Skip to content

CodeInspectus 3.3.0 — Verified Cleanup

Choose a tag to compare

View all tags
@Synvoya Synvoya released this 03 Oct 06:13
· 2 commits to master since this release
v3.3.0
This tag was signed with the committer’s verified signature.
Synvoya Synvoya
SSH Key Fingerprint: k+H95W+vdF3kckXYqNA2BuQN2CTW0V1iKiihoKcbKGA
Verified
Learn about vigilant mode.
ce940cd

Verified Cleanup

CodeInspectus 3.3 adds approval-gated cleanup for verified repository-trust artifacts:

  • codeinspectus_plan_cleanup (read-only) reproduces evidence for exact artifact IDs, rejects protected, ambiguous, or unsupported records, records preimage hashes, and shows every exact transformation before approval.
  • codeinspectus_apply_cleanup requires exact-scope confirmation (plus a separate rights confirmation for attribution/provenance), makes managed backups, applies bounded atomic edits, rescans with the same validators, and automatically rolls back on partial failure.
  • codeinspectus_rollback_cleanup restores recorded preimages, or removes generated clean copies, only when current hashes still match the applied result.
  • Copy-only metadata adapters for PNG, JPEG, MP3, WAV, MP4, MOV, M4A and M4V. Originals are preserved.

Safety boundary

  • Scanning and planning stay read-only. Apply and rollback are the only tools that change files, and their MCP annotations mark them destructive.
  • Git history and protected legal, licensing, compliance, and C2PA records are never eligible.
  • No arbitrary repository commands are run. Tests, formatters, and builds are reported not_run for the calling agent to complete.
  • No pixel/audio/frame changes, no statistical watermark detection or rewriting, and no claim that cleaned content is human-authored.

Security fixes

  • Finding snippets and messages are scrubbed value-agnostically before persistence and output. Earlier versions could surface a neighbouring or window-truncated credential in location.snippet. Scan history written by earlier versions under ~/.codeinspectus/scans may contain such snippets: delete it and rotate any affected credential.
  • Git runs with overrides that a scanned repository's config cannot change (no fsmonitor, hooks, signature programs, or pagers). Working-tree comparisons are refused when filter drivers are configured. Earlier versions could run programs named in a scanned repository's .git/config.
  • Terminal control characters from repository-controlled text are rendered as visible \uXXXX escapes. JSON and SARIF output is unchanged when parsed.
  • Sealed-bundle verification rejects manifest content outside the seal.

Fixed

  • CI policy no longer exits 2 because of harmless documentation symlinks such as CLAUDE.md -> AGENTS.md.
  • Git-scoped enforcement counts findings a change introduces outside the changed paths and measures diffs from the merge-base.
  • Native Pub coverage is no longer partial for every Flutter project or once the bundled snapshot is a week old.
  • Inserting lines above a finding no longer makes rescan or baseline report it as both resolved and new.
  • SARIF regenerated from a sealed export keeps its recorded driver version, so 3.2.0 bundles verify under 3.3.0.

See CHANGELOG.md for the complete release notes.

Assets 2
Loading