Comma

Share what Aider produced

Aider's design is a virtue right up until the moment you need someone else to read the result. It edits files and it makes commits, which is exactly right for code — and leaves you with nothing addressable when the deliverable is an explanation: the migration risk assessment, the audit of every raw SQL call, the account of what the refactor actually changed.

That output is either scrollback or a markdown file with no URL.

The publish step

Aider is good at writing files, so let it. Then publish the file — the same shell script, three lines later:

aider --message "Audit every raw SQL call in this repo for injection risk. \
Write the findings to audit.html as a self-contained HTML document." --yes

curl -sS -X POST https://commareports.com/api/v1/reports \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg t "SQL injection audit" --rawfile h audit.html \
        '{title:$t, html:$h}')" | jq -r '.url'

One URL on stdout. Paste it into the ticket, the PR, or the security channel. The full REST shape is in the API docs, and the token comes from API tokens.

Why not just commit the markdown

Because a markdown file in a repo is readable by people who clone the repo and render it, and the audience for a security audit is almost never that set. It also has no comment thread — review feedback ends up in a PR conversation attached to a file diff rather than to the finding it is about.

  • A report renders, in a sandboxed iframe, exactly as written.
  • Comments anchor to the finding, not to a line of a markdown file — see commenting on HTML.
  • Re-running updates the same URL. PATCH the report id instead of creating a second one, and the link in the ticket keeps working with the old version in history.

Keep the transcript out of it

.aider.chat.history.md is a record of how the work happened, not the work. Publishing it gives readers the sausage rather than the sausage. Ask for the document you want and publish that.

Worth knowing

  • reports:write is the only scope this script needs — see scoped tokens.
  • 5 MB of HTML per report body.
  • Nothing re-executes when a reader opens the page.

Try it

Free — unlimited reports, commenters and revisions.

Read the API docs →

Related