Caliper v1.2.0

Caliper v1.2.0

Cross-method lifecycle rules (issue #8), plus the go install version-reporting fix that landed after v1.1.1. Caliper now exposes 26 MCP tools across seven categories.

Added — cross-method lifecycle rules

The bellui pre-v1 audits showed the properties worth checking in a GUI toolkit are cross-method, while all analyses were function-local. Three new capabilities close that gap:

• check_paired_calls — type-scoped pairing rule: a match of first_pattern in any method of a type requires a match of second_pattern somewhere in the type's method set, or in a companion type its methods construct (the widget→renderer link). Pairs by field identity when both patterns share a metavariable bound to a receiver field, lenient otherwise — $x.Start() on one field is not excused by $x.Stop() on a different one, but an unresolvable binding never produces a false positive.
• find_stale_capture — capture-at-create vs re-read-at-refresh: exported fields copied in a capture method (CreateRenderer) and never re-read in the re-read method (Refresh) of the type or its constructed companions.
• find_pattern gains inside / not_inside enclosing-context filters: "go", "defer", "callback_of:<pattern>", "call:<pattern>". Expresses goroutine-context call discipline like "widget mutation inside go/time.AfterFunc contexts must be wrapped in ui.Do(...)" in one call. Context is lexical: code in a named function called from a go statement elsewhere does not count as "inside go".

Both new tools are whole-program analyses and honor //caliper:ignore suppressions and .caliper.pxf severity overrides like every other check.

Fixed

• go install-ed binaries report their version instead of dev. go install pkg@version builds from the module cache and records no vcs.* settings, so resolveVersion now falls back to Main.Version. Local builds keep reporting dev-<rev>[-dirty].
• Download instructions that actually work: docs/getting-started.md now documents gh release download (with a raw-curl asset-endpoint equivalent and a checksums.txt verification step) instead of the browser-download URL, which 404s for private repos.

Install

Binaries for macOS / Linux / Windows × amd64 / arm64, built CGO_ENABLED=0 with -trimpath, stamped with -X main.Version=v1.2.0. caliper is the MCP server; caliper-analyze is the single-shot SARIF/JSON CLI.

gh release download v1.2.0 --repo trendvidia/caliper -p caliper-darwin-arm64
chmod +x caliper-darwin-arm64 && sudo mv caliper-darwin-arm64 /usr/local/bin/caliper

Or:

brew install trendvidia/tap/caliper   # macOS
go install github.com/trendvidia/caliper/cmd/caliper-mcp@v1.2.0

Full details in CHANGELOG.md.