CodeTruss CLI v0.2.39
Two analyzers join the registry, which now holds 15. Both target things AI-written code does that compile fine and pass tests.
Comment Signal reports comments that repeat the line beneath them, and comments that narrate an edit (// Updated to use the new auth middleware), address the reader, or describe the work as provisional (// In a real app you would verify this) — the last of which no TODO scan can see, because it carries no marker.
Comment density is reported as a metric and is never a finding. Across the design study the most densely commented codebase produced zero restating comments and the sparsest produced sixty-one, so a density rule would penalise exactly the code worth rewarding.
Speculative Structure reports exported values that appear in no other file, and catch blocks whose entire body logs an error and rethrows it unchanged. Export findings are worded as candidates, because a symbol reached through a dynamic import looks identical to this pass.
Both analyzers emit only INFO and LOW, and the verdict escalates at MEDIUM — so neither can turn a PASS into a REVIEW_REQUIRED or a FAILED. A comment that repeats the line below it is not a reason to stop an agent mid-turn.
Both came from a study that ran candidate rules against eight real repositories and kept only what survived. Rules that measured badly were dropped, including several that seemed obviously right beforehand.
Install
curl -fsSL https://codetruss.com/install.sh | shVerify what you installed
sha256 feb9a7454abaf2c25bdeade2a6e638137290df8c0725a447e3aca04aef2bd8f0
gh attestation verify codetruss-cli-0.2.39.tgz --repo CodeTruss/codetruss-cli