prettier、eslint、gofmt、cargo fmt）、`ready`（提交前检查）
 - **编码自动检测**：UTF-8 → GBK → GB2312 回退，消除老项目扫描盲区
 - **自适应搜索**：永不返回空结果 — 关键词扩展 → 热点兜底
 
@@ -111,8 +111,8 @@ repomap lsp setup --project .             # 安装缺失的服务器
 | `affected --files <文件...>` | 发现受源代码变更影响的测试；`--stdin` 管道模式；`--filter` 自定义模式 |
 | `call-chain --symbol <名称>` | 调用者、被调用者和引用，支持配置深度；`--direction`；`--json` |
 | `routes [--json] [--with-consumers]` | HTTP/API 路由清单（FastAPI、Express、Axum、Spring Boot） |
-| `verify [--quick] [--no-diff]` | 编辑后证据门：git 变更、风险、诊断、孤儿符号、图差异；`--risk-threshold HIGH\|MED\|LOW` |
-| `fix [--dry-run]` | 自动修复：ruff --fix + eslint --fix |
+| `verify [--quick] [--no-diff]` | 编辑后证据门：git 变更、风险、诊断、孤儿符号、图差异、级联调用方、密钥扫描；`--risk-threshold HIGH\|MED\|LOW`；`--no-cascade`；`--no-secrets` |
+| `fix [--dry-run]` | 自动修复：多语言格式化工具（ruff、biome、prettier、eslint、gofmt、cargo fmt），基于配置就近检测 |
 | `ready` | 提交就绪检查：verify + check + format 一键执行 |
 | `check` | 编译器/类型/lint 诊断（tsc、pyright、ruff、cargo check、go vet） |
 | `cache save` | 图基线保存（用于 diff 对比，自动清理陈旧 session） |
@@ -146,7 +146,7 @@ repomap check                                         # 编译器诊断
 
 ## 起源
 
-`repomap` 的核心思想来自 **[aider](https://github.com/Aider-AI/aider)**——用 tree-sitter + PageRank 为编程代理提供代码库感知。LSP 集成借鉴了 **[serena](https://github.com/oraios/serena)** 的服务器自动检测、搜索结果格式和分级符号索引。
+`repomap` 的核心思想来自 **[aider](https://github.com/Aider-AI/aider)**——用 tree-sitter + PageRank 为编程代理提供代码库感知。LSP 集成借鉴了 **[serena](https://github.com/oraios/serena)** 的服务器自动检测、搜索结果格式和分级符号索引。多语言格式化分发和密钥扫描借鉴了 **[pi-lens](https://github.com/apmantza/pi-lens)**，一个面向 pi 编程代理的 TypeScript 扩展包。
 
 ---
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "repomap-cli"
-version = "4.9.0"
+version = "4.10.0"
 description = "Standalone RepoMap CLI with tree-sitter AST parsing"
 requires-python = ">=3.12"
 dependencies = [

skills/repomap/SKILL.md

@@ -35,10 +35,10 @@ repomap <command> [--project <path>] [options]
 | Read a file | `query --file <path>` | Symbols, signatures, callers, LSP tree |
 | Impact analysis | `impact --files <f...> --with-symbols` | Blast radius, suggested tests; `--compact` for concise output; `--top-n <N>` to limit files |
 | Discover affected tests | `affected --files <f...>` | Reverse dependency tracing from changed files; `--stdin` for pipe mode, `--filter` for custom pattern |
-| Post-edit verify | `verify` | Git changes, risk, diagnostics, orphan symbols, graph diff; `--risk-threshold HIGH\|MED\|LOW` |
+| Post-edit verify | `verify` | Git changes, risk, diagnostics, orphan symbols, graph diff, cascade callers, secrets scan; `--risk-threshold HIGH\|MED\|LOW`; `--no-cascade`; `--no-secrets` |
 | Quick check | `verify --quick` | Git changes + risk only |
 | Lint diagnostics | `check` | Compiler/lint errors |
-| Auto-fix | `fix` | ruff --fix, eslint --fix |
+| Auto-fix | `fix` | Multi-language formatters (ruff, biome, prettier, eslint, gofmt, cargo fmt) with config-gated nearest-wins detection |
 | Pre-commit | `ready` | verify + check + format |
 | API routes | `routes` | HTTP route inventory |
 | Prepare for changes | `cache save` | Baseline snapshot for verify diff comparison; auto-prunes session caches older than 7 days |
@@ -47,7 +47,7 @@ repomap <command> [--project <path>] [options]
 
 ## Value-Added Features (Auto-Enabled)
 
-- **verify** — high-confidence orphan symbols (≥70), call-graph consistency check (broken call/import edges), and graph diff (when baseline exists)
+- **verify** — high-confidence orphan symbols (≥70), call-graph consistency check (broken call/import edges), graph diff (when baseline exists), cascade caller analysis (≤2 hop, top-10), and secrets scanning (gitleaks → detect-secrets → builtin)
 - **query --symbol** — state map for enum/const symbols and references
 - **call-chain** — all references
 - **overview** — hotspot files

src/cli/cli.py

@@ -283,6 +283,24 @@ def build_parser() -> argparse.ArgumentParser:
         default="MED",
         help="Minimum contract risk level to display (default: MED).",
     )
+    verify_parser.add_argument(
+        "--no-cascade",
+        action="store_true",
+        default=False,
+        help="Skip cascade impact analysis (caller chain).",
+    )
+    verify_parser.add_argument(
+        "--cascade-depth",
+        type=int,
+        default=2,
+        help="Maximum cascade traversal depth (default: 2, range: 1-5).",
+    )
+    verify_parser.add_argument(
+        "--no-secrets",
+        action="store_true",
+        default=False,
+        help="Skip secrets/credentials scanning.",
+    )
 
     cache_parser = subparsers.add_parser(
         "cache", help="Prepare a graph baseline before the target edits."
@@ -612,6 +630,9 @@ def main(argv: Sequence[str] | None = None) -> int:
             incremental=not getattr(args, "no_incremental", False),
             max_chars=args.max_chars,
             risk_threshold=getattr(args, "risk_threshold", "MED"),
+            no_cascade=getattr(args, "no_cascade", False),
+            cascade_depth=getattr(args, "cascade_depth", 2),
+            no_secrets=getattr(args, "no_secrets", False),
         )
     if command == "cache":
         return run_cache(