v0.25.0 — app debloat, tool uninstaller, storage cleaner, CSS diet

Highlights

• Application Debloat & Storage Cleaner — New bluntcode clean [--logs] [--cache] [--database] [--all] command and POST /api/v1/system/clean API endpoint to prune stale logs older than 7 days, empty the Trivy cache, and run SQLite VACUUM. Also available in the web Settings page with a live disk breakdown and one-click cleanup.
• Tool Uninstaller & Disk Footprint Visibility — Added bluntcode tools uninstall <tool> CLI command and a one-click Uninstall action with confirmation dialog in the Tools page. Accurately measures tool disk usage and completely purges runtime data (reclaiming gigabytes from SonarQube, Trivy, Semgrep, Checkov).
• Automatic Scan History Retention — Limits scans per workspace (capped at 20 scans by default) after scan completion, pruning aged findings and artifacts to prevent unbounded database growth.
• Binary Footprint Stripped (~32% reduction) — Production builds now strip debug symbols via -ldflags="-s -w", dropping the executable footprint from 23.5 MB to 15.9 MB, backed by an automated 18 MB budget check in packaging.
• Frontend & CSS Diet — Cleaned ~22.7 KB of unused and redundant CSS across styles, removed stale Vite chunk configurations, and disabled eager preloading of non-critical route chunks for faster page load times.
• Design Contract & UI Polish — Rebuilt table views on shared RowMenu and .toolbar-row patterns with at most one visible control per row; live client-side workspace RISK grading; honest scan completion states.
• Repository Hygiene — Hardened .gitignore against temporary editor files, crash dumps, and test artifacts.

Full changelog: https://github.com/sanketpatel32/Blunt-code/blob/main/CHANGELOG.md#0250---2026-09-20

v0.24.0 — scan compare in the web app, honest dashboards, clearer UX

Highlights

• Compare any two scans in the web app — the history page's new Compare flow shows "since : N new · M fixed · P still present" with collapsible lists and shareable ?compare=&with= links (the CLI's history compare finally has a UI).
• A cancelled re-scan can no longer erase your results — dashboards fall back to the last completed scan (with an honest note) instead of blanking to "—" and 0 findings; never-scanned workspaces read "no scan yet" instead of all-zero cards.
• Risk scores explain themselves — weighting tooltips (critical ×10, high ×5, medium ×2, low ×1; bands A 0–4 / B 5–19 / C 20–49 / D 50+), trend words instead of glyphs, and the CLI docs' false "(0–100)" claim replaced with the real scale.
• Terminology unified on "analyzers" ("engines" retired everywhere), readiness counts qualified as optional tools, analyzer display names throughout.
• Report clarity — Persistent verdict stat, status chips that actually count (per-finding status now in the report payload), "What changed" stays honest on cancelled scans, rule-docs fallback links (Sonar/Biome/Semgrep).
• Friendlier first run — scan confirms no longer look destructive, profile hints set time expectations, Search filters workspaces by name, Files/Search explain empty states, Ctrl K pill advertises the palette.

Also ships the 2026-09-11 bug-bash fixes (40+ defects: nav stability, fabricated-data removal, paging/date-filter correctness, YAML validator, CSP/cache/404 static fixes, offline update-check soft-fail) and the packaging version guard that repaired v0.23.0's release asset.

Full changelog: https://github.com/sanketpatel32/Blunt-code/blob/main/CHANGELOG.md#0240---2026-09-16

Blunt Code 0.23.0

Provenance, coverage-aware baselines, hardened exports — the IMP-07..16 batch completing the architecture improvement plan (all 16 packages now shipped).

Added

• Auditable scan provenance — snapshots record input digests, effective configuration, analyzer/rule/parser versions, platform, and dirty-tree state; drift test pins that mid-analysis edits can't pass as reproducible.
• Versioned finding identity + coverage-aware baselines — fingerprints versioned, occurrence identity separated, not_evaluated replaces false Fixed when an analyzer was disabled/failed/excluded; SARIF and prior-scan baselines classify identically.
• Correctness-first incremental reuse — cache keys on digests + versions + config, not mtime; renames/deletes/profile/dependency changes invalidate; interrupted output never reused; reuse tracked in metadata.
• Crash-safe updates — staged extract, zip-slip rejection, hash verification, atomic swap with rollback.
• Crash recovery + retention transparency — interrupted scans relabeled at startup with partial results visible; prune returns deleted ids and refuses to prune baseline-referenced scans.
• Hardened exports — atomic writes for every artifact; SARIF helpUri http(s)-only; CSV formula-injection neutralized; GitHub workflow-command escaping; control-char scrubbing; hostile-corpus acceptance test across all exporters.
• Coverage-paired risk metrics — grades pair with scan state/freshness/coverage + complete flag; versioned severity mappings with unmapped values marked, raw preserved; counting semantics documented in docs/metrics.md.
• Understandable scan UX — state badges + failure reasons, SCAN_ALREADY_ACTIVE with View-scan action, pre-scan engine summary, history coverage details, inline suppression reasons.
• Release evidence map (docs/release-evidence.md) and accessibility evidence (docs/accessibility.md) — every P0 acceptance case mapped to a test or manual procedure; WCAG claim scoped to actual evidence.

Fixed

• Command palette "Go to findings" landed on the 404 page (/search was never parsed back).
• Eight undocumented scan flags added to the usage line and CLI manual (now contract-tested), plus the missing pentest profile.
• Stale agent docs (web llms.txt/llm.txt advertised 0.16.21).

Full changelog: https://github.com/sanketpatel32/Blunt-code/blob/main/CHANGELOG.md

Blunt Code 0.22.0

Honest outcomes and P0 hardening batch — the first six work packages of the architecture review.

Honest scan outcomes

• Precise CLI exit codes: 0 clean, 1 gate-only failure, 2 usage, 3 operational failure or incomplete coverage, 4 cancel, 130 double Ctrl+C. Gates only run on complete scans; a degraded scan never reads as a pass.
• Analyzer runs carry a persisted warning_count; degraded scans complete as completed_with_warnings and the scan page says "coverage was incomplete" instead of all-clear.

Analyzer awareness & discovery

• One machine-readable capability inventory for all analyzers (served from GET /api/v1/analyzers).
• Terraform files route to checkov/trivy; license files feed the license scanner; dependency lockfiles count as scan inputs (osv applies to lockfile-only workspaces); skipped files are counted by reason.

Offline policy & network honesty

• Offline mode: osv/trivy refuse cold-cache scans with actionable errors instead of dialing out; the UI ships zero third-party requests (webfonts removed).
• Pentest probe refuses cross-host redirects and reports them (CWE-601).

API & trust boundary hardening

• Embedded UI behind the loopback Host check + security headers (foreign Host → 421).
• Single-instance handoff verifies server identity before handing over the browser.
• NTFS junction escapes blocked in workspace containment — both file serving and every analyzer adapter.

Process supervision

• Every analyzer child runs in a kill-on-close job object (8 GiB commit cap): trees die with their run and with a Blunt Code crash.
• Analyzer/installer output capped; post-run normalization (SonarQube compute wait) bounded by the analyzer deadline.
• Max 3 concurrent scans; overflow returns HTTP 503 SCAN_CAPACITY / CLI exit 3.
• Regression test proves scans leave workspace bytes untouched.

Full changelog: https://github.com/sanketpatel32/Blunt-code/blob/main/CHANGELOG.md

v0.21.2 — Nav language dropdown, single-line filters, unified tools table

Changed

• Navigation language dropdown: Replaced the horizontal row of language buttons in the nav utility cluster with a clean dropdown menu with locale codes, native names, and active checkmarks.
• Workspaces filter toolbar: Kept workspace search and tag filters on a single horizontal row alongside sort controls without vertical stacking.
• Unified tools table: Replaced category accordion boxes on the Tools page with a single unified table, and removed the redundant languages column across all tool tables.

Install (PowerShell): irm https://github.com/sanketpatel32/Blunt-code/releases/latest/download/install-latest.ps1 | iex — rerunning upgrades in place.

v0.21.1 — Nav language dropdown, single-line filters, unified tools table

Changed

• Navigation language dropdown: Replaced the horizontal row of language buttons in the nav utility cluster with a clean dropdown menu with locale codes, native names, and active checkmarks.
• Workspaces filter toolbar: Kept workspace search and tag filters on a single horizontal row alongside sort controls without vertical stacking.
• Unified tools table: Replaced category accordion boxes on the Tools page with a single unified table, and removed the redundant languages column across all tool tables.

Install (PowerShell): irm https://github.com/sanketpatel32/Blunt-code/releases/latest/download/install-latest.ps1 | iex — rerunning upgrades in place.

v0.21.0 — Smart skip for generated files

Scans now skip what nobody hand-edits.

Added

• Smart skip for generated files: discovery and the Files page exclude build/dependency/cache/log directories across ecosystems (target, vendor, obj, Pods, .svelte-kit, .output, .turbo, site-packages, .terraform, playwright-report, log/logs, ~35 more), minified and bundled output wherever it sits (*.min.css, *.chunk.js, *.bundle.js, vendor.js, numeric webpack chunks, and hash-suffixed bundler output like index-CKc0XBc7.js), dependency lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, …), generated code (*.pb.go, *_pb2.py, *.generated.ts, *.designer.cs), *.tsbuildinfo, files over 10 MiB, and any large text file whose head contains a 500+ character line — a minified bundle hiding under a source-looking name.
• Findings inside generated output are dropped: directory-walking analyzers (sonarqube, trivy, checkov) can report style findings on dist/ bundles; those are filtered before persistence. Secret detectors keep artifact findings — a credential baked into a shipped bundle is exactly the leak a scan must surface — and lockfile findings survive so osv/trivy dependency results are unaffected.

Fixed

• SonarQube findings pointed at a workspace UUID instead of a file — stored paths are healed on upgrade without a rescan.
• Notifications bell: single legible unread badge inside the nav utility cluster.
• Findings table readability: path tail + line in FILE, display-name tool badge, human type labels.

Install (PowerShell): irm https://github.com/sanketpatel32/Blunt-code/releases/latest/download/install-latest.ps1 | iex — rerunning upgrades in place.

v0.20.3

Fixed

• Live scan panel double-counted every finding: the event stream replays the scan's full history to every new subscriber, and the scan page re-subscribed as soon as the scan record loaded — appending a second copy of the replay. "Results so far" showed exactly 2× the real total (a 10,771-finding scan read as 21,542) and every analysis-flow entry appeared twice. Each connection now replaces the list from the server's authoritative replay instead of appending to it, and results-so-far totals are summed per analyzer (last completion wins), so they cannot double-count across reconnects.

Changed

• Real severity totals while a scan is still running: analyzer.completed events now carry per-severity counts, so the "Results so far" panel shows live critical/high/medium/low chips (previously all zeros until the scan finalized) and each succeeded analyzer pill shows its own findings count. Severity chips read as muted "pending" until the first analyzer reports. Large numbers are locale-grouped (10,771) on the live metric, flow entries, verdict bars, and headline.

v0.20.2

Fixed

• Scans now honor the configured files: directory-walking analyzers (gitleaks, checkov, sonarqube, trivy, osv) traverse the whole workspace root no matter which files they are handed, so their reports could name files the workspace configuration excludes. The scan pipeline now drops any finding inside an excluded override path (longest match wins) or an enabled user exclude rule before persisting it.
• Stable loopback port: default bind is now port 8787 (--port 0 still picks a free port, explicit --port N is honored), the running server records its port, and a second launch hands off to the existing instance instead of starting another server.

v0.20.1

Fixed

• Files page (/workspaces/:id/files) could never save: api.saveRules sent rules as a bare array while the backend requires the {"rules": [...]} envelope, so every save failed with 400 INVALID_JSON. Unfinished empty-pattern rule drafts are now filtered client-side instead of tripping INVALID_RULE.
• Bulk file selection: Select all / Exclude all / Invert toolbar with live count, redundant-override pruning, and honest folder tri-state.
• Files page visual refresh: roomier rows, bordered expanders, larger checkboxes, tinted included rows, excluded-reason pills, language rail limited to loaded languages.