v4.48.0

4.48.0 (2026-10-12)

Features

• cicd: print done settings for Vitest and Jest in cicd init (#997) (c79cdc5)
• cli: explain security evidence and scan coverage (#985) (8458ed2)
• gate: fail on critical AI-code issues by default and always print the verdict (#991) (cb6f54a)
• hooks: block shell commands that print secrets (#996) (e711fcd)
• provenance: record agent edits and preserve commit associations (#958) (20b62cc)
• reporting: replace blended grades with clear scan assessments (#983) (386718e)
• scan: skip generated files and reserve critical for shipped code (#992) (d0bf61c)

Bug Fixes

• cli: enforce scan coverage and catch PR dead-code regressions (#984) (5119cc9)
• cli: improve help, reports and CI setup safety (#965) (9db0c2e)
• cli: show workspace naming and handle invalid credit responses (#966) (086ba1f)
• dead-code: next.js conventions, php type references and laravel (#990) (0111d5c)
• dead-code: recognize bounded Flask and Django entrypoints (#972) (9eb23cd)
• dead-code: stop getattr hiding unrelated dead code (#971) (56f1545)
• deps: read requirements like pip, pnpm lockfiles and setup.cfg (#988) (bae44e6)
• docs: correct claims and standardize CLI plan names (#967) (a0c77f4)
• doctor: detect the native accelerator and correct build advice (#961) (7a31d92)
• gate: explain results and count custom findings (#963) (199ed4e)
• packaging: pin PyPI README links to the release tag (#979) (556e8fc)
• quality: require diagnostic evidence for debug output (#968) (95cb62f)
• sca: disclose non-registry uv sources without failing valid scans (#994) (0cb9bee)
• scan: keep full scans whole when the tree has uncommitted edits (#962) (5754fa3)
• scan: reduce false alarms while preserving dangerous command detection (#964) (a522560)
• secrets: distinguish descriptive token labels from credentials (#995) (4102f1e)
• security: block authentication loss in PR gates and done (#973) (16df15a)
• security: stop false positives on test clients, fixed hosts and CI setup (#989) (03c6818)
• skills: hide repository maintenance skills from discovery (#982) (764f5f1)
• typescript: parse valid syntax tree-sitter-typescript rejects (#987) (1aeae3d)
• vscode: correct listing claims and shrink extension package (#981) (55b4f5d)

Performance Improvements

• analyzer: speed up repeated attribute scoring without changing results (#975) (e11b183)
• cli: avoid unused report JSON copies (#974) (1da322a)

Documentation

• mcp: explain tool inputs, effects and result resources (#980) (61f09fb)
• packaging: clarify Python scope and package links (#977) (82cfb4d)
• readme: lead with Python checks and common commands (#978) (b0e38d8)