This release adds 1 notable feature for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+12 more
Summary
AI summaryThe reuse-before-create nudge for class‑bound methods is restored with verbatim body matching.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Medium |
Re‑enable reuse-before-create nudge for class-bound methods with verbatim body match detection. Re‑enable reuse-before-create nudge for class-bound methods with verbatim body match detection. Source: llm_adapter@2026-07-18 Confidence: high |
— |
Full changelog
Added
- The reuse-before-create nudge again covers class-bound methods (Rails
models, Django querysets, service objects) -- where reuse most often lives
in object-oriented code. v4.4.2 had excluded class methods to kill an
"import this method" false positive, but that silenced the nudge exactly
where an agent re-implements an existing model/queryset/service method
verbatim. It is back, gated to fire only on a real duplicate:- It triggers only on a VERBATIM body match: the new method's body is
structurally and textually identical to an existing one. Sharing a name
is no longer enough. - The wording is "same body as
Xin Y -- extract a shared helper/concern
instead of re-implementing it", not "import and reuse" -- a class-bound
method cannot be imported, so the fix is extraction. - Matching uses a structure-preserving body fingerprint computed by the same
extractor at bootstrap time and at edit time. A genuine duplicate matches
by construction; a span the cheap extractor mis-reads simply fails to
match instead of mis-matching, so the nudge cannot fire on two methods
that are not identical. The fingerprint preserves each line's relative
indent depth, so an in-block statement never collapses to read the same as
an after-block one, and it skips a body whose span is cut short by a
flush-left string, heredoc, comment, line-continuation, or unbalanced
multi-line bracket (array, hash, call, percent-literal) rather than risk a
partial match. Validated false-positive-free across ~15,000 real methods in
Ruby, Python, and TypeScript.
- It triggers only on a VERBATIM body match: the new method's body is
Notes
- Existing profiles pick up the class-bound reuse coverage on the next
/chameleon-refresh, which rebuilds the function catalog that stores the
fingerprint. Until then that pass stays inert rather than guessing.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About Chameleon
All releases →Beta — feedback welcome: [email protected]