Changelog
What the Verified Suite Can Reach
Two fixes to what the verified test suite can reach: it no longer inherits your credentials, and a diff can no longer name a file outside the repository. Neither is exploitable without already being able to hand Refactron a diff or a test command, which is the normal mode of use. That is the point.
Your Working Tree Was Not Safe
Refactron could write to your working tree, and the verdict said SAFE while it happened. The shadow tree was populated with hardlinks, so any in-place write from your own test suite went straight into your repository. Every release from 0.2.0 through 0.4.1 is affected. Update immediately.
Five False SAFE Verdicts
Five false SAFE verdicts fixed, and SAFE now means something narrower. The report's shape did not change, so the version number alone will not tell you that. Every verdict that moves, moves from SAFE toward UNPROVEN, and exit codes are unchanged.
Only the Verification Layer
Breaking, despite being a minor. The refactoring product this package grew out of has been removed: six commands, the 20 AST transforms, the interactive TUI, blast-radius scoring and the tier taxonomy. They were the demo of the verification engine, not the product. verify-diff and the MCP tool are untouched.
Two False SAFE Verdicts
Two false SAFE verdicts, found and fixed. Both had the same shape: coverage measured a different program than the tests gate ran, then reported the changed lines as covered. A false SAFE is the one defect this product cannot have, so upgrade rather than pin.
The Verification Layer Ships
Refactron can now verify any diff, whoever wrote it, and return SAFE, UNSAFE, or UNPROVEN. It applies the change in an isolated shadow tree, runs your real suite, and checks whether those tests exercise the lines that changed. The same gate is exposed to agents over MCP.
Tier Taxonomy & Five Real Fixes
Findings now split by debt, modernization, and style. Five real fixes land, and the license moves from MIT to Apache 2.0. No new transforms, no API breakage.
Ten New Deterministic Transforms
Six Python and four TypeScript transforms, roughly doubling coverage, plus a pythonVersion key so version-gated rewrites can be opted in safely.
Boxed Output, Rollback & a Faster Docs Engine
Journalled rollback, boxed reports, live apply progress, and a faster documentation engine.
Large-File Fix & Transform Coverage
analyze survives large files, var conversion is scope-correct, and format_to_fstring speaks the full printf grammar.
The Deterministic Rebuild
Refactron rebuilt from the ground up as a 100% deterministic AST engine. No LLM touches your code, and versioning restarts at 0.2.0.
The original Python tool, superseded by the 0.2.0 deterministic rebuild above.
AI/LLM Integration & RAG System
Semantic suggestions, automated docstrings, ChromaDB indexing, metrics, and CI generators for the legacy line.
Pattern Learning, Performance & Safety
A pattern-learning engine, AST caching, an interactive dashboard, and git-integrated rollback.
New Analyzers & Improved Accuracy
Security, performance, and complexity analyzers with context-aware confidence scoring.
Production Ready: the Auto-fix System
Fourteen automatic fixers with atomic writes, backups, and four safety tiers.
Initial Beta Release
Eight analyzers, six refactorers, risk scoring, and a plugin architecture.