DiffScope

DiffScope turns a public GitHub pull request URL or a pasted unified Git diff into a concise, actionable impact report. It is designed to answer four review questions quickly:

1. What changed?
2. Which parts of the system are affected?
3. What is most likely to break?
4. What should be tested before merging?

The screenshot above is a real capture of the local production build at a 1440px viewport.

• Accepts only canonical public pull request URLs: https://github.com/{owner}/{repo}/pull/{number}.
• Accepts pasted unified diffs.
• Fetches pull-request file metadata through the GitHub REST API; it never acts as a general server-side URL fetcher.
• Classifies files as frontend, backend, database, tests, configuration, documentation, dependencies, or unknown.
• Produces a deterministic 0-100 risk score with visible contributing factors.
• Lists likely breakpoints and a prioritized test checklist.
• Keeps the current input and report visible when a provider request fails.
• Exports a completed report as reusable Markdown.
• Includes three built-in sample diffs for checkout, authentication middleware, and Prisma schema changes.

Browser UI
  -> POST /api/analyze
       -> Zod input validation and size bounds
       -> pasted diff parser OR fixed GitHub REST pull-files client
       -> file classification + deterministic risk scoring
       -> normalized impact report
       -> optional AI explanation of normalized data only
  -> interactive report + Markdown export

The core parsing, classification, scoring, report normalization, and Markdown export modules are independent of React and network calls. Route handlers own external access and secrets; focused React components own input, loading, error, report, checklist, and export state.

Requirements: Node.js 20+ and npm.

Copy-Item .env.example .env.local
npm.cmd install
npm.cmd run dev

Open http://localhost:3000. In PowerShell on this machine, use npm.cmd because the npm.ps1 shim is blocked by execution policy.

All variables are optional.

Do not prefix any of these with NEXT_PUBLIC_; they are read on the server only.

The base report is deterministic. The score is the sum of matching factors, capped at 100.

Scores are shown as low below 30, moderate from 30 through 69, and high from 70 onward. Each displayed score includes its contributing factors, so it can be challenged during review instead of being treated as opaque automation.

• DiffScope does not persist reports, pasted diffs, or credentials in an application database.
• Pasted diff text is processed by the server for the request; keep that in mind when using a shared deployment.
• For a GitHub URL, the server calls only the fixed api.github.com/repos/{owner}/{repo}/pulls/{number}/files endpoint after strict URL validation.
• Optional AI enrichment receives bounded normalized fields such as file paths, statuses, categories, line counts, score factors, and checklist context. It never receives raw diff text or patches.
• File names and normalized metadata can still be sensitive. Leave OPENAI_API_KEY unset if no external model provider should receive that data.
• GitHub may rate limit anonymous requests. The UI preserves your input and reports a safe retry state when that happens.

npm.cmd test
npm.cmd run lint
npm.cmd run typecheck
npm.cmd run build

The unit suite covers URL validation, unified-diff parsing, classification, deterministic scoring, report generation, Markdown export, GitHub pagination and error mapping, optional AI normalization/validation, route responses, samples, and the client request adapter. GitHub and AI calls are mocked in tests.

1. Start the app and choose Paste diff, or enter a public GitHub pull request URL.
2. For a fast walkthrough, choose Add subscription billing from the built-in samples.
3. Select Analyze change.
4. Read the summary, category distribution, risk factors, likely breakpoints, and prioritized checklist.
5. Check off the review tasks you complete, then choose Export Markdown to download the report.

This MVP intentionally supports public GitHub pull requests and pasted unified diffs only. It does not include authentication, private repository access, billing, multi-tenancy, a database, background jobs, or generic URL fetching.