Codevena · Codevena · Jun 12, 2026 · Jun 12, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -0,0 +1,52 @@
+# Changelog
+
+All notable changes to fixbuddy are documented here. The format is based on
+[Keep a Changelog](https://keepachangelog.com/), and this project aims to follow
+[Semantic Versioning](https://semver.org/).
+
+## [0.5.0] - 2026-06-12
+
+Security hardening from a full audit, plus five new features. No breaking changes
+to existing flags.
+
+### Added
+- **`--issue N`** (repeatable) — fix specific issues, fetched directly via
+  `gh issue view` (no 200-item list blind spot). Dedup filters and
+  `--label`/`--severity` still apply; non-actionable numbers warn distinctly.
+- **`--check-cmd 'CMD'`** (repeatable) — a deterministic test gate that runs in
+  the project dir after the fix commit and before review. A non-zero exit is
+  treated like a review rejection (retried with the output as feedback, then
+  `fix:rejected` on exhaustion), so it also gates auto-merge. Output is capped.
+- **Config files** — `~/.fixbuddy/config` then `./.fixbuddy.conf`, safe-parsed
+  with no `eval`/`source`; CLI flags override. The wizard offers to write one.
+- **`--auto-merge`** flag — explicit counterpart to `--no-auto-merge`, so a
+  config `auto_merge = false` can be overridden from the CLI.
+- **`fix:needs-human`** label — separates deterministic blockers (human needed)
+  from `fix:blocked` (crash/timeout, auto-requeues).
+- **Ctrl-C/abort handling** — an interrupted run kills the in-flight agent,
+  cleans up the local branch, and resumes the issue on the next run.
+
+### Changed
+- **`--dry-run` is now fully read-only** — it previously created labels and ran
+  the unstick scan before the dry-run check. It now mutates nothing and prints
+  the planned config (including `--check-cmd` strings) and respects `--max`.
+- CI uses `actions/checkout@v5` (Node 24); `main` has branch protection.
+
+### Fixed (security & robustness)
+- Auto-merge no longer falls back to an immediate squash that bypassed CI.
+- Issue **titles** are sanitized and marked untrusted in agent prompts
+  (prompt-injection vector); `GH_TOKEN`/`GITHUB_TOKEN` are stripped from agent
+  environments; the review diff is wrapped in a sentinel block.
+- Crash on stock macOS Bash 3.2 (empty array under `set -u`) fixed.
+- BSD/macOS `sed` portability; numeric-option validation; fail-closed on `gh`
+  errors; base-branch auto-detect works in GitHub Actions; `gh auth setup-git`
+  so a custom `github-token` reaches `git push`.
+- Reviewer feedback is no longer truncated to its first line; watchdog timeout
+  classification fixed; stale `fix:blocked`/`fix:rejected` labels are removed at
+  success endpoints.
+
+## [0.4.0] and earlier
+
+Predate this changelog. See the git history and the `v0.4.0` / `v0.3.2` tags.
+
+[0.5.0]: https://github.com/Codevena/fixbuddy/compare/v0.4.0...v0.5.0
diff --git a/README.md b/README.md
@@ -58,15 +58,15 @@ VERIFY -> FIX -> REVIEW -> PUSH/PR -> optional auto-merge
 Install with the one-liner (macOS and Linux, including WSL2):
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.4.0/install.sh | bash
+curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.5.0/install.sh | bash
 ```
 
-This downloads the pinned `v0.4.0` scripts into `~/.local/bin` (or `/usr/local/bin`), makes them executable, and prints a PATH hint if needed. Override the location with `| bash -s -- --prefix /custom/bin` or track the latest commit with `--ref main`.
+This downloads the pinned `v0.5.0` scripts into `~/.local/bin` (or `/usr/local/bin`), makes them executable, and prints a PATH hint if needed. Override the location with `| bash -s -- --prefix /custom/bin` or track the latest commit with `--ref main`.
 
 **Prefer to read before you run?** The installer is short — inspect it first, then run it:
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.4.0/install.sh -o install.sh
+curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.5.0/install.sh -o install.sh
 less install.sh        # read it
 bash install.sh        # then run it
 ```

diff --git a/SHA256SUMS b/SHA256SUMS
@@ -1,2 +1,2 @@
-63162498d361d9d88efbbf0879b04406a89378729b65fd49d0389c26f196f781  fixbuddy.sh
-b2218aaea15a45175ec45efca99a4174e80e41312676fce3540c6740ec8b6e51  fixbuddy-wizard.sh
+288eda7831f6b3bd7078417e46ac8270a7f8b0175a288748cf9f3bac55c23cb8  fixbuddy.sh
+d6868daf05471c46ab969fe50b441af004d6622f664c529912da82d91665ac73  fixbuddy-wizard.sh
diff --git a/fixbuddy-wizard.sh b/fixbuddy-wizard.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# fixbuddy-wizard.sh v0.4.0 — beginner-friendly launcher for fixbuddy.sh
+# fixbuddy-wizard.sh v0.5.0 — beginner-friendly launcher for fixbuddy.sh
 #
 # Walks a user through the required flags via interactive prompts, validates
 # prerequisites, shows a preview of the exact command, and then exec's fixbuddy.sh.
@@ -32,7 +32,7 @@ printf "%s" "${MAG}${BOLD}"
 cat <<'EOF'
 
   ╔═══════════════════════════════════════════════════╗
-  ║              fixbuddy wizard v0.4.0                ║
+  ║              fixbuddy wizard v0.5.0                ║
   ║   Turn GitHub issues into reviewed PRs             ║
   ╚═══════════════════════════════════════════════════╝
 EOF

diff --git a/fixbuddy.sh b/fixbuddy.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# fixbuddy v0.4.0 — two-agent pipeline for autonomous issue fixing
+# fixbuddy v0.5.0 — two-agent pipeline for autonomous issue fixing
 #
 # Pipeline per issue:
 #   1. VERIFY (fix-agent)    — is this real? → PROCEED / FALSE-POSITIVE / BLOCKED
@@ -47,7 +47,7 @@
 #   config-provided label/check cannot be removed from the CLI.
 
 set -uo pipefail
-VERSION="0.4.0"
+VERSION="0.5.0"
 
 # -------- Defaults --------
 REPO=""

diff --git a/install.sh b/install.sh
@@ -2,12 +2,12 @@
 # install.sh — installer for fixbuddy (https://github.com/Codevena/fixbuddy)
 #
 # Quick install:
-#   curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.4.0/install.sh | bash
+#   curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.5.0/install.sh | bash
 #
 # Options (pass after the URL as: | bash -s -- <options>):
 #   --prefix PATH   Install into PATH instead of the auto-detected location
 #   --ref TAG       Install the fixbuddy scripts from a specific git ref.
-#                   Default: v0.4.0.  Use --ref main for the latest commit.
+#                   Default: v0.5.0.  Use --ref main for the latest commit.
 #   -y, --yes       Skip the sudo confirmation prompt
 #   -h, --help      Show this help and exit
 #
@@ -16,7 +16,7 @@
 set -euo pipefail
 
 REPO_SLUG="Codevena/fixbuddy"
-DEFAULT_REF="v0.4.0"
+DEFAULT_REF="v0.5.0"
 RAW_BASE="https://raw.githubusercontent.com/${REPO_SLUG}"
 SCRIPTS=(fixbuddy.sh fixbuddy-wizard.sh)
 
@@ -40,11 +40,11 @@ usage() {
   cat >&2 <<'EOF'
 install.sh — installer for fixbuddy
 
-  curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.4.0/install.sh | bash
+  curl -fsSL https://raw.githubusercontent.com/Codevena/fixbuddy/v0.5.0/install.sh | bash
 
 Options (pass as: | bash -s -- <options>):
   --prefix PATH   Install into PATH instead of the auto-detected location
-  --ref TAG       Install fixbuddy scripts from a specific git ref (default: v0.4.0;
+  --ref TAG       Install fixbuddy scripts from a specific git ref (default: v0.5.0;
                   use --ref main for the latest commit)
   -y, --yes       Skip the sudo confirmation prompt
   -h, --help      Show this help and exit