#47 feat(cli): add list subcommand for script/run discovery

Summary

• Adds reverse-api-engineer list non-interactive CLI subcommand
• Rich table output (compact/full) and JSON output (--json)
• Filters: --mode, --model, --search, --limit
• Enriches runs with script directory paths, file counts, and local path detection
• Bumps version to v0.4.0

Test plan

• reverse-api-engineer list — Rich table renders with all runs
• reverse-api-engineer list --json — valid JSON array
• reverse-api-engineer list --search "hn" --limit 2 — filtered correctly
• reverse-api-engineer list --help — all options documented
• ruff check — no new lint errors

🤖 Generated with Claude Code

---

Summary by cubic

Add reverse-api-engineer list to quickly discover generated scripts and past runs. Supports compact/full table views and --json, with filters and filesystem details.

• New Features
  • Non-interactive list subcommand with rich table (compact/full) and --json.
  • Filters: --mode, --model, --search, --limit.
  • Adds script directory path, file list/count, and local copy detection.
  • Bumps reverse-api-engineer to 0.4.0.

Greptile Summary

This PR adds a reverse-api-engineer list subcommand that renders run history as a Rich table (compact/full) or JSON, with filters for mode, model, prompt search, and row limit, and bumps the version to v0.4.0.

• Path-traversal bypass in _get_run_details: run_id is taken directly from the history JSON and used to build a filesystem path without the regex, length, or is_relative_to guards that get_scripts_dir / get_har_dir / get_docs_dir all apply. A corrupted history entry could silently traverse outside the expected directory.
• Unhandled OSError in iterdir() calls: All three iterdir() calls (script_dir, local_scripts, and each subdir) can raise PermissionError or OSError, which would crash the entire list command via an unhandled exception inside a list comprehension.
• local_path not shown in table output: The field is computed and correctly included in --json output, but neither the compact nor --full table renders it, despite the PR description listing "local path detection" as a visible feature.
• uv.lock version (previously 0.3.2) was out of sync with pyproject.toml (0.3.3); both are now correctly aligned at 0.4.0.

Confidence Score: 3/5

• Safe to merge with low risk, but the path-traversal bypass should be addressed before shipping to users who may have untrusted history files.
• The new command is additive and read-only, so there is no data-loss risk. However, _get_run_details skips the run_id validation that every other path-building utility in the codebase enforces, which is a correctness/security regression. The missing OSError guards could also cause the command to crash unexpectedly for legitimate users.
• src/reverse_api/cli.py — specifically the _get_run_details helper (lines 1735–1773)

Important Files Changed

Filename	Overview
src/reverse_api/cli.py	Adds _get_run_details helper and list subcommand. The helper bypasses the existing run_id path-traversal validation used everywhere else in the codebase, and all three iterdir() calls lack OSError handling. The computed local_path field is also missing from the table output despite being documented as a feature.
pyproject.toml	Version bumped from 0.3.3 to 0.4.0, consistent with the new list subcommand feature addition.
CHANGELOG.md	New [0.4.0] entry added documenting the list CLI subcommand and its options. No issues.
uv.lock	Lock file updated to reflect version 0.4.0; also resolves a pre-existing discrepancy where the lock file had 0.3.2 while pyproject.toml said 0.3.3.

_{Last reviewed commit: 3a26e3e}

Greptile also left 1 inline comment on this PR.