You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+35-1Lines changed: 35 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,6 +5,38 @@ All notable changes to this project will be documented in this file.
5
5
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
6
6
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
7
7
8
+
## [3.1.0] - 2026-05-01
9
+
10
+
### Security
11
+
-**CRITICAL**: `dep-scan.cjs` — eliminated all `bash -c` shell execution. Audit commands and reachability search now use `spawnSync` with explicit argv arrays, preventing command injection via `targetDir` or `packageName`
12
+
-**MEDIUM**: `fix-lock.cjs` — TOCTOU race in `acquire()` fixed by wrapping `unlinkSync` in try-catch (ignores `ENOENT` only, re-throws permission errors)
13
+
-**MEDIUM**: `worktree-harvest.cjs` — `isManagedWorktreeDir` now requires both a valid manifest (`fixBranch` + matching `worktreeDir`) AND git worktree list confirmation. `harvestCore` also validates manifest before operating
14
+
-**LOW**: `schema-runtime.cjs` — `resolveRef()` blocks `__proto__`, `constructor`, `prototype` path segments and uses `hasOwnProperty` instead of `in` operator
15
+
-**LOW**: `triage.cjs` — files >5MB skipped during line-count sampling to prevent OOM
16
+
-**LOW**: `bug-hunter-state.cjs` — files >10MB use size+mtime fingerprint instead of SHA-256 hash to prevent OOM
17
+
-**LOW**: `dep-scan.cjs` — graceful fallback when `rg` (ripgrep) is not installed
-`modes/loop-generic.md` — harness-agnostic loop mode using `experiment-loop.cjs` for agents without `ralph_start`/`ralph_done`
22
+
- Installer support for Copilot, Windsurf, and Opencode agents in `bin/bug-hunter`
23
+
- Option C2 (native-dispatch) in SKILL.md for Cursor, Copilot, Windsurf, Kiro agent backends
24
+
- Node.js graceful degradation — core pipeline continues with reduced features when Node.js is unavailable
25
+
26
+
### Changed
27
+
-**Cross-harness compatibility**: 25+ Claude-specific tool name references ("Read tool", "Bash tool", "Edit tool") replaced with functional phrasing ("read the file", "run a shell command", "edit the file") across all skill files, modes, and templates
28
+
-`modes/local-sequential.md` now reads from `skills/*/SKILL.md` (canonical) instead of `prompts/*.md`
29
+
-`modes/fix-pipeline.md` references updated from `prompts/fixer.md` to `skills/fixer/SKILL.md`
30
+
-`EnterWorktree`/`ExitWorktree` references generalized to "your runtime's built-in isolation tools"
31
+
-`modes/loop.md` and `modes/fix-loop.md` now include cross-harness notes directing non-Claude agents to `loop-generic.md`
32
+
- Login shell overhead eliminated — worker dispatch changed from `bash -lc` to `bash -c` in `run-bug-hunter.cjs` and `dep-scan.cjs`
33
+
-`worktree-harvest.cjs``harvestCore` returns `{ ok: false }` for expected errors instead of throwing JSON strings
34
+
-`payload-guard.cjs` removed redundant `require('fs')` and `require('path')` inside `generate()`
35
+
-`triage.cjs` removed false-positive `env` and `.env` from SKIP_DIRS
36
+
- Refactored `run-bug-hunter.cjs`, `bug-hunter-state.cjs`, `render-report.cjs`, `delta-mode.cjs` to use `shared.cjs`
37
+
- SKILL.md fallback probe order expanded to 8 agent directories
38
+
- Test suite: **113 tests**, 0 failures
39
+
8
40
## [3.0.10] - 2026-03-14
9
41
10
42
### Fixed
@@ -283,7 +315,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
283
315
- Coverage enforcement - partial audits produce explicit warnings
284
316
- Large codebase strategy with domain-first tiered scanning
> **Requirements:** Node.js 18+. No other dependencies.
46
+
> **Requirements:** Node.js 18+ recommended (enables triage, schema validation, and experiment tracking). Core pipeline works without Node.js in degraded mode.
47
47
>
48
-
> **Works with:**[Pi](https://github.com/mariozechner/pi-coding-agent), Claude Code, Codex, Cursor, Windsurf, Kiro, Copilot — or any AI agent that can read files and run shell commands.
48
+
> **Works with:**[Pi](https://github.com/mariozechner/pi-coding-agent), Claude Code, Codex CLI, Cursor, Windsurf, Kiro, Copilot, Opencode — or any AI agent that can read files and run shell commands.
49
49
50
50
---
51
51
52
52
## New in This Update
53
53
54
-
This release is a reliability hardening pass — 11 bugs fixed, 10 previously-failing tests now pass, and the full pipeline is more robust end-to-end.
54
+
This release is a security hardening + cross-harness compatibility pass — 8 security fixes, shared utility extraction, and full multi-agent compatibility.
55
55
56
-
-**`High` severity works everywhere.** All JSON schemas, severity ranking, and payload-guard templates now recognize `High` — previously only `Critical`, `Medium`, and `Low` were accepted, silently dropping valid findings.
57
-
-**Confidence threshold is fully wired.**`--confidence-threshold` now propagates from the CLI through the orchestrator to `record-findings`. Previously the flag was parsed but never forwarded, always defaulting to 75.
58
-
-**Shell injection fixed in doc-lookup.** Library names passed to `chub` CLI are now properly shell-quoted — prevents command injection via crafted library names.
59
-
-**SIGKILL timer leak fixed.** The failsafe kill timer in `runCommandOnce` is now cleared on normal exit — previously it could fire after the child had already exited.
60
-
-**Modern Bun lockfile support.**`dep-scan.cjs` now detects `bun.lock` (text format, Bun 1.2+) alongside the legacy `bun.lockb` binary format.
61
-
-**Worktree commit parsing hardened.** Edge case where `git log` lines with no space separator caused truncated hashes and wrong messages is now handled.
62
-
-**61 tests, 0 failures.** Up from 50 passing / 10 failing — the test suite now covers severity ranking, schema validation, confidence threshold propagation, and shell-safe worker templating.
56
+
-**Command injection eliminated in dep-scan.** All shell commands now use `spawnSync` with explicit argv arrays — no more `bash -c` with interpolated strings.
57
+
-**TOCTOU race fixed in fix-lock.** Concurrent agents no longer crash on stale lock cleanup.
58
+
-**Prototype pollution blocked in schema validator.**`resolveRef()` blocks `__proto__`/`constructor`/`prototype` and uses `hasOwnProperty` for safe traversal.
59
+
-**OOM guards added.** Files >5MB are skipped during triage sampling; files >10MB use size+mtime fingerprints instead of SHA-256.
60
+
-**Worktree manifest validation hardened.** Both `isManagedWorktreeDir` and `harvestCore` now verify `fixBranch` and `worktreeDir` match before operating.
61
+
-**Cross-harness compatibility.** Tool-specific references ("Read tool", "Bash tool") replaced with functional phrasing. Loop mode works without `ralph_start` via generic self-driven loop. Installer now supports 8 agents.
<imgsrc="docs/images/2026-03-12-pr-review-flow.png"alt="PR review workflow banner — pull request scope, security checks, threat-model context, and final verdict in a clean product-style UI"width="100%">
66
67
</p>
67
68
68
69
## Start Here
69
70
70
-
If you're evaluating the new PR flow, start with one of these:
Bug Hunter ships with a test fixture containing an Express app with **6 intentionally planted bugs** (2 Critical, 3 Medium, 1 Low):
692
683
693
-
The repository also ships with **61 Node.js regression tests** covering orchestration, schemas, PR scope resolution, fix-plan validation, lock behavior, worktree lifecycle, severity ranking, and the bundled local security-skill routing.
684
+
The repository also ships with **113 Node.js regression tests** covering orchestration, schemas, PR scope resolution, fix-plan validation, lock behavior, worktree lifecycle, severity ranking, experiment loop, and the bundled local security-skill routing.
Copy file name to clipboardExpand all lines: package.json
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
{
2
2
"name": "@codexstar/bug-hunter",
3
-
"version": "3.0.10",
3
+
"version": "3.1.0",
4
4
"description": "Adversarial AI bug hunter — multi-agent pipeline finds security vulnerabilities, logic errors, and runtime bugs, then fixes them autonomously. Works with Claude Code, Cursor, Codex CLI, Copilot, Kiro, and more.",
0 commit comments