$ rev-local gallery

See it work

The interactive piece from the front page, with room to try it, followed by rev-local’s logo, colors and type.

From a commit to a report, and what happens next time.

rev-local finds the commit, reviews a copy of it with the coding CLI you already use, and files what it finds. Each finding gets a fingerprint built from the repository, file, category and title. Line numbers and severity are left out, so the same defect found again updates what’s already there.

acme · 7c41e2a · src/auth/session.rs

@@ -36,6 +36,7 @@ impl SessionStore {     pub fn validate(&self, token: &str) -> Result<UserId, AuthError> {         let row = self.lookup(token)?;-        if row.expires_at <= now() {+        // Allow for clock drift between app servers.+        if row.expires_at + GRACE_SECS <= now() {             return Err(AuthError::Expired);         }         Ok(row.user_id)

The run

queued
Polling found 7c41e2a on main.
preparing
Checked the commit out into a scratch worktree. ~/code/acme isn’t touched.
reviewing
Depth deep, because src/auth/ counts as security-relevant (25 minute limit). Engine claude, with GITHUB_TOKEN, NPM_TOKEN and DATABASE_PASSWORD held back from its environment.
synthesizing
1 finding, normalized and fingerprinted.
publishing
Local report written. Local reports never wait for approval.
done
reviewed acme 7c41e2a — request_changes (1 finding(s), 1 action(s), claude)

~/.local/share/rev-local/reports/acme/25f3c9c09015e4b6.md

# Session check accepts tokens up to 300 seconds after expiry

`validate` now adds `GRACE_SECS` to the expiry before comparing, so an expired token keeps working for another five minutes. Clock drift between servers is usually a few seconds.

## Failure scenario

A token copied from a shared machine at 12:00, which expires at 12:30, still signs in at 12:34.

## Suggested fix

Keep the window to a few seconds, or apply it only when refreshing a session.

## Where

- Location: `src/auth/session.rs:39`
- Change: 7c41e2a
- Review page: not published
- Severity: high · Category: security · Confidence: 0.82

---
rev-local-fingerprint: 25f3c9c09015e4b6

The next commit. Pick what happened, then see where the finding goes.

Field	This run	Fingerprint
repo	acme	hashed
file	src/auth/session.rs	hashed
category	security	hashed
title	Session check accepts tokens up to 300 seconds after expiryhashed as “session check accepts tokens up to ### seconds after expiry”	hashed
line	53	not hashed
severity	high	not hashed

Same fingerprint, 25f3c9c09015e4b6. It’s the same defect, so the existing report is rewritten. A tracker issue would get a “rev-local saw this again” comment.

reports/acme/

25f3c9c09015e4b6.md rewritten

An illustration. The run states, report format, path and fingerprint formula are rev-local’s own, and the fingerprints shown were computed with that formula. The repository, the diff and the finding are invented, and the line under each state is written for this page.

Assets

Logo, colors, and type.

Mark

The project’s generated logo mark. The grid gets finer with the commit count, and the cells show the split between languages. It’s redrawn as the project grows.

Palette

The colors rev-local uses across this site: one hue from its discipline’s band, plus the shades that make it work on both dark and light backgrounds.

rev-local Developer & agent tooling DM SANS · NEWSREADER · DM MONO

Type

The two typefaces on the site: a sans-serif for the interface and a serif for headlines.

Build rev-local

It’s open source under the Apache 2.0 license. There are no prebuilt downloads yet, so you build it from source with Rust.

Get the source git clone https://github.com/dmoore-dwmmholdings/rev-local

Command line cargo build --release --workspace

Desktop app cargo tauri build --features desktop

The desktop app needs tauri-cli and is built from crates/revlocal-tauri. On Linux you’ll also need the WebKitGTK development packages. The public source is updated in batches, so it can be behind the newest features described here.

Source on GitHub Read the source

Questions, or something it doesn’t do yet? Email dmoore@dwmmholdings.com