Iris Code - Score every file. Block what falls below.

Catch secrets, duplicate code, security smells, and maintainability regressions before they reach human review.

Iris Code is a deterministic, local-first quality gate for JavaScript, TypeScript, Vue, Svelte, Go, Python, Ruby, ERB, C#, Java, and Rust. Source analysis runs directly in VS Code, JetBrains IDEs, and the iris CLI, hooks, and CI without sending your source to an AI model or analysis backend.

Iris Code does not guess whether code was written by AI. It independently checks the result against explicit rules, whether it was written by a person, an AI assistant, or both.

Verification integrity compares a change with its starting point and reports newly removed or disabled tests, fewer assertions, silenced checkers, widened types, swallowed errors, Iris Code suppressions, loosened configuration and statements packed onto shared lines. Run iris check --integrity for a Free comparison, including deleted files; --staged reads the index. The same core verdict reaches gates, push and agent finish hooks, Review My Changes and MCP iris_check with changed: true. See verification integrity.

Install for VS Code · Read the docs · Security · Support

Screens show the current bundled interface with illustrative project data. See the navigation overview for Home, Review, Improve, Explore and Configure.

Also available on Open VSX for Cursor, Windsurf, VSCodium, and Trae, and on the JetBrains Marketplace for IntelliJ IDEA, WebStorm, PyCharm, GoLand, and other IntelliJ-based IDEs - all served by the same analysis engine. See Supported editors.

Refactor plan on the File, Folder and Workspace tabs opens the Refactor Playbook in VS Code and JetBrains. Get plan reads the sources locally, including unsaved editor changes, and keeps a local baseline so Verify refactor can compare against it. See The refactor playbook.

Local file analysis and existing basic tools remain Free without an account. Where recurring Free is enabled, sign in for monthly local project actions covering fresh folder, workspace and changed-file scans, dependency audits and multi-file plans. Your account shows the current allowance and UTC reset. Pro includes unmetered local project actions and adds continuous local enforcement. The existing anonymous introductory workspace scan remains separate.

Launch defaults are 12 local project actions and 4 cloud scans monthly for Personal Free, and 36 local actions and 12 cloud scans shared monthly for Free Teams. Your account supplies the current allocation. Cloud repositories start in manual mode; automatic scans require an explicit opt-in and use the same cloud allowance.

Unchanged project inputs, effective configuration and engine revision can reuse an earned result without spending another action. Rescan everything explicitly starts fresh work. Completed project results retain their captured scope, standard and age across editor, CLI and MCP readers; reopening, comparing or exporting them does not run another scan. Failed or cancelled work releases its reservation; an interrupted unknown outcome stays pending until reconciled. Cloud scans use a separate allowance, and continuous score enforcement in hooks, builds and CI requires paid access. Verification integrity remains Free on those surfaces.

The refactor playbook

A long file needs a concrete next step, not another request to make it shorter. Refactor plan on the File, Folder or Workspace tab opens the Refactor Playbook panel. Opening it reads nothing; Get plan reads the eligible sources locally, detects the conventions your repository already follows, and returns:

• Mechanical fixes Iris Code can prove safe, applied with Apply mechanical fixes as one undoable editor change.
• Ranked structural suggestions, such as moving types or a cluster of related functions into the location your project already uses, each with its evidence, risk and destination. Public API changes are marked as needing approval. Suggestions are instructions for you or your agent; the editor never applies them.

Open agent instructions shows the plan as readable instructions and exact JSON, ready to copy to a coding agent. Verify refactor then compares every planned file with the snapshot taken at planning time and reports improved, not improved or regressed. It catches lines saved only by packing code together or deleting comments, broken imports, new import cycles, removed exports that something still imports, and new findings, and Copy correction for your agent turns a regression into the next step.

Agents get the same loop over MCP through iris_refactor_plan and iris_verify_refactor, and the terminal through iris refactor <file> and iris refactor <file> --verify, which compares with git HEAD. iris hook agent install --verify-on-finish verifies an agent's refactor when it stops, for Claude Code, Codex, GitHub Copilot, Gemini CLI and Cursor. Suggestion coverage differs by language and the panel says which checks apply to the file in front of you. Iris Code does not call a model, and verification is advisory: tests and a reviewed diff are still needed.

Planning and verifying one file is Free. Where recurring Free is enabled, a new folder or workspace plan uses one successful local project action. Approved fixes and verification against that captured plan are included in the same workflow. Project plans remain available after exhaustion, and iris refactor --verify --baseline <id> compares against their saved baseline. Read the refactor guide.

Review your changes before someone else does

When Git reports local changes, Iris Code offers changed-file review from the Review navigation. Select it to check every supported staged, unstaged, and untracked Git file. The result opens in a dedicated Change Review editor tab with blockers first, filterable findings, file health, and click-to-open source locations. Each changed file also shows which mapped files import it, with an expandable list that opens the importer. Pro adds transitive reach and a summary of files outside the change set that import changed files. If the graph has not been built, the review offers a build action rather than showing zero.

Where recurring Free is enabled, a fresh changed-file scan uses one successful local project action. Its saved findings and TODOs remain readable without another action. It does not alter full-workspace trend history or claim unused dependencies from a partial scope. Pro adds automatic changed-file enforcement in hooks, builds and CI.

One signal, then the evidence

Iris Code gives you a clear health score and shows exactly what changed it:

• Health score - a 0–100 score for the active file, updated whenever you open or save it
• Duplicate code - structural matching catches copied blocks even after identifiers, literals, comments, or formatting change
• Secrets and security smells - catch exposed credentials, unsafe eval, SQL concatenation, weak hashing, unsafe regexes, disabled TLS checks, and more
• Maintainability signals - complexity, long functions, deep nesting, debug prints, magic numbers, unused code, and TODO load. Statements joined onto one line still count as separate lines, so packing code never gets a file or function under its limit
• TypeScript quality - track any, @ts-ignore, non-null assertions, and missing return types
• Dependency risk - inspect installed versions, outdated packages, and version-matched OSV advisories

Findings stay connected to the code. Click a result to open its source location, use inline diagnostics when you want editor squiggles, or detach Iris Code into a full editor panel for a wider view.

After a workspace scan, Iris Code: Open Code Map shows the measured files as a collapsible health tree. It keeps the scan time visible, omits ignored and unsupported files, and lets you open a file from its score. A folder's score is the plain average of its files, rounded down as the gate rounds the workspace score, and a caution icon with a count marks any folder holding a file that would still fail the gate's minimum. Focused views remain Free. An earned project scan includes its full measured health tree, including on Free after allowance exhaustion.

Switch the Code Map to Graph to see how files import each other: every edge opens the import line it came from, cycles are marked, and an import Iris Code cannot resolve is listed with the reason rather than guessed. The same scan builds it, for TypeScript, JavaScript, Vue, Svelte, Go, Python, Java, C# and Rust. A Go or Java package or a C# namespace is drawn as its folder, and the canvas says what an import graph cannot show: files in one package can use each other without an import. The focused file and its direct neighbours remain Free. An earned folder or workspace scan includes that captured scope without another action or a hidden rescan.

The same graph supplies import impact in Change Review and iris_check. It informs the review and never changes a health score or gate decision. iris check --changed and --staged add per-file impact to JSON reports and pretty output.

Export from the Tree or the Graph saves exactly what is on screen: a PNG or SVG picture for slides and docs, Mermaid that GitHub draws when pasted into a README or pull request, a Markdown table or CSV of the tree, or JSON. Mermaid and Markdown can also be copied straight to the clipboard. Pictures, Mermaid and Markdown carry a small "Made with Iris Code" line. Export is free, and a Free export contains only what a Free user can see.

Start in under a minute

1. Install Iris Code.
2. Open a Git project in VS Code.
3. Select the Iris Code icon in the Activity Bar.
4. Select Review my changes, then open any blocker or warning directly from the review.
5. Open Review, then Workspace. Sign in to use a monthly project action where recurring Free is enabled, or open your existing saved scan.

No configuration, account or AI key is required for local file analysis. Fresh recurring project actions require sign-in and an online allowance check. The introductory workspace scan is saved locally. Further fresh scans can use a signed-in Free monthly action; paid access adds unmetered local project work and continuous enforcement.

To set a project up properly - a config matched to the project, rules for your coding agent, and the pre-push hook where your licence allows it - run npx -y @iris-code/cli init. It asks three short questions, recommends a preset and explains why, and reports what it did or skipped at each step. Running it again preserves an existing config.

See the gate in action

Iris Code uses the same local analysis engine in the editor, the iris CLI, hooks, and CI. When a configured rule fails, the action stops with the evidence instead of a generic red status.

Block a push before the regression leaves the machine

Apply the same gate before a build

Duplicate code that survives cosmetic changes

Iris Code 1.12 detects copy-pasted structure within and across files. Rename variables, change string or number literals, reformat the block, or edit comments-the structural match remains visible.

• Detection and duplication percentage are free.
• Import headers, re-export blocks, uniform data tables, oversized files, and minified-looking files are filtered to reduce noise.
• // iris-ignore: duplicate-code -- <reason> records an intentional exception without silently hiding it.
• Earned project results include their duplicate comparisons. Pro can enforce a repository-wide duplicate-block cap with gateMaxDuplicateBlocks.

Read how duplicate detection works

Remove what can be proved safe to remove

Iris Code fixes only the findings that need no judgement: a debug statement on its own, even across several lines, an unused variable inside a function that is assigned a literal, an unused import or an unused name in an import (JavaScript keeps the module load; whole TypeScript value imports are left for review), and two compatible imports from the same module merged into one. Everything else refuses with a reason, per finding rather than per run, so one unfixable finding does not stop the provable ones. console.error is left alone, because it reports real errors, and so is a debug statement whose removal could change behaviour, such as one whose arguments do work or one that is the whole body of a branch.

A hardcoded secret is never auto-fixed - the value has to move to the environment and the credential has to be rotated, and neither is a mechanical edit. A debug statement sharing its line with real code is left alone, because deleting the line would take the code with it.

It is a Quick Fix on the lightbulb in VS Code, iris fix --safe in the terminal, and iris_fix_safe over MCP. All three share one planner, so they agree on what is safe. Free.

Schema graph (1.38.0): Iris Code: Open Schema reads real database names, columns and relations from Prisma, SQL (PostgreSQL, MySQL, SQLite), Drizzle, Django, Rails and Diesel. For Django it also reads the columns and join tables Django's own user classes add (AbstractBaseUser, PermissionsMixin, AbstractUser), and draws Django's own tables such as auth_user and auth_group as dashed "Django's own table" cards when your code links to them. The whole schema and PNG, SVG, JSON, Mermaid and DBML exports are Free; usage and warnings for one focused table are Free, and aggregate usage is Pro. The CLI adds iris schema; agents can call iris_schema before a query or migration. Source support and limits.

Free analysis and integrity. Pro score enforcement.

A 14-day Pro trial is available by request with no credit card required. Request a trial or compare plans.

Preview before you block anything

Gate Preview scans the project against six built-in policies without installing a hook or blocking a file:

Start with a preset, see how many files would fail, and only enable enforcement when the threshold is realistic for the repository.

Enforce the same standard everywhere

Pro uses the same analysis engine in the editor, CLI, hooks, and CI:

• Pre-push hook - blocks a push when the configured gate fails; a hung analysis is stopped after 120 s (IRIS_HOOK_TIMEOUT env var to adjust) so a push is never stuck forever
• Build hook - runs before Node builds, or Makefile-based Go, Python, Ruby, .NET, Java, and Rust builds
• GitHub Actions - emits inline annotations and a job summary with --format github
• Other CI systems - use the exit code plus JSON output in GitLab CI, Bitbucket Pipelines, or any shell runner
• Slack - set IRIS_SLACK_WEBHOOK and gate results post to a channel from your own CI; the message is built locally and never passes through Iris Code servers (iris slack setup walks you through it)

Commit one .irisconfig.json so the team shares the same preset and limits:

{
  "$schema": "https://www.iriscode.co/schema/v1/irisconfig.schema.json",

  "presetId": "balanced",
  "minHealthScore": 75,
  "gateMaxSecrets": 0,
  "gateMaxDuplicateBlocks": 2,
  "gateMaxNamingViolations": 0,
  "gateMaxSecuritySmells": 0
}

Generated configs include that $schema line, and it is what gives you key completion, hover docs, and a warning on typos - in VS Code, JetBrains, Neovim, or anything else that reads JSON schema, with no editor-specific setup. Iris Code ignores the key itself, so removing it changes nothing but the editor help.

File naming is Free. You don't have to configure it by hand: after a workspace scan, if no policy is set, Iris Code detects the convention your files already follow and offers to adopt it in one click. Or set a workspace fallback and add ordered path rules for components, hooks, composables, routes, or any other project role. Pro additionally unlocks per-file thresholds:

{
  "fileNaming": {
    "convention": "kebab-case",
    "ignore": ["src/generated/**"],
    "overrides": [
      { "files": ["**/components/**"], "convention": "PascalCase" },
      { "files": ["**/hooks/**", "**/composables/**"], "convention": "camelCase" }
    ]
  },
  "fileNamingScope": "new-files",
  "fileLengthThreshold": 300,
  "languages": {
    "typescript": {
      "fileNaming": { "convention": "camelCase", "scope": "all", "ignore": [] },
      "functionLengthThreshold": 30
    },
    "python": { "fileLengthThreshold": 500, "complexityThreshold": 8 },
    "ruby": { "fileNaming": { "convention": "snake_case", "ignore": [] } }
  }
}

Language keys are typescript, javascript, go, python, ruby, csharp, java, and rust (.tsx counts as TypeScript, .jsx as JavaScript, ERB uses Ruby, .csproj uses C#, .properties uses Java, and .rs uses Rust). Top-level ignore globs always exclude matching files. Path rules are evaluated in order and the last match wins. When no path rule matches, a nested language naming policy is used as a backward-compatible fallback; otherwise the top-level convention applies. A matching path rule or language fallback may override fileNamingScope. Blocks may also carry custom per-file thresholds, healthScoreWeights, severityOverrides, and gate caps; scan-total gates and enable* toggles stay top-level.

Naming warnings are on by default once a naming policy is configured: violations color the Explorer entry through VS Code's Problems decorations and show a rename hint at the top of an open file. Set inlineDiagnostics.fileNaming to false to opt out of the diagnostic while keeping scan findings.

Fixing names. A violation's CodeLens, its Quick Fix (lightbulb), and the Explorer right-click menu all rename the file to its suggested convention through an editable prompt. Iris Code renames through a workspace edit so TypeScript and JavaScript imports are rewritten automatically, and every rename can be undone from the toast or the "Iris Code: Undo Last Rename" command. Earned project results include naming findings in their captured scope. The File Naming panel lists violations with editable targets and checks applicable access before applying changes. Renaming Python, Ruby, or C# files does not rewrite import/require_relative statements or type and namespace names - Iris Code warns when one of those is renamed. Committing before a large batch is recommended.

Presets and per-language file naming remain Free. Signed-in Free users can edit custom thresholds, weights and gate fields where recurring Free is enabled. Applying those fields through continuous enforcement requires paid access.

Set up GitHub Actions · Configure .irisconfig.json

Use Iris Code from the terminal

The extension includes the iris CLI used by its hooks. You can also install the standalone package:

npm install -g @iris-code/cli

Common commands:

iris init                   # free: set the project up - config, rules, hook
iris check src/app.ts       # free single-file scan
iris fix --safe src/app.ts  # free: preview the removals Iris Code can prove safe
iris refactor src/app.ts    # free: a refactor plan for one file
iris graph --focus src/app.ts  # free: one file's imports and importers
iris secrets .              # free secrets scan
iris security .             # free security-smell scan
iris report . --evidence <id> # export an earned report without another scan
iris rules                  # free: write project rules for your AI agent
iris mcp                    # free: serve Iris Code to your AI agent over MCP

iris check . --inspect      # deliberate project scan: uses available local project access
iris check .                # paid continuous/enforcement command
iris gate .                 # Pro quality gate
iris deps .                 # reuse a saved audit
iris deps . --no-cache --allow-network  # fresh audit: local action plus separate network consent
iris cve . --severity high  # Pro CVE severity gate
iris sbom .                 # Free CycloneDX 1.5 SBOM; no package lookup
iris graph --format json    # captured project graph; fresh project access checked

The CLI supports pretty, JSON, and GitHub Actions output. Set IRIS_SLACK_WEBHOOK and iris check / iris gate also post the result to Slack from your own CI - file paths and scores only, built and sent locally; run iris slack setup for a guided walkthrough. Read the CLI guide.

Hand your AI agent the same rules the gate uses

Coding agents guess at a project's standards. Iris Code can tell them instead - over the Model Context Protocol, so it works in Claude Code, Codex, Cursor, Windsurf, Copilot agent mode, Zed and JetBrains AI Assistant rather than one editor's assistant:

npx -y @iris-code/mcp

The agent can then ask what a file's findings are, what the project actually enforces, whether a change would pass the gate, and whether a dependency is safe - and it gets the same numbers your pre-push hook uses, not an approximation. Safe fixes are preview-first: Iris Code applies only a change set it has already shown, refuses per finding anything it cannot prove, and never auto-fixes a secret. Analysis stays on your machine.

In JetBrains IDEs, open a project and choose Tools | Iris Code | Set Up MCP Server. Iris Code copies the ready-to-paste configuration for its bundled server, so Node.js is not required and the server is pinned to the open project.

Single-file findings, project config, package checks and single-file safe fixes remain Free. Fresh project reviews, independent dependency audits and multi-file plans use applicable local project access. Earned scope, explanations and gate previews stay readable without another action; continuous score enforcement remains paid. Verification integrity comparisons remain Free. Read the MCP guide.

Stop an agent installing a bad package

An agent that needs a library runs the install itself, and nobody reads that command first. The package guard checks each package at that moment: it works out which version would actually install, and blocks a known-vulnerable, malicious, yanked or (if you choose) brand-new version with the exact command to run instead.

iris hook agent install      # agent hooks (Claude Code, Cursor, Codex, Copilot, Gemini CLI, Windsurf), committed with the project
iris install lodash@4.17.20  # the same check for an install you run yourself
iris install                 # check a whole cloned project, and its install scripts, before installing it

It is also available to agents as the iris_check_package MCP tool, and your editor shows a notice when a manifest gains a package that would be blocked. A package it could not check is reported as not checked, never as safe. The policy lives in .irisconfig.json under packageGuard. It is free; checking pushed lockfile changes in the git hook is Pro. Read the package guard guide.

Govern how agents use Iris Code across a team

Team owners and admins can turn off the Iris Code agent handoff on members' machines everywhere, only in the team's projects, or in one project. A repository can turn it off for everyone who opens it with "agentHandoff": false in .irisconfig.json. When it is off, every repository tool in the MCP server refuses and names who turned it off. The package guard keeps working either way.

The running VS Code extension refreshes the saved policy at startup, when the window regains focus and every ten minutes while signed in and online, and each MCP tool call reads that saved policy, so a change reaches a running agent session. Offline and signed-out editors keep any remembered restriction for up to seven days.

Team pre-push hooks record a receipt when a push passes the check, and iris hook verify in CI warns when a pushed commit has no receipt without failing the pipeline. A missing receipt can mean the hook is not installed, reporting was unavailable or the push used --no-verify, so it is a record, not proof. See the governance guide.

Supported languages

Dependency audits understand npm/yarn/pnpm workspaces, go.mod, requirements.txt, pyproject.toml, RubyGems (Gemfile.lock, Gemfile, .gemspec), NuGet (.csproj, Directory.Packages.props, packages.lock.json, packages.config), Cargo (Cargo.toml, Cargo.lock), and Maven/Gradle (pom.xml, build.gradle, version catalogues). Lockfiles are used when available so advisory checks reflect installed versions rather than manifest ranges. RubyGems and Cargo lockfiles include the resolved transitive tree; NuGet without packages.lock.json and Maven/Gradle manifests scan direct package declarations only. Unpinned or conflicting versions are reported as not checked rather than clean.

Supported editors

One analysis engine backs every editor, so a finding in one is a finding in all of them. There is no "lite" edition with quieter rules.

In JetBrains IDEs, Iris Code runs as a local language server and provides inline diagnostics, one-click iris-ignore suppressions that scaffold the required reason, per-file health scores on hover, code lenses, filename-convention renames, and a local workspace dashboard under Tools > Iris Code. Configuration comes from the same .irisconfig.json, and a single sign-in in ~/.iris/credentials is shared with the CLI - sign in or out from Tools > Iris Code, and analysis and the panel refresh in place without an IDE restart. A config built in the dashboard Config Studio can be pulled in from Tools > Iris Code > Sync Config from Dashboard - paste the one-time code the dashboard shows, review a real diff, and confirm before anything is written. The panel follows the IDE's own theme, and its text scales with your IDE interface font rather than staying at a fixed size. Analysis stays on the machine in every host. The same pasted-code route works in any VS Code-compatible editor whose own URI scheme the dashboard cannot deep-link into (Trae, Positron): run Iris Code: Sync Config from Dashboard from the command palette.

Install the LSP4IJ plugin first, and use a full IDE restart after installing - JetBrains registers file-type associations at startup. If .irisconfig.json reports "JSON standard does not allow comments", the IDE is holding a user-level override that cancels the JSON5 association Iris Code ships; reinstalling the plugin will not clear it. Fix it under Settings > Editor > File Types: select JSON5 and add .irisconfig.json back to its file-name patterns. Full explanation in docs.iriscode.co/installation and hosts/jetbrains/README.md.

Workspaces with several folders

Iris Code scans one root folder at a time. In a single-folder window, including a monorepo with many packages, that is the whole workspace and nothing changes: config resolution walks up from each file, so every package keeps its own .irisconfig.json rules.

In a multi-root window - several separate folders added to one VS Code window and saved as a .code-workspace - Iris Code scans the folder containing the file you are working in, names it in the progress notification, and says afterwards how many folders it did not scan. Run Iris Code: Select Workspace Folder to Scan to switch; the choice is remembered for that workspace.

Roots are not merged on purpose. Those folders are usually unrelated projects, so one blended health score across two codebases would not mean anything, and a locked baseline, a trend history and a pre-push hook each belong to one project rather than to the window.

Accuracy you can check

Every analysis rule is measured against a labelled corpus of real code and reported as per-rule, per-language precision and recall - no single global accuracy figure that averages away the detail that matters. The measured baseline is checked in, and Iris Code's own test suite fails the build if any rule regresses, so no release ships a quality regression unnoticed. Every finding in the sidebar carries feedback buttons; the feedback is count-only (rule id, language, verdict) and never leaves source code behind.

Read the accuracy methodology

Local analysis and network boundaries

Source analysis runs locally. Iris Code does not send source code, file contents, or project structure to an analysis backend or AI model. Earned project results and required refactor baselines stay privately on this machine so saved views and refactor verification can work offline. Accounting sends operation identifiers, hashes and counters, not source. Explicit cloud scans and exports have their own data boundaries.

Network requests are limited to:

• sign-in, licence validation, billing, and config sync
• product-use events, which can be disabled in account settings outside required trial operation
• dependency version and advisory lookups, including the package guard; only package ecosystem, name, and version are sent after consent

Dependency results are cached locally for 24 hours. CLI network consent can be revoked with --revoke-network.

Read the privacy policy

Documentation and support

• Getting started
• All features
• Enforcement guides
• Configuration reference
• CLI command reference
• Changelog
• Security and data handling
• Privacy policy
• Support and issue reporting

Iris Code is built and maintained by David Jaja. Questions, bugs, or security concerns can be sent to hello@iriscode.co.

Already using Iris Code? An honest Marketplace review helps other developers decide whether it belongs in their workflow.

Share your code health

The download icon in the sidebar header, Iris Code: Share Report, or Share report on the Workspace tab opens a preview of your last workspace scan. Save it as a portrait or landscape card (PNG or SVG), copy the image or a ready-written caption, or export a PDF report. Owned earned scans can be exported without another action, including on Free. A fresh scan checks the applicable project access; the introductory saved scan remains separate.

Choose what the PDF contains. Summary is a one-page overview, Full includes every page the scan supports, and any switch you change makes a custom selection. Each switch explains what it adds. The pages are Summary, Findings by category, Where to look, The standard used, Score trend (after more than one saved scan) and Dependencies (after a dependency audit, with status colours and a link to each advisory). Open Dependency Audit in the dialog runs the audit if you have not.

What is shared, and what is not. Cards never include file paths, source code, secret values or package names. File names in the PDF and the Dependencies page are off until you turn them on. A check the scan could not run says Not checked rather than zero; when a few files were too large to compare for duplicates, the report shows the duplication it found in the rest and says how many it skipped.

From the terminal: iris report --format png|svg|pdf [--size portrait|landscape] [--include-paths] [--pages summary|full|<ids>], where the page ids are summary,findings,areas,standard,trend,dependencies. HTML stays the default format.

Local development and release status

The selected interface uses Home, Review, Improve, Explore and Configure. It connects to real host operations and backend-controlled access; the anonymous browser preview uses explicitly fictional fixtures. Recurring Free access is controlled by the backend, including any incident pause. Development builds, installed Marketplace versions and live service state are verified separately at release. Design references remain under webview/prototypes/sidebar/.

To try the local extension, run npm run build, then choose Run Extension in VS Code's Run and Debug view (F5). Open Iris Code in the Extension Development Host. This does not replace the installed Marketplace extension. For JetBrains, build with npm run package:jetbrains:local, install the resulting ZIP from hosts/jetbrains/build/distributions/, then restart the IDE fully. Local development account endpoints require the existing local services.

Implementation scope and outstanding acceptance: navigation slice, visual alignment, File/Findings surfaces and remaining UI sweep.

Interrupted local actions

Open Account → Usage → Reconcile interrupted actions in the editor to reconcile saved outcomes. If a request still needs review, release it only after confirming that the work stopped without a usable result. The host asks for confirmation. An unknown outcome stays pending; it is not automatically refunded.

From the terminal, run iris usage recover to list unresolved request IDs. Only for work you have confirmed stopped without a usable result, run iris usage release <request-id> --confirm-failed. Saved artifacts are recovered first and successful operations cannot be released. Neither command starts another scan.