What's New
Reliability Hardening — 11 Bugs Fixed, 0 Test Failures
Systematic audit of the entire pipeline. 10 previously-failing tests now pass, 1 new test added. 61 tests, 0 failures.
High Severity Works End-to-End
All JSON schemas (findings, skeptic, referee, fix-report), severity ranking in bug-hunter-state.cjs, and payload-guard templates now recognize High as a valid severity level. Previously only Critical, Medium, and Low were accepted — valid findings were silently dropped.
Confidence Threshold Fully Wired
--confidence-threshold now propagates from the CLI through the orchestrator, through processPendingChunks, all the way to record-findings. Previously the flag was parsed but never forwarded — the pipeline always used the hardcoded default of 75.
Shell Injection Fixed in Doc-Lookup
Library names and IDs passed to the chub CLI in doc-lookup.cjs are now properly shell-quoted. Crafted library names could previously cause command injection via execSync.
SIGKILL Timer Leak Fixed
The failsafe kill timer in runCommandOnce is now cleared on normal process exit. Previously it leaked a timer handle that could fire after the child had already exited cleanly.
Modern Bun Lockfile Support
dep-scan.cjs now detects bun.lock (text format, Bun ≥1.2) alongside the legacy bun.lockb binary format.
Worktree Commit Parsing Hardened
Edge case where git log output lines with no space separator caused truncated hashes and wrong commit messages is now handled correctly.
Other Fixes
classifyStrategy()— explicit parentheses on compound boolean conditions prevent operator-precedence misclassification- npm package now includes
llms.txt,llms-full.txt,test-fixture/,CONTRIBUTING.md,SECURITY.md,CODE_OF_CONDUCT.md - Internal tooling files (
autoresearch.*,handoff.md) removed from repo
Install / Update
npm install -g @codexstar/bug-hunter # npm global
npx skills add codexstar69/bug-hunter # cross-IDEFull Changelog
See CHANGELOG.md