Skip to content

v0.43.2

Choose a tag to compare

View all tags
@aahlijia aahlijia released this 21 Aug 15:45
· 15 commits to main since this release
v0.43.2
e51d5d3
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release v0.43.2

Previous release: v0.31.1

Another large release — twelve minor/patch versions of accumulated work landing in one tag. Headline additions are six new read-side analysis commands (module dependency graphs, error-flow tracing, env-var reads, dead-type detection) and four new Claude Code integrations built directly from real-world eval friction (dekko doctor, dekko sanity, and a dekko-review-context skill). Underneath that, several rounds of 7-repo real-world evaluation (awesome-go, claude-buddy, claude-code, cline, spring-boot, tensorflow, zed) drove a substantial correctness pass on the resolver, heritage/throws labeling, and dead-code detection.

✨ Highlights

  • dekko deps — module-level dependency graph. File-to-file import graph resolved from raw import/use/#include source text (full resolution for Python, JS/TS/TSX, Rust, Java, C/C++). --file for one file's imports/importers/external sources, --cycles for circular-import detection, --top for most-depended-on ranking, --export {mermaid,dot}.
  • dekko query throws/catches/env/importers/peers/cohesion — a batch of new structural queries: exception/error-flow tracing (scoped pilot: full support for Python/Java/C++), static env-var read detection across all 9 Tier-1 languages, reverse shared-dependency lookups, callee-overlap peer detection, and intra-file symbol-cohesion clustering.
  • dekko unused --kinds {callables,types,all} and workset --type-impact — dead-type detection (classes/interfaces/enums/structs/traits, counting heritage and type-usage evidence) and combined call-graph + type-usage + heritage blast-radius reporting.
  • dekko doctor / /doctor — unified environment/install-state diagnostic. Catches PATH shadowing (a stale globally-installed dekko binary silently producing wrong/empty answers — the single most-repeated friction point across past eval rounds), map freshness, MCP/plugin registration, hook install state, and the CLAUDE.md policy block, each check degrading independently rather than aborting the rest.
  • dekko sanity <target> / /sanity — cross-checks a callers/uses result against a scoped, word-bounded grep sweep, classifying any grep-only miss's likely cause (qualified call, unsupported language, test-filter exclusion, generic name, or a bare-name mention in a nearby comment/docstring). Automates the manual spot check dekko-verify already documented.
  • dekko-review-context skill — orchestrates workset + impacted_tests + check_ambiguous to give PR-description and code-review flows a structural head start on a diff, ahead of a dedicated dekko review command (tracked as #14).

🛠 Correctness fixes

  • Resolver / heritage / throws labeling: .h header files are now content-sniffed for C vs. C++ instead of always parsing as C (was silently mis-resolving heritage/call edges on LLVM/gRPC/Chromium/TensorFlow-style codebases); same-file TypeScript type aliases used with implements/extends now resolve instead of being mislabeled (external); Java instanceof-pattern-bound rethrow variables no longer mislabeled as a fake external type; dekko deps now recognizes Rust crates whose Cargo.toml [lib] path isn't src/lib.rs (was undercounting resolved edges on ~90% of a real repo's crates in one eval case).
  • Dead-code detection: dekko unused no longer false-flags Java methods only reached via this::method/Class::method references, or module-level const variables read as binary/ternary operands rather than called.
  • dekko deps/query importers/query peers/query throws/query catches: fixed self-import false positives, ambiguous --file matches, env-write detection, --exact matching, JS/TS side-effect/namespace imports, NodeNext/ESM relative-import resolution, several false positives, a truncation-footer miscount, and a leaf-function mislabeling on ambiguously-resolved calls.
  • MCP server robustness: every ProcessPoolExecutor call site now retries once at a reduced worker count on BrokenProcessPool instead of an opaque crash; a long-lived MCP server reading a newer map.json format now gets a clear "restart the server" (or "regenerate the map," for a genuinely malformed doc) instead of a bare TypeError.
  • Disclosure fixes: files dropped by the 1MB size cap are now disclosed instead of silently omitted; affected/workset no longer overstate a cold-resolve file count; query catches reflects the languages actually present in the scanned repo instead of a hardcoded exclusion list; throws/catches disclose Rust/Go/C's lack of a syntax-level exception concept in-CLI, not just in docs.
  • --claude-md-uninstall now deletes CLAUDE.md when removing the dekko usage block leaves nothing behind, instead of leaving a 0-byte file.

⚡ Performance

  • .dekko/map.json on-disk size cut 5.6–7.9x on large repos (measured: zed 853.5MB→117.2MB, spring-boot 894.2MB→113.9MB, tensorflow 1212.4MB→217.6MB) via symbol-id interning and dropping pretty-printing, now that map.json has no human-reader use case.
  • Resolver parallelism — call/ref/throws/catches resolution passes now use oversubscribed chunking plus a shared-index pool initializer, cutting run-to-run variance on heterogeneous-core machines from ~2.2–3.9x swings to a tight ~3% spread at a consistent ~3.3–3.5x speedup.

🔧 Internal

  • src/dekko/cli.py's repo-loading/map pipeline extracted into src/dekko/repo_ops.py (no behavior change); daemon auth token comparison now uses secrets.compare_digest, closing a timing side-channel.
  • CI now reports test coverage (--cov=dekko, no gate yet) and runs a non-blocking pip-audit job — which, until this release, false-failed on nearly every run because it was trying to audit dekko's own dev version against PyPI; uv export --no-emit-project now excludes the local package from the audited set.

Compatibility

  • All new commands, hooks, and skills are opt-in — no behavior change for existing installs until you turn them on.
  • map.json's schema version (MAP_DOC_VERSION) advanced 4→10 across this range (id interning, then same-file type-alias tracking); existing files keep reading correctly via version-branch handling in load_map(), and a plain dekko map re-run upgrades an already-mapped repo to the current format.
  • No breaking changes to existing MCP tool signatures.

Full changelog: see CHANGELOG.md for the complete per-version breakdown ([0.31.2] → [0.43.2]).

Assets 2
Loading