代码审计工具

Prerequisites

Required Flags

Getting Started

Deploy — audit a live server (read-only)

./repolens.sh --project /srv/myapp --agent claude --mode deploy --parallel --max-issues 5

Deploy — force live-server lenses even if Android files are present

./repolens.sh --project /srv/myapp --agent claude --mode deploy --deploy-target server

Remote deploy — audit a server from your workstation

./repolens.sh --project ~/myapp --agent claude --mode deploy \ --remote ubuntu@198.51.100.10 \ --remote-key ~/.ssh/server_deploy \ --remote-label "Production app server" \ --max-issues 1

Deploy — audit a remote server target over SSH

./repolens.sh --project /srv/myapp --agent claude --mode deploy --remote ubuntu@host.example.com:2222 --remote-key ~/.ssh/id_ed25519

Deploy — audit an Android APK target

./repolens.sh --project ~/my-app/app/build/outputs/apk/debug/app-debug.apk --agent claude --mode deploy

Deploy — audit an Android source tree when no APK is built yet

./repolens.sh --project ~/my-android-app --agent claude --mode deploy --deploy-target android

Remote deploy mode

Remote deploy mode lets you run deploy-mode server lenses from your workstation while inspecting a server over SSH. Use it only for server targets; it is rejected with --hosted and Android deploy targets.

Remote SSH runs with BatchMode=yes, so the connection must not require an interactive password prompt. Load the key before starting RepoLens, for example with ssh-add ~/.ssh/server_deploy, or pass an unlocked key with --remote-key <path>. RepoLens writes the remote preflight output for each run under logs/<run-id>/.remote/preflight.log.

Remote deploy uses OpenSSH ControlMaster so the run performs one TCP connection and authentication, then multiplexes agent SSH commands over the control socket. The master connection persists for 600 seconds after the last command, which reduces repeated authentication and connection setup during long deploy runs.

For the first run against a remote host, start with --max-issues 1 and avoid --parallel; if you do enable parallel execution, keep it to --parallel --max-parallel 1 until the transcript confirms commands are wrapped correctly and the target handles the SSH load. --max-issues 1 keeps the first pass short, and --max-parallel 1 prevents several lenses from competing for the same remote target while you validate the setup.

Forge actions still happen on the operator workstation. gh, glab, tea, or fj issue creation, label setup, and issue lookups run locally against the configured forge account; only deploy-target investigation commands are wrapped over SSH.

Quickstart

```bash

Mode Examples

```bash

Example invocations

```bash

Optional Flags

| Flag | Description

3. Authenticate your forge CLI (if not already done; not needed for --local)

gh auth login # GitHub glab auth login # GitLab.com; add --hostname for a custom host tea login add # Gitea fj -H codeberg.org auth login # Codeberg; use your Forgejo host for self-hosted instances

CLI Reference

Usage: repolens.sh --project <path|url> --agent <agent> [OPTIONS]
       repolens.sh status [run-id] [OPTIONS]
       repolens.sh clean [OPTIONS]
       repolens.sh supersede <run-id>

Full bugreport pipeline — symptom-driven multi-round investigation

./repolens.sh --project ~/my-app --agent claude --mode bugreport --bug-report ~/bug.txt

Branch review — file only the regressions this branch introduced vs main

./repolens.sh --project ~/my-app --agent claude --mode branch-review --branch-base main