Iris Code
Search docsCtrl K
Sign inGet Iris Code Free
Version 1.18.2 · latest

Changelog

Release notes for Iris Code across VS Code, JetBrains IDEs, and the iris CLI. Updates ship automatically through the VS Code Marketplace, Open VSX, and the JetBrains Marketplace.

Jump to latest
v1.18.25 Aug 2026fixlatest

JetBrains panel legibility, and a correction

Two fixes to how the Iris Code panel renders inside JetBrains IDEs, and a correction to a claim made in the 1.18.1 release notes.

  • Fixed: secondary text in the JetBrains panel was drawn in the IDE's disabled-control grey rather than its secondary-text grey, so supporting detail was dimmer than the same UI in VS Code.
  • Fixed: the JetBrains panel now matches your IDE's text size. It was never told the IDE's interface scale, so it rendered smaller than the rest of the IDE for anyone using a larger UI font. It follows theme and font changes while open, and the table views scale with it.
  • Correction: the 1.18.1 notes said the iris CLI is now published with npm provenance. It is not. npm only accepts a provenance attestation when the source repository is public, and ours is private, so the registry rejects it. No code changed as a result - only the incorrect note.
  • Fixed: comments in a config created by iris config init called the tool "Iris" instead of "Iris Code" in two places, and had lost the (Pro) marker on two fields that a Free licence ignores. Existing config files are untouched.
v1.18.05 Aug 2026feature

Vue, Svelte, and naming that follows your folders

Iris Code reads Vue and Svelte components, analysing their script blocks while ignoring template and style markup, with findings on the component's own lines. File naming can now follow what a file does rather than only which language it is written in.

  • Vue and Svelte single-file components are analysed everywhere Iris Code runs: the editor, the CLI, hooks, and CI. Script blocks are read as JavaScript or TypeScript from the lang attribute, and template and style markup is excluded from both analysis and duplicate detection, so component markup never inflates a finding count.
  • Findings keep their real line numbers. A secret on line 11 of a .vue file is reported at line 11.
  • Role-based file naming (Free): fileNaming.overrides takes an ordered list of path globs, so components/** can require PascalCase while composables/** or hooks/** require camelCase - conventions that could not both be expressed before, because a lang="ts" component and a .ts module are the same language. The last matching rule wins, and existing configs behave exactly as before.
  • File-naming violations now appear as inline diagnostics in JetBrains IDEs, matching VS Code.
  • Fixed: the no-exports check fired on essentially every Vue and Svelte component, and SvelteKit route files such as +page.svelte were reported as badly named with a suggested rename identical to the name they already had.
  • Fixed: large files analyse dramatically faster. Analysis time grew with the square of a file's line count, so a very long file could stall the editor or a CI run for minutes; a 200,000-line file now takes a fraction of a second. Findings are unchanged.
  • Fixed: an unusable file-naming glob is reported with its exact location instead of stopping the scan, and can no longer quietly excuse a file from its convention.
  • Changed: iris report and iris sbom now require --output to stay inside the current directory, matching iris check, iris deps, and iris cve.
  • Fixed: the Config Studio preview showed a config shape Iris cannot read - it described its own nested groups (thresholds, detections, diagnostics, severity) rather than the real flat keys. Copying the preview instead of syncing produced a file where every threshold and toggle was silently ignored. The preview, the Copy button, and Sync are now the same text. Configs you synced were always correct.
v1.17.030 Jul 2026feature

One engine, every editor

Iris Code 1.17.0 runs in JetBrains IDEs and installs from Open VSX, both driven by the same analysis engine as the VS Code extension. A file scores identically in every host, one sign-in covers your editors and the CLI, and analysis still never leaves your machine.

  • Iris Code for JetBrains IDEs: IntelliJ IDEA, WebStorm, PyCharm, GoLand, PhpStorm, Rider, RubyMine, CLion, and Android Studio. Inline diagnostics, iris-ignore quick fixes, health scores on hover, code lenses, filename-convention renames, and the full Iris Code panel under Tools > Iris Code. Install the LSP4IJ plugin first and restart the IDE fully.
  • Open VSX distribution, so Cursor, Windsurf, VSCodium, and other Open VSX editors install the byte-identical extension and update automatically instead of a manual .vsix.
  • 25 searchable Iris Code commands in JetBrains. Press Ctrl+Shift+A, type iris, and run workspace scans, Review My Changes, trends, hooks, dependencies, history secrets, or report export. Any of them can be bound to a keyboard shortcut under Settings > Keymap.
  • Sign in and out from JetBrains under Tools > Iris Code. Analysis and the panel refresh in place, so Pro activates without an IDE restart, and one sign-in still covers the CLI.
  • Dashboard config sync reaches JetBrains: build a config in the Config Studio, choose Sync to JetBrains, and paste the one-time code into Tools > Iris Code > Sync Config from Dashboard. You review a diff before anything is written.
  • Hovering a setting in .irisconfig.json now explains what it does. The documentation comes from the schema bundled with your installed version, so it works offline and always matches the version you are running.
  • Fixed: a Pro config could briefly be reported as Free in JetBrains while the licence was still validating, which also scored files against Free thresholds until it settled.
  • Fixed: Gate Preview and the trend-history table are Free features but were refused on the Free plan in JetBrains. The CI generators, which are Pro, now correctly require it.
v1.16.026 Jul 2026feature

Clearer signals, consistent names

Iris Code 1.16.0 keeps Code Health as the single headline score and adds ranked Quality Signals that point to the recurring risks behind it. Free users can also enforce workspace-wide or per-language file naming conventions, with baseline-aware rollout and Explorer feedback. Ships with @iris-code/cli 1.9.0.

  • Quality Signals rank recurring duplication, suppressions, security smells, type debt, debug prints, TODO load, complexity, and naming problems using density-based attention levels while preserving the raw counts. They are navigation and prioritisation, not a second score.
  • Free file naming policies support snake_case, kebab-case, camelCase, and PascalCase at workspace level, with optional per-language overrides for mixed-language repositories.
  • Naming rollout can check only files outside the locked baseline or audit every file. Per-language scope overrides the workspace default when a language needs a different migration pace.
  • Misnamed files receive rename suggestions, Explorer decorations, and optional editor diagnostics. Framework entry points, generated files, test suffixes, and custom ignore globs are handled without forcing one convention everywhere.
  • Added an AI-assisted preset and the Pro gateMaxNamingViolations cap for teams reviewing AI-assisted code at volume.
  • Fixed config parity gaps so security-smell toggles, severity overrides, inline-diagnostic defaults, and sidebar font sizing are applied consistently across the extension and CLI.
v1.15.020 Jul 2026feature

Accuracy you can check, and rate

Iris Code 1.15.0 makes its findings accountable: every analysis rule is measured against a labelled corpus of real code for per-rule, per-language precision and recall, a checked-in baseline blocks any release that regresses a rule, and every finding in the sidebar now carries a thumbs up / down so you can tell Iris Code when it is right or wrong. Ships with @iris-code/cli 1.8.0.

  • Rate any finding: a thumbs up / down control on every finding in the sidebar and Issues view. Feedback is count-only - the rule, the language, and your verdict, never source code, file paths, or line contents - and respects your account analytics setting. Rate once, change your mind anytime; the control remembers what you chose.
  • Accuracy benchmark: every rule is now measured against a labelled corpus of realistic code for per-rule, per-language precision (how often a finding is correct) and recall (how many real issues it catches). The measured baseline is checked in and the test suite fails the build if any rule regresses - so no release ships a quality regression unnoticed.
  • Fewer false positives, found and fixed by the benchmark: an any inside a comment or string, print() inside a Python docstring, CommonJS module.exports files reported as export-less, arithmetic like (a + b) * c mistaken for a risky regular expression, and the eval( token inside a string literal are no longer flagged. Each fix is locked in by a permanent test case.
  • A public methodology page shows the enforcement-rule accuracy figures per rule, with no single misleading global percentage. See docs.iriscode.co/trust/accuracy-benchmark.
v1.14.019 Jul 2026feature

Per-language config overrides

Iris Code 1.14.0 lets mixed-language repos stop compromising: a languages block in .irisconfig.json overrides per-file thresholds for TypeScript, JavaScript, Go, and Python independently, applied identically by the sidebar, CLI, hooks, and CI. Ships with @iris-code/cli 1.7.0.

  • Added per-language config overrides (Pro): a languages block in .irisconfig.json sets per-file thresholds, scoring weights, severity overrides, and per-file gate caps for typescript, javascript, go, and python files independently - a 500-line Python module and a 300-line TypeScript cap can finally coexist. Anything not stated falls back to the base config, and unknown language keys from newer versions warn instead of breaking older installs.
  • Resolution happens once, inside the analysis core, so the editor, CLI, git hook, build hook, and CI can never disagree about which threshold applied. The file tab shows the applied override next to the config source, and iris gate prints the limit that actually governed each failing file.
  • Build the block visually in the Config Studio: a new Per-language overrides section lets you enable a language and set its per-file thresholds and gate caps - empty fields inherit the base config - then sync the result straight to VS Code like any other studio config.
  • Six more secret formats detected: Stripe live and restricted keys, GitHub fine-grained PATs, GitLab PATs, npm access tokens, SendGrid API keys, and PEM private-key headers - masked in output, as always.
  • The pre-push hook now stops a hung analysis after 120 seconds (IRIS_HOOK_TIMEOUT to adjust) instead of blocking git push indefinitely - the push still fails closed with a clear bypass hint, so enforcement is never silently skipped.
  • Long React components are now actually measured: functions with destructured parameters were previously never checked against the function-length threshold. Component-heavy files may score lower after updating - that is the analyser finally seeing them, not a scoring change.
  • Reliability fixes: --allow-network reliably re-enables dependency lookups after a revoke, and the remaining CLI commands were hardened against a Windows-only crash on exit.
v1.13.015 Jul 2026feature

Review my changes, and secrets that history still remembers

Iris Code 1.13.0 makes reviewing your own Git changes the primary workflow - free, interactive, and scoped to exactly what you touched - and adds a git history secrets scan that finds credentials which were committed and later removed. Ships with @iris-code/cli 1.6.0.

  • Added Review my changes (Free): when Git reports local changes, a count-aware strip appears above the sidebar tabs. Run it to check every supported staged, unstaged, and untracked file and open a dedicated review with blockers first, filterable findings, changed-file health, and click-to-open source locations.
  • Change reviews are honest about scope: they never alter full-workspace trend history and never report unused dependencies, because that conclusion needs a full-project scan. The changed-file count only counts files the review will actually analyse.
  • Added the git history secrets scan (Pro): walk past commits - committed .env files included - through the same two-layer secrets detection. Findings are deduplicated per distinct secret, always masked, and show first and last sighting, the commits and files involved, and whether the secret is still in HEAD or historical-only. Content introduced by merge commits is covered, and coverage limits (depth, size caps, shallow clones) are always disclosed instead of implying a clean full history. Everything runs against local git - nothing leaves the machine.
  • The same scan is available in the terminal as iris secrets --history, with --depth to control how far back to walk and JSON output for automation.
  • Git-aware features behave predictably in unusual setups: workspaces opened inside a larger repository are scoped correctly, repositories with huge untracked folders no longer fail discovery, and a missing Git installation is reported as exactly that.
  • First-run experience: new installs land on a review launchpad that works on your real code immediately - review the active file, review your changes, or run the one free whole-project review. No demo tour, no account required.
v1.12.013 Jul 2026feature

Duplicate code detection: find the copy-paste, diff it, gate on it

Iris Code 1.12.0 finds copy-pasted blocks within and across files with normalised token-window matching - renamed identifiers, changed literals, reformatted whitespace, and comments do not hide a duplicate. Free for everyone, with a Pro side-by-side diff view and a new gate rule. Ships with @iris-code/cli 1.5.0.

  • Added duplicate code detection (Free): source is normalised before comparison, so two stretches of code that differ only in naming or values still match. Within-file blocks appear as a Duplicate blocks smell on the File tab; cross-file blocks power a new Duplication section on the Workspace and Folder tabs showing block count, the duplication percentage of total code lines, and the largest blocks with click-through to both locations.
  • Results stay reviewable by design: import and require headers never match, uniform data literals (country lists, enum tables) are excluded, a block repeated many times reports as a minimal set of pairs instead of every combination, and JSX-heavy files need twice the evidence before matching.
  • Added a full Duplicates table - filterable by cross-file or within-file, searchable, both locations clickable - that tracks live edits: line ranges update as you type and resolved pairs drop out without a rescan.
  • Added an Open diff action on every duplicate (Pro), titled with both locations GitHub-style. Cross-file pairs open the two full files side by side, editable with normal saves; same-file pairs open the two blocks as editable extracts that write back to the real file. Iris Code toasts the moment the duplication is resolved.
  • Added gateMaxDuplicateBlocks (Pro): caps the total duplicate blocks across the scan, enforced by iris check, iris gate, the git hook, and the build hook. New config knobs: enableDuplicateDetection (default on), duplicateBlockMinTokens (default 40), a duplicateCode scoring weight, and an optional duplicateCode inline diagnostic.
  • Duplicate findings can be suppressed like any other rule: // iris-ignore: duplicate-code -- <reason>.
  • .mjs and .cjs files are now analysed everywhere .js is - workspace scans, folder scans, and CLI directory checks previously skipped them.
v1.11.09 Jul 2026feature

Inline suppressions with required reasons, and a better vulnerability data source

Iris Code 1.11.0 adds inline suppressions - silence a specific finding at a specific line, but only with a written reason - and moves vulnerability lookups to the OSV.dev database, adding per-advisory confidence labels and removing the GitHub token requirement entirely. Ships with @iris-code/cli 1.4.0.

  • Added inline suppressions (Free): // iris-ignore: <rule> -- <reason> suppresses a matching finding on the next line, and // iris-ignore-file covers the whole file (# comments in Python). The reason is required - a directive without one stays inert and is flagged as a Bare Ignore with its own score penalty, so every suppression stays auditable.
  • Suppressions surface everywhere: a Suppressed section in the File tab, a Suppressions section with per-file counts in the Workspace and Folder tabs, a full filterable suppressions table with click-to-open-at-line, and a --show-suppressed flag on iris check and iris gate.
  • Added gateMaxSuppressions (Pro): a per-file cap on suppressions enforced by iris gate, the git hook, and the build hook - plus an ignoreSuppressions team-lead override that treats every iris-ignore comment as inert. The strict and security presets ship with default caps (5 and 3 per file) and a raised bare-ignore penalty.
  • Vulnerability lookups now use the OSV.dev database instead of the GitHub Advisory API. No token, no rate-limit setup - the GitHub PAT button and GITHUB_TOKEN plumbing are gone.
  • Every advisory now carries a confidence label - fix-available, direct, transitive, or manual-review - plus the fixed-in version where one exists, in the Dependents Table and in iris deps and iris cve output.
  • Advisories without a verifiable id or severity are never shown: they are skipped and the skip count is disclosed. Dependencies whose lookup failed are marked "not checked" instead of being assumed clean.
  • Added fix-available notifications (Pro): when a fresh scan finds critical or high-severity vulnerabilities with a fix version available, one aggregated toast offers a Review shortcut to the Dependents Table.
  • Fixed debug prints quoted inside comments being flagged as live debug prints in TS/JS, Go, and Python.
v1.10.05 Jul 2026feature

The supply-chain release: dependency scanning accurate enough to gate CI on

Iris Code 1.10.0 makes dependency scanning precise enough to block CI on. Scans now read your lockfile for exact installed versions, advisories are filtered to the version you actually run, monorepos are understood end to end, and two new CLI commands - iris cve and iris sbom - turn the scan into a CI gate and a standards-compliant inventory. Ships with @iris-code/cli 1.3.0.

  • Dependency scans are now lockfile-aware: the Dependents Table and iris deps, iris cve, and iris sbom resolve the exact installed version from package-lock.json, pnpm-lock.yaml, yarn.lock (classic and Berry), poetry.lock, or Pipfile.lock instead of trusting manifest ranges.
  • Advisory results are now filtered to the installed version, so packages already on a patched release are no longer flagged for advisories that only affect older versions.
  • Added monorepo support: npm and yarn workspaces plus pnpm-workspace.yaml members are discovered automatically, their dependencies merged and deduplicated, and internal workspace:, file:, and link: dependencies excluded from lookups.
  • Added iris cve [path] (Pro): the same scan, cache, and consent flow as iris deps, but exits 1 only when a vulnerability at or above --severity (low, medium, high, or critical; default high) is found - so CI can block on serious findings without failing on low-severity noise. Supports --format pretty|json and --output.
  • Added iris sbom [path] (Pro): exports a CycloneDX 1.5 software bill of materials across npm, Go, and Python - fully offline. Components carry name, version, purl, and direct/dev scope, and if a cached iris deps scan exists its vulnerability findings fold in, cross-referenced by purl. Supports --output and --stdout.
  • Added a network consent step to CLI dependency scans: the first lookup asks permission and discloses exactly what is sent (package names and versions only - never code, file paths, or project names). The choice persists in ~/.iris/preferences.json, --revoke-network and --allow-network manage it, and cached results now show their age.
  • Added a CVE badge (Pro) to the Dependencies section of the Workspace tab: a pill summarising the last cached scan - green when no known CVEs are found, or the vulnerable count with the highest severity. Reads the local cache only and never triggers a network request.
  • Added a scope indicator to the Issues and TODOs tabs showing which scan the list reflects (for example "Showing: folder · src") with a one-click switch back to the workspace scan.
v1.9.02 Jul 2026feature

Security smell enforcement: gate on it, scan for it from the CLI

Iris Code 1.9.0 closes the loop on 1.8.0's security smell detection: a new gate rule blocks pushes and CI runs on security smell count, and a dedicated CLI command scans for them independently of a full health check.

  • Added gateMaxSecuritySmells to .irisconfig.json: the gate fails when the total number of security smells (eval usage, SQL injection risk, insecure RNG, disabled TLS, weak hashing, and the rest of the nine 1.8.0 patterns) across the workspace exceeds this value. Enforced by the CLI, the git hook, and the build hook alongside gateMaxSecrets, gateMaxComplexity, gateMaxFileLength, and gateMaxSmellsPerFile.
  • Added iris security [path]: a free CLI command that scans JS/TS/Go/Python for the same nine security smell categories as the sidebar, independent of a full iris check run. Supports --format pretty|json and --output; exits 1 if any smell is found.
  • Added a Security Posture section to the Workspace and Folder tabs in the VS Code sidebar — a collapsible count-by-category breakdown of security smells found in the current scan.
  • Added the gateMaxSecuritySmells field to the Config Studio's Gate limits editor for Pro users.
v1.8.030 Jun 2026feature

Security smell detection: nine patterns, every file, free

Iris Code 1.8.0 adds a second static-analysis tier below hardcoded secrets: security smells. Nine patterns catch the most common security anti-patterns before they reach production. The feature is on by default, free for all users, and emits Warning-severity squiggles in the editor when inline diagnostics are enabled.

  • Added nine security smell detectors across TypeScript, JavaScript, Go, and Python: eval/exec calls, SQL built by string concatenation, insecure random number generation, ReDoS-prone regex quantifiers, disabled TLS verification, weak hashing (MD5/SHA-1), open redirects to unvalidated input, debug flags left in production code, and hardcoded localhost URLs in production paths.
  • Added enableSecuritySmells toggle in .irisconfig.json and VS Code settings (iris.enableSecuritySmells, default on). Turning it off suppresses all nine patterns.
  • Added inline diagnostics support: when enableInlineDiagnostics is on, security smell findings appear as Warning squiggles in the editor and entries in the Problems panel. Controlled per-category via inlineDiagnostics.securitySmells.
  • Added custom scoring weights for each of the nine patterns for Pro users — adjust the health-score penalty per pattern in healthScoreWeights (keys: evalUsage, sqlConcatenation, insecureRandom, unsafeRegex, hardcodedLocalhost, disabledTlsVerification, debugFlagsEnabled, weakHashing, openRedirect).
  • Added Security Smells page to the Enforcement section of docs.iriscode.co with pattern reference, language coverage tables, and configuration guide.
v1.7.025 Jun 2026feature

Trend tracking, baseline enforcement, and dashboard redesign

Iris Code 1.7.0 ships health score history, a dedicated Trends panel with per-file comparison, and baseline-mode gate enforcement so existing debt never blocks your team. The account dashboard is also fully redesigned — a new Insights page tracks all your activity with date-range filtering, streak tracking, and grouped event breakdowns.

  • Added trend tracking: Iris Code automatically snapshots your workspace health score on every scan, stored in .iris-snapshots/ (gitignored, 2 MB cap, same-day dedup, corrupt-entry hardening).
  • Added Trends panel: compare any two snapshots with a sortable, filterable per-file score table. Click any row to jump directly to the file. Free tier gets a rolling 2-snapshot window; Pro users get unlimited history.
  • Added inline trend summary in the Workspace tab showing regressed files, recovered files, and net score change between the two most recent snapshots.
  • Added baseline mode: lock a baseline with iris.lockTrendBaseline. Iris Code writes .iris-baseline.json to the workspace root (committable, diffable). Set gateBaselineMode: true and the gate only blocks new regressions above the accepted baseline.
  • Added iris.clearTrendHistory command to wipe all snapshots and the baseline file.
  • Added trial plan type: the extension now surfaces 'trial' as a distinct plan with an Iris Code Pro Trial badge and trial-end date. Trial users get full Pro access.
  • Redesigned the account dashboard: new Insights page shows full activity history grouped by Lifecycle, Scans, Enforcement, and Product event categories with date-range filtering (7d, 14d, 30d, 90d, all time, or custom) and streak tracking.
  • Docs moved to docs.iriscode.co: all documentation — getting started, configuration, enforcement, secrets, dependents, privacy, and CLI — now lives on a dedicated subdomain.
v1.6.117 Jun 2026fix

Python analysis fixes: multi-line signatures and test-file secrets

Two Python correctness fixes. Files using multi-line (Black-formatted) function or block signatures are no longer misreported as syntax errors, and test files no longer have their score penalised for fixture credentials.

  • Fixed: a Python def/class/if/for/with header that wraps across multiple lines (e.g. a long Black-formatted signature) was being flagged as a syntax error, scoring the file 0 and skipping all analysis. These files now analyse normally.
  • Fixed: the suspicious-name secret heuristic no longer fires in test files (test_*.py, *_test.go, *.test.ts, tests/, __tests__/, conftest.py, and similar), so fixture credentials like password="secret123" no longer reduce the score. Real provider token formats (AWS, Stripe, GitHub, and more) are still detected everywhere, including tests.
v1.6.016 Jun 2026feature

CI enforcement: GitHub Actions, inline PR annotations, and multi-CI snippets

Iris Code 1.6.0 takes the same health gate you run locally and enforces it in CI. Run iris gate . --format github on every pull request to block merges and annotate the exact failing lines inline on the diff. Everything runs on your own runners - your code never leaves your infrastructure.

  • Added --format github to iris check and iris gate: emits GitHub Actions workflow commands so failing rules render as inline annotations on the pull request diff, and writes a pass/fail summary table to the run's job summary.
  • Added the Iris Code: Add GitHub Actions Workflow command (Pro): generates a ready-to-commit .github/workflows/iris.yml in your repo, pre-filled with your configured threshold.
  • Added the Iris Code: Add CI Pipeline Snippet command (Pro): generates an Iris Code step for GitLab CI, Bitbucket Pipelines, an npm/pnpm/yarn script, or a generic shell script.
  • Added a versioned JSON schema: all --format json output now carries a schemaVersion field (currently 1) so scripts can depend on the payload shape.
  • Changed CI behaviour when no licence is present: Pro-only steps now skip and exit 0 instead of failing the build, with a non-blocking warning annotation inside GitHub runners, so a missing token does not turn the pipeline red with noise.
  • Added an iris-alpine-amd64 binary for musl-based (Alpine) containers. The npm install -g @iris-code/cli route was already musl-safe and works unchanged.
  • Published @iris-code/cli 1.1.0 with the new --format github support, and bumped the example workflows to actions/checkout@v5 and actions/setup-node@v5 (Node 24).
v1.5.010 Jun 2026feature

Analytics batching, push-blocked counter, and reliability improvements

Iris Code 1.5.0 ships reliable background analytics, a Pro push-blocked counter, CLI event tracking, and reliability improvements across the extension and backend.

  • Added analytics batching: the extension buffers usage events in memory and flushes every 60 seconds. push_blocked events flush immediately. The buffer survives extension crashes via crash-safe persistence to globalState.
  • Added exponential backoff on consecutive analytics flush failures, with a clean flush on extension deactivate so no events are dropped on VS Code quit.
  • Added CLI analytics: iris check, iris gate, and iris secrets runs now emit a fire-and-forget event so hook-triggered runs appear in the Iris Code dashboard alongside extension activity.
  • Added push-blocked counter: the Pro sidebar now shows monthly pushes blocked, total pushes blocked, and the health score delta since Pro was activated. Resets the monthly count automatically on month rollover.
  • Improved reliability and hardening across the extension, backend, and web surfaces.
v1.4.25 Jun 2026fix

Documentation and CLI reference updates

Documentation clarity improvements and expanded CLI command reference across the extension and landing site.

  • Improved command reference documentation for the full CLI suite with clearer descriptions and examples.
  • Updated landing site copy to reflect the published @iris-code/cli npm package.
v1.4.14 Jun 2026fix

Welcome page improvements

Enhanced welcome page layout with updated feature highlights and clearer onboarding paths.

  • Refreshed the VS Code welcome page with a new feature section layout and updated quick-start links.
v1.4.03 Jun 2026feature

Full CLI command suite and npm package

Iris Code 1.4.0 ships a complete command-line tool — available via npm install -g @iris-code/cli. Scan any project from your terminal, manage enforcement hooks without opening VS Code, audit dependencies for CVEs, and authenticate once with a persistent credentials file. No VS Code installation required.

  • Added iris auth: sign in via browser or licence token, store credentials in ~/.iris/credentials (chmod 600). iris auth login, iris auth logout, and iris auth status. Credentials read from IRIS_LICENCE_TOKEN env var first, then credentials file.
  • Added iris secrets: free hardcoded secret scanner across JS/TS/Go/Python. Two-layer detection — suspicious variable names and known token formats. Exits 1 if any findings. No licence required.
  • Added iris deps: audit all dependencies (package.json, go.mod, requirements.txt) for outdated versions and CVEs via the GitHub Advisory API. Results are cached for 24 hours. Store a GitHub PAT via iris auth login for higher rate limits.
  • Added iris todos: aggregate all TODO/FIXME/HACK comments across your codebase. Pro feature.
  • Added iris gate: run the full enforcement gate and show each configured rule's threshold vs actual value with per-rule PASS/FAIL. Pro feature.
  • Added iris report: generate a standalone dark-themed HTML scan report. Free. Defaults to iris-report.html in the current directory.
  • Added iris hook: manage pre-push and pre-build hooks from the terminal without VS Code. iris hook git|build install|uninstall|status. Install/uninstall is Pro, status is free.
  • Added iris config: iris config init generates a .irisconfig.json with interactive preset selection. iris config validate reports any problems in an existing config.
  • Updated iris check: file scans remain free. Directory scans, --staged, and --changed now require Pro — consistent with workspace analysis in the extension.
  • Published @iris-code/cli to npm with Linux and Windows self-contained binaries on each GitHub Release.
  • Added GitHub Actions docs page at docs.iriscode.co/enforcement/github-actions covering the full CI workflow, gate variant, exit codes, and threshold configuration.
  • Hook install messages in the extension now inform users to run iris auth login or set IRIS_LICENCE_TOKEN so the hook can validate at push or build time.
v1.3.028 May 2026feature

Gate Preview, preset cycling, and custom scoring weights

Iris Code 1.3.0 ships Gate Preview — a free, read-only view of how your workspace scores against all five preset thresholds. Cycle through presets with prev/next controls or jump directly from the chip strip, drill into failing files (Pro), and apply the chosen preset in one click. Also ships custom health score weights and four new gate enforcement config fields for Pro users.

  • Added Gate Preview: open it from the bottom of the File tab. It runs a full workspace scan and shows pass/fail counts for each of the five preset thresholds (legacy, balanced, typescript, strict, security) with proportion bars, a threshold card, and a recommendation for the next enforcement step. Always read-only — no files are blocked and no config is written.
  • Added preset cycling: use prev/next arrows or click any chip in the preset strip to jump between presets. The focused preset shows a full drilldown and an Apply button so you can lock in a threshold in one click without leaving the surface.
  • Added per-file drilldown for Pro users: expand any preset row to see the exact files that would be blocked, their health scores, and the warning pills driving the failure.
  • Added custom health score weights for Pro users: set `healthScoreWeights` in `.irisconfig.json` to change how many points each finding type deducts from the base 100. Supported keys: `hardcodedSecret`, `errorWarning`, `warningWarning`, `anyUsage`, `tsIgnore`, `consoleLog`, `deepNesting`, `longParamList`, `unusedVar`, `unusedFunction`.
  • Added four gate enforcement config fields for Pro users: `gateMaxSecrets`, `gateMaxComplexity`, `gateMaxFileLength`, and `gateMaxSmellsPerFile`. Set these in `.irisconfig.json` and the CLI enforces them on every push alongside `minHealthScore`.
  • Improved licence reliability: server errors (5xx) and network timeouts now apply an offline grace period instead of revoking Pro. Activation skips the network call if your licence was validated within the last 24 hours.
v1.2.127 May 2026fix

Collapsible Pro card

A small follow-up to 1.2.0 that adds a collapsible Pro-status card in the sidebar and detached panel.

  • Added a collapsible Pro-status card in the sidebar and detached panel. Once signed in the card collapses to a compact chip so it stays out of the way while still showing plan status at a glance.
v1.2.020 May 2026feature

Config presets, dashboard sync, and bank transfer billing

Iris Code 1.2.0 ships a complete config management flow — pick from five presets, tune on the dashboard, and push to VS Code in one click. Nigerian users can now also pay with a bank transfer instead of a card.

  • Added preset configs: set `presetId` in `.irisconfig.json` to snap your whole team to a known baseline (strict, balanced, legacy, security, or typescript). Preset configs are free for all users.
  • Added config enforcement for Free users: if a free user edits preset threshold values locally, those edits are ignored and marked with a yellow warning in the editor pointing to the preset as the source of truth.
  • Pro users can start from any preset and override individual values — the preset acts as a baseline, not a lock.
  • Added a Config page in the account dashboard for generating and customising Iris Code configs with a live preview.
  • Added dashboard-to-VS Code sync: generate a config on the dashboard, click Sync to VS Code, review a diff preview in the editor, and confirm the write — no copy-pasting.
  • Added Paystack bank transfer checkout for Nigerian users: choose a one-time transfer checkout from the billing page, pay to the transaction-specific account shown, and Pro activates on confirmation. A fresh checkout is opened each renewal cycle.
  • Fixed config sync diff preview leaving behind unsaved Untitled files after confirmation.
v1.1.018 May 2026feature

Onboarding, docs, and account setup flow

Iris Code 1.1.0 turns the first-run experience into a complete product flow across the extension and the web account surfaces, with guided onboarding, embedded docs, and clearer setup follow-through.

  • Added a guided first-run onboarding flow inside the extension sidebar, including skip, resume, restart, and a 15-step spotlight walkthrough across the live tabs.
  • Added an in-flow docs surface inside Iris Code so setup help now lives in the extension instead of forcing users out to separate pages first.
  • Added public and dashboard-nested getting-started flows covering install, first scan, sign-in, configuration, and enforcement setup.
  • Added an account dashboard welcome banner and contextual driver.js tour to help new users land on billing, license, and quick-start actions faster.
  • Improved onboarding state handling so returning users with existing config do not get dropped back into the first-run path unnecessarily.
  • Added a free-user config nudge and clearer Pro gating cues so workspace scans, issue navigation, and setup boundaries are easier to understand.
v1.0.911 May 2026fix

Trae, Cursor, Windsurf and all VS Code forks

Sign-in now works correctly in Trae IDE and any other VS Code fork. The sidebar has also been rebuilt internally for better reliability.

  • Fixed sign-in redirect failing in Trae IDE and other VS Code forks — the extension now auto-detects the correct URI scheme for any editor without needing manual updates.
  • Fixed an inaccurate notification shown in the detached panel when a free user clicks a Pro-only feature.
  • Rebuilt the sidebar and detached panel internals using React — the experience is identical but the foundation is now typed and maintainable.
v1.0.030 Apr 2026feature

Build hook enforcement

Iris Code can now run a health check before your project builds, not just before you push. Failing files block the build early, before the language toolchain runs.

  • Added pre-build health check for Node projects via the npm prebuild lifecycle script — runs automatically before pnpm build, npm run build, and yarn build.
  • Added Makefile-based pre-build check for Go and Python projects, wired as a prerequisite on the build or all target.
  • Iris Code creates a Makefile with sensible defaults if none exists in Go or Python projects.
  • Build hook status appears alongside the existing Git Hook section in the sidebar File tab.
  • Both install and uninstall are safe: markers guard the injected block and original hook content is preserved on removal.
v1.0.029 Apr 2026major release

Enforcement Update

Version 1.0.0 brings Iris Code together as a fuller code-health workflow inside VS Code, with stronger checks before code leaves your machine.

  • Added pre-push enforcement so teams can catch failing code before it is pushed.
  • Improved in-editor issue visibility with clearer diagnostics while you work.
  • Expanded project-wide analysis and dependency review in the extension.
  • Included a more complete release focused on enforcement, scanning, and review flows.
v1.0.025 Apr 2026improvements

Stability and polish

A follow-up update focused on smoothing rough edges after the main 1.0 rollout.

  • Improved default configuration behavior for day-to-day use.
  • Fixed smaller workflow issues and tightened overall stability.
  • Polished supporting parts of the product for a cleaner experience.
v0.2.013 Apr 2026version update

Version 0.2.0

Version 0.2.0 continued the early Iris Code rollout with another round of product polish and refinement.

  • Improved the overall extension experience.
  • Shipped another round of fixes and polish in the 0.x cycle.
v0.1.x6 Apr 2026feature update

Panel and history improvements

This update expanded how results could be reviewed during longer coding sessions.

  • Added a wider panel view for reviewing analysis results.
  • Improved how scan history and progress were presented.
v0.1.x12 Mar 2026project start

Initial rollout

The first Iris Code release introduced the foundation for local code-health analysis inside VS Code.

  • Launched the first version of the Iris Code extension experience.
  • Introduced the early scoring and analysis workflow.

Catch regressions before human review

Install Iris Code, set a threshold, and make every change answer to the same deterministic rules. Source analysis runs locally. The same rules run in VS Code, JetBrains IDEs, the iris CLI, hooks, and CI.

Install free on VS CodeInstall free on JetBrainsRead the docs
VS CodeCursorWindsurfVSCodiumIntelliJ IDEAWebStormPyCharmGoLandVS CodeCursorWindsurfVSCodiumIntelliJ IDEAWebStormPyCharmGoLand