Hacker Bob v1.3.5

Hacker Bob v1.3.5

Major feature release shipping OSS repo hunting mode, the Kimi CLI adapter, CVE feed matching, and installer symlink hardening — on top of the runtime contract and release-gate overhaul.

Highlights

OSS repo hunting — /bob-oss <github-url> (Claude) / $bob-oss <github-url> (Codex) runs the full Bob pipeline against an open-source repo in a Docker sandbox. ASAN/libFuzzer/Valgrind harnesses, CodeQL/Semgrep static scanning, per-path reachability triage, and a local session dashboard.

Kimi CLI adapter — npx hacker-bob-kimi install <dir> joins hacker-bob-cc (Claude Code) and hacker-bob-codex as a first-class adapter wrapper.

CVE feed matching — bounty_public_intel now cross-references NVD/GHSA feeds against the session target, surfacing relevant CVEs as ranked hunter leads.

Installer symlink hardening — closes a TOCTOU window in scripts/install.js where a malicious symlink could redirect a Bob-owned file write.

Upgrade

npx -y hacker-bob@1.3.5 install /path/to/your/project
npx -y hacker-bob-cc@1.3.5 install /path/to/your/project
npx -y hacker-bob-codex@1.3.5 install /path/to/your/project
npx -y hacker-bob-kimi@1.3.5 install /path/to/your/project

Full changelog: CHANGELOG.md
Full release notes: docs/releases/v1.3.5.md