@eldrex/core

@eldrex/core

Core engine for DevDiff — intelligent, privacy-first changelog generation

🔒 Built for Privacy — DevDiff tracks zero telemetry, logs no data, and makes no external calls except directly to your configured AI provider. Verify yourself →

Overview

@eldrex/core is the engine that powers DevDiff. It parses git diffs, analyzes code changes, and generates human-readable changelogs using AI that runs entirely on your machine.

⭐ Love DevDiff?

If DevDiff saves you time, leave a review — it helps other developers find us.

  

Installation

npm install @eldrex/core

Quick Start

import { generateChangelog } from "@eldrex/core";

const result = await generateChangelog({
  diffText: "...",
  dryRun: false,
});

console.log(result.formattedOutput);

Key Features (v1.7.0)

• 🧠 Unified Knowledge Architecture: Single source of truth loading (SKILL.md → .devdiff/context.md → autoGenerate).
• 🛡️ Multi-Stage Hallucination Guard: HallucinationGuard verifying output against diffs, naming conventions, anti-pattern rules, and AI hedging language.
• 🗂️ Memory Control & Timeline Manager: Browser-history-like control over codebase memory (MemoryManager), date range deletions, dry-run previews, active range scoping, and storage deduplication.
• 📅 Time-Aware Generator: Resolves human time expressions (today, yesterday, this-week, date-range, since-initial, between-commits) to exact git revision ranges.
• 🔒 Complete Trust & Transparency: NetworkGuardV2 with 100+ domain blocklist across 5 categories, PluginAuditor, and DisclosureReport (devdiff disclose).

API Reference

Full documentation: devdiff.vercel.app

🔒 Security & Privacy

What This Package Accesses

Resource	Why	Default	Can Disable
File System	Read git repos, write changelogs	Yes	No (core function)
Shell	Execute git, detect tools	Yes	Yes
Network	Cloud AI, webhooks, notifications	No	Yes (default off)

What This Package NEVER Does

• ❌ Send telemetry or analytics
• ❌ Read files outside your project
• ❌ Access environment variables except configured API keys
• ❌ Execute arbitrary shell commands
• ❌ Share data with third parties

Shell Access Notice

This package may execute shell commands for:

• Git operations (git log, git diff) — for analyzing code changes
• Tool detection (which ollama) — to find installed AI providers

All shell access is:

• Whitelisted (only git, ollama, which, node allowed)
• Audited (logged to security trail)
• Disableable (set { security: { disableShellAccess: true } })

Network Access Notice

DevDiff is local-first by default. Network access only occurs when you explicitly configure:

Feature	Default	Network Required
AI Analysis	Local only	No
Cloud AI (OpenAI, etc.)	Disabled	Yes (your API key)
Webhooks (incoming)	Disabled	Yes
Notifications (Slack, etc.)	Disabled	Yes
Version check	Enabled	Yes (can disable)

AI Security Disclosure

DevDiff integrates with AI/LLM models for code analysis. We take specific precautions to mitigate AI-related risks:

• Prompt Injection Protection: All inputs to AI models are sanitized to prevent prompt injection.
• Data Minimization: We send the minimum data required (only the diff, not the entire file). Secrets are automatically redacted before AI processing.
• Local-First Default: By default, AI processing uses local models (Ollama, WebGPU, WASM). No data leaves your machine unless you explicitly configure a cloud provider.
• Model Verification: When using local models, we verify model checksums to prevent supply-chain attacks through model files.

Audit Trail

Every sensitive operation is logged:

npx devdiff audit --package @eldrex/core

💬 Feedback & Community

     

_{Enjoying DevDiff? Leave a review — it takes 30 seconds and helps more than you know.}

License

MIT © DevDiff Contributors