v4.1.0

Chainlit/chainlitv4.1.0Mar 25, 2026by sinewaveai

AI Summary

A feature release for the cr-agent introducing a dedicated Security Analysis Mode with advanced filtering and deduplication capabilities for code reviews.

Key Highlights

New Security Analysis Mode (`--mode security`)
Post-filtering to drop non-security findings
Carrier/sink deduplication using heuristic scoring
Cross-file security context summaries

New Features

Security Analysis Mode
Dedicated security-focused LLM prompts
Tiered guard recognition
SARIF output format support

Full Release Notes

## What's New

### Security Analysis Mode for cr-agent (`--mode security`)

- **Dedicated security-focused LLM prompts** with sink localization instructions
- **Post-filtering** drops non-security findings unless they have CWE/OWASP mapping
- **Carrier/sink deduplication** using heuristic scoring (file path, language signals, CWE)
- **Tiered guard recognition** (strong/medium/weak) to reduce false positives on guarded code
- **Cross-file security context summaries** for better LLM analysis

### Usage

```bash
# Security-only mode — focused on exploitable vulnerabilities
npx cr-agent analyze ./path/to/project --mode security

# Shorthand
npx cr-agent analyze ./path/to/project --security-only

# SARIF output for CI (recommended with security mode)
npx cr-agent analyze ./path/to/project --format sarif --mode security
```

## Bug Fixes

- Fix crossFileDedup collapsing independent findings
- Fix Math.random() map key collision risk  
- Fix duplicate extractImports logic
- Fix double IO in context assembler
- Fix mode validation and fallback behavior
- Fix missing claude CLI flags (`-` stdin marker, `--no-session-persistence`)

## Tests

- 119 code-review-agent tests (30 new for postprocess, 11 for security-summary)
- 1404 total tests passing

---

**Full Changelog**: https://github.com/sinewaveai/agent-security-scanner-mcp/compare/v4.0.1...v4.1.0