v4.1.0

QuentinFuxa/WhisperLiveKitv4.1.0Mar 25, 2026by sinewaveai

AI Summary

Introduces a dedicated 'Security Analysis Mode' for the cr-agent, utilizing specialized LLM prompts for sink localization and post-filtering to isolate exploitable vulnerabilities. Includes fixes for deduplication logic, context assembly, and CLI flag handling.

Key Highlights

New `--mode security` flag for focused vulnerability analysis.
Features sink localization and carrier/sink deduplication.
Fixed cross-file deduplication and Math.random() collision risks.
Expanded test suite to 1404 passing tests.

New Features

Security Analysis Mode, tiered guard recognition, cross-file security context summaries, and post-filtering logic.

Full Release Notes

## What's New

### Security Analysis Mode for cr-agent (`--mode security`)

- **Dedicated security-focused LLM prompts** with sink localization instructions
- **Post-filtering** drops non-security findings unless they have CWE/OWASP mapping
- **Carrier/sink deduplication** using heuristic scoring (file path, language signals, CWE)
- **Tiered guard recognition** (strong/medium/weak) to reduce false positives on guarded code
- **Cross-file security context summaries** for better LLM analysis

### Usage

```bash
# Security-only mode — focused on exploitable vulnerabilities
npx cr-agent analyze ./path/to/project --mode security

# Shorthand
npx cr-agent analyze ./path/to/project --security-only

# SARIF output for CI (recommended with security mode)
npx cr-agent analyze ./path/to/project --format sarif --mode security
```

## Bug Fixes

- Fix crossFileDedup collapsing independent findings
- Fix Math.random() map key collision risk  
- Fix duplicate extractImports logic
- Fix double IO in context assembler
- Fix mode validation and fallback behavior
- Fix missing claude CLI flags (`-` stdin marker, `--no-session-persistence`)

## Tests

- 119 code-review-agent tests (30 new for postprocess, 11 for security-summary)
- 1404 total tests passing

---

**Full Changelog**: https://github.com/sinewaveai/agent-security-scanner-mcp/compare/v4.0.1...v4.1.0