Skip to content

CodeDecay v0.3.1

Choose a tag to compare

View all tags
@kunaldhongade kunaldhongade released this 28 Jun 09:42
v0.3.1
ff11fd8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CodeDecay v0.3.1 is a release of the local-first PR safety harness and CLI.

Highlights:

  • Adds Semgrep static-analysis tool adapter evidence.
  • Adds coverage artifact/tool adapter support.
  • Adds Agent Process harness support for user-owned local agents such as Codex, Claude Code, OpenCode, Pi, desktop agents, or custom CLIs.
  • Keeps local execution gated behind explicit config and safety.allowCommands.
  • Records agent output as untrusted agent-suggestion evidence.
  • Fixes CodeQL-reported sanitization and regex security alerts.
  • Expands OSS-first agent guidance and requires squash merges/modular package structure for future PRs.

Validation:

  • pnpm install
  • pnpm run lint
  • pnpm typecheck
  • pnpm test (341 tests)
  • pnpm build
  • pnpm --filter @submuxhq/codedecay pack --dry-run
  • Installed npm package smoke test
  • Code scanning open alerts: 0

Package:

  • npm: @submuxhq/codedecay@0.3.1
  • CLI: codedecay

CodeDecay remains local-first, deterministic by default, no telemetry, no required API keys, and no hidden model calls.

Assets 2
Loading