Release v0.7.0

Highlights

A correctness release. No new commands; detection, replay and artifact sizes are more often right, and three changes need a rescan or a recreated baseline.

Before you upgrade: rescan and recreate baselines

The C, C++ and Rust frontends now split and name some code differently, so their recorded versions moved. Ids recorded by 0.6.0 for affected code do not carry over, and a baseline written by 0.6.0 names the old detector versions. Create a fresh baseline with codehelion baseline create after the first 0.7.0 scan, as Baselines describes for any detector-version change.

The database schema did not change. A 0.6.0 database opens as it is. A scan after the upgrade analyses the tree again instead of replaying the 0.6.0 run, because run reuse now compares the tool and detector versions.

Destructor and operator units in C and C++ Fast mode are now named ~Name, operator== and so on. A symbols suppression glob written against the old names needs updating.

Detection

• Fast mode keeps a whole-function verbatim duplicate even when a renamed fragment of it also exists. Fast recall on the Rust corpus goes from 0.7143 to 0.8571. Structural figures are unchanged.
• Adding a C++ file to a tree with no bare .h file no longer changes every stable id.
• Group order and the occurrence each group is measured against no longer depend on file discovery order.
• Structural mode no longer overflows the stack on very long return/break/yield or fn() -> chains.
• A Rust doc comment no longer widens the lines a unit reports, and its text no longer enters the token stream.
• Fast mode handles constructors after an access specifier, operator>, records with C++11 attributes, trailing return types with multi-argument templates, &mut impl Trait parameters and qualified function-pointer types.

Reports and replay

• report without --run, seam, and the seam findings count cover every partition of a multi-configuration Semantic scan.
• report --run N shows the seam block recorded with that run and the suppressions that run applied. It says explicitly that the baseline status is not replayed, in text, JSON (summary.baseline_not_replayed) and SARIF.
• explain and report agree on ranking and order. Printed short ids are unique within the report.
• Printed replay and explain commands carry --path, --config, --db and --untrusted when they are needed.
• Every command resolves a relative --db against the working directory, doctor included.
• Command-line usage errors exit with status 2 in every command.

Seam tracking

--until accepts annotated tags, and a shallow clone is read to its depth with a warning instead of failing.

Artifact analysis

• ELF dead-code candidates and retained sizes follow tail jumps and address-taken functions.
• Same-address ELF aliases are no longer counted twice.
• Inferred function sizes no longer cut real trailing instructions.
• artifact compare reports changed native code as modified when the format has no body identity.
• PDB expansion is bounded by the same budget as DWARF.
• Archives and relocatable objects no longer claim line attribution they cannot produce.

Hardening

• A discovered codehelion.toml that is a symlink is refused, and configuration reads are capped at 1 MiB.
• Under --untrusted, a database whose lock, WAL, SHM or journal file is a symlink is refused.
• Two commands creating the same new database at once no longer fail with an orphaned-sidecar error; the second waits for the first to finish.
• A Semantic helper ends its own process group when the scanner disappears, so build scripts and compilers do not outlive a cancelled scan.

Library crates

codehelion-store changed its API: Store::activate_suppressions is replaced by Store::confirm_reused_run, and looking up a group by a malformed id now returns an error.

Full Changelog: v0.6.0...v0.7.0