Skip to content

v1.0.11

Latest
Latest

Choose a tag to compare

View all tags
@vohongtho vohongtho released this 17 Sep 06:24
v1.0.11
823a38b

Code Intel v1.0.11

Overview

Version 1.0.11 expands Code Intel from symbol indexing into evidence-backed semantic and change intelligence. The release adds:

  1. Framework semantic adapters for routes, handlers, dependency bindings, resources, prompts, forms, and embedded scripts.
  2. Graph-aware API contracts that connect HTTP producers and consumers and classify compatibility changes.
  3. Branch-aware semantic graph diff between committed Git refs without changing the active checkout or published index.
  4. Cross-repository contract drift for synchronized repository groups.
  5. Graph-backed agent workflows for exploration, debugging, impact analysis, planning, review, API review, test coverage, and security investigation.
  6. Self-contained runtime bundles for Linux and macOS on x64 and ARM64, with lifecycle management and integrity metadata.
  7. Program-analysis foundations built on a universal IR, CFG, dataflow, function summaries, PDG, and bounded taint analysis.

The release branch is release/1.0.11.

Release status: release candidate. Do not treat this document as publication evidence until the final candidate SHA passes the authoritative release workflow and is tagged v1.0.11.

Framework semantic adapters

Code Intel now detects framework registrations through multiple static signals and projects framework facts into the evidence-carrying graph. Supported adapter families include:

  • NestJS, Express, and Fastify;
  • ASP.NET Core and Microsoft dependency injection;
  • Spring;
  • FastAPI, Flask, and Django;
  • Go HTTP router patterns;
  • Laravel, Symfony, and Rails;
  • MCP SDK registrations;
  • HTML forms and embedded scripts.

Framework-derived relationships include adapter identity, version, certainty, strategy, and evidence. Detection inventories and framework fingerprints are recorded in generation metadata so stale framework-derived state can be rejected instead of silently trusted.

Graph-aware API contracts

Version 1.0.11 adds normalized producer and consumer facts for HTTP APIs:

  • method and normalized route path;
  • request and response shapes where statically knowable;
  • middleware, guard, and authentication evidence;
  • fetch, Axios, and Angular HttpClient consumers;
  • exact, candidate-set, and unresolved match certainty.

Consumers are matched to producers by HTTP method and normalized path, never by route-name similarity alone. Compatibility analysis classifies changes as compatible, potentially-breaking, breaking, or unknown, including route removal, method changes, required request fields, response field removal, type-category changes, and success-status removal.

New surfaces include:

code-intel api-contract
code-intel api-impact
code-intel api-drift

Equivalent MCP tools and HTTP endpoints are available. pr_impact adds API impact when changed files contain API-contract routes without changing its existing output when no contract evidence applies.

Branch-aware semantic graph diff

Use semantic graph diff to compare two committed branches, tags, or commit SHAs:

code-intel graph diff --base main --head HEAD
code-intel graph diff --base main --head HEAD --json
code-intel graph diff --base v1.0.10 --head v1.0.11 --no-contracts
code-intel graph diff --base main --head HEAD --no-cache

Each ref is resolved to an immutable commit and analyzed in an isolated temporary Git worktree. The operation does not modify the caller's HEAD, working tree, global repository registry, or active Generation V2 index.

Diffs report:

  • added, removed, and changed symbols by canonical identity;
  • conservative rename and move correlations;
  • relationship and repeated call-site changes;
  • certainty, strategy, evidence, and confidence changes;
  • optional API-contract drift.

Snapshots are cached under .code-intel/snapshots/ with bounded eviction and validation before reuse. Corrupt or incompatible entries are rebuilt. Dirty working-tree snapshots are not supported; commit the compared state first.

The graph-diff algorithm is regression-tested at 10k and 100k normalized entities. This is a synthetic diff-stage scaling test, not a claim that full end-to-end snapshot analysis of repositories that size has been benchmarked.

Cross-repository contract drift

Synchronized repository groups can compare contracts across base/head refs or explicit snapshots:

code-intel group drift <group> --base main --head HEAD

Results use stable contract identity, identify affected consumers, preserve certainty and coverage boundaries, and expose cap hits and partial repository failures instead of reporting false safety.

Supported drift analysis includes:

  • HTTP route and shape changes;
  • shared-schema property, type, requiredness, and enum changes;
  • event topic and payload-shape changes where statically modeled.

GraphQL and protobuf/gRPC contracts can be extracted, but their drift result remains unknown in this release.

Graph-backed agent workflows

code-intel analyze can install eight evidence-aware workflows for Claude Code and Cursor:

  • explore
  • debug
  • impact
  • plan
  • review
  • api-review
  • test-coverage
  • security-investigation

The workflows use the live MCP tool definitions as their contract. Missing optional capabilities trigger documented fallbacks with reduced guarantees. Managed workflow files carry content fingerprints; a user-modified file is preserved and reported as a conflict rather than overwritten. Other selected agent targets continue to work but currently report workflow installation as not-supported.

Self-contained runtime distribution

Self-contained bundles are produced for:

  • linux-x64
  • linux-arm64
  • darwin-x64
  • darwin-arm64

Each release archive includes a pinned Node runtime and the required CLI, Web UI, parser, workflow, and native assets. Archive outputs include SHA-256, CycloneDX SBOM, and provenance sidecars.

Install and verify a downloaded bundle:

node scripts/distribution/install/install-runtime.mjs \
  --archive code-intel-runtime-v1.0.11-linux-x64.tar.gz \
  --checksum-file code-intel-runtime-v1.0.11-linux-x64.tar.gz.sha256

~/.local/share/code-intel/bin/code-intel --version
~/.local/share/code-intel/bin/code-intel doctor --json

Lifecycle commands support side-by-side versions and preserve user data by default:

code-intel version list --json
code-intel upgrade --archive ./code-intel-runtime-v1.0.11-linux-x64.tar.gz \
  --checksum-file ./code-intel-runtime-v1.0.11-linux-x64.tar.gz.sha256 \
  --version 1.0.11
code-intel version pin 1.0.11
code-intel rollback 1.0.10
code-intel uninstall --dry-run
code-intel uninstall

The npm/developer installation remains supported and continues to use the existing code-intel update flow.

Program Analysis Foundation

The new program-analysis layer includes:

  • universal IR lowered from real tree-sitter syntax trees;
  • control-flow graph construction;
  • dominators and control dependence;
  • reaching definitions and def-use chains;
  • per-function summaries;
  • program dependence graphs;
  • bounded taint analysis.

The tested language capability matrix is:

Status Languages
supported TypeScript, JavaScript, Python, Java, Go, C, C++, C#, Rust, PHP, Ruby
partial Kotlin, Swift, Dart
not-applicable HTML

supported means a real tree-sitter parse and the IR → CFG → reaching-definitions → def-use → summary path pass repository tests. Unsupported constructs return explicit truncation reasons rather than fabricated analysis.

This is a foundation, not a complete public advanced-analysis product. code-intel inspect exposes function-summary fields, but not the raw CFG or dataflow artifacts. PDG and bounded taint are implemented and unit-tested library capabilities without CLI, MCP, HTTP, or Web entry points in 1.0.11.

Release hardening and security

The release path now uses one explicit Shared → Web → Core build order. npm packages, Docker images, and runtime bundles are validated from clean inputs rather than relying on test-created artifacts.

Additional hardening includes:

  • safe Git argument handling for pr-impact and semantic snapshot refs, with no shell interpolation;
  • centralized cross-platform LadybugDB native-package preparation for every workflow that builds the four-target runtime matrix;
  • sharp pinned to patched version 0.35.4;
  • package-layout checks for required and forbidden files;
  • isolated npm install, upgrade, CLI, MCP, HTTP, and Web smoke paths;
  • Docker startup and vulnerability scanning;
  • exact-SHA release evidence with artifact hashes;
  • runtime checksum, SBOM, provenance, and attestation validation.

Upgrading from 1.0.10

No manual repository registry, group, or configuration migration is required.

Version 1.0.11 introduces new semantic producer fingerprints for identity, resolution, evidence, framework adapters, API contracts, and language capabilities. A 1.0.10 index without compatible producer evidence is marked stale and must be rebuilt; it is not silently reported as trusted.

Recommended upgrade sequence:

npm install -g @vohongtho.infotech/code-intel@1.0.11
code-intel analyze /path/to/repository
code-intel index-status /path/to/repository

Repository identity, group membership, configuration, remembered embedding preference, selected agent targets, and user-owned instruction content are preserved by the verified upgrade path. Older session cookies and other behavior documented for prior releases remain governed by their existing migration rules.

Rollback preserves configuration and user data. If an older runtime cannot prove compatibility with the active index, it fails closed or requests reanalysis instead of serving incompatible semantic results.

Known limitations

  • Semantic graph diff accepts committed refs only; dirty working-tree snapshots are not supported.
  • Snapshot builds perform a full isolated analysis. Dependency-aware incremental semantic resolution exists as a tested foundation, but production snapshot seeding and surgical publication are not enabled.
  • Flow and cluster deltas are not reported because their current per-analysis identity is not stable enough for independent snapshot comparison.
  • API-contract producers currently cover Express, Fastify, NestJS, and ASP.NET Core; consumers cover fetch, Axios, and Angular HttpClient.
  • GraphQL and protobuf/gRPC cross-repository drift remain unknown.
  • Program-analysis public exposure is limited to function-summary fields through code-intel inspect; PDG and taint have no public production entry point.
  • Workflow renderers currently target Claude Code and Cursor.
  • Final npm provenance, Docker digest/signature, GitHub attestations, and public-artifact smoke tests require the tag-triggered publication workflow and cannot be proven by a local candidate build.

Release validation

Before tagging, the exact candidate SHA must pass .github/workflows/release-validate.yml, including:

  • typecheck, unit, integration, and E2E coverage;
  • OpenSpec and workflow-registry validation;
  • clean product and Docker builds;
  • npm tarball content and isolated-install smoke tests;
  • all four self-contained runtime targets and integrity sidecars;
  • 1.0.10 → 1.0.11 upgrade and rollback checks;
  • production dependency and license gates;
  • container vulnerability scanning;
  • exact commit, version, runtime, and artifact-hash evidence.

Any source, documentation, dependency, workflow, or metadata change after validation creates a new candidate SHA and requires the complete gate to run again.

Full Changelog: v1.0.10...v1.0.11

Assets 2
Loading