Skip to content
crimes docs

crimes 0.28.2

Discoverable skill updates, working Claude hook delivery, and a documentation site whose links and API declarations are checked against what ships. This patch closes integration and documentation gaps found by revisiting the accepted 0.28 product review.

Upgrading

Section titled “Upgrading”

Upgrade your chosen CLI. During ordinary terminal use, unchanged generated project skills refresh after the report completes; stderr names the changes. Agent/JSON invocations show a safe refresh action on stderr without writing skills. CI skips maintenance. Customized files and newer templates stay intact; --no-skill-update disables maintenance. No missing skills are auto-installed.

Normal use also notices exact legacy Claude hooks and points to crimes init --agent-skill. That explicit setup replaces the shipped old command with an offline project-local/PATH invocation and fixes its timeout. Skill refresh alone never changes executable hook settings. Custom commands, custom timeout values and unrelated settings remain intact.

JSON schema remains 0.8.0. Detector behavior, scoring and finding identity are unchanged. Two previously inconsistent output paths are corrected:

  • Feedback JSON now reports the shared schema version instead of the hardcoded 0.1.0. Existing payload fields remain. export --append-global --format json returns a global feedback report rather than prose.
  • Triage list/apply summaries gain schema_version and report_type (triage_list / triage_apply) while retaining entries / applied. --clear --format json returns a triage_clear report. JSON requires list/apply/clear; interactive triage uses human output. Conflicting triage operations are rejected before writing.

Consumers of these paths should accept the corrected envelopes. Commander argument errors now use the documented exit 2. Gate failures retain exit 1 and allow the report and advisory update notice to finish flushing.

Integration fixes

Section titled “Integration fixes”

The Claude hook returns hookSpecificOutput.additionalContext, the host’s context-delivery contract. Plain stdout from a PreToolUse hook was insufficient. The old generated compact command also returns the envelope when stdin identifies a PreToolUse event, so updating the CLI repairs delivery before settings refresh.

The briefing uses the host project root, includes analysis status, coverage limits, evidence and durable fingerprints, and never sets a permission decision. It remains advisory. Generated hooks use a 30-second host timeout; the old 8000 value used the wrong unit. New setup targets supported Edit/Write file payloads. Each hook still pays for repository analysis; --no-hooks skips installation if that per-edit cost is undesirable.

JSON commands never enter the first-run wizard, even when attached to a terminal. Setup and maintenance follow the command’s project instead of an unrelated launch directory. No registry query or npm lifecycle script is added.

Documentation that stays aligned

Section titled “Documentation that stays aligned”
  • The JSON guide now explains interpretation and compatibility; exact report declarations are generated from TypeScript and type-checked together.
  • CI guidance distinguishes selected files from new findings, explains actual scan cost, and requires reviewing upgrades before replacing a baseline. The example pins crimes and compares against the actual PR target branch.
  • Triage, suppression and skill guides cover current behavior and preservation of prior decisions. The skill describes how to act on update notices.
  • Documentation links are converted from repository Markdown paths to published routes or GitHub source links. Build verification checks internal destinations and anchors across the rendered site, alongside version/capability checks.

Review coverage and remaining limits.

Verification

Section titled “Verification”
  • Node 26.7.0: pnpm verify passes formatting, lint, build, generated references/skills, typecheck and 2,497 tests.
  • Clean-tree package smoke passes real npm 0.28.0 and 0.28.1 upgrades, actual terminal refresh, unconfigured-terminal JSON, piped JSON, CI/opt-out, failed gates, explicit checks and customization protection. Packaged JS, Python WASM/import graph, context and pin migration checks pass.
  • A fresh tarball install also passes on minimum supported Node 18.20.8: JS/Python analysis, skill setup/check, feedback and triage envelopes, and structured hook context.
  • The website passes metadata/capability checks and internal page/anchor checks across 83 HTML pages (the generated 404 canonical is excluded). Deliberately stale API text and a broken rendered link are rejected.
  • Ranking is unchanged: mean nDCG 0.4770 across 57 scored scenarios, 0.3895 across the same 32 deep scenarios. Scoped CLI/core self-scans introduce no new high findings, including suppressed and triaged observations.

Fresh Codex CLI 0.153.4 and Claude Code 2.1.263 sessions load the installed skill, select the local 0.28.2 executable, retain comparable pre/post scans, compare fingerprints, pass behavior assertions and preserve unrelated files. These two small skill trials have zero findings before and after.

A separate Claude session has no installed skill and uses the generated hook. It receives a real high God Function briefing, acknowledges an unpredictable handoff token added by the test observer, completes the requested fee/test edit, and leaves the unrelated pre-existing high-risk function unchanged. This tests host context delivery and scope preservation, not a general productivity gain.

Recorded host evidence. All host trials use host-default models, one task per path, on macOS. They do not establish activation on every task, Windows host behavior, or improved precision/recall. Context latency and broader outcome evaluation remain open.