Metadata-Version: 2.4
Name: reprokit
Version: 0.2.1
Summary: Executable minimal reproduction capsule builder
Author: Viraj Sabhaya
License-Expression: Apache-2.0
Project-URL: Homepage, https://github.com/virajsabhaya23/reprokit
Project-URL: Repository, https://github.com/virajsabhaya23/reprokit
Project-URL: Issues, https://github.com/virajsabhaya23/reprokit/issues
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# ReproKit

**Executable minimal reproduction builder for Python and Node.js projects.**

ReproKit starts from a project and a command that already fails. It repeatedly removes files, dependencies, and text while **executing the command after every accepted reduction**. The final `.repro` capsule is independently replayed and cryptographically checked before it is considered valid.

## Quick start

Python 3.10+; Node is needed only for Node fixtures/projects. Runtime dependencies: none.

```bash
python -m pip install https://github.com/virajsabhaya23/reprokit/releases/download/v0.2.0/reprokit-0.2.0-py3-none-any.whl

python -m reprokit reduce examples/demo_project \
  --command "python -S app.py" \
  --out out/demo.repro \
  --report out/report.json \
  --junit out/report.junit.xml
```

Verify independently:

```bash
python -m reprokit verify out/demo.repro
```

Run the 20-case benchmark:

```bash
python -m reprokit benchmark benchmark/corpus.json \
  --out-dir benchmark/out \
  --report benchmark/results.json
```

## What ReproKit implements

- exact failing-command capture;
- normalized deterministic failure signatures;
- lexical Python/Node reachability pre-pass;
- executable greedy file reduction;
- executable dependency-line reduction;
- executable chunk/line delta reduction;
- timeout handling;
- no-shell subprocess execution;
- environment/tool provenance capture;
- secret scanning that blocks unsafe exports by default;
- portable `.repro` ZIP format;
- SHA-256 file manifest + capsule hash;
- safe ZIP extraction/path traversal defense;
- independent replay verification;
- JSON and JUnit reports;
- deterministic Python/Node benchmark;
- GitHub Actions, Dockerfile, and devcontainer.

## Benchmark scope

`benchmark/corpus.json` contains 20 deterministic local reconstructions:
- 10 Python cases anchored to BugsInPy project families;
- 10 Node.js cases anchored to all ten BugsJS project families.

They validate reducer mechanics and failure preservation. They are **not represented as direct archived checkouts of 20 upstream bugs**.

## Security model

ReproKit:
- never invokes a shell;
- sanitizes the environment passed to the failing command;
- limits execution time;
- blocks capsule creation when common secret patterns are detected unless explicitly overridden;
- rejects path traversal when verifying a capsule.

A failing project is still untrusted code. Run third-party repositories inside a container/VM.

## Limitations

- v0.2 is file/text/dependency reduction, not language-AST minimization.
- Failure identity is normalized exit code + output digest; nondeterministic failures may need a future custom oracle plugin.
- The benchmark measures controlled local reduction, not maintainer acceptance rate or production adoption.
