v1.2.26

Highlights

• Dependency analysis now resolves Python distributions from import evidence instead of assuming a package name and an import name are identical.
• Clone detection recognizes substantially more Python syntax, produces more reliable results, and avoids unnecessary work on large codebases.
• The VS Code extension now keeps diagnostics and manual rescans in sync with the active workspace and document state.
• MCP file-oriented tools are confined to their configured project root, while release installers verify downloaded artifacts before execution.
• Added reference documentation for nine dangerous-code rules and expanded the related coverage corpus.

Dependency Analysis That Follows Real Python Packaging

• Added import-location evidence collection for static imports, literal dynamic imports, aliases, and type-checking-only code.
• Matches installed distribution metadata and explicit package_mapping configuration before using built-in package knowledge, eliminating guesswork where a distribution and its import package have different names.
• Handles namespace-package roots, src/ layouts, parent manifest discovery when analysis starts in a subdirectory, included requirements files, and literal setup.py or setup.cfg dependency declarations.
• Treats TYPE_CHECKING imports as valid usage without treating them as runtime requirements, reducing misleading unused-dependency findings while preserving runtime missing-dependency checks.
• Consolidates multi-import distributions into one dependency finding and adds broad regressions for dependency-analysis edge cases.

More Accurate And Scalable Clone Detection

• Extends clone modeling to definitions, signatures, decorators, lambdas, comprehensions, generators, f-strings, match patterns and guards, and modern generic type syntax.
• Preserves semantic differences that should prevent a match while still normalizing safely renameable identifiers for Type-2 clone detection.
• Makes clone reporting deterministic and validates configuration thresholds and source metadata before producing results.
• Improves large-workspace performance by splitting oversized candidate groups, caching failed loads, avoiding global edge rescans, and reducing edit-distance memory use.
• Removes unsafe clone auto-fixing paths so findings cannot trigger an incorrect source mutation.

VS Code Diagnostics And Scan Scheduling

• Refreshes current-file and workspace analysis through the canonical diagnostic path, so manual rescans update the Problems view rather than only printing command output.
• Adds per-file debouncing, queued workspace reruns, multi-root workspace support, and clear failure-state handling.
• Resolves quick fixes against the exact finding identity and supports configured MCP executable locations.
• Packages the current Windows CLI consistently with the extension release artifacts.

MCP And Installer Hardening

• Restricts MCP path-based operations to a canonical configured project root, preventing requests from escaping the intended workspace.
• Adds explicit MCP launch and configuration arguments for controlled root selection.
• Downloads installer artifacts to temporary locations and verifies their SHA-256 values against the release manifest before installation.
• Updates installation guidance to avoid piping a remote script directly into a shell.
• Limits GitHub release-write permission to the release workflow jobs that require it.

Documentation And Rule Coverage

• Adds dedicated documentation and navigation for CSP-D006, CSP-D106, CSP-D107, CSP-D306, CSP-D412, CSP-D507, CSP-D705, CSP-D903, and CSP-D904.
• Expands the dangerous-code guide and the dangerous-code corpus, including documentation corrections and pytest-plugin coverage updates.
• Updates the nightly workflow coverage to keep the documented rule behavior aligned with CI verification.

Merged Changes

• #113 Docs update by @djinn-soul
  • Added nine dangerous-code rule reference pages, expanded guide coverage, and added them to the documentation navigation.
• #114 Docs update by @djinn-soul
  • Refined dangerous-code documentation and accompanying corpus and pytest-plugin coverage.
• #115 Codex/dependency location evidence by @djinn-soul
  • Introduced modular import-evidence collection for static, dynamic, aliased, and type-checking-only dependency usage.
• #116 fix(deps): resolve import names from evidence, not guesswork by @djinn-soul
  • Corrected distribution-to-import matching, manifest discovery, namespace and src/ handling, requirements inclusion, and setuptools declaration analysis.
• #117 Improve clone detection accuracy and performance by @djinn-soul
  • Delivered clone-analysis correctness and performance improvements together with VS Code diagnostics, scheduling, and packaging fixes.
• #118 Harden MCP and release installation by @djinn-soul
  • Confined MCP filesystem operations, added checksum-verified installers, and reduced release workflow permissions.

Full Changelog: v1.2.25...v1.2.26