# CommitBrief v1.7.0

> A deterministic flaky-test detector flags timing-dependent and unseeded-random anti-patterns in changed tests before any model call. Plus guard hardening — user-extensible secret patterns and a prompt-injection scan of your own rules — glob support for the `--file`/`--dir` filters, and a `setup --alias` installer for a `cbr` shell shortcut.

Released June 19, 2026

Canonical URL: https://commitbrief.com/changelog/v1.7.0/

---

## Added

- **Deterministic flaky-test detector (ADR-0022).** A static, provider-free
  pre-pass scans the added lines of changed test files for high-precision
  flakiness anti-patterns — hard-coded sleeps / fixed waits (`time.Sleep`,
  `Thread.sleep`, `Task.Delay`, `asyncio.sleep`, `*.waitForTimeout`, numeric
  `cy.wait`, `usleep`, `sleep(<n>)`) and unseeded randomness (`Math.random`,
  Python `random.*`, Go `math/rand`). Findings merge into the structured
  output, so they render, count toward `--fail-on`, and `--copy` like any
  other finding. No model call, no JSON-schema change. On by default for
  API providers; skip per-run with `--no-flaky` or persistently with
  `review.flaky: false`. Localized (en/tr).

- **`setup --alias` — install a shell alias (ADR-0023).** `commitbrief setup
  --alias` skips the provider wizard and installs a shell alias (default
  `cbr`) into the right startup file per shell — bash, zsh, fish, PowerShell,
  and cmd.exe (via a DOSKEY macrofile loaded from a merged `AutoRun` registry
  value). The alias lives in an idempotent managed block that is replaced in
  place on re-run and never clobbers surrounding lines. If the name shadows an
  existing command you are warned first. `--alias=<name>` sets it without
  prompting.

- **User-extensible secret-scan patterns (ADR-0024).** `guard.secret_patterns`
  lets you add your own credential regexes on top of the built-in eight —
  useful for internal/company token formats. Patterns are **additive**: the
  built-ins always run and cannot be disabled or shadowed (use
  `guard.secret_scan: false` for that). An invalid regex aborts the review
  before any provider call, naming the offending entry. As with the built-ins,
  only the line number and pattern name are ever reported — never the matched
  text.

- **Prompt-injection scan of your rules (ADR-0025).** When you use a custom
  `COMMITBRIEF.md` or `OUTPUT.md` template, its content is scanned for
  prompt-injection phrasing ("ignore previous instructions", "you are now…",
  "system prompt", …) before it joins the system prompt. On a match the CLI
  prints a **non-blocking warning** (file + line numbers) and continues — it
  never aborts, because it is your own file. The embedded default rules are
  trusted and skipped. Toggle with `guard.injection_scan` (default on).

- **Glob support for `--file` / `--dir` (ADR-0026).** The path filters now
  accept gitignore-style glob patterns in addition to exact paths. A value
  containing `*`, `?`, or `[` is compiled as a glob: a slash-less pattern
  matches the basename at any depth (`--file '*.go'`), and a slash-bearing
  pattern is anchored to the repo root (`--file 'internal/**/*.ts'`). `--dir`
  accepts globs too (`--dir 'app/**'`). **Backward compatible:** a value with
  no glob metacharacter keeps its exact pre-v1.7 behavior. An invalid pattern
  errors clearly instead of silently mis-filtering.