ReproKit

Executable minimal reproduction builder for Python and Node.js projects.

ReproKit starts from a project and a command that already fails. It repeatedly removes files, dependencies, and text while executing the command after every accepted reduction. The final .repro capsule is independently replayed and cryptographically checked before it is considered valid.

Quick start

Python 3.10+; Node is needed only for Node fixtures/projects. Runtime dependencies: none.

python -m pip install https://github.com/virajsabhaya23/reprokit/releases/download/v0.2.0/reprokit-0.2.0-py3-none-any.whl

python -m reprokit reduce examples/demo_project \
  --command "python -S app.py" \
  --out out/demo.repro \
  --report out/report.json \
  --junit out/report.junit.xml

Verify independently:

python -m reprokit verify out/demo.repro

Run the 20-case benchmark:

python -m reprokit benchmark benchmark/corpus.json \
  --out-dir benchmark/out \
  --report benchmark/results.json

What ReproKit implements

• exact failing-command capture;
• normalized deterministic failure signatures;
• lexical Python/Node reachability pre-pass;
• executable greedy file reduction;
• executable dependency-line reduction;
• executable chunk/line delta reduction;
• timeout handling;
• no-shell subprocess execution;
• environment/tool provenance capture;
• secret scanning that blocks unsafe exports by default;
• portable .repro ZIP format;
• SHA-256 file manifest + capsule hash;
• safe ZIP extraction/path traversal defense;
• independent replay verification;
• JSON and JUnit reports;
• deterministic Python/Node benchmark;
• GitHub Actions, Dockerfile, and devcontainer.

Benchmark scope

benchmark/corpus.json contains 20 deterministic local reconstructions:

• 10 Python cases anchored to BugsInPy project families;
• 10 Node.js cases anchored to all ten BugsJS project families.

They validate reducer mechanics and failure preservation. They are not represented as direct archived checkouts of 20 upstream bugs.

Security model

ReproKit:

• never invokes a shell;
• sanitizes the environment passed to the failing command;
• limits execution time;
• blocks capsule creation when common secret patterns are detected unless explicitly overridden;
• rejects path traversal when verifying a capsule.

A failing project is still untrusted code. Run third-party repositories inside a container/VM.

Limitations

• v0.2 is file/text/dependency reduction, not language-AST minimization.
• Failure identity is normalized exit code + output digest; nondeterministic failures may need a future custom oracle plugin.
• The benchmark measures controlled local reduction, not maintainer acceptance rate or production adoption.