v0.16.0

v0.16.0 is a scoping release. fix and scan can be pointed at what changed rather than the whole tree, and fix can show what it would do before it does it.

No scoring change in this release. Unlike 0.15.0, existing badges and CI thresholds are unaffected.

Added

• aislop fix --dry-run. Prints the planned fix steps, including the ones that will be skipped and why, without writing anything. It cannot be combined with an agent handoff or --prompt; that combination is rejected rather than silently ignored.
• aislop fix --changes, --staged, and --base <ref>. Restricts fixes to changed or staged files, matching the flags scan already accepted. --base sets the diff base, defaulting to HEAD.
• Changed-line context on findings. Diagnostics are classified as changed-line or existing-file context, so a scoped run separates what a change introduced from what it merely sits next to. Surfaced in terminal, JSON, and SARIF output.

Fixed

• Dependency fixes stay inside the selected scope. A scope holding a lockfile and a source file, but not package.json, previously still ran the unused-dependency fixer, which always rewrites package.json. Fixes can no longer touch a file outside the selection. The force audit and Expo alignment steps shared the same gap.
• Dependency-only scopes work. Selecting just a manifest detected no source language, so every dependency fixer skipped a scope that explicitly asked for it.
• Scoped fix no longer rewrites test files. A scoped run merged test files into the fixer's file list, so fix --changes edited a changed test file that a plain fix leaves alone.
• Scoped fix and scan agree on the score. fix measured finding density against the selection while scan measured it against the project, so the same scope reported different numbers.
• --dry-run no longer deletes a same-named file. The dotnet format report was written into the project root and removed on every run, destroying a user-owned .aislop-dotnet-format.json. It now lives outside the tree, which fixes the non-preview path too.
• C# and C/C++ formatters appear in the dry-run plan instead of being omitted from the skipped-step list.
• Changed-line detection survives forced git colour, an external differ, and diff-shaped content. git diff now runs with --no-color and --no-ext-diff, and a file header is only recognised outside a hunk body, so an added line beginning ++ can no longer be read as a new file and swallow the hunks after it. Each of these previously left every diagnostic silently classified as unknown.
• fix respects CI=true. Only CI=1 was honoured, so spinner escape sequences reached the logs on GitHub Actions, GitLab and CircleCI.
• The agent TUI elapsed time advances. It was derived from the clock during render with nothing scheduling a repaint, so it sat stale until an unrelated update happened to redraw the sidebar.

Internal

• Dependency bumps: @biomejs/biome 2.5.10, vitest 4.1.11, @types/node 26.4.0, expo-doctor 1.20.3, github/codeql-action 4.37.9.

Upgrading

npx aislop@0.16.0 scan

Scores are unchanged from 0.15.0 for the same code, so nothing needs re-baselining.

One behaviour change worth noting if you script the CLI: fix --dry-run combined with an agent handoff or --prompt now exits 1 with an error. It previously printed a plan and exited 0 without launching anything.

Validation

• 2,101 tests passing across 201 files
• Linux and Windows CI passing on Node 22 and 24
• Typecheck and build clean
• aislop self-scan at 100/100
• npm pack --dry-run produces aislop-0.16.0.tgz, 32 files, with the bundled JetBrains asset and postinstall script present