Skip to content

Chameleon

v4.4.6 Feature

This release adds 1 notable feature for engineering teams evaluating rollout.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

ai-coding-assistant archetype ast-analysis claude-code claude-plugin code-conventions
+12 more
code-review code-style developer-tools javascript linter mcp mcp-server prompt-engineering python ruby rails typescript

Summary

AI summary

Diff‑scoped conformance lint reduces false‑positive advisory findings for edits that did not introduce issues.

Changes in this release

Bugfix Medium

Per-edit conformance lint now diff-scoped, reducing false positives.

Per-edit conformance lint now diff-scoped, reducing false positives.

Source: llm_adapter@2026-07-18

Confidence: low

Full changelog

Fixed

  • The per-edit conformance lint's ADVISORY is now diff-scoped: an Edit /
    MultiEdit is nagged only for the advisory findings it INTRODUCED, not for
    every pre-existing convention issue elsewhere in the file. Whole-file
    attribution -- an edit flagged for a style / convention issue on a line it
    never touched -- was the top false-positive source across every effectiveness
    eval (79 to 100% of per-edit findings). chameleon reconstructs the pre-edit
    content from the tool input, lints it the same way as the post-edit content,
    and drops the advisory findings present in both.
    • ENFORCEMENT is unchanged. Every block-eligible rule (secrets, eval,
      phantom-import, naming / import / inheritance / jsx / file-naming) is exempt
      and surfaces whole-file, so the block partition, the inline block, and the
      turn-end Stop-backstop arming are computed from exactly the same findings as
      before. A pre-existing broken import or a credential still surfaces and
      blocks; a follow-up clean edit can never disarm a block-eligible violation an
      earlier edit in the turn introduced.
    • Measured 93 to 100% fewer per-edit advisory findings on benign edits across
      Ruby, TypeScript (NestJS), and React fixtures, while every genuinely
      introduced finding still surfaces (verified against an injected-violation
      control).
    • Scope is narrow and fail-safe: Write / NotebookEdit author the whole
      file (no pre-edit content to diff against, so whole-file lint stands), a
      replace_all edit or any ambiguous reversal falls back to whole-file, and
      any error fails open to the whole-file findings. Kill switch:
      CHAMELEON_DIFF_LINT=0.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Chameleon

Get notified when new releases ship.

Sign up free

About Chameleon

All releases →

Related context

Earlier breaking changes

  • v3.0.0 MCP surface folded from 48 tools to 19; remaining 32 operator tools become actions on three dispatchers.

Beta — feedback welcome: [email protected]