v3.2.0 — Leaner, faster, fail-closed

Bug Hunter 3.2.0 makes the skill cheaper to load and faster to run. It also makes verification safer and the benchmark honest.

Highlights (measured on this repo)

• Less instruction text before any source is read. It drops 59–63% in the delegated modes and 29% in local-sequential:

  Mode	Before (bytes)	After (bytes)
  small scan	70,170	26,103
  single-file	59,059	24,130
  large-codebase	77,859	29,499
  local-sequential	65,559	46,833

  Role skills shrink from 51,815 to 42,811 bytes.

• State runs in-process. A chunked run's state operations take 1.44 s instead of 11.67 s, with 0 helper spawns instead of 44.

• Sharper scoping. Risk tagging matches identifiers rather than substrings, which cuts boundary files from 62 to 6. Generated files are excluded. Evidence-cache writes take 1.08 ms instead of 310 ms, and the code index shrinks from 317 KB to 45 KB.

• The hybrid verifier fails closed.

  • A failing required check fails the pipeline.
  • Output is redacted line by line before it is bounded, so a cut can't expose a private key.
  • The repository root is realpath'd before containment checks.
  • A process-group deadline applies.
  • Command argv is correct for npm, pnpm, yarn and bun.

• The benchmark is labelled and reproducible. New record and compare commands, a hashed eval corpus, line-range labels, and gate aggregates recomputed from the runs.

• Installer paths are current. Codex uses ~/.agents/skills, OpenCode uses $XDG_CONFIG_HOME/opencode/skills, and Windsurf uses ~/.codeium/windsurf/skills. doctor verifies SHA-256 manifests and has a --json mode.

• Safer concurrency. Stale state and cache locks are reclaimed by claiming the dead owner's record, so two recovering runners can't delete each other's lock.

The full list of changes is in CHANGELOG.md.