Skip to content

v0.20.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 21 Jul 14:22
v0.20.0
79eb059

v0.20.0

Routing is injection, end-to-end

Routes are resolved from visible code literals on two axes — path and HTTP verb. When either axis is dynamic, zzop now marks an injection boundary instead of fabricating a route:

  • The old [GET, POST] verb fabrication is gone → cross-layer/unknown-verb-route discloses the unknown verb.
  • A non-literal route path is dropped honestly (tri-state), never collapsed into a phantom route at an empty base.
  • Java and C# now resolve non-literal method-path / class-prefix constants across the whole corpus.
  • New lightweight routes injection field (AnalyzeRequest + config trees[].routes) and paste-ready data.injectionStub strings close the last mile: inject the missing route fact and the cross-layer join resolves.

Native C# (ASP.NET Core)

New tree-sitter frontend: symbols/imports/namespaces, attribute-routed + minimal-API HTTP provides, HttpClient egress consumes, namespace dependency graph, and a whole-corpus route-constant resolver (partial classes are merged, not dropped).

ORM db-table channel complete — 5 producers

Prisma/SQL DDL, TypeORM @Entity, GORM, SQLAlchemy/SQLModel, and Django all mint and consume the db-table join channel under one canonical key.

Framework auth-route modeling

mutating-route-no-auth now models Spring method-security + global SecurityFilterChain and NestJS forRoutes middleware; route-shadowing fires only on first-match routers (framework-scoped). Environment gates (isLocal / isProduction / NODE_ENV) are no longer mistaken for authorization.

Multi-verb route expansion

axum any(), express/hono .all, gin .Any, and FastAPI @api_route(methods=[...]) each expand to one route per verb.

Distribution: npm removed

@zzop/cli and @zzop/native are gone — the zzop-mcp binary is the single runtime form. An MCPB manifest ships for Claude Desktop, and validate-envelope / validate-rule-pack CLI subcommands were added.

Behavior changes to expect

Parser fingerprints bumped for C#, Go, Java, Python, Rust, SQL, and TypeScript (route-axis + db-table + egress work), so those languages' cached per-file results recompute once. C#, the TypeORM/GORM/SQLAlchemy/SQLModel/Django db-table channel, and framework-auth findings are new. Verb-unknown routes now disclose instead of fabricating GET/POST. No npm packages are published.

Full Changelog: v0.19.0...v0.20.0

Assets 12
Loading