v3.2.0

Security & DLP

• BIP39 multilingual DLP: Mnemonic seed phrase detection expanded from English-only to 10 languages (20,480
  words total: Chinese Simplified/Traditional, Czech, English, French, Italian, Japanese, Korean, Portuguese,
  Spanish). SHA-512 integrity verification at both compile-time (go:generate) and test-time against canonical
  bitcoin/bips checksums.
• Windows %VAR% expansion: Shell extractor now resolves cmd.exe-style %USERPROFILE%, %APPDATA% environment
  variable syntax in commands, closing an evasion vector on Windows.
• 4 new CVE defenses: Expanded CVE coverage with new detection rules and MSYS2 pwsh worker hang fix.
• CSRF origin validation: MCP HTTP gateway now validates Origin headers; malformed Referer fallback fails
  closed.
• WebSocket reverse proxy: MCP gateway adds WebSocket support with origin validation.
• VSCode config gap: Close self-protection gap for VSCode configuration access.
• cmd/wsl/bat/Invoke-Item support: Universal path normalization and shell detection for Windows-native, WSL,
  and batch environments.
• Credential rule actions: All credential protection rules now include execute and network actions for
  complete coverage.

Installation

• TUI installer: Interactive installer with progress display, auto-installs Go/git/curl dependencies.
• Alpine/apk support: install-common.sh now handles Alpine Linux package management.
• FreeBSD support: Build and install support for FreeBSD targets.
• Gitleaks as hard dependency: DLP requires gitleaks; single source of truth for version across install
  scripts, CI, and Docker.
• Uninstall --purge flag: Non-interactive full data wipe; three-tier data dir cleanup with prompts; preserves
  rules.d (user-authored rules) by default.
• 6 install script bug fixes: set -e for fail-close, PowerShell install.ps1 fixes, deduplicated local/remote
  build paths, CI non-interactive mode.

Doctor & Agent Management

• crust doctor agent scan: Detects unguarded AI agent servers on localhost.
• Unified agent registry: Single registry for HTTP proxies and MCP clients; always restores agent configs on
  stop, even after daemon crash.

CI & Testing

• Go 1.26 modernization: sync.Map.Range, strings.SplitSeq, goroutine leak profiler on platform tests.
• CI pipeline optimization: Merged lint jobs, parallelized fuzz suite (batch size 2), added go mod tidy
  check.
• Full CI fuzzing: All 39 fuzz targets now get real mutation fuzzing in CI (previously 6 packages only ran
  seed corpus). GOMEMLIMIT=4GiB for heavyweight targets.
• Fuzz consolidation: 43 → 39 targets by merging overlapping targets
  (FuzzParseAnthropicEvent+FuzzParseOpenAIEvent → FuzzParseEvent,
  FuzzSelfProtectAPIRegex+FuzzSelfProtectSocketRegex → FuzzSelfProtectBypass) without coverage loss. Enhanced
  oracles for FuzzParseSSEEventData (4 invariants) and FuzzBufferEvent (3 invariants).
• MSYS2 pwsh timeout fix: Shared singleton pwsh worker across 28 TestPSWorker tests eliminates 28× process
  spawn overhead.
• Windows BIP39 CRLF fix: .gitattributes enforces LF for wordlist files, preventing SHA-512 mismatch on
  Windows checkout.
• Failing fuzz seed artifact upload: actions/upload-artifact@v4 on failure for all 7 fuzzed packages.
• CVE regression test suite: Auto-discovery pipeline with --archive flag for resolved CVEs.
• Docker proxy tests, E2E install tests, shellcheck for install scripts.
• Dependabot: Added for Actions and Go modules; bumped golang.org/x/crypto 0.48.0, golang.org/x/text 0.34.0,
  klauspost/compress 1.18.4.

Bug Fixes

• MCP config corruption: Fix race in JSON config patching.
• DB key rotation: Fix secret store key rotation logic.
• Path case-sensitivity: Filesystem-aware case comparison in path operations.
• PowerShell WorkerPool: Replace single worker with pool for concurrent parsing; fix pipe-hang and per-parse
  timeout; remove eager restart after timeout.
• FuzzForkBombDetection false positive: Oracle now parses original command with syntax.Simplify, matching
  extractor pipeline.
• MSYS2 path robustness: stripADS edge case, mount path expansion, .exe interpreter stripping, idempotent
  ToSlash.

Internal

• pwsh WorkerPool: Concurrent parsing with warm-up; sync.Once for Engine.Close.
• internal/platform: ShellEnv enum with WSL/MSYS2/Cygwin detection.
• Stale doc/comment cleanup: Updated DLP pattern count (34→42), locked rule count (19→24), fuzz badge (39
  targets).