v0.28.0

What's Changed

New Features

• AI Agent Mode (@hahwul, @ksg97031)
• ACP (Agent Client Protocol) integration (@hahwul)
• CakePHP & Goyave detector + analyzer (@chei-l)

AI Agent Mode
Iterative tool-calling AI workflow for deeper, autonomous endpoint discovery (uses tools like list_directory, read_file, grep, semantic_search).

Example:

noir -b ./myapp --ai-agent

ACP (Agent Client Protocol)
With ACP integration, you can analyze using locally configured AI Agents even without API keys for AI Providers (local agent handles authentication).

Example:

noir -b ./myapp --ai-provider=acp:codex

Improvements

• Cross-file Express.js router support (@fabiencheret)
• Enhanced analyzers: Kotlin Spring (static paths/body) (@chei-l), Flask (shortcut decorators/MethodView/async) (@fabiencheret), Tornado (cross-file handlers) (@fabiencheret), Chi (Group scope) (@fabiencheret)
• Detector performance optimization (Rocket, Kemal)
• Endpoint deduplication improved to O(N)
• Minimum Crystal version raised to 1.19 + CI updates

Bug Fixes

• Missing route patterns in JS/Express extractor (@fabiencheret)
• Flask & Tornado route parser fixes (@fabiencheret)

New Contributors

• @fabiencheret made their first contribution in #1000

Full Changelog: v0.27.1...v0.28.0