@mindrian_os/cli 1.15.3-beta.40 → 1.15.3-beta.44

package/CHANGELOG.md

@@ -1,3 +1,61 @@
+## [1.15.3-beta.44] - 2026-07-23
+
+### Added
+- 
+
+### Fixed
+- **Every Stop hook turn showed a raw Claude Code hook JSON validation error
+  ("Hook JSON output validation failed: - : Invalid input") instead of the intended calm
+  systemMessage, whenever `scripts/check-card-fire.cjs` force-blocked a turn to demand an
+  AskUserQuestion card fire.** Root cause: Claude Code's Stop-hook output schema does not
+  define a `hookSpecificOutput` variant for the Stop event at all (the union covers only
+  PreToolUse, UserPromptSubmit, and PostToolUse); including the key on a Stop envelope
+  rejects the WHOLE envelope (`additionalProperties: false`), not just that key, silently
+  replacing the carefully-set `decision`/`reason`/`systemMessage` with a raw schema-error
+  dump. This is the 4th live occurrence of the same defect class: fixed once in
+  `scripts/on-stop` (v1.10.9 -> v1.10.10, 2026-04-15), then reintroduced in
+  `scripts/feynman-minto-guardian.cjs` (under a since-corrected comment that had the rule
+  backwards), reintroduced again as a regression inside `scripts/on-stop` itself (the
+  Phase 198-09 MCP-first thin-adapter branch), and hit live by a real user via
+  `scripts/check-card-fire.cjs` today. Fixed at all 3 sites: `hookSpecificOutput` removed
+  outright (and removed from `check-card-fire.cjs`'s own envelope-key allowlist so it can't
+  silently slip back in); the calm, human-facing `decision`/`reason`/`systemMessage` fields
+  each branch already set are unaffected. New structural regression gate:
+  `scripts/check-hook-schema-compatibility.cjs` (previously unwired and, worse, encoding the
+  opposite/wrong rule) is corrected and wired into `scripts/verify-release` (section 16) --
+  it enumerates every script Claude Code registers as a Stop hook straight off
+  `hooks/hooks.json`, follows one level of subprocess invocation, and fails the release if
+  any of them would emit a Stop-shaped `hookSpecificOutput` again. Full RCA:
+  `.planning/debug/resolved/stop-hook-invalid-hookspecificoutput-schema.md`.
+
+## [1.15.3-beta.42] - 2026-07-23
+
+### Fixed
+- **Windows-only: Python source interpolating shell variables directly (`normwin('$VAR')`) raised a
+  `SyntaxError` at Python compile time whenever the interpolated value contained a native Windows
+  path with a backslash, before `normwin()` ever ran.** This is the same family of bug as beta.40's
+  `os.rename`/`os.replace` fix, but one layer earlier: 36 interpolation sites across
+  `scripts/room-registry`, `scripts/resolve-room`, `scripts/update-icm-index`, and
+  `scripts/on-cwd-changed` built Python heredoc/`-c` source by quoting a shell variable straight
+  into the source string, instead of passing it through `sys.argv` (the safe pattern
+  `room-registry`'s own `_write_current_room()` already used). Fixed by converting all 36 sites to
+  `sys.argv`-based parameter passing. New regression suite
+  (`tests/test-room-registry-windows-python-interp.cjs`, 29/29) includes a load-bearing control
+  proving the old interpolation shape fails to compile on a backslash value and the new
+  `sys.argv` shape does not. Root-caused and fixed same day as beta.40; independently verified live
+  on the reporter's Windows install.
+- **Windows-only: the regression tests' own Python-probe spawn mechanism corrupted probe source
+  containing a backslash-next-to-a-quote, at the Windows `CreateProcess` argv-marshalling
+  boundary.** Three test files (`test-room-registry-windows-atomic-replace.cjs`,
+  `test-room-registry-windows-python-interp.cjs`, `test-room-registry-windows-path.cjs`) each
+  routed a Python probe body through `bash -c` as a positional argv element, to survive the two
+  bugs above -- safe on Linux/macOS, but Node spawning `bash.exe` on Windows re-quotes argv before
+  bash's own `$1` expansion runs, silently mangling the probe. Fixed by writing the probe source to
+  a temp `.py` file and executing the file path instead of the source text -- a path has no
+  embedded quote/backslash-adjacent-quote sequences, eliminating the defect class rather than
+  special-casing which characters are unsafe. Verified green on this dev box (21/21, 29/29, 25/25,
+  byte-identical to pre-fix baselines); Windows re-verification of this exact patch is pending.
+
 ## [1.15.3-beta.40] - 2026-07-23
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mindrian_os/cli",
-  "version": "1.15.3-beta.40",
+  "version": "1.15.3-beta.44",
   "description": "Install MindrianOS into Claude Code with one command -- `npx @mindrian_os/cli`. Ships the MindrianOS plugin (Larry + PWS methodology + Data Room) plus a setup/diagnostics CLI (install/doctor/update).",
   "scripts": {
     "mcp": "node bin/mindrian-mcp-server.cjs",