Version 1.28.0 - latest

Changelog

Release notes for Iris Code across VS Code, JetBrains IDEs, and the iris CLI. Updates ship automatically through the VS Code Marketplace, Open VSX, and the JetBrains Marketplace.

Jump to latest

v1.28.016 Sept 2026improvementslatest

One name per thing

The Command Palette offered two verbs for one act, the docs used four labels for scanning a project, and developers were reading the whole website and still asking what the product was. This release gives every concept exactly one name.

Every command that runs an analysis is called Scan. Analyse Workspace is Scan Workspace, Analyse This Folder is Scan This Folder, Analyse Current Folder is Scan Current Folder, Analyse Current File is Scan Current File, Analyse This File is Scan This File, and Restart First Review is Restart First Scan. Command ids are unchanged, so existing keybindings still work.
The JetBrains plugin carried its own copies of those names and had drifted from VS Code. Both hosts now read the same, which is the promise a shared engine makes.
The Folder tab pointed at Iris: Analyse This Folder, a name no registered command had. Every command is prefixed Iris Code:.
The Issues tab is the Findings tab. A finding is what Iris Code reports; issue also meant a real defect and a support report.
Project Review is a workspace scan. The behaviour is identical: your first full workspace scan is still free, still saved locally, still needs no account.
finding, blocker, warning, gate and threshold are defined in the docs, and a terminology page lists every term with the ones it replaced.
Gate Preview and Quick Start said five presets while the configuration pages said six. ai-assisted was missing from both, and is now listed with its real threshold of 82.
The CLI overview omitted iris init, iris fix, iris mcp, iris rules and iris auth while linking to a page promising all seventeen.
The docs Languages table listed six of ten languages, silently dropping Ruby, C#, Java and Rust.

v1.27.015 Sept 2026feature

Setup, safe fixes, and presets that enforce

Setting a project up is now one command, Iris Code can remove the findings it can prove are safe to remove, and a preset finally enforces at the gate what it has been showing in the editor.

iris init sets a project up in one command. It asks three short questions, recommends one of the shipped presets and says why, writes a commented .irisconfig.json, creates or refreshes the AGENTS.md rules block, and installs the pre-push hook where the licence allows it. Running it again preserves an existing config.
iris fix --safe removes only what can be proved safe to remove: a line holding nothing but a debug statement, a literal-only unused variable, or a standalone unused Java import. It previews first and asks before writing. The same three are a Quick Fix in VS Code and available to agents over MCP.
Findings explain themselves. A threshold finding now reports the measured value, the configured limit and the exact overage, using the limit that actually applied to that file.
presetId now applies to the CLI, the git hook and CI. It was honoured in the editor and dropped everywhere else, so a project on a preset was gated at the default 70 while the editor showed the preset thresholds.
Presets now carry gate limits, so choosing one configures the whole gate rather than only the score. Gate limits remain a Pro feature.
Iris Code follows Git core.hooksPath, so Husky projects get the block in .husky/pre-push with their own script preserved.
Run Iris Code: Open Config Studio from the Command Palette to open the dashboard editor. Sync still opens a real diff and writes only after confirmation.
VS Code can discover the Iris Code MCP server without copying a JSON block. The registration uses npx -y @iris-code/mcp without naming a folder, so the client workspace remains the boundary.
When .irisconfig.json changes, Iris Code checks generated agent-rule blocks it already wrote and suggests iris rules --refresh only when they no longer match. The notice never rewrites a committed file.

v1.26.08 Sept 2026feature

Iris Code Cloud and Teams workspaces

Iris Code can now audit a repository without your editor open. Connect it on GitHub once and every change that lands is scored, with the report kept against the commit that produced it. Teams adds a shared workspace on top: seats, a published standard every repository is measured against, and an audit trail a reviewer can read.

Connect a GitHub repository and Iris Code audits it on the events you choose. A merge costs one audit; a pull request costs one per update pushed to it, so merges are on by default and pull requests are opt-in. Each repository decides for itself, and the setting says what it costs rather than only what it does.
Every audit spends one scan from your allowance, whoever or whatever started it. Pro includes 50 a month and a Teams workspace includes 100 per seat, so the smallest team has 300. The allowance is shown on your projects screen with the date it resets, and warns before it runs out rather than at the moment it does.
Teams workspaces: invite by email with roles, per-seat billing from three seats up, and seat changes you can make yourself - quoted before anything is charged, with increases prorated to the card on file and reductions taking effect at the next renewal.
A team seat grants Pro in every member's editor. Your account page now says whose subscription is covering you and until when, rather than reading your own subscription alone and telling a paying team member they were on the free plan.
A published team standard, and an audit trail recording which commit was audited, what it scored and how many findings were open - from the editor and from CI. Counts and revisions only: no source code, no file names, no findings text.
Reports are pinned to the commit that produced them, so a pull request audit never overwrites your default branch's score, and an old link resolves to an honest answer rather than to today's numbers.

v1.25.231 Aug 2026fix

Accuracy corrections across JavaScript and TypeScript

Iris Code reported some valid JavaScript and TypeScript files as unparseable, scored them zero, and failed the gate on them. It also counted JSX markup as function length, so React components were reported as long functions when their logic was short. Both were reported from real projects, and both are corrected here.

Regular expressions containing brackets, and JSX files with a URL in visible markup, no longer produce false parse errors. Twelve files in one project moved from a score of 0 to between 92 and 100.
A file Iris Code cannot parse is no longer scored zero into your workspace average or listed below the minimum score. It is reported separately as a file that could not be analysed, and gateMaxParseErrors is available for teams that want it to fail the gate.
Function length in .jsx and .tsx excludes JSX markup, so a component is measured by its logic. Logic inside markup still counts. File length and functions-per-file are unchanged, so a large component is still reported as a long file.
.tsx files score about 1 to 2 points higher as a result. This corrects a measurement rather than reflecting a change in your code; re-lock your baseline if you use gateBaselineMode.
Storage keys such as const KEY = "da-os-canvas" are no longer reported as hardcoded secrets, TODO and FIXME are found in block comments, and a localhost mention inside documentation prose is no longer reported as a hardcoded endpoint.

v1.25.131 Aug 2026fix

MCP server setup no longer names a folder

Every published MCP example pinned a project folder, including the configuration block most people copy. That flag stops Iris Code asking your editor which project is open, so one pinned entry reused across projects answered all of them about the folder it named.

The documented setup is now npx -y @iris-code/mcp with no folder, which makes a single registration correct for every project you open.
--root remains available as a deliberate per-project pin. --root . pins nothing: it resolves to the directory the server was started in, which is already the fallback.
The server now reports the folder it is analysing at startup, and explains itself when run by hand in a terminal rather than waiting silently.

vCLI 1.17.027 Aug 2026feature

MCP server: your rules, in your AI agent

Iris Code now serves its analysis to Claude Code, Cursor, Windsurf, Copilot agent mode and Zed over the Model Context Protocol. An agent can ask what a file's findings are, what the project actually enforces, and whether a change would pass the gate, and it gets the same numbers the pre-push hook uses rather than a guess. Shipped through the CLI, so it needs no extension update.

npx -y @iris-code/mcp starts the server; editors bundling the Iris Code binary can use iris-lsp --mcp instead, with no Node install.
Six tools. Free: findings for one file, the project's resolved config, and safe fixes on one file. Pro: folder and workspace scope, rule detail, gate status, and dependency risk.
Findings carry every rule with its real severity and a stable id, so an agent sees debug prints, TODOs and magic numbers alongside blockers rather than only what CI annotates.
Safe fixes preview first and apply only the change set a previous preview returned a token for. A hardcoded secret is never auto-fixed, and a debug print sharing its line with real code is left alone.
Oversized results drop the lowest severities first and report what was withheld, so a critical finding is never truncated away and a partial answer cannot look complete.
Paths are confined to the folder you name, checked after resolving symlinks. There is no shell-execution tool, secret values are always masked, and analysis stays on your machine.
Pro tools stay listed and describe themselves as Pro rather than hiding, so your assistant can tell you what an upgrade adds.

v1.24.025 Aug 2026feature

Project rules for AI agents

Iris Code writes your project's own limits, naming convention, suppression policy and gate rules into the files your coding agents read, so an agent follows your standards while it writes instead of after review. Free, generated from .irisconfig.json, and no AI model is involved.

Added iris rules and the matching editor command: writes AGENTS.md, CLAUDE.md, Cursor rules, or GitHub Copilot instructions. Run it from the command palette, the File tab, the welcome page, or the terminal.
Write several files at once. Claude Code reads only CLAUDE.md while AGENTS.md is the file Codex, Cursor and Copilot read, so a team running two agents needs both. Each file gets the full rules rather than a pointer to another file.
The rules are imperatives carrying your project's real numbers, not a copy of your config. Only what you have configured appears: turn a detector off and its rule is absent rather than stated and contradicted.
A project written in one language gets that language's effective limits, not the project defaults with a footnote. The rules never quote a limit the gate does not enforce.
The rules name only what your project can contain. A Java project is not told to avoid TypeScript's any, and the debug-output rule names System.out.println rather than every language's equivalent.
Regenerating updates only Iris Code's own block, between markers, and never your own text. Running it again with nothing changed reports the file is already up to date rather than producing a diff.
Added --all to write every target, --refresh to update only the files a repository already has, and --dry-run to see the result first. One file that cannot be updated is reported with the reason while the rest still change.
Fixed per-language overrides for Java and Rust being rejected by the config schema. Both languages have been analysed since 1.23.0, but a valid languages.java block was flagged as invalid in every editor with schema support.

v1.23.223 Aug 2026fix

Release tooling

A fix to the release process itself. Analysis, findings, and scores are unchanged from 1.23.1.

Fixed: the JetBrains release step that confirms the shared analysis engine was rebuilt was written for one platform's shell, so it could report success without having checked anything. Nothing you interact with changed in this version.

v1.23.123 Aug 2026fix

Workspace scans stay inside the workspace

Every file a workspace scan analyses now resolves to a real location inside the folder you selected.

Fixed: a scan could follow a symlinked file out of the folder being scanned, so a file living elsewhere on the machine was analysed, scored, and counted as part of your project. A score that covers files the repository does not contain is a score nobody can act on. Partial scans now compare resolved paths, and full scans skip links.

v1.23.017 Aug 2026feature

Java and Rust analysis

Java and Rust join the same analysis engine as the other seven languages, bringing the total to nine. Maven, Gradle, and Cargo dependencies are audited alongside npm, Go, Python, RubyGems, and NuGet, and Cargo lockfiles give the full resolved transitive tree.

Added Java analysis across every editor, the CLI, git hooks, and CI. Covers .java source and .properties configuration, including methods and constructors, imports, nesting, complexity, secrets, suppressions, naming, scoring, gates, and duplicate detection.
Added Rust analysis on the same surfaces, covering functions, modules, imports, complexity, secrets, suppressions, naming, scoring, gates, and duplicate detection.
Added three language-specific checks: process execution in Java via Runtime.exec or ProcessBuilder, and in Rust both unwrap or expect calls and explicit panics. Catch-all exception handling now covers Java as well as C#, sharing one rule id so a single severity setting and a single iris-ignore comment cover a codebase using both.
Rust checks are exempt inside #[cfg(test)] modules. Rust puts tests in the file under test, so the exemption is computed per test item rather than per file - a whole-file exemption would spare the production half too.
Java unused imports are reported, and the check reads Javadoc, so an import referenced only from a {@link} is left alone rather than removed in a way that would break javadoc.
A .properties file is read as configuration rather than code: it is scanned for committed credentials, and its ports and log levels are not reported as unexplained numbers.
Added Maven and Gradle dependency and CVE audits covering pom.xml, build.gradle, build.gradle.kts, and Gradle version catalogues, including ${property} placeholders and dependencyManagement. Neither tool commits a resolved tree by default, so these scans cover declared dependencies and say so.
Added Cargo dependency and CVE audits. Cargo.lock is the best dependency input of any ecosystem Iris Code reads: exact versions and the full transitive tree, with git and path dependencies correctly excluded because a public registry knows nothing about them.
Advisories published without a severity are now shown rather than dropped. Most RustSec advisories carry no score, so they were being hidden entirely; they appear as unrated, are counted, and never satisfy a high-severity gate, because an unrated advisory is one nobody has scored rather than one known to be minor.
Added Java and Rust to the published accuracy benchmark, on 17 and 16 rules respectively.
Fixed committed credentials in Java source and .properties files going undetected. Java has no const, let, or var, so the name-based check matched nothing and only credentials with a recognisable provider format were ever reported - a database password has no such format.
Fixed constants that name a credential field being reported as the credential they name. A settings key or JSON field whose value mirrors its own identifier is no longer flagged, which cut false positives on a large real-world Java codebase by three quarters without losing a single real detection.
Fixed fixture credentials in Gradle test source sets being reported as production secrets. Gradle projects declare test source sets freely, and only src/test was recognised.
Fixed a naming convention asking you to rename application.properties. Spring resolves that filename exactly, so the suggested rename would have broken the application.
Fixed advisories with no published severity disappearing on a second scan, which turned a vulnerable package green after the first result was cached.
Fixed iris sbom reporting no dependencies for Java and Rust projects, and iris deps, iris cve, and iris sbom refusing pure Rust and pure Gradle projects outright.
Fixed Maven latest-version lookups in both directions: an upgrade is no longer offered to a date-based release from 2003, and a -jre or -android classifier is no longer mistaken for a prerelease, which had left some packages with no known latest version at all.
Fixed the Dependencies table flickering when a scan finishes. It was rebuilding every row to re-sort them, which also closed any advisory panel you had expanded and repeated on every filter click and search keystroke.
Large, heavily documented Java files now analyse in a fraction of the time and scale in proportion to file size.
Java and Rust files show their own language label and colour, and Java debug output is described as System.out.println rather than console.log.

v1.22.013 Aug 2026feature

RubyGems and NuGet dependency audits

Ruby and .NET dependencies are audited like every other ecosystem. Gemfile.lock gives the full resolved tree so transitive gems are covered, and NuGet reads PackageReference entries across a whole solution alongside Central Package Management, packages.lock.json, and legacy packages.config.

Added RubyGems dependency and CVE audits across the Dependents Table, iris deps, iris cve, and iris sbom. Gemfile.lock provides exact transitive versions; a gem pinned only to a range is reported as not checked rather than guessed at.
Added NuGet dependency and CVE audits covering .csproj PackageReference entries across every project in a solution, Central Package Management via Directory.Packages.props, packages.lock.json, and legacy packages.config. Two projects pinning different versions are surfaced as a conflict instead of silently resolved to one, and prerelease versions are never offered as stable upgrades.
Added Ruby to the published accuracy benchmark on every shared rule, not only the three Ruby-specific ones.
The dependency-lookup disclosure now names RubyGems.org and NuGet.org, the two new registries contacted. Only package names and versions are sent, as before.
Fixed native gems being reported as vulnerable when already patched. A platform-suffixed lock version such as 1.19.4-x64-mingw-ucrt had its suffix read as part of the version, so advisories already fixed in the installed version still matched and current gems stayed listed as outdated.
Fixed a gem RubyGems cannot resolve - yanked, renamed, private, or mistyped - appearing as outdated with an upgrade target of unknown instead of not checked.
Fixed SBOM components with no resolvable version carrying a package URL whose version was placeholder text. The form was structurally valid, so a scanner accepted it and then silently failed to match the component.

v1.21.012 Aug 2026feature

C# and .NET analysis

C# joins TypeScript, JavaScript, Vue, Svelte, Go, Python, and Ruby on the same analysis engine, with .NET-aware checks and project files read as manifests rather than as code.

Added C# analysis across every editor, the CLI, git hooks, and CI. Covers .cs source and .csproj project files, including methods, constructors, nesting, using namespaces, PackageReference entries, secrets, suppressions, naming, scoring, and gates.
Added four C#-specific checks: async void outside an event handler, catch-all exception handlers, LINQ chains long enough to be hard to follow, and types carrying too many responsibilities.
All five C# string forms are understood before any rule runs, including verbatim paths such as @"C:logs\" and raw triple-quoted literals. A Windows path or an embedded JSON payload can no longer be mistaken for code.
A .csproj is read as a manifest: its dependencies and any committed credential, never its build settings. Language versions and warning levels are not reported as unexplained numbers.
.NET test projects are recognised, so fixture credentials and localhost URLs inside a Tests project are not reported as production findings.
C# reports no unused members or unused packages. Dependency injection, reflection, partial classes, and source generators reference code in ways static analysis cannot see, so an unused verdict is not one we can stand behind.
JetBrains: the Iris Code panel no longer opens blank on IntelliJ 2026.2, where the IDE moved its embedded browser out of the platform. If an IDE cannot provide one at all, the panel offers to open the same interface in your browser instead of showing an empty tab.

v1.20.010 Aug 2026feature

Ruby, Rails, and ERB analysis

Ruby joins TypeScript, JavaScript, Go, and Python on the same analysis engine, with Rails-aware checks and support for the filenames Ruby projects actually use.

Added Ruby analysis across every editor, the CLI, git hooks, and CI. Covers .rb and the Ruby DSL extensions, plus the extensionless files Ruby projects rely on such as Gemfile, Rakefile, Vagrantfile, and the Fastlane set, which no extension-based check would ever have found.
Added ERB template support. Ruby inside <% %> tags is analysed while the surrounding HTML is excluded from scoring and duplicate matching, and findings report the line in the template file itself.
Added three Ruby-specific checks: method_missing defined without respond_to_missing?, god classes, and Rails parameters reaching a model without require and permit.
Ruby-aware lexing: heredoc bodies, percent literals, and =begin/=end blocks are excluded before matching, and a method's length is measured by tracking do/end nesting rather than stopping at the first end.
Ruby reports no unused imports or unused gems. Constants resolve at runtime through send, const_get, and Rails autoloading, so an unused verdict is not one we can stand behind.

v1.19.08 Aug 2026feature

Slack notifications and a responsive Config Studio

Iris Code can send check and gate results directly from your own CI to Slack. The Config Studio also keeps its live preview usable on narrow screens.

Added Slack notifications for iris check and iris gate. Set IRIS_SLACK_WEBHOOK once in CI; messages are built and sent locally, contain paths, scores, rule names and counts only, and never pass through Iris Code servers.
Added the free iris slack setup, test and manifest commands. Setup validates the webhook and proves delivery before showing the CI secret configuration, while manifest creates a pre-configured Slack app with incoming-webhook as its only scope.
Added --slack-on always for passing runs and --slack-dry-run for inspecting the payload without posting. Notification failures never change the check or gate exit code.
Fixed the Config Studio preview disappearing on smaller screens. A centred modal now shows the same live config with copy, keyboard and backdrop dismissal, internal scrolling, and spacing that remains usable down to phone widths.
Moved the narrow account navigation into an animated menu so account links no longer occupy the bottom of every page.
Fixed a file-naming violation appearing twice in the VS Code Problems panel.

v1.18.25 Aug 2026fix

JetBrains panel legibility, and a correction

Two fixes to how the Iris Code panel renders inside JetBrains IDEs, and a correction to a claim made in the 1.18.1 release notes.

Fixed: secondary text in the JetBrains panel was drawn in the IDE's disabled-control grey rather than its secondary-text grey, so supporting detail was dimmer than the same UI in VS Code.
Fixed: the JetBrains panel now matches your IDE's text size. It was never told the IDE's interface scale, so it rendered smaller than the rest of the IDE for anyone using a larger UI font. It follows theme and font changes while open, and the table views scale with it.
Correction: the 1.18.1 notes said the iris CLI is now published with npm provenance. It is not. npm only accepts a provenance attestation when the source repository is public, and ours is private, so the registry rejects it. No code changed as a result - only the incorrect note.
Fixed: comments in a config created by iris config init called the tool "Iris" instead of "Iris Code" in two places, and had lost the (Pro) marker on two fields that a Free licence ignores. Existing config files are untouched.

v1.18.05 Aug 2026feature

Vue, Svelte, and naming that follows your folders

Iris Code reads Vue and Svelte components, analysing their script blocks while ignoring template and style markup, with findings on the component's own lines. File naming can now follow what a file does rather than only which language it is written in.

Vue and Svelte single-file components are analysed everywhere Iris Code runs: the editor, the CLI, hooks, and CI. Script blocks are read as JavaScript or TypeScript from the lang attribute, and template and style markup is excluded from both analysis and duplicate detection, so component markup never inflates a finding count.
Findings keep their real line numbers. A secret on line 11 of a .vue file is reported at line 11.
Role-based file naming (Free): fileNaming.overrides takes an ordered list of path globs, so components/** can require PascalCase while composables/** or hooks/** require camelCase - conventions that could not both be expressed before, because a lang="ts" component and a .ts module are the same language. The last matching rule wins, and existing configs behave exactly as before.
File-naming violations now appear as inline diagnostics in JetBrains IDEs, matching VS Code.
Fixed: the no-exports check fired on essentially every Vue and Svelte component, and SvelteKit route files such as +page.svelte were reported as badly named with a suggested rename identical to the name they already had.
Fixed: large files analyse dramatically faster. Analysis time grew with the square of a file's line count, so a very long file could stall the editor or a CI run for minutes; a 200,000-line file now takes a fraction of a second. Findings are unchanged.
Fixed: an unusable file-naming glob is reported with its exact location instead of stopping the scan, and can no longer quietly excuse a file from its convention.
Changed: iris report and iris sbom now require --output to stay inside the current directory, matching iris check, iris deps, and iris cve.
Fixed: the Config Studio preview showed a config shape Iris cannot read - it described its own nested groups (thresholds, detections, diagnostics, severity) rather than the real flat keys. Copying the preview instead of syncing produced a file where every threshold and toggle was silently ignored. The preview, the Copy button, and Sync are now the same text. Configs you synced were always correct.

v1.17.030 Jul 2026feature

One engine, every editor

Iris Code 1.17.0 runs in JetBrains IDEs and installs from Open VSX, both driven by the same analysis engine as the VS Code extension. A file scores identically in every host, one sign-in covers your editors and the CLI, and analysis still never leaves your machine.

Iris Code for JetBrains IDEs: IntelliJ IDEA, WebStorm, PyCharm, GoLand, PhpStorm, Rider, RubyMine, CLion, and Android Studio. Inline diagnostics, iris-ignore quick fixes, health scores on hover, code lenses, filename-convention renames, and the full Iris Code panel under Tools > Iris Code. Install the LSP4IJ plugin first and restart the IDE fully.
Open VSX distribution, so Cursor, Windsurf, VSCodium, and other Open VSX editors install the byte-identical extension and update automatically instead of a manual .vsix.
25 searchable Iris Code commands in JetBrains. Press Ctrl+Shift+A, type iris, and run workspace scans, Review My Changes, trends, hooks, dependencies, history secrets, or report export. Any of them can be bound to a keyboard shortcut under Settings > Keymap.
Sign in and out from JetBrains under Tools > Iris Code. Analysis and the panel refresh in place, so Pro activates without an IDE restart, and one sign-in still covers the CLI.
Dashboard config sync reaches JetBrains: build a config in the Config Studio, choose Sync to JetBrains, and paste the one-time code into Tools > Iris Code > Sync Config from Dashboard. You review a diff before anything is written.
Hovering a setting in .irisconfig.json now explains what it does. The documentation comes from the schema bundled with your installed version, so it works offline and always matches the version you are running.
Fixed: a Pro config could briefly be reported as Free in JetBrains while the licence was still validating, which also scored files against Free thresholds until it settled.
Fixed: Gate Preview and the trend-history table are Free features but were refused on the Free plan in JetBrains. The CI generators, which are Pro, now correctly require it.

v1.16.026 Jul 2026feature

Clearer signals, consistent names

Iris Code 1.16.0 keeps Code Health as the single headline score and adds ranked Quality Signals that point to the recurring risks behind it. Free users can also enforce workspace-wide or per-language file naming conventions, with baseline-aware rollout and Explorer feedback. Ships with @iris-code/cli 1.9.0.

Quality Signals rank recurring duplication, suppressions, security smells, type debt, debug prints, TODO load, complexity, and naming problems using density-based attention levels while preserving the raw counts. They are navigation and prioritisation, not a second score.
Free file naming policies support snake_case, kebab-case, camelCase, and PascalCase at workspace level, with optional per-language overrides for mixed-language repositories.
Naming rollout can check only files outside the locked baseline or audit every file. Per-language scope overrides the workspace default when a language needs a different migration pace.
Misnamed files receive rename suggestions, Explorer decorations, and optional editor diagnostics. Framework entry points, generated files, test suffixes, and custom ignore globs are handled without forcing one convention everywhere.
Added an AI-assisted preset and the Pro gateMaxNamingViolations cap for teams reviewing AI-assisted code at volume.
Fixed config parity gaps so security-smell toggles, severity overrides, inline-diagnostic defaults, and sidebar font sizing are applied consistently across the extension and CLI.

v1.15.020 Jul 2026feature

Accuracy you can check, and rate

Iris Code 1.15.0 makes its findings accountable: every analysis rule is measured against a labelled corpus of real code for per-rule, per-language precision and recall, a checked-in baseline blocks any release that regresses a rule, and every finding in the sidebar now carries a thumbs up / down so you can tell Iris Code when it is right or wrong. Ships with @iris-code/cli 1.8.0.

Rate any finding: a thumbs up / down control on every finding in the sidebar and Issues view. Feedback is count-only - the rule, the language, and your verdict, never source code, file paths, or line contents - and respects your account analytics setting. Rate once, change your mind anytime; the control remembers what you chose.
Accuracy benchmark: every rule is now measured against a labelled corpus of realistic code for per-rule, per-language precision (how often a finding is correct) and recall (how many real issues it catches). The measured baseline is checked in and the test suite fails the build if any rule regresses - so no release ships a quality regression unnoticed.
Fewer false positives, found and fixed by the benchmark: an any inside a comment or string, print() inside a Python docstring, CommonJS module.exports files reported as export-less, arithmetic like (a + b) * c mistaken for a risky regular expression, and the eval( token inside a string literal are no longer flagged. Each fix is locked in by a permanent test case.
A public methodology page shows the enforcement-rule accuracy figures per rule, with no single misleading global percentage. See docs.iriscode.co/trust/accuracy-benchmark.

v1.14.019 Jul 2026feature

Per-language config overrides

Iris Code 1.14.0 lets mixed-language repos stop compromising: a languages block in .irisconfig.json overrides per-file thresholds for TypeScript, JavaScript, Go, and Python independently, applied identically by the sidebar, CLI, hooks, and CI. Ships with @iris-code/cli 1.7.0.

Added per-language config overrides (Pro): a languages block in .irisconfig.json sets per-file thresholds, scoring weights, severity overrides, and per-file gate caps for typescript, javascript, go, and python files independently - a 500-line Python module and a 300-line TypeScript cap can finally coexist. Anything not stated falls back to the base config, and unknown language keys from newer versions warn instead of breaking older installs.
Resolution happens once, inside the analysis core, so the editor, CLI, git hook, build hook, and CI can never disagree about which threshold applied. The file tab shows the applied override next to the config source, and iris gate prints the limit that actually governed each failing file.
Build the block visually in the Config Studio: a new Per-language overrides section lets you enable a language and set its per-file thresholds and gate caps - empty fields inherit the base config - then sync the result straight to VS Code like any other studio config.
Six more secret formats detected: Stripe live and restricted keys, GitHub fine-grained PATs, GitLab PATs, npm access tokens, SendGrid API keys, and PEM private-key headers - masked in output, as always.
The pre-push hook now stops a hung analysis after 120 seconds (IRIS_HOOK_TIMEOUT to adjust) instead of blocking git push indefinitely - the push still fails closed with a clear bypass hint, so enforcement is never silently skipped.
Long React components are now actually measured: functions with destructured parameters were previously never checked against the function-length threshold. Component-heavy files may score lower after updating - that is the analyser finally seeing them, not a scoring change.
Reliability fixes: --allow-network reliably re-enables dependency lookups after a revoke, and the remaining CLI commands were hardened against a Windows-only crash on exit.

v1.13.015 Jul 2026feature

Review my changes, and secrets that history still remembers

Iris Code 1.13.0 makes reviewing your own Git changes the primary workflow - free, interactive, and scoped to exactly what you touched - and adds a git history secrets scan that finds credentials which were committed and later removed. Ships with @iris-code/cli 1.6.0.

Added Review my changes (Free): when Git reports local changes, a count-aware strip appears above the sidebar tabs. Run it to check every supported staged, unstaged, and untracked file and open a dedicated review with blockers first, filterable findings, changed-file health, and click-to-open source locations.
Change reviews are honest about scope: they never alter full-workspace trend history and never report unused dependencies, because that conclusion needs a full-project scan. The changed-file count only counts files the review will actually analyse.
Added the git history secrets scan (Pro): walk past commits - committed .env files included - through the same two-layer secrets detection. Findings are deduplicated per distinct secret, always masked, and show first and last sighting, the commits and files involved, and whether the secret is still in HEAD or historical-only. Content introduced by merge commits is covered, and coverage limits (depth, size caps, shallow clones) are always disclosed instead of implying a clean full history. Everything runs against local git - nothing leaves the machine.
The same scan is available in the terminal as iris secrets --history, with --depth to control how far back to walk and JSON output for automation.
Git-aware features behave predictably in unusual setups: workspaces opened inside a larger repository are scoped correctly, repositories with huge untracked folders no longer fail discovery, and a missing Git installation is reported as exactly that.
First-run experience: new installs land on a review launchpad that works on your real code immediately - review the active file, review your changes, or run the one free whole-project review. No demo tour, no account required.

v1.12.013 Jul 2026feature

Duplicate code detection: find the copy-paste, diff it, gate on it

Iris Code 1.12.0 finds copy-pasted blocks within and across files with normalised token-window matching - renamed identifiers, changed literals, reformatted whitespace, and comments do not hide a duplicate. Free for everyone, with a Pro side-by-side diff view and a new gate rule. Ships with @iris-code/cli 1.5.0.

Added duplicate code detection (Free): source is normalised before comparison, so two stretches of code that differ only in naming or values still match. Within-file blocks appear as a Duplicate blocks smell on the File tab; cross-file blocks power a new Duplication section on the Workspace and Folder tabs showing block count, the duplication percentage of total code lines, and the largest blocks with click-through to both locations.
Results stay reviewable by design: import and require headers never match, uniform data literals (country lists, enum tables) are excluded, a block repeated many times reports as a minimal set of pairs instead of every combination, and JSX-heavy files need twice the evidence before matching.
Added a full Duplicates table - filterable by cross-file or within-file, searchable, both locations clickable - that tracks live edits: line ranges update as you type and resolved pairs drop out without a rescan.
Added an Open diff action on every duplicate (Pro), titled with both locations GitHub-style. Cross-file pairs open the two full files side by side, editable with normal saves; same-file pairs open the two blocks as editable extracts that write back to the real file. Iris Code toasts the moment the duplication is resolved.
Added gateMaxDuplicateBlocks (Pro): caps the total duplicate blocks across the scan, enforced by iris check, iris gate, the git hook, and the build hook. New config knobs: enableDuplicateDetection (default on), duplicateBlockMinTokens (default 40), a duplicateCode scoring weight, and an optional duplicateCode inline diagnostic.
Duplicate findings can be suppressed like any other rule: // iris-ignore: duplicate-code -- <reason>.
.mjs and .cjs files are now analysed everywhere .js is - workspace scans, folder scans, and CLI directory checks previously skipped them.

v1.11.09 Jul 2026feature

Inline suppressions with required reasons, and a better vulnerability data source

Iris Code 1.11.0 adds inline suppressions - silence a specific finding at a specific line, but only with a written reason - and moves vulnerability lookups to the OSV.dev database, adding per-advisory confidence labels and removing the GitHub token requirement entirely. Ships with @iris-code/cli 1.4.0.

Added inline suppressions (Free): // iris-ignore: <rule> -- <reason> suppresses a matching finding on the next line, and // iris-ignore-file covers the whole file (# comments in Python). The reason is required - a directive without one stays inert and is flagged as a Bare Ignore with its own score penalty, so every suppression stays auditable.
Suppressions surface everywhere: a Suppressed section in the File tab, a Suppressions section with per-file counts in the Workspace and Folder tabs, a full filterable suppressions table with click-to-open-at-line, and a --show-suppressed flag on iris check and iris gate.
Added gateMaxSuppressions (Pro): a per-file cap on suppressions enforced by iris gate, the git hook, and the build hook - plus an ignoreSuppressions team-lead override that treats every iris-ignore comment as inert. The strict and security presets ship with default caps (5 and 3 per file) and a raised bare-ignore penalty.
Vulnerability lookups now use the OSV.dev database instead of the GitHub Advisory API. No token, no rate-limit setup - the GitHub PAT button and GITHUB_TOKEN plumbing are gone.
Every advisory now carries a confidence label - fix-available, direct, transitive, or manual-review - plus the fixed-in version where one exists, in the Dependents Table and in iris deps and iris cve output.
Advisories without a verifiable id or severity are never shown: they are skipped and the skip count is disclosed. Dependencies whose lookup failed are marked "not checked" instead of being assumed clean.
Added fix-available notifications (Pro): when a fresh scan finds critical or high-severity vulnerabilities with a fix version available, one aggregated toast offers a Review shortcut to the Dependents Table.
Fixed debug prints quoted inside comments being flagged as live debug prints in TS/JS, Go, and Python.

v1.10.05 Jul 2026feature

The supply-chain release: dependency scanning accurate enough to gate CI on

Iris Code 1.10.0 makes dependency scanning precise enough to block CI on. Scans now read your lockfile for exact installed versions, advisories are filtered to the version you actually run, monorepos are understood end to end, and two new CLI commands - iris cve and iris sbom - turn the scan into a CI gate and a standards-compliant inventory. Ships with @iris-code/cli 1.3.0.

Dependency scans are now lockfile-aware: the Dependents Table and iris deps, iris cve, and iris sbom resolve the exact installed version from package-lock.json, pnpm-lock.yaml, yarn.lock (classic and Berry), poetry.lock, or Pipfile.lock instead of trusting manifest ranges.
Advisory results are now filtered to the installed version, so packages already on a patched release are no longer flagged for advisories that only affect older versions.
Added monorepo support: npm and yarn workspaces plus pnpm-workspace.yaml members are discovered automatically, their dependencies merged and deduplicated, and internal workspace:, file:, and link: dependencies excluded from lookups.
Added iris cve [path] (Pro): the same scan, cache, and consent flow as iris deps, but exits 1 only when a vulnerability at or above --severity (low, medium, high, or critical; default high) is found - so CI can block on serious findings without failing on low-severity noise. Supports --format pretty|json and --output.
Added iris sbom [path] (Pro): exports a CycloneDX 1.5 software bill of materials across npm, Go, and Python - fully offline. Components carry name, version, purl, and direct/dev scope, and if a cached iris deps scan exists its vulnerability findings fold in, cross-referenced by purl. Supports --output and --stdout.
Added a network consent step to CLI dependency scans: the first lookup asks permission and discloses exactly what is sent (package names and versions only - never code, file paths, or project names). The choice persists in ~/.iris/preferences.json, --revoke-network and --allow-network manage it, and cached results now show their age.
Added a CVE badge (Pro) to the Dependencies section of the Workspace tab: a pill summarising the last cached scan - green when no known CVEs are found, or the vulnerable count with the highest severity. Reads the local cache only and never triggers a network request.
Added a scope indicator to the Issues and TODOs tabs showing which scan the list reflects (for example "Showing: folder · src") with a one-click switch back to the workspace scan.

v1.9.02 Jul 2026feature

Security smell enforcement: gate on it, scan for it from the CLI

Iris Code 1.9.0 closes the loop on 1.8.0's security smell detection: a new gate rule blocks pushes and CI runs on security smell count, and a dedicated CLI command scans for them independently of a full health check.

Added gateMaxSecuritySmells to .irisconfig.json: the gate fails when the total number of security smells (eval usage, SQL injection risk, insecure RNG, disabled TLS, weak hashing, and the rest of the nine 1.8.0 patterns) across the workspace exceeds this value. Enforced by the CLI, the git hook, and the build hook alongside gateMaxSecrets, gateMaxComplexity, gateMaxFileLength, and gateMaxSmellsPerFile.
Added iris security [path]: a free CLI command that scans JS/TS/Go/Python for the same nine security smell categories as the sidebar, independent of a full iris check run. Supports --format pretty|json and --output; exits 1 if any smell is found.
Added a Security Posture section to the Workspace and Folder tabs in the VS Code sidebar — a collapsible count-by-category breakdown of security smells found in the current scan.
Added the gateMaxSecuritySmells field to the Config Studio's Gate limits editor for Pro users.

v1.8.030 Jun 2026feature

Security smell detection: nine patterns, every file, free

Iris Code 1.8.0 adds a second static-analysis tier below hardcoded secrets: security smells. Nine patterns catch the most common security anti-patterns before they reach production. The feature is on by default, free for all users, and emits Warning-severity squiggles in the editor when inline diagnostics are enabled.

Added nine security smell detectors across TypeScript, JavaScript, Go, and Python: eval/exec calls, SQL built by string concatenation, insecure random number generation, ReDoS-prone regex quantifiers, disabled TLS verification, weak hashing (MD5/SHA-1), open redirects to unvalidated input, debug flags left in production code, and hardcoded localhost URLs in production paths.
Added enableSecuritySmells toggle in .irisconfig.json and VS Code settings (iris.enableSecuritySmells, default on). Turning it off suppresses all nine patterns.
Added inline diagnostics support: when enableInlineDiagnostics is on, security smell findings appear as Warning squiggles in the editor and entries in the Problems panel. Controlled per-category via inlineDiagnostics.securitySmells.
Added custom scoring weights for each of the nine patterns for Pro users — adjust the health-score penalty per pattern in healthScoreWeights (keys: evalUsage, sqlConcatenation, insecureRandom, unsafeRegex, hardcodedLocalhost, disabledTlsVerification, debugFlagsEnabled, weakHashing, openRedirect).
Added Security Smells page to the Enforcement section of docs.iriscode.co with pattern reference, language coverage tables, and configuration guide.

v1.7.025 Jun 2026feature

Trend tracking, baseline enforcement, and dashboard redesign

Iris Code 1.7.0 ships health score history, a dedicated Trends panel with per-file comparison, and baseline-mode gate enforcement so existing debt never blocks your team. The account dashboard is also fully redesigned — a new Insights page tracks all your activity with date-range filtering, streak tracking, and grouped event breakdowns.

Added trend tracking: Iris Code automatically snapshots your workspace health score on every scan, stored in .iris-snapshots/ (gitignored, 2 MB cap, same-day dedup, corrupt-entry hardening).
Added Trends panel: compare any two snapshots with a sortable, filterable per-file score table. Click any row to jump directly to the file. Free tier gets a rolling 2-snapshot window; Pro users get unlimited history.
Added inline trend summary in the Workspace tab showing regressed files, recovered files, and net score change between the two most recent snapshots.
Added baseline mode: lock a baseline with iris.lockTrendBaseline. Iris Code writes .iris-baseline.json to the workspace root (committable, diffable). Set gateBaselineMode: true and the gate only blocks new regressions above the accepted baseline.
Added iris.clearTrendHistory command to wipe all snapshots and the baseline file.
Added trial plan type: the extension now surfaces 'trial' as a distinct plan with an Iris Code Pro Trial badge and trial-end date. Trial users get full Pro access.
Redesigned the account dashboard: new Insights page shows full activity history grouped by Lifecycle, Scans, Enforcement, and Product event categories with date-range filtering (7d, 14d, 30d, 90d, all time, or custom) and streak tracking.
Docs moved to docs.iriscode.co: all documentation — getting started, configuration, enforcement, secrets, dependents, privacy, and CLI — now lives on a dedicated subdomain.

v1.6.117 Jun 2026fix

Python analysis fixes: multi-line signatures and test-file secrets

Two Python correctness fixes. Files using multi-line (Black-formatted) function or block signatures are no longer misreported as syntax errors, and test files no longer have their score penalised for fixture credentials.

Fixed: a Python def/class/if/for/with header that wraps across multiple lines (e.g. a long Black-formatted signature) was being flagged as a syntax error, scoring the file 0 and skipping all analysis. These files now analyse normally.
Fixed: the suspicious-name secret heuristic no longer fires in test files (test_*.py, *_test.go, *.test.ts, tests/, __tests__/, conftest.py, and similar), so fixture credentials like password="secret123" no longer reduce the score. Real provider token formats (AWS, Stripe, GitHub, and more) are still detected everywhere, including tests.

v1.6.016 Jun 2026feature

CI enforcement: GitHub Actions, inline PR annotations, and multi-CI snippets

Iris Code 1.6.0 takes the same health gate you run locally and enforces it in CI. Run iris gate . --format github on every pull request to block merges and annotate the exact failing lines inline on the diff. Everything runs on your own runners - your code never leaves your infrastructure.

Added --format github to iris check and iris gate: emits GitHub Actions workflow commands so failing rules render as inline annotations on the pull request diff, and writes a pass/fail summary table to the run's job summary.
Added the Iris Code: Add GitHub Actions Workflow command (Pro): generates a ready-to-commit .github/workflows/iris.yml in your repo, pre-filled with your configured threshold.
Added the Iris Code: Add CI Pipeline Snippet command (Pro): generates an Iris Code step for GitLab CI, Bitbucket Pipelines, an npm/pnpm/yarn script, or a generic shell script.
Added a versioned JSON schema: all --format json output now carries a schemaVersion field (currently 1) so scripts can depend on the payload shape.
Changed CI behaviour when no licence is present: Pro-only steps now skip and exit 0 instead of failing the build, with a non-blocking warning annotation inside GitHub runners, so a missing token does not turn the pipeline red with noise.
Added an iris-alpine-amd64 binary for musl-based (Alpine) containers. The npm install -g @iris-code/cli route was already musl-safe and works unchanged.
Published @iris-code/cli 1.1.0 with the new --format github support, and bumped the example workflows to actions/checkout@v5 and actions/setup-node@v5 (Node 24).

v1.5.010 Jun 2026feature

Analytics batching, push-blocked counter, and reliability improvements

Iris Code 1.5.0 ships reliable background analytics, a Pro push-blocked counter, CLI event tracking, and reliability improvements across the extension and backend.

Added analytics batching: the extension buffers usage events in memory and flushes every 60 seconds. push_blocked events flush immediately. The buffer survives extension crashes via crash-safe persistence to globalState.
Added exponential backoff on consecutive analytics flush failures, with a clean flush on extension deactivate so no events are dropped on VS Code quit.
Added CLI analytics: iris check, iris gate, and iris secrets runs now emit a fire-and-forget event so hook-triggered runs appear in the Iris Code dashboard alongside extension activity.
Added push-blocked counter: the Pro sidebar now shows monthly pushes blocked, total pushes blocked, and the health score delta since Pro was activated. Resets the monthly count automatically on month rollover.
Improved reliability and hardening across the extension, backend, and web surfaces.

v1.4.25 Jun 2026fix

Documentation and CLI reference updates

Documentation clarity improvements and expanded CLI command reference across the extension and landing site.

Improved command reference documentation for the full CLI suite with clearer descriptions and examples.
Updated landing site copy to reflect the published @iris-code/cli npm package.

v1.4.14 Jun 2026fix

Welcome page improvements

Enhanced welcome page layout with updated feature highlights and clearer onboarding paths.

Refreshed the VS Code welcome page with a new feature section layout and updated quick-start links.

v1.4.03 Jun 2026feature

Full CLI command suite and npm package

Iris Code 1.4.0 ships a complete command-line tool — available via npm install -g @iris-code/cli. Scan any project from your terminal, manage enforcement hooks without opening VS Code, audit dependencies for CVEs, and authenticate once with a persistent credentials file. No VS Code installation required.

Added iris auth: sign in via browser or licence token, store credentials in ~/.iris/credentials (chmod 600). iris auth login, iris auth logout, and iris auth status. Credentials read from IRIS_LICENCE_TOKEN env var first, then credentials file.
Added iris secrets: free hardcoded secret scanner across JS/TS/Go/Python. Two-layer detection — suspicious variable names and known token formats. Exits 1 if any findings. No licence required.
Added iris deps: audit all dependencies (package.json, go.mod, requirements.txt) for outdated versions and CVEs via the GitHub Advisory API. Results are cached for 24 hours. Store a GitHub PAT via iris auth login for higher rate limits.
Added iris todos: aggregate all TODO/FIXME/HACK comments across your codebase. Pro feature.
Added iris gate: run the full enforcement gate and show each configured rule's threshold vs actual value with per-rule PASS/FAIL. Pro feature.
Added iris report: generate a standalone dark-themed HTML scan report. Free. Defaults to iris-report.html in the current directory.
Added iris hook: manage pre-push and pre-build hooks from the terminal without VS Code. iris hook git|build install|uninstall|status. Install/uninstall is Pro, status is free.
Added iris config: iris config init generates a .irisconfig.json with interactive preset selection. iris config validate reports any problems in an existing config.
Updated iris check: file scans remain free. Directory scans, --staged, and --changed now require Pro — consistent with workspace analysis in the extension.
Published @iris-code/cli to npm with Linux and Windows self-contained binaries on each GitHub Release.
Added GitHub Actions docs page at docs.iriscode.co/enforcement/github-actions covering the full CI workflow, gate variant, exit codes, and threshold configuration.
Hook install messages in the extension now inform users to run iris auth login or set IRIS_LICENCE_TOKEN so the hook can validate at push or build time.

v1.3.028 May 2026feature

Gate Preview, preset cycling, and custom scoring weights

Iris Code 1.3.0 ships Gate Preview — a free, read-only view of how your workspace scores against all five preset thresholds. Cycle through presets with prev/next controls or jump directly from the chip strip, drill into failing files (Pro), and apply the chosen preset in one click. Also ships custom health score weights and four new gate enforcement config fields for Pro users.

Added Gate Preview: open it from the bottom of the File tab. It runs a full workspace scan and shows pass/fail counts for each of the five preset thresholds (legacy, balanced, typescript, strict, security) with proportion bars, a threshold card, and a recommendation for the next enforcement step. Always read-only — no files are blocked and no config is written.
Added preset cycling: use prev/next arrows or click any chip in the preset strip to jump between presets. The focused preset shows a full drilldown and an Apply button so you can lock in a threshold in one click without leaving the surface.
Added per-file drilldown for Pro users: expand any preset row to see the exact files that would be blocked, their health scores, and the warning pills driving the failure.
Added custom health score weights for Pro users: set `healthScoreWeights` in `.irisconfig.json` to change how many points each finding type deducts from the base 100. Supported keys: `hardcodedSecret`, `errorWarning`, `warningWarning`, `anyUsage`, `tsIgnore`, `consoleLog`, `deepNesting`, `longParamList`, `unusedVar`, `unusedFunction`.
Added four gate enforcement config fields for Pro users: `gateMaxSecrets`, `gateMaxComplexity`, `gateMaxFileLength`, and `gateMaxSmellsPerFile`. Set these in `.irisconfig.json` and the CLI enforces them on every push alongside `minHealthScore`.
Improved licence reliability: server errors (5xx) and network timeouts now apply an offline grace period instead of revoking Pro. Activation skips the network call if your licence was validated within the last 24 hours.

v1.2.127 May 2026fix

Collapsible Pro card

A small follow-up to 1.2.0 that adds a collapsible Pro-status card in the sidebar and detached panel.

Added a collapsible Pro-status card in the sidebar and detached panel. Once signed in the card collapses to a compact chip so it stays out of the way while still showing plan status at a glance.

v1.2.020 May 2026feature

Config presets, dashboard sync, and bank transfer billing

Iris Code 1.2.0 ships a complete config management flow — pick from five presets, tune on the dashboard, and push to VS Code in one click. Nigerian users can now also pay with a bank transfer instead of a card.

Added preset configs: set `presetId` in `.irisconfig.json` to snap your whole team to a known baseline (strict, balanced, legacy, security, or typescript). Preset configs are free for all users.
Added config enforcement for Free users: if a free user edits preset threshold values locally, those edits are ignored and marked with a yellow warning in the editor pointing to the preset as the source of truth.
Pro users can start from any preset and override individual values — the preset acts as a baseline, not a lock.
Added a Config page in the account dashboard for generating and customising Iris Code configs with a live preview.
Added dashboard-to-VS Code sync: generate a config on the dashboard, click Sync to VS Code, review a diff preview in the editor, and confirm the write — no copy-pasting.
Added Paystack bank transfer checkout for Nigerian users: choose a one-time transfer checkout from the billing page, pay to the transaction-specific account shown, and Pro activates on confirmation. A fresh checkout is opened each renewal cycle.
Fixed config sync diff preview leaving behind unsaved Untitled files after confirmation.

v1.1.018 May 2026feature

Onboarding, docs, and account setup flow

Iris Code 1.1.0 turns the first-run experience into a complete product flow across the extension and the web account surfaces, with guided onboarding, embedded docs, and clearer setup follow-through.

Added a guided first-run onboarding flow inside the extension sidebar, including skip, resume, restart, and a 15-step spotlight walkthrough across the live tabs.
Added an in-flow docs surface inside Iris Code so setup help now lives in the extension instead of forcing users out to separate pages first.
Added public and dashboard-nested getting-started flows covering install, first scan, sign-in, configuration, and enforcement setup.
Added an account dashboard welcome banner and contextual driver.js tour to help new users land on billing, license, and quick-start actions faster.
Improved onboarding state handling so returning users with existing config do not get dropped back into the first-run path unnecessarily.
Added a free-user config nudge and clearer Pro gating cues so workspace scans, issue navigation, and setup boundaries are easier to understand.

v1.0.911 May 2026fix

Trae, Cursor, Windsurf and all VS Code forks

Sign-in now works correctly in Trae IDE and any other VS Code fork. The sidebar has also been rebuilt internally for better reliability.

Fixed sign-in redirect failing in Trae IDE and other VS Code forks — the extension now auto-detects the correct URI scheme for any editor without needing manual updates.
Fixed an inaccurate notification shown in the detached panel when a free user clicks a Pro-only feature.
Rebuilt the sidebar and detached panel internals using React — the experience is identical but the foundation is now typed and maintainable.

v1.0.030 Apr 2026feature

Build hook enforcement

Iris Code can now run a health check before your project builds, not just before you push. Failing files block the build early, before the language toolchain runs.

Added pre-build health check for Node projects via the npm prebuild lifecycle script — runs automatically before pnpm build, npm run build, and yarn build.
Added Makefile-based pre-build check for Go and Python projects, wired as a prerequisite on the build or all target.
Iris Code creates a Makefile with sensible defaults if none exists in Go or Python projects.
Build hook status appears alongside the existing Git Hook section in the sidebar File tab.
Both install and uninstall are safe: markers guard the injected block and original hook content is preserved on removal.

v1.0.029 Apr 2026major release

Enforcement Update

Version 1.0.0 brings Iris Code together as a fuller code-health workflow inside VS Code, with stronger checks before code leaves your machine.

Added pre-push enforcement so teams can catch failing code before it is pushed.
Improved in-editor issue visibility with clearer diagnostics while you work.
Expanded project-wide analysis and dependency review in the extension.
Included a more complete release focused on enforcement, scanning, and review flows.

v1.0.025 Apr 2026improvements

Stability and polish

A follow-up update focused on smoothing rough edges after the main 1.0 rollout.

Improved default configuration behavior for day-to-day use.
Fixed smaller workflow issues and tightened overall stability.
Polished supporting parts of the product for a cleaner experience.

v0.2.013 Apr 2026version update

Version 0.2.0

Version 0.2.0 continued the early Iris Code rollout with another round of product polish and refinement.

Improved the overall extension experience.
Shipped another round of fixes and polish in the 0.x cycle.

v0.1.x6 Apr 2026feature update

Panel and history improvements

This update expanded how results could be reviewed during longer coding sessions.

Added a wider panel view for reviewing analysis results.
Improved how scan history and progress were presented.

v0.1.x12 Mar 2026project start

Initial rollout

The first Iris Code release introduced the foundation for local code-health analysis inside VS Code.

Launched the first version of the Iris Code extension experience.
Introduced the early scoring and analysis workflow.

Iris Code

Get Iris Code Free