repowiseComponents are the unit that health, hotspots, bus factor, test reach, dead
code and Change Records roll up to. Declare them in
.repowise/components.yaml or a repo-root catalog-info.yaml (Backstage
Component, System and Group entities). With no file, repowise derives
them from workspace services, then module pages, then top-level directories.
The file format is on
Configuration.
repowise components
repowise components check [--path PATH] [--format table|json]
repowise components list [--path PATH] [--format table|json]
repowise components ownership [--path PATH] [--format table|json]| Subcommand | What it does |
|---|---|
check | Validates components.yaml and catalog-info.yaml against the files git tracks. Exits 1 on any error, so it fits a CI step |
list | Declared and derived components with their file counts |
ownership | Compares declared owners (catalog spec.owner, CODEOWNERS for GitHub and GitLab, .repowise/teams.yaml) with the last 90 days of indexed commits |
ownership raises four findings: a high or critical component with no active
owner, an owner with no recent changes on its files, a bus factor of 1 on a
critical component, and a catalog entry that claims no files. An owner whose
identities never appear in the indexed history is unknown, not inactive.
Findings name components and teams; individual owners are counted, never
named.
The same data is served by get_context(targets=["component:<name>"]),
get_context(..., include=["ownership"]) and
get_overview(include=["components"]).
repowise packages
Where third-party packages are used: import sites, the component each sits in, its owner teams and reachability.
repowise packages where NAME [--path PATH] [--format text|json]
repowise packages export [--format cyclonedx] [-o FILE] [--path PATH]
repowise packages import FILE [--path PATH] [--format text|json]| Subcommand | What it does |
|---|---|
where | Files that import NAME (a package name or ecosystem:name), with the import line, component, owner teams and reachability |
export | Declared packages and their import sites as CycloneDX 1.6 JSON with evidence.occurrences from the import graph. It describes usage and is not an SBOM |
import | Joins a Syft, SPDX 2.x, CycloneDX or OSV JSON file you supply to the import sites, advisories first. Nothing is fetched |
repowise packages where requests
repowise packages where npm:lodash --format json
repowise packages export -o usage.cdx.json
repowise packages import osv-scan.jsonrepowise report inventory lists components with their packages; see
Change evidence.
repowise attribution
AI attribution for this repository. Every commit is labelled agent,
human_attested or unknown, and a commit with no marker is unknown, never
counted as human. Indexing reads public markers from local git history: bot
authors, message footers, trailers, git-ai notes and Agent Trace files. Every
AI share is reported as the agent share of commits with a known source, next
to that coverage, and is withheld below 30% coverage.
repowise attribution status [PATH] [--format table|json]
repowise attribution backfill [PATH] --agent claude-code,codex [--format table|json]
repowise attribution purge [PATH] [--yes]| Subcommand | What it does |
|---|---|
status | What is on, capture per agent, the effective, repo and user values, and the provenance coverage of indexed history |
backfill | Binds past commits to the edits recorded in this machine's Claude Code and Codex transcripts, keeping only line hashes. An edit binds to a commit made within 14 days after it. Later runs read only what was appended since |
purge | Deletes the labels in the index, the .repowise/attribution/ sidecar and the git-ai notes repowise wrote. Git history and notes written by anything else stay |
Edit capture is opt-in. With attribution.capture: local (or notes, which
also writes a git-ai v3 note on refs/notes/ai) in both the repo and the user
config, the Claude Code, Codex or Cursor edit hook records the lines the agent
wrote as content hashes, never prompts, code or identities, and
repowise update binds them to commits. init --yes never turns capture on,
and DO_NOT_TRACK keeps it off. attribution.enabled: false stores and shows
nothing about AI. The block is on
Configuration.
The first backfill reads every transcript these agents keep on the machine
(about 4 minutes for 7 GB on a laptop). When it binds new commits, the next
repowise update re-reads git history once to label them.