Chameleon

v4.5.8 Bugfix

This release fixes issues for SREs watching stability and regressions.

Published 6d Developer Productivity

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

ai-coding-assistant archetype ast-analysis claude-code claude-plugin code-conventions

+12 more

code-review code-style developer-tools javascript linter mcp mcp-server prompt-engineering python ruby rails typescript

Affected surfaces

auth deps

Summary

AI summary

Fixed non‑interactive trust command stall and reduced false secret detections for test fixtures.

Full changelog

Trust works non-interactively. /chameleon-trust <repo-basename> stalled at the
interactive confirmation under claude -p, silently stranding the repo untrusted for the
whole session — the entire guidance layer absent, observed on a graded run. The argument IS
the typed confirmation: the skill now proceeds directly when it matches, and surfaces the
expected token when it does not.
Delimited test/dummy/fake fixture segments are placeholder secrets. gh-test-secret-style
node:test fixture values fired 14 error-severity secret findings on one graded run. A
segment-bounded test/testing/dummy/fake marker plus the existing entropy gate drops the
human-written fixture shape while a real test-mode key (Stripe sk_test_<random>: high
entropy) and embedded letters (contest-winner) stay flagged.
describe_codebase names why a bare-basename repo argument resolved to nothing instead of a
reasonless found: false.

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Chameleon

Get notified when new releases ship.

About Chameleon

v3.0.0 MCP surface folded from 48 tools to 19; remaining 32 operator tools become actions on three dispatchers.