Release v0.18.0

What's New in v0.18.0

Security

• Release checksums are signed with cosign keyless and verified by install.sh and cora upgrade (#591). release.yml now signs checksums-sha256.txt (which covers every archive) via Sigstore/GitHub OIDC before creating the release and uploads checksums-sha256.txt.sigstore.json; a signing failure aborts the job so no unsigned release is published. install.sh and cora upgrade verify the bundle with cosign verify-blob (identity: this repo's release.yml on a v* tag, issuer token.actions.githubusercontent.com) when cosign is on PATH; an invalid signature aborts. Without cosign, or for releases without a bundle, they print a notice and fall back to checksum-only. CORA_REQUIRE_SIGNATURE=1 makes a missing cosign or bundle fatal. See docs/installation.md.

Changed

• Documented what the hardcoded-secret check flags and its one known limit (all-letter unquoted YAML values), and closed that item as not planned (#625, #635).

• Scanners take file lines instead of diffs (#610). New engine::scan_input::ScanFile (path, language, (line number, text) pairs) is the one input shape for secrets_scanner::scan_secrets_in, security_scanner::scan_security_in, rules::run_rules_in and inline_suppress::apply_lines. Diff chunks and whole files are thin adapters (ScanFile::added_lines, ScanFile::post_image, ScanFile::from_entry); scan_secrets/scan_security/run_rules/inline_suppress::apply keep their signatures. The files_as_chunks workaround and the MCP fake diff are gone. Findings are byte-identical for diffs and scans. Unit tests that open an index session now use a per-test temp database instead of the shared global one.

Fixed

• A rules_engine: section without enabled: true no longer disables the built-in rules. enabled now defaults to true when the section is present, so rules_engine: { max_findings: 0 } only changes the cap; set enabled: false to turn the engine off (#638).

• cora.check_snippet (MCP) now honors ignore.rules, inline cora-ignore: markers and the false-positive filters, and rules_engine.max_findings (#610). The tool used to run the secrets and security scanners on a fake diff with a fixed cap of 10 per scanner and no filtering, so a snippet could report findings that cora scan suppresses. It now goes through the shared post-processing pipeline as a synthetic snippet.<language> file (so path-aware classification applies), loads the project config like the other MCP tools (and fails with the same "Failed to load config" error), and mentions how many findings the cap dropped. Output format is unchanged.

• Secret-detection edge cases (#625, #628, #629, #630). A string literal inside a constructor wrapper is now a literal: Java new String(".."), Cow::Owned, Box::from, Secret::new, Python str("..") (plain calls such as get_password() stay quiet) (#630). A literal default in the default position of an env read is flagged in code files: os.environ.get("X", "lit"), os.getenv, process.env.X || "lit" / ?? "lit", Rust env::var("X").unwrap_or("lit".into()) / unwrap_or_else(|_| "lit".to_string()), Ruby ENV.fetch, PHP getenv() ?:; the env var name and name-only reads stay quiet (#628). Shell ${VAR:-literal} / ${VAR:=literal} is flagged, while ${VAR}, ${VAR:-} and ${VAR:?msg} stay quiet (#629). The unquoted-YAML rule no longer applies to source code (secret: Secret1Type in .ts/.py), YAML flow-style { password: hunter2hunter2 } is flagged, unspaced password:=os.Getenv("X") is no longer matched, and SQL PASSWORD "..." with double quotes is detected (#625). All-alphabetic unquoted YAML values (password: correcthorsebattery) remain undetected, tracked in #635. The LLM secret cross-check uses the same classification.

• rules_engine.max_findings is applied after suppression and truncation is reported (#624). The cap (default 5) used to be applied inside each scanner, before ignore.rules / cora-ignore, so suppressed findings consumed slots and pushed real findings out, and the rest were dropped silently. Scanners now run uncapped and the cap is enforced once in post-processing on deterministic findings only (LLM issues are never capped), highest severity first. cora scan and cora review print ⚠ N more deterministic findings not shown (...) on stderr when findings are cut, and the cora scan summary mentions it; stdout formats are unchanged. max_findings: 0 or null now means unlimited (previously 0 hid every finding).

📦 Platforms

Platform	File
Linux (x86_64)	cora-x86_64-unknown-linux-gnu-v0.18.0.tar.gz
Linux (ARM64)	cora-aarch64-unknown-linux-gnu-v0.18.0.tar.gz
macOS (Apple Silicon)	cora-aarch64-apple-darwin-v0.18.0.tar.gz
Windows (x86_64)	cora-x86_64-pc-windows-msvc-v0.18.0.zip

🚀 Quick Start

# Quick install (Linux / macOS)
curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install.sh | sh

# Or via cargo
cargo install cora

# Init project
cora init

# Review staged changes
CORA_API_KEY=your-key cora review --staged

Full changelog: https://github.com/codecoradev/cora-code/blob/main/CHANGELOG.md

Release v0.17.2

What's New in v0.17.2

Fixed

• Env reads, call expressions and shell interpolation are no longer reported as hardcoded secrets. process.env.X, os.environ["X"], os.getenv("X"), std::env::var("X")?, System.getenv("X"), get_password_from_vault(), String::new() and bare identifiers/member accesses (const password = userInput;) are expressions, not literals, in source files (#616). DB_PASSWORD=${VAR}, db.password=${DB_PASSWORD}, export X="$VAULT_X" and $(cmd) are references (#617). Real values stay flagged: quoted or concatenated literals in code, and bare tokens in .env/.properties/.ini/.toml/shell/YAML files (DB_PASSWORD=hunter2hunter2xx). The LLM secret cross-check uses the same classification.

📦 Platforms

Platform	File
Linux (x86_64)	cora-x86_64-unknown-linux-gnu-v0.17.2.tar.gz
Linux (ARM64)	cora-aarch64-unknown-linux-gnu-v0.17.2.tar.gz
macOS (Apple Silicon)	cora-aarch64-apple-darwin-v0.17.2.tar.gz
Windows (x86_64)	cora-x86_64-pc-windows-msvc-v0.17.2.zip

🚀 Quick Start

# Quick install (Linux / macOS)
curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install.sh | sh

# Or via cargo
cargo install cora

# Init project
cora init

# Review staged changes
CORA_API_KEY=your-key cora review --staged

Full changelog: https://github.com/codecoradev/cora-code/blob/main/CHANGELOG.md

Release v0.17.1

What's New in v0.17.1

Fixed

• Hardcoded secrets in Go short declarations, YAML/JSON keys and SQL PASSWORD literals are now detected. Go password := "..." (with or without a trailing comment) and var apiKey string = "..." (#618); unquoted YAML password: hunter2hunter2 and JSON quoted keys "password": "..." / "apiKey": "..." (#619); SQL CREATE USER app WITH PASSWORD '<literal>' and IDENTIFIED BY '<literal>' (#620). References stay quiet: ${VAR}/$VAR, !tag, *alias, &anchor, paths, null/required-style bare words, and SQL placeholders (PASSWORD '%s'). The LLM secret cross-check uses the same pattern, so LLM findings on these shapes are no longer dropped.

Changed

• One shared post-processing module for cora review and cora scan. The finding filter pipeline (LLM secret false-positive cross-check, Markdown code blocks, ignore.rules, inline cora-ignore:, context-line filter, scanner merge for scans) now lives in engine::postprocess, so a fix lands in one place. Internal refactor with no CLI or output change (#610).

• ReviewIssue::new constructor and table-driven hardcoded-secret tests. ReviewIssue is now built through ReviewIssue::new(..) plus with_* setters, so adding a field touches one place instead of every construction site. One end-to-end table covers the hardcoded-secret heuristics across languages; known false positives/negatives are pinned in a separate table. Internal change with no CLI or output change (#610).

📦 Platforms

Platform	File
Linux (x86_64)	cora-x86_64-unknown-linux-gnu-v0.17.1.tar.gz
Linux (ARM64)	cora-aarch64-unknown-linux-gnu-v0.17.1.tar.gz
macOS (Apple Silicon)	cora-aarch64-apple-darwin-v0.17.1.tar.gz
Windows (x86_64)	cora-x86_64-pc-windows-msvc-v0.17.1.zip

🚀 Quick Start

# Quick install (Linux / macOS)
curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install.sh | sh

# Or via cargo
cargo install cora

# Init project
cora init

# Review staged changes
CORA_API_KEY=your-key cora review --staged

Full changelog: https://github.com/codecoradev/cora-code/blob/main/CHANGELOG.md

Release v0.17.0

What's New in v0.17.0

Fixed

• A cora-ignore: naming a scanner rule could hide an unrelated LLM finding on the same line. A scanner finding is now merged into an LLM issue on the same line only when they share a topic word (the secret family — password, key, token, credential — counts as one topic); otherwise both are reported and the marker suppresses only the finding it names (#609).

Fixed

• Real secrets in typed declarations were missed. const password: string = "..." (TypeScript), password: str = "..." (Python) and let password: &str = "..." (Rust) matched none of the secret patterns (they required the value right after password =/password:), and cora review also dropped the LLM's finding on them (and on single-quoted literals) as a false positive. The scanner, the built-in rule and the LLM cross-check now allow an optional type annotation, and the cross-check accepts single-quoted literals. The bare identifier check in the object-shorthand filter, which was always true, now rejects values containing a string literal (#607).

Fixed

• Real secrets were missed when the line had a trailing comment containing :. The hardcoded-secret false-positive filter treated the first : anywhere (even inside a comment or string) as object shorthand, so password = "..."; // note: fix later was not flagged, and no scanner finding existed on lines carrying a cora-ignore: <rule> marker. The filter now judges only the code, ignoring trailing comments and quoted colons (#603).
• Concurrent index opens could fail with UNIQUE constraint failed: schema_version.version. Schema migrations are now serialised per process, which also removes a flaky test (#604).

Added

• Findings now carry a rule_id. Deterministic scanner findings (rules, secrets, security, index) keep their rule id through the merge; it appears in pretty/compact output, as rule_id in JSON (omitted when absent, so older JSON still deserializes), and as properties.coraRuleId in SARIF (#597).

Changed

• cora-ignore: and ignore.rules match rule ids. cora-ignore: sec-hardcoded-secret suppresses by id (exact, case-insensitive) as well as title; ignore.rules additionally matches ids exactly. A marker naming a scanner rule now also suppresses the LLM finding that displaced that scanner finding on the same line (#597).

📦 Platforms

Platform	File
Linux (x86_64)	cora-x86_64-unknown-linux-gnu-v0.17.0.tar.gz
Linux (ARM64)	cora-aarch64-unknown-linux-gnu-v0.17.0.tar.gz
macOS (Apple Silicon)	cora-aarch64-apple-darwin-v0.17.0.tar.gz
Windows (x86_64)	cora-x86_64-pc-windows-msvc-v0.17.0.zip

🚀 Quick Start

# Quick install (Linux / macOS)
curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install.sh | sh

# Or via cargo
cargo install cora

# Init project
cora init

# Review staged changes
CORA_API_KEY=your-key cora review --staged

Full changelog: https://github.com/codecoradev/cora-code/blob/main/CHANGELOG.md

Release v0.16.1

What's New in v0.16.1

Fixed

• cora scan no longer reports "No issues found" when the LLM fails. It now runs the deterministic secrets and security scanners on every scanned file, merges them with LLM findings, and applies ignore.rules and inline cora-ignore: markers (read from file contents), so a hardcoded secret is reported even on an LLM 502 (#595).
• The LLM no longer flags cora-ignore: markers themselves (e.g. "Security scanner findings suppressed instead of remediated"). The hardened system prompt now explains the marker is Cora's own suppression syntax (#596).

📦 Platforms

Platform	File
Linux (x86_64)	cora-x86_64-unknown-linux-gnu-v0.16.1.tar.gz
Linux (ARM64)	cora-aarch64-unknown-linux-gnu-v0.16.1.tar.gz
macOS (Apple Silicon)	cora-aarch64-apple-darwin-v0.16.1.tar.gz
Windows (x86_64)	cora-x86_64-pc-windows-msvc-v0.16.1.zip

🚀 Quick Start

# Quick install (Linux / macOS)
curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install.sh | sh

# Or via cargo
cargo install cora

# Init project
cora init

# Review staged changes
CORA_API_KEY=your-key cora review --staged

Full changelog: https://github.com/codecoradev/cora-code/blob/main/CHANGELOG.md

Release v0.16.0

What's New in v0.16.0

Added

• Rule-scoped inline suppression with cora-ignore:. A source comment such as // cora-ignore: Hardcoded password or secret in variable (also #, --, /* */, <!-- -->; comma-separated rules) suppresses findings with that exact title (case-insensitive) on the same line, or on the next line when the marker line holds only a comment. Applies to both static-scanner and LLM findings; other rules and other lines stay visible, and a bare cora-ignore without rules suppresses nothing. Coexists with ignore.rules / ignore.files (#554).

Security

• Project .cora.yaml can no longer redirect your API key. provider.base_url from a discovered project config is ignored unless CORA_TRUST_PROJECT_CONFIG=1; base_url must be https (plain http only for loopback); LLM error bodies echoed to the terminal are length-capped (#563).
• Hardened cora upgrade and install.sh. Checksums are matched by exact filename; downloads go to a random 0700 temp dir; only the single cora binary entry is extracted (symlink/hardlink entries are rejected); every request has a timeout and a size cap; the version probe does not follow redirects and the tag is validated. CORA_UPGRADE_SKIP_CHECKSUM now also requires CORA_UPGRADE_I_UNDERSTAND=1. install.sh fails closed when the checksums file or entry is missing (opt out with CORA_SKIP_CHECKSUM=1) and falls back to shasum -a 256 (#572).
• install.sh requests now have timeouts and size caps. Every curl call sets --connect-timeout, --max-time and --max-filesize (256 MiB archive, 1 MiB checksums/API JSON), matching cora upgrade, so a stalled or hostile server cannot hang or flood the installer (#580).
• Hardened LLM response handling. Review and scan system prompts tell the model to treat diff content as untrusted data; the diff fence is longer than any backtick run in the diff; the SSE stream errors on a line over 1 MiB or more than 16 MiB of content (#573).
• Secrets in test and doc files are no longer invisible to the static security scanner. Test and doc paths still skip the noisy general rules but now run high-confidence checks (AWS keys, private-key headers, GitHub/Slack/Stripe live tokens; values containing EXAMPLE are ignored) (#573).

Fixed

• cora watch reindexed every source file on each cycle. Change detection now reindexes only files that changed, and --filter restricts what is indexed instead of only gating the trigger (#578, #584).
• Secrets in test, fixture and example files were skipped entirely by the secrets scanner. High-confidence secrets are now reported in those paths too (#579, #583).
• cora findings list --severity never matched, and severity colouring never applied. Both are now case-insensitive (#586, #588).
• Unit tests wrote to the real data directory and could block on the global vector index lock. Tests are isolated from the real data dir, and the lock wait is bounded (#587, #589).
• cora affected never matched naming-convention tests. The CLI took the file extension (rs) as the file stem. CLI and MCP now share one query, with escaped LIKE wildcards, batched queries and one deduplicated pattern list ({stem}_test, test_{stem}, {stem}.test, {stem}.spec, tests/{stem}, __tests__/{stem}). MCP dead-code now honors analysis.entry_point_patterns like the CLI (#575).
• cora --config <file> serve ignored --config. The global option is now passed through (#576).
• MCP brain_search ignored the configured embedding backend. It now resolves the backend from the project config (#576).
• Review and indexing disagreed about which files to skip. Review-time scanners now use the same patterns as the indexer (ignore.files + index.skip_files) (#576).
• Review scanners could resolve a different project than indexing when run from a subdirectory or workspace member. Every entry point now resolves the project root the same way, and review no longer creates an empty cora.db when no index exists (#574).
• Files from different projects overwrote each other's fingerprints (perpetual reindex). Files are keyed by (project_id, path) (schema v8). callers/callees/trace match names exactly instead of by substring (run no longer matches rerun), and index runs prune stale files and their edges (#565).
• MCP server robustness. Stdin is framed as bytes and decoded as UTF-8; garbage input yields a -32700 parse error; notifications get no response and notifications/cancelled no longer stops the server; tools/call without a name returns -32602; limit/depth/min_lines are clamped; cora.install requires confirm: true (#564).
• Chunked review printed "No issues found" while reporting issues when chunks returned empty summaries (#562).
• CI: the CLA check works for fork PRs (#553); rustls pinned to 0.23.45 for RUSTSEC-2026-0285 and a deprecated f32 import removed so clippy passes on rustc 1.99 (#561).

Changed

• Ignore patterns now use a single matcher for the index walk, review scanners, cora scan --include/--exclude and watch --filter. Behavior changes you may notice in ignore.files and related options:
  • **/*.test.ts no longer matches footest.ts, and vite.config.* no longer matches vite.configx.
  • Patterns with a wildcard in the middle (src/*.rs, *.gen.*) now match; they were silently ignored before, so files you thought were excluded may now actually be excluded.
  • Patterns without a / also match by basename, in cora scan --include/--exclude and watch --filter too.
  • An invalid glob matches literally instead of being dropped (#577).
• cora index --watch now runs the same watcher as cora watch. It checks every 500 ms (was 2 s), skips hidden directories, and prints Reindexed: ... (#576).
• Internal refactors with no CLI change: one seam for opening the index (IndexBridge, #574), one index-session module (#576), and review split into a deterministic stage testable without an LLM (#577), LLM parse/repair/retry policy unified behind one Transport seam (#582), and review-history SQL owned by a single review_store module (#585).

📦 Platforms

Platform	File
Linux (x86_64)	cora-x86_64-unknown-linux-gnu-v0.16.0.tar.gz
Linux (ARM64)	cora-aarch64-unknown-linux-gnu-v0.16.0.tar.gz
macOS (Apple Silicon)	cora-aarch64-apple-darwin-v0.16.0.tar.gz
Windows (x86_64)	cora-x86_64-pc-windows-msvc-v0.16.0.zip

🚀 Quick Start

# Quick install (Linux / macOS)
curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install.sh | sh

# Or via cargo
cargo install cora

# Init project
cora init

# Review staged changes
CORA_API_KEY=your-key cora review --staged

Full changelog: https://github.com/codecoradev/cora-code/blob/main/CHANGELOG.md

Release v0.15.0

What's New in v0.15.0

Added

• Opt-in vecq vector store for Brain Mode. Set brain.vector_store: vecq in .cora.yaml to replace the usearch HNSW index with a vecq quantized scan (pure Rust, deterministic, ~5x smaller). Keyed persistence included: symbol ids survive reload, so a fresh process serves the index as-is and cora index no longer re-embeds unchanged projects (#542, #547).
• brain.vector_bits quantization-width knob. residual (default) | 4 | 5 | 6 — 4-bit base codes with second-pass residual rescoring, or plain Lloyd-Max widths. The default is residual: best recall@10 at 4-bit scan speed in a recall study on cora's own embeddings, ahead of plain 5-bit at 1k/5k/13k-symbol scales. Changing the width rebuilds the index once on the next cora index instead of silently serving the old width; unknown values fall back to residual.

Fixed

• Vector signal never fired in a fresh process. cora brain and MCP brain_search only saw the vector index if the same process had run the embed — otherwise results silently degraded to FTS-only. The search path now lazy-loads the on-disk index once per process, with a dimension guard against backend switches (#545).
• Stale embed fingerprints after a global vector-index rebuild. The vector index is a single file shared by all projects; rebuilding it (width/dims change, legacy file, corruption) wiped every project's vectors while their fingerprints still said "embedded" — the incremental path would skip those symbols forever. A rebuild now clears fingerprints for all projects, and the usearch dims-mismatch path (which deleted the index without clearing) joins the same heal.

Changed

• vecq-core dependency 0.2.0 → 0.3.0. Picks up the 4-bit+residual mode, plain 5/6-bit widths, runtime-detected AVX2 scoring, and file formats v1.3–v1.5 with the keyed-slot table. Pre-0.3.0 .vecq files carry no key table and rebuild once with a warning, then upgrade to the keyed format.

📦 Platforms

Platform	File
Linux (x86_64)	cora-x86_64-unknown-linux-gnu-v0.15.0.tar.gz
Linux (ARM64)	cora-aarch64-unknown-linux-gnu-v0.15.0.tar.gz
macOS (Apple Silicon)	cora-aarch64-apple-darwin-v0.15.0.tar.gz
Windows (x86_64)	cora-x86_64-pc-windows-msvc-v0.15.0.zip

🚀 Quick Start

# Quick install (Linux / macOS)
curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install.sh | sh

# Or via cargo
cargo install cora

# Init project
cora init

# Review staged changes
CORA_API_KEY=your-key cora review --staged

Full changelog: https://github.com/codecoradev/cora-code/blob/main/CHANGELOG.md

v0.14.0 — smarter review context, usable dead-code, resilient LLM calls

What's New in v0.14.0

This release makes Cora harder to fool and its output easier to trust.

Reviews now see the code around your diff. When a hunk touches branching constructs, Cora attaches the enclosing function from the post-image file, so claims like "this branch never calls X" get checked against the real match arm instead of guessed from diff shape. A standing guardrail tells the model not to assert reachability it cannot verify.

Dead code you can act on. Method calls that cross crate lines finally resolve, so library functions with real callers stop showing up as dead. Public API surface is skipped by default since its consumers live outside the repo; pass --include-pub when you want it back. Ignore patterns from .cora.yaml are now honored during indexing, not just during review.

Reviews survive chatty models. Reasoning models sometimes spend the whole output budget thinking and return an empty answer. Cora now raises the budget and retries on its own, and can read the final JSON straight out of the reasoning text, so a working review no longer dies with a cryptic parse error.

Better project identity. Running cora index inside a workspace member crate no longer creates a second, invisible project. Incremental runs say "Index up to date" with real totals, and index_status explains itself when a root mismatch is detected.

Also in this release: Cora is relicensed from MIT to Apache-2.0, with a Contributor License Agreement for individual and corporate contributors.

Full changelog: see CHANGELOG.md. Thanks to everyone who filed reproducible issues.

Release v0.13.0

What's New in v0.13.0

Added

• Runtime embedding backend selection. Brain Mode now reads brain.embedding from .cora.yaml to select the embedding backend at runtime instead of compile time. Supported values: auto (best available — default), hashing (force 256d zero-dependency), pretrained (force 768d nomic). No recompilation needed to switch.
• Incremental per-symbol embedding. embed_project() now tracks an embed_fingerprint (hash of symbol name + signature) and skips re-embedding symbols that have not changed since the last index. On large projects, re-indexing after touching one file embeds only the changed symbols instead of all.
• Schema migration v7. Adds embed_fingerprint TEXT column to the symbols table for incremental embedding tracking. Auto-migrates on first run; existing indexes are upgraded transparently.
• Backend enum + resolve_backend() in embed module. Clean runtime dispatch with OnceLock caching, graceful fallback when a requested backend is not compiled, and active_dims() / active_provider_name() helpers.
• BrainConfig + BrainEmbeddingMode in config schema. New brain section in .cora.yaml with embedding field. Includes Display, FromStr, and serde impls for CLI and YAML ergonomics.

Changed

• embed_code_dispatch() now checks ACTIVE_BACKEND at runtime. Previously selected via #[cfg] at compile time only. Falls back to compile-time default if resolve_backend() was never called (lazy resolution).
• cora index, cora brain, cora watch all resolve embedding backend on startup. Each command loads .cora.yaml, reads brain.embedding, and calls resolve_backend() before touching the vector index.
• Embedding doc comments updated. Module-level docs now describe runtime selection and the three-tier architecture (hashing → pretrained → ONNX future).

📦 Platforms

Platform	File
Linux (x86_64)	cora-x86_64-unknown-linux-gnu-v0.13.0.tar.gz
Linux (ARM64)	cora-aarch64-unknown-linux-gnu-v0.13.0.tar.gz
macOS (Apple Silicon)	cora-aarch64-apple-darwin-v0.13.0.tar.gz
Windows (x86_64)	cora-x86_64-pc-windows-msvc-v0.13.0.zip

🚀 Quick Start

# Quick install (Linux / macOS)
curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install.sh | sh

# Or via cargo
cargo install cora

# Init project
cora init

# Review staged changes
CORA_API_KEY=your-key cora review --staged

Full changelog: https://github.com/codecoradev/cora-code/blob/main/CHANGELOG.md

Release v0.12.0

What's New in v0.12.0

Fixed

• FTS5 returning 0 results for camelCase queries (#451). Added file column to FTS5 virtual table (schema v6), split_camel_case() identifier decomposition, and OR query expansion. Searches like findUser now correctly match via find OR user.
• Dead-code false positives on framework entry points (#452). Added FRAMEWORK_ENTRY_PREFIXES with SQL LIKE pattern matching for common framework handlers (handle_*, on_*, route_*, etc.) — these are no longer flagged as dead code.
• Symbol-level suppression markers (#452). Symbols containing // cora: keep in their body are excluded from dead-code detection.
• Sticky skip files on config change (#453). Added index_config_hash column to projects table — when .cora.yaml changes, previously skipped files are re-evaluated instead of permanently skipped.

Added

• entry_point_patterns config field — New field in AnalysisConfig and .cora.yaml analysis section. Custom list of glob patterns for framework-specific entry points beyond built-in defaults.
• Schema migration v6 — Auto-migration: adds index_config_hash to projects, drops and recreates FTS5 with file column, rebuilds search index.
• index_project_with_skip() — Indexing now respects index_skip_files from config, skipping non-code files during symbol extraction.
• split_camel_case() — Decomposes camelCaseIdentifiers into individual tokens for FTS5 search (camelCase → camel OR case).
• Enhanced sanitize_fts_query() — Handles quoted phrases, trims whitespace, and escapes special FTS5 characters.
• 31 new unit tests — Tests for camelCase splitting, FTS5 query expansion, glob matching, suppression markers, framework prefix detection, schema migration v6, and config hash invalidation.

Changed

• should_skip_file() rewritten — Simplified glob matching with early exit for non-glob patterns, explicit **/name branch handling.
• Governance documentation — Added CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md, PR template, issue templates (bug report + feature request), and PR checks workflow (branch naming, conventional commits, PR description validation).

📦 Platforms

Platform	File
Linux (x86_64)	cora-x86_64-unknown-linux-gnu-v0.12.0.tar.gz
Linux (ARM64)	cora-aarch64-unknown-linux-gnu-v0.12.0.tar.gz
macOS (Apple Silicon)	cora-aarch64-apple-darwin-v0.12.0.tar.gz
Windows (x86_64)	cora-x86_64-pc-windows-msvc-v0.12.0.zip

🚀 Quick Start

# Quick install (Linux / macOS)
curl -fsSL https://raw.githubusercontent.com/codecoradev/cora-code/main/install.sh | sh

# Or via cargo
cargo install cora

# Init project
cora init

# Review staged changes
CORA_API_KEY=your-key cora review --staged

Full changelog: https://github.com/codecoradev/cora-code/blob/main/CHANGELOG.md