v0.3.0

What is new since 0.2.0

Leads for small groups. --inventory lists every peer group and the items that lack something most of their peers have, with no size floor. It also compares an item with its neighbours in the same file. The Claude Code skill no longer stops on an empty scan: it judges these leads too. Shell steps with continue-on-error: true are now checked.

Security. A scanned repository can no longer run a program through a git filter, however the filter is named (.gitattributes, .git/info/attributes, core.attributesFile, or a redirecting .git file). Control characters from a scanned project are shown as visible escapes in the text output. Every string in the output is cut to 500 characters, and git evidence has a 60 second budget. The scan prints a line when its git history comes from outside the scanned folder.

Robustness. Several patterns that grew with the square of the input are now linear. A junction loop is walked once instead of for minutes. An alias bomb or recursive anchor in one workflow no longer slows or drops the others. Shell steps get exact line numbers from the YAML positions. Paths the system cannot read are reported, not skipped silently.

Release process. The release workflow now runs lint and the tests, and checks that the tagged commit is on main, before it builds or publishes.

Benchmarks, stated plainly

On a sealed fresh set of 99 planted bugs, Claude reading the code alone found 45% and Claude with the Deviant skill found 35%. The skill is ahead on ignored step failures and removed auth checks, and finds none of the inverted conditions that no detector checks. Precision is not measured. See bench/results/fresh-set-benchmark.md.