Chameleon

v2.33.0 Breaking

This release includes 1 breaking change for platform teams planning a safe upgrade.

Published 1mo Developer Productivity

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

ai-coding-assistant archetype ast-analysis claude-code claude-plugin code-conventions

+12 more

code-review code-style developer-tools javascript linter mcp mcp-server prompt-engineering python ruby rails typescript

Affected surfaces

breaking_upgrade auth

Summary

AI summary

Enforcement now defaults to blocking instead of shadow mode.

Full changelog

Enforcement now defaults to enforce. A newly bootstrapped or sparse-config
repo (no enforcement section in config.json) now blocks for real instead of
running shadow-only. Blocking stays gated: the convention rules
(naming/import/jsx/file-naming) require per-repo zero-false-positive calibration
against the repo's own committed files plus a high-confidence archetype match;
deterministic security facts (hard-kind credentials, eval/exec) block on
detection; the turn-end idiom review blocks once per session. Every block needs
a trusted profile, is overridable inline with // chameleon-ignore, and
CHAMELEON_ENFORCE=0 forces advisory. Set enforcement.mode: "shadow" to
log-only or "off" for advisory. Existing repos with an explicit mode are
unaffected; a sparse-config repo flips on its next session with no migration step.