v0.9.5

[heavykenny]

First release since the Hacker News launch. Fixes the Python import false positives reported there, adds two precision rules, ships the SARIF / per-rule-severity / trend tooling, and extends agent support to pi.

Added

• pi agent support — aislop fix --pi / --crush hand-off, and aislop hook install --pi (auto-running pi extension that scans each edit).
• ai-slop/silent-recovery — flags catch blocks that only log and continue.
• ai-slop/meta-comment — flags AI plan/process narration comments.
• SARIF output (scan --sarif), trend command, per-rule severity overrides, config JSON schema, and a pre-commit hook.
• Hardcoded-config and defensive-pattern rules — hardcoded-id, hardcoded-url, redundant-try-catch, redundant-type-coercion, duplicate-type-declaration.

Fixed

• Python import false positives — install-name vs import-name divergences (yaml→pyyaml, PIL→pillow, etc.) and [project.optional-dependencies] extras. Reported on HN.
• TypeScript @types resolution — type-only imports backed solely by @types/X no longer flagged.
• duplicate-import — separate import type / import from the same module is no longer a duplicate.
• security/eval — member calls like foo.exec(...) no longer match the bare exec( rule.

Full notes in CHANGELOG.md.

---

This discussion was created from the release v0.9.5.