repowiseget_risk
Modification-risk assessment for files before editing, covering hotspot scores, dependents, co-change partners, blast radius, recommended reviewers, test gaps, and security signals.
Before changing a file, your agent should know what it's walking
into. get_risk rolls up churn, complexity, dependents, hidden
coupling (co-changes), ownership, test coverage, and security signals
into a single per-file profile, plus an optional PR-style blast-radius
analysis when you pass a changed_files list.
When to call
- Before editing any file the agent doesn't already understand.
- PR review: pass
changed_filesto get the transitive impact surface, missing co-change partners, and recommended reviewers. - Architectural planning: surface bus-factor risks and coupling hotspots ahead of time.
Parameters
| Parameter | Type | Description |
|---|---|---|
targetsrequired | string[] | File paths to assess. |
repo | string | Repository alias. Usually omitted. |
changed_files | string[] | When provided, triggers PR blast-radius analysis: transitive affected files, co-change warnings, recommended reviewers, and an overall_risk_score of 0 to 10. |
Returns
targets is keyed by file path. Each entry contains:
| Field | Meaning |
|---|---|
hotspot_score | 0 to 1 churn percentile (higher = changed more often) |
trend | "increasing", "decreasing", or "stable" (30d vs 60d rate) |
risk_type | "churn-heavy", "bug-prone", "high-coupling", "bus-factor-risk", or "stable" |
dependents_count | Number of files importing this one |
co_change_partners | Top 5 co-changed files with date and import-link flag |
primary_owner, owner_pct | Historical owner |
recent_owner, recent_owner_pct | Active maintainer if different |
bus_factor | How many people could disappear before the file becomes unowned |
contributor_count | Total contributors |
change_pattern | "feature-active", "fix-heavy", "primarily refactored", "dependency-churn", or "mixed-activity" |
change_magnitude | lines_added_90d, lines_deleted_90d, avg_commit_size |
impact_surface | Top 3 critical modules that depend on this file (PageRank-ranked) |
defect_profile | (only on files with counted bug fixes) fix_count, last_fix_days_ago, bug_magnet flag, and up to 3 top_symbols most often touched by those fixes |
test_gap | true if coverage data doesn't prove a test exercises this file, and no test file matches its basename |
security_signals | kind, severity, snippet from static analysis |
episodes | (only when at least one exists) count of dated episode records bound to this target; get_why serves the bodies. A directory target aggregates everything beneath it |
risk_summary | One-line human summary |
Top-level extras:
global_hotspots: top 5 hotspot files in the repo (excluding targets).pr_blast_radius(only ifchanged_filesprovided):direct_risks,transitive_affected,cochange_warnings,recommended_reviewers,test_gaps,overall_risk_score.
PR mode: read directive first
When changed_files is passed, the response leads with a directive
block. This is the block a PR-reviewing agent is told to read before
anything else in the response:
| Field | Meaning |
|---|---|
will_break | Production files that depend on the diff and are likely to break |
will_break_tests | Test files impacted the same way, kept separate so a burst of broken tests doesn't crowd out production impact |
missing_cochanges | Historical co-changers absent from the diff |
missing_tests | Changed files without test coverage |
tests_to_run | The positive complement of missing_tests: pytest-runnable ids the per-test coverage map proves execute the changed files. Empty until a coverage map is ingested with repowise coverage add |
In workspace mode, the same directive also carries the changed repo's
cross-repo fallout: will_break_consumers (services in other repos that
structurally depend on this one), missing_cross_repo_cochanges,
breaking_changes (incompatible provider-contract changes and the
consumers they endanger), conformance_violations (declared
dependency-rule breaches), and dependency_cycles.
directive is the block to act on. Everything else in the response
ranks and describes; directive recommends. Read it before
pr_blast_radius or any of the per-target fields.
Example
get_risk(["src/auth/service.py"])
get_risk(
targets=["src/payments/api.py", "src/payments/db.py"],
changed_files=["src/payments/api.py", "src/payments/db.py"],
)Things worth knowing
- Risk type classification (priority order):
bug-proneif the file is flaggedbug_magnetor has 3+ counted bug fixes in the fix history (not a keyword scan over commit messages);churn-heavyif churn percentile ≥ 0.7;bus-factor-riskifbus_factor == 1, >20 commits, and the repo isn't a small team unless the file is itself a hotspot;high-couplingif ≥5 dependents. - Change pattern is the dominant commit category at ≥50%, else
mixed-activity. - Test gap detection checks ingested coverage data first: if a
coverage report proves a test exercises the file, it's not a gap. Only
when there's no coverage proof does it fall back to a filename
heuristic, looking for
test_*.py,*_test.py, or*.spec.*matching the file's basename. Test files themselves are never reported as having a test gap. - PR blast radius walks the import graph up to depth 3.
Recommended reviewers are the top-5 owners of affected files.
cochange_warningsflag missing historical co-change partners not in the PR. - Cross-repo impact (workspace mode): co-change partners and
contract links from other repos contribute to
dependents_count.
A high hotspot_score plus bus_factor: 1 plus test_gap: true is
the danger triangle. Don't ship a refactor of that file without pulling
the primary owner into review.
search_codebase
Hybrid code search over repowise's indexes: symbols, file paths, or the wiki, depending on the shape of the query. One tool instead of a fallback to Grep for identifiers.
get_change_risk
Pre-merge defect risk for a whole commit or diff range, scored from the shape of the live diff, plus the tests that actually cover the changed lines and whether those files have been bug-fixed before.