v0.11.1

0.11.0 was tagged but never published: a timing test stopped its build. This is that release.

Highlights

• Inherited methods resolve in every class-based language. Java, Kotlin, C#, Swift, C++, Scala, Rust, Python, JavaScript, TypeScript, Go, PHP, Ruby and Dart state their bases, and a call follows them up the chain to the method that answers it, including across traits, mixins, extensions and Go embedding. Only classes the tree defines count, and an import or the file's package decides which of two same-named classes is meant.
• find_callers says what it cannot decide. Calls by a name several definitions could answer are listed as undecided_callers instead of reading as if nothing called the symbol.
• Rust calls through a typed value resolve. A field, parameter or let binding states the type, so self.path.grant() reaches that type's method even when the name alone is ambiguous.
• Very large trees finish. A language check walked the whole symbol table per definition, which on the largest trees never ended. Crafted files no longer cost the square of their length either: nesting and lookahead are bounded, and files stay within 1 MiB.
• A served tree is not trusted to run anything. Every git call Glasir makes checks the repository's own configuration first and refuses, by name, a repository whose .git/config sets something git would run on a diff, a log or the index: core.fsmonitor other than git's own daemon, diff.external, a diff driver's command or textconv, filter.*. Before, serving a checkout with a nested repository carrying such a setting ran it on the next detect_changes, affected_tests, impact-of or review. Every git child now has a deadline and a bound on the output read, and leaves the optional index locks alone.
• Release archives carry build provenance. Every .tar.gz and .zip is attested by the release workflow and verifiable with gh attestation verify <archive> --repo Attackwave/glasir; the .sha256 beside it stays. The review action verifies that before it runs a downloaded release, and refuses releases before 0.11.0, which carry none.

Hardening

• glasir view serves its map with the connection cap, the deadlines and the thread per connection the MCP endpoint already had; one idle client or one wide viewport query no longer holds the map for everyone, and a viewport query costs at most the nodes it returns.
• The map page escapes the names it embeds: a file whose name ends a script element could run in the map's origin before.
• A stored .glasir-graph is checked against itself after reading (offsets, edge arrays, targets, names, communities, hubs) and rebuilt when it does not agree, as for a stale version; a crafted file could stop the server before.
• The release workflow holds write access only in the jobs that publish; the tools it installs are pinned by version, the container's base images by digest, and the image build leaves out the files Glasir writes beside a tree.

Assistants

• glasir install adds a session hook that points a coding assistant at the graph in an indexed tree, and the repository ships a plugin with a marketplace entry.

Scanners

• Block balance on real code: blocks, strings and comments no longer derail a file in Ruby, TypeScript, JSX, Kotlin, Dart, Elixir, PHP, C and C++ macros and conditional branches, Java and C# constants, or shell. Heredocs, #{...} and ${...} with nested quotes, raw strings, regexps and JSX text are read as what they are.
• Classes and methods defined in one file resolve per class; super.run() in run no longer links to itself.
• overview states the server version and when the index was loaded, and warns about directories that repeat each other.
• impact of a class or module reaches through its members.

Review

• A pull request from a fork, whose token cannot comment, no longer fails the action's comment step: the report is in the job summary and the gate applies.
• Release notes come from the tree (.github/releases/<tag>.md) and travel through the release's pull request.

Operations

• The flood regression test compares cost against a quarter of the input instead of a fixed time, so a slower runner fails nothing.
• Partition floor 58 -> 62.

The snapshot format and the scanner identity changed; the first analyse after upgrading rebuilds the graph.

Install

• Homebrew: brew install attackwave/glasir/glasir
• Scoop: add the bucket Attackwave/scoop-glasir, then run scoop install glasir