feat: analyze public GitHub issue URLs (#60)

Author: aryamthecodebreaker

.github/workflows/publish.yml

@@ -37,7 +37,7 @@ jobs:
           set -euo pipefail
           if [[ "${GITHUB_REF_TYPE}" != "tag" ]] ||
              [[ ! "${GITHUB_REF_NAME}" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
-            echo "::error::Dispatch this workflow from a stable tag such as v0.5.0, not from a branch or prerelease tag."
+            echo "::error::Dispatch this workflow from a stable tag such as v1.2.3, not from a branch or prerelease tag."
             exit 1
           fi
           echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"

CHANGELOG.md

@@ -2,6 +2,22 @@
 
 All notable changes to FixMap are documented here.
 
+## 0.6.0 - 2026-07-22
+
+### Added
+
+- CLI and MCP users can paste a canonical public GitHub issue URL as the issue input. FixMap anonymously fetches its title and body and infers the matching repository when no repository is supplied.
+- A `remote-issue-fetched` diagnostic records the exact issue source and whether its body was truncated before ranking.
+
+### Security
+
+- Issue URL inputs accept only credential-free canonical HTTPS URLs on `github.com`; queries, fragments, encoded separators, and mismatched explicit repository URLs are rejected.
+- Issue content is fetched only from the fixed `api.github.com` endpoint without redirects or credentials, with a 15-second timeout, a bounded API response, a 20,000-character body cap, stable rate-limit errors, and explicit pull-request rejection.
+
+### Changed
+
+- The README, npm package page, MCP tool description, growth kit, and production quick start now lead with the single-input public issue workflow.
+
 ## 0.5.1 - 2026-07-18
 
 ### Added

README.md

@@ -10,7 +10,7 @@ Turn an issue or git diff into relevant files, test routes, risk notes, and clea
 [![npm](https://img.shields.io/npm/v/%40aryam%2Ffixmap)](https://www.npmjs.com/package/@aryam/fixmap)
 [![MIT](https://img.shields.io/badge/license-MIT-74f0ba)](LICENSE)
 
-[Live demo](https://fixmap-flax.vercel.app) · [Install](#quick-start) · [MCP server](#mcp-server) · [GitHub Action](#github-action) · [Contribute](CONTRIBUTING.md)
+[Live demo](https://fixmap-flax.vercel.app) · [Install](#quick-start) · [MCP server](#mcp-server) · [GitHub Action](#github-action) · [Contribute](CONTRIBUTING.md) · [Star FixMap](https://github.com/aryamthecodebreaker/FixMap)
 
 </div>
 
@@ -30,15 +30,21 @@ FixMap is a transparent routing layer for that gap. It needs no account or API k
 
 ## Quick start
 
-Try FixMap on any public GitHub repository without cloning it first:
+Paste a public GitHub issue URL. FixMap fetches its title and body, infers the repository, and returns a repo map without making you clone anything first:
+
+```bash
+npx -y @aryam/fixmap plan --issue https://github.com/aryamthecodebreaker/FixMap/issues/59
+```
+
+Or describe a task and point FixMap at any public GitHub repository:
 
 ```bash
 npx -y @aryam/fixmap plan \
-  --issue "support public GitHub repository inputs" \
+  --issue "support public GitHub issue URLs" \
   --repo https://github.com/aryamthecodebreaker/FixMap
 ```
 
-Or run it from a local JavaScript or TypeScript repository:
+For private source or working-tree changes, run it from a local JavaScript or TypeScript repository:
 
 ```bash
 npx @aryam/fixmap plan --issue "password reset emails fail"
@@ -56,9 +62,11 @@ Machine-readable output:
 npx @aryam/fixmap plan --base main --head HEAD --format json --output fixmap-report.json
 ```
 
-### Public GitHub repository inputs
+### Public GitHub issue and repository inputs
+
+CLI and MCP users can pass a canonical `https://github.com/owner/repository/issues/123` URL as the issue. FixMap anonymously fetches the public issue title and body and infers the matching repository when `--repo` / `repo` is omitted. A separately supplied public repository URL must match the issue; an explicit local checkout is allowed.
 
-CLI and MCP users can pass a canonical `https://github.com/owner/repository` URL to `--repo` / `repo`. FixMap anonymously shallow-clones the default branch into an isolated OS temporary directory, disables credentials, hooks, submodules, symlinks, and LFS smudging, scans without running install/build/test scripts, and removes the checkout before returning the report.
+Repository inputs use the canonical `https://github.com/owner/repository` form. FixMap anonymously shallow-clones the default branch into an isolated OS temporary directory, disables credentials, hooks, submodules, symlinks, and LFS smudging, scans without running install/build/test scripts, and removes the checkout before returning the report. Issue fetches use GitHub's fixed public API host with no redirects or credentials, a 15-second timeout, bounded response and task sizes, and a clear anonymous rate-limit error.
 
 Remote URL mode is deliberately issue-only in this first release. Clone the repository locally when you need `--diff`, `--base`, or `--head`. Paths and test commands in a remote report are informational because the temporary checkout no longer exists after analysis.
 
@@ -137,7 +145,7 @@ jobs:
         with:
           fetch-depth: 0
       - id: fixmap
-        uses: aryamthecodebreaker/FixMap@v0.5.1
+        uses: aryamthecodebreaker/FixMap@v0.6.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 ```
@@ -201,7 +209,7 @@ npm run ci
 
 ## Status and roadmap
 
-FixMap is an early public release focused on JavaScript and TypeScript repositories. The [changelog](CHANGELOG.md) records what each release shipped, including cross-repository evaluation, MCP support, and one-command public GitHub repository analysis. Near-term work:
+FixMap is an early public release focused on JavaScript and TypeScript repositories. The [changelog](CHANGELOG.md) records what each release shipped, including cross-repository evaluation, MCP support, and one-command public GitHub issue analysis. Near-term work:
 
 - git co-change and ownership signals
 - adapters and examples for popular monorepo layouts

apps/web/app/layout.tsx

@@ -15,7 +15,7 @@ const mono = JetBrains_Mono({ subsets: ["latin"], weight: ["400", "500"], variab
 export const metadata: Metadata = {
   metadataBase: new URL("https://fixmap-flax.vercel.app"),
   title: "FixMap — Repo maps for coding agents",
-  description: "Turn an issue or git diff into ranked files, test routes, risk notes, and explainable diagnostics. Local-first and open source.",
+  description: "Paste a public GitHub issue URL and get ranked files, test routes, risk notes, and explainable diagnostics. Local-first and open source.",
   keywords: [
     "AI coding agents",
     "developer tools",
@@ -28,15 +28,15 @@ export const metadata: Metadata = {
   robots: { index: true, follow: true },
   openGraph: {
     title: "FixMap — Give coding agents a map before they edit",
-    description: "Local-first repository context, test routing, and explainable diagnostics for coding agents.",
+    description: "Paste a GitHub issue URL and get local-first repository context, test routes, and explainable diagnostics.",
     siteName: "FixMap",
     url: "/",
     type: "website"
   },
   twitter: {
     card: "summary_large_image",
     title: "FixMap — Give coding agents a map before they edit",
-    description: "Local-first repository context, test routing, and explainable diagnostics for coding agents."
+    description: "Paste a GitHub issue URL and get local-first repository context, test routes, and explainable diagnostics."
   }
 };
 

apps/web/app/page.tsx

@@ -1,7 +1,7 @@
 import { Demo } from "./demo";
 
 const installCommand =
-  "npx -y @aryam/fixmap plan --issue \"support public GitHub inputs\" --repo https://github.com/aryamthecodebreaker/FixMap";
+  "npx -y @aryam/fixmap plan --issue https://github.com/aryamthecodebreaker/FixMap/issues/59";
 
 export default function HomePage() {
   return (
@@ -76,7 +76,7 @@ export default function HomePage() {
         <div>
           <p className="kicker">Thirty-second start</p>
           <h2>One command. No account. No API key.</h2>
-          <p>Point it at a public GitHub repository, or run it from a local JavaScript or TypeScript checkout.</p>
+          <p>Paste a public GitHub issue URL. FixMap fetches the task, infers the repository, and maps where to start.</p>
         </div>
         <pre><code>{installCommand}</code></pre>
         <div className="quick-links">

docs/LAUNCH_KIT.md

@@ -8,8 +8,7 @@ Let a developer try FixMap on a real public repository in one command, without c
 
 ```bash
 npx -y @aryam/fixmap@latest plan \
-  --repo https://github.com/aryamthecodebreaker/FixMap \
-  --issue "the external ranking evaluation regressed"
+  --issue https://github.com/aryamthecodebreaker/FixMap/issues/59
 ```
 
 The report ranks likely files with reasons, suggests test routes, and names risks and diagnostics. Public URL analysis is issue-only; diff analysis still requires a local checkout.
@@ -18,7 +17,7 @@ The report ranks likely files with reasons, suggests test routes, and names risk
 
 - MIT licensed, deterministic, local-first analysis with no model call or account.
 - CLI, MCP server, and GitHub Action share the same core ranker.
-- Public GitHub repositories work through an isolated anonymous shallow checkout that is removed after analysis.
+- Public GitHub issue URLs supply both task context and the repository in one input; source is scanned in an isolated anonymous shallow checkout that is removed after analysis.
 - A frozen external evaluation uses six real fixed issues at pinned pre-fix commits.
 - Current checked-in result: top-1 `3/6` (50%), top-3 `5/6` (83%), top-5 `5/6` (83%).
 - The remaining Zod miss and every ranked output are public in [`benchmarks/external/`](../benchmarks/external/).
@@ -32,7 +31,7 @@ Do not say:
 
 - “FixMap is 83% accurate” or “finds the right file 83% of the time.”
 - “FixMap runs or verifies the tests.” It suggests test routes; it does not execute them.
-- “Any GitHub URL works.” Only canonical public `https://github.com/owner/repository` inputs are supported.
+- “Any GitHub URL works.” Only canonical public repository and issue URLs are supported.
 - “Your code never leaves your machine” without the remote-mode nuance: FixMap downloads public source from GitHub, but does not upload analyzed source to a FixMap service.
 - “5,000 stars is expected.” It is the goal, not a promised outcome.
 
@@ -42,7 +41,7 @@ Keep the documented miss visible. If a scheduled evaluation regresses, pause pro
 
 - [ ] The latest GitHub release, npm CLI, npm core package, and official MCP Registry entry show the same version.
 - [ ] `npx -y @aryam/fixmap@latest --version` returns that version from a fresh cache outside the repository.
-- [ ] The public GitHub URL command above succeeds from a fresh cache.
+- [ ] The public GitHub issue URL command above succeeds from a fresh cache.
 - [ ] Main CI and the manual external-evaluation workflow are green at the release commit.
 - [ ] The production site shows the public URL command and current product language.
 - [ ] The README, changelog, benchmark page, Action pin, and release notes agree.
@@ -118,7 +117,7 @@ Points for the maintainer to explain personally:
 
 1. The recurring problem that made you build it: agents lose time before the first edit because they start in the wrong module or miss the owning test.
 2. The one-sentence solution: deterministic repo context—ranked files, test routes, risks, and diagnostics.
-3. The fastest trial: include the public GitHub URL command.
+3. The fastest trial: include the one-input public GitHub issue URL command.
 4. The technical mechanism: path/content signals, real git diff signals, bounded static import proximity, file-kind priors, and workspace boundaries.
 5. The honest evidence: six frozen real bugs, `3/6` top-1 and `5/6` top-3/top-5, with the Zod miss linked.
 6. The scope: JavaScript/TypeScript today; remote URLs are issue-only; suggested tests are not executed.

package-lock.json

@@ -1,8 +1,8 @@
 {
   "name": "fixmap-workspace",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "private": true,
-  "description": "Local-first repo context for coding agents: ranked files, test routes, risks, and public GitHub URL analysis.",
+  "description": "Local-first repo context for coding agents: paste a GitHub issue URL to get ranked files, test routes, and risks.",
   "license": "MIT",
   "type": "module",
   "repository": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fixmap/action",
-  "version": "0.5.1",
+  "version": "0.6.0",
   "description": "GitHub Action wrapper for FixMap pull request reports.",
   "private": true,
   "license": "MIT",
@@ -10,6 +10,6 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@aryam/fixmap-core": "0.5.1"
+    "@aryam/fixmap-core": "0.6.0"
   }
 }

packages/action/package.json

@@ -6,15 +6,21 @@ FixMap turns an issue, prompt, or git diff into ranked context files, test route
 
 ## Quick start
 
-Try a public GitHub repository without cloning it first:
+Paste a public GitHub issue URL; FixMap fetches its task context and infers the repository:
+
+```bash
+npx -y @aryam/fixmap plan --issue https://github.com/aryamthecodebreaker/FixMap/issues/59
+```
+
+Or supply your own task and public repository:
 
 ```bash
 npx -y @aryam/fixmap plan \
-  --issue "support public GitHub repository inputs" \
+  --issue "support public GitHub issue URLs" \
   --repo https://github.com/aryamthecodebreaker/FixMap
 ```
 
-Or run from a local JavaScript or TypeScript repository:
+For private source or working-tree changes, run from a local JavaScript or TypeScript repository:
 
 ```bash
 npx @aryam/fixmap plan --issue "password reset emails fail"
@@ -32,7 +38,7 @@ Machine-readable output:
 npx @aryam/fixmap plan --base main --head HEAD --format json --output fixmap-report.json
 ```
 
-Public GitHub URL mode is available in the CLI and MCP server for issue-only analysis. FixMap anonymously shallow-clones the default branch into an isolated temporary directory, disables credentials and repository execution surfaces, and removes the checkout before returning. Clone locally to use `--diff`, `--base`, or `--head`.
+Public GitHub issue and repository URL modes are available in the CLI and MCP server for issue-only analysis. FixMap fetches issue context anonymously, shallow-clones the default branch into an isolated temporary directory, disables credentials and repository execution surfaces, and removes the checkout before returning. Clone locally to use `--diff`, `--base`, or `--head`.
 
 ## MCP server
 
@@ -63,7 +69,7 @@ Cursor, Windsurf, or any MCP client:
 fixmap plan            Generate a FixMap report for a task or diff
 fixmap mcp             Run FixMap as an MCP server over stdio
 
---issue <text>         Issue, prompt, or task description
+--issue <text|url>     Issue text, task description, or public GitHub issue URL
 --diff <spec>          Git diff spec, such as main...HEAD
 --base <ref>           Base ref for diffing when --diff is not given
 --head <ref>           Head ref for diffing (defaults to HEAD)