# CommitBrief v1.3.0

> A fourth CLI-backed provider (`codex-cli`), `--with-context` for grounding CLI reviews in the wider repo, `remote pr --no-post` for local-only PR reviews, two new `cache` subcommands (`stats`, `inspect`) with size-bounded eviction, a `command.default` config key, and an SPDX-header CI guard.

Released May 29, 2026

Canonical URL: https://commitbrief.com/changelog/v1.3.0/

---

## Added

- **New CLI-tool-backed provider: `codex-cli`.** Drives a locally
  installed OpenAI Codex CLI (`codex`) as the review engine, joining
  `claude-cli` and `gemini-cli`. Selectable via `--cli codex` or
  `--provider codex-cli`; no API key needed (it reuses the host CLI's
  auth and billing). Driven through
  `codex exec --sandbox read-only --skip-git-repo-check` — headless and
  read-only, so a review can never modify your working tree. Like the
  other CLI providers it is a plain-text emitter — no structured
  findings, so `--json` / `--markdown` and `remote pr`'s posting mode
  don't apply (but `remote pr --no-post`, below, does). Total live
  providers: **10** (4 API + 3 OpenAI-compatible + 3 CLI-backed).

- **`--with-context` flag for CLI-backed providers.** Opt-in: lets the
  agentic host CLI (`claude-cli` / `gemini-cli` / `codex-cli`) read
  project files beyond the diff — callers, type definitions, sibling
  modules, conventions — to ground the review in how the change fits the
  wider codebase. The diff stays the subject; the rest is background.
  CLI providers only — an API provider has no filesystem and the flag
  errors there, pointing you at `--cli`. The host CLI runs **read-only**
  with its working directory pinned to the repo root
  (`claude --allowedTools Read,Grep,Glob`,
  `gemini --approval-mode plan --skip-trust`; `codex`'s read-only
  sandbox already permits reads). CommitBrief prints a one-line caution
  on every run: the agent may read files outside the diff (including
  untracked secrets) and the pre-send secret scan covers the diff only.
  Context and diff-only runs cache under distinct keys. See ADR-0017.

- **`remote pr --no-post` — review a PR locally, no GitHub writes.**
  Fetches the PR diff via `gh` and renders the review to your terminal
  like a local review, posting nothing to GitHub (no inline comments, no
  verdict). Because output is local, the flags posting mode rejects now
  apply: `--json`, `--markdown`, `--output`, `--copy`, `--compact`,
  `--cli` (CLI providers), and `--fail-on` (exit-code gate). No self-PR
  block; results are cached like a local review. `--request-changes-on`
  and `--with-context` are noted-and-ignored in this mode. See
  ADR-0016 §Update.

- **`cache stats` subcommand.** A read-only summary of the local
  response cache: entry count, total size, oldest/newest entry
  timestamps, the configured size limit, and a per-provider/model
  breakdown.

- **`cache inspect <key>` subcommand.** Dumps a single cache entry's
  metadata (provider, model, language, created-at, TTL + freshness,
  token counts, on-disk size) by its cache key — the SHA-256 shown by
  `--verbose` / `dry-run`, with or without the `.json` suffix. The
  cached review body is shown only with `--show-content`.

- **Size-bounded cache eviction.** The `cache.max_size_mb` config key
  returns as a real key: when set (`>0`), each cache write that pushes
  the directory over the limit evicts the oldest entries first until it
  fits; the just-written entry is never evicted. The default `0` keeps
  the cache unlimited (`cache prune` remains the manual stand-in). This
  is a fresh key with real Put-path enforcement, not a revival of the
  v0.9.1-removed dead field.

- **`command.default` config key — customize bare `commitbrief`.** Set
  it to an argument string (e.g. `--unstaged --cli gemini`) and a bare
  `commitbrief` behaves as if you typed those args. Empty/unset keeps
  the built-in `commitbrief` == `commitbrief --staged`. It applies
  **only** to the truly bare invocation — any explicit flag or
  subcommand bypasses it. Set via
  `config set -- command.default "…"` or by editing `config.yml`.

- **SPDX-header CI guard.** `make spdx-check` (folded into `make check`
  and a dedicated CI job) fails the build if any Go source — tracked or
  newly added — is missing its
  `// SPDX-License-Identifier: GPL-3.0-or-later` header, keeping the
  100% coverage from regressing (ADR-0012).