Highlights

Artifact analysis now says who owns the code in a binary. Symbols are labelled as your own, toolchain or other code, reports total the bytes per owner, and they name the functions of yours that pull toolchain code in. Identical copies of one function now get distinct fingerprints, so retained sizes and dead-code results are available on emscripten C++ and stripped release WASM, where they used to be withdrawn. Source scanning is unchanged.

Before you upgrade: artifact JSON moved to schema v3

The source scan, its database and baselines did not change. A 0.7.0 database opens as it is and no rescan is needed.

Both artifact JSON reports moved to a new schema version:

• artifact-report-v3: retained_sizes[].symbol, dead_code.symbols[], duplicate_groups.*[].fingerprint and each member's symbol are hex strings instead of byte arrays. New fields: symbols[].content_fingerprint, symbols[].identity_by_order and a top-level symbol_assumptions.
• artifact-comparison-report-v3: adds ownership deltas and an owner on each symbol delta.

The v2 schema files still ship unchanged, for consumers that validate old output against them.

Some artifact symbols get new fingerprints, so artifact compare across the upgrade can show them as removed and added:

• C++ demangling applies only to _Z/__Z/___Z names. Bare names such as y, Ss or _GLOBAL__I_a are no longer turned into type names, and a binaryen $byn$… suffix is kept. Symbols whose display name changed get a new fingerprint.
• Copies of one function (same name, same content) now have distinct fingerprints. Unique symbols keep theirs.

artifact compare now reads codehelion.toml from the working directory, like artifact analyze, and fails on an invalid configuration. It used to read no configuration.

Artifact analysis

• [artifact] own lists the owners that count as your code. Every symbol is labelled own, toolchain, other or unnamed, and analyze, report and compare show totals per class and per owner, in text, JSON and CSV. See Artifact analysis.
• Toolchain holdings: the report names the non-toolchain functions through which toolchain code is reached, with the bytes each one holds.
• Owner labels are derived when a report is rendered, from the stored names and the current [artifact] own. Nothing about ownership is written to the database, so artifact report on an older analysis shows ownership too.
• Copies of one function are told apart by their callers, callees, roots and body, and by file order only as a last resort. Such symbols are marked identity_by_order and the report says so. On suzume's release WASM this restores retained sizes for 240 copies.
• Each copy gets its own DWARF/PDB inline frames and source-mapping rows, and dead-code lists copies individually.
• artifact compare pairs copies by their shared content, so reordering identical functions no longer shows them as removed and added. Editing one function in an archive no longer marks its unchanged siblings as changed.
• A stored analysis from before this release still replays, with retained sizes for shared identities withdrawn as before.
• Mixed-format archives classify each member's symbols by that member's format.
• Artifact CSV gains per-symbol, owner, ownership-summary and toolchain-holdings records; comparison CSV gains owner deltas.

Library crates

codehelion-artifact changed its API: ArtifactSymbol has new public fields content_fingerprint and identity_by_order, so struct literals need updating. native::NativeSymbolRange, native::NativeTextSymbols and native::infer_text_regions now carry symbol positions, and native::join_addresses is new. The new ownership module and metrics::CallGraph::toolchain_holdings are additive.

Full Changelog: v0.7.0...v0.8.0

Highlights

A correctness release. No new commands; detection, replay and artifact sizes are more often right, and three changes need a rescan or a recreated baseline.

Before you upgrade: rescan and recreate baselines

The C, C++ and Rust frontends now split and name some code differently, so their recorded versions moved. Ids recorded by 0.6.0 for affected code do not carry over, and a baseline written by 0.6.0 names the old detector versions. Create a fresh baseline with codehelion baseline create after the first 0.7.0 scan, as Baselines describes for any detector-version change.

The database schema did not change. A 0.6.0 database opens as it is. A scan after the upgrade analyses the tree again instead of replaying the 0.6.0 run, because run reuse now compares the tool and detector versions.

Destructor and operator units in C and C++ Fast mode are now named ~Name, operator== and so on. A symbols suppression glob written against the old names needs updating.

Detection

• Fast mode keeps a whole-function verbatim duplicate even when a renamed fragment of it also exists. Fast recall on the Rust corpus goes from 0.7143 to 0.8571. Structural figures are unchanged.
• Adding a C++ file to a tree with no bare .h file no longer changes every stable id.
• Group order and the occurrence each group is measured against no longer depend on file discovery order.
• Structural mode no longer overflows the stack on very long return/break/yield or fn() -> chains.
• A Rust doc comment no longer widens the lines a unit reports, and its text no longer enters the token stream.
• Fast mode handles constructors after an access specifier, operator>, records with C++11 attributes, trailing return types with multi-argument templates, &mut impl Trait parameters and qualified function-pointer types.

Reports and replay

• report without --run, seam, and the seam findings count cover every partition of a multi-configuration Semantic scan.
• report --run N shows the seam block recorded with that run and the suppressions that run applied. It says explicitly that the baseline status is not replayed, in text, JSON (summary.baseline_not_replayed) and SARIF.
• explain and report agree on ranking and order. Printed short ids are unique within the report.
• Printed replay and explain commands carry --path, --config, --db and --untrusted when they are needed.
• Every command resolves a relative --db against the working directory, doctor included.
• Command-line usage errors exit with status 2 in every command.

Seam tracking

--until accepts annotated tags, and a shallow clone is read to its depth with a warning instead of failing.

Artifact analysis

• ELF dead-code candidates and retained sizes follow tail jumps and address-taken functions.
• Same-address ELF aliases are no longer counted twice.
• Inferred function sizes no longer cut real trailing instructions.
• artifact compare reports changed native code as modified when the format has no body identity.
• PDB expansion is bounded by the same budget as DWARF.
• Archives and relocatable objects no longer claim line attribution they cannot produce.

Hardening

• A discovered codehelion.toml that is a symlink is refused, and configuration reads are capped at 1 MiB.
• Under --untrusted, a database whose lock, WAL, SHM or journal file is a symlink is refused.
• Two commands creating the same new database at once no longer fail with an orphaned-sidecar error; the second waits for the first to finish.
• A Semantic helper ends its own process group when the scanner disappears, so build scripts and compilers do not outlive a cancelled scan.

Library crates

codehelion-store changed its API: Store::activate_suppressions is replaced by Store::confirm_reused_run, and looking up a group by a malformed id now returns an error.

Full Changelog: v0.6.0...v0.7.0

Highlights

Three new commands, and a change to the local database that needs one manual step.

history, seam and guard

codehelion seam measures the seams a project has written down in its ledger — sets of
files that implement one rule in more than one place and therefore have to change
together. codehelion guard compares one change against that ledger and can fail a
build when a change touched some of a seam's members and not the others
(--deny-asymmetric, exit 3). codehelion history reads a local git history into
pinned commit records, which is what the seam measurement is derived from.

Each seam run is recorded in the local database, so a report says what the previous
generation measured beside what this one did.

See Seam tracking.

Before you upgrade: the local database is recreated

The audit database schema moved from 5 to 6 to hold the seam run tables. A database
written by 0.5.0 is not migrated. The first 0.6.0 command that needs it leaves the
old file untouched, writes to audit-v6.db beside it, and says which file it used:

note: <repo>/.codehelion/audit.db was written by another schema version and was
      left unchanged; codehelion used <repo>/.codehelion/audit-v6.db

Nothing is lost that a fresh scan does not recreate. Baselines are unaffected — they
are separate files with their own version. If you want the run history back, rescan;
if you do not, delete the old file.

Continuous integration

A new page gathers the three things a CI job can use — the baseline gate on
duplication that arrived, the seam gate on asymmetric changes, and the SARIF upload
into a code-scanning view:
Continuous integration.

Install

The prebuilt binaries attached to each release are now the first route the README
offers; no toolchain is needed to run one.

The Intel macOS archive is no longer built. codehelion-0.5.0-macos-x86_64.tar.gz
existed; codehelion-0.6.0-macos-x86_64.tar.gz does not. The compiler helpers were
never built for that platform, so the release shipped a CLI where semantic mode could
not be installed from a release at all. Intel macOS is still supported through
cargo install codehelion.

Stability

The pre-1.0 caveat in the README is now two halves rather than one blanket sentence.
Scanning in Fast or Structural mode, the text report, replaying a run with report
and explain, the JSON export and artifact analyze are settled. Semantic mode,
baselines, SARIF, seam tracking and guard, artifact compare, calibration,
history and the suppression configuration keys are still finding their shape, and
each page says so.

Full Changelog: v0.5.0...v0.6.0

Full Changelog: v0.4.0...v0.5.0

Full Changelog: v0.3.0...v0.4.0

Full Changelog: v0.2.0...v0.3.0

Full Changelog: v0.1.0...v0.2.0

Full Changelog: https://github.com/libraz/codehelion/commits/v0.1.0