bdo-cli 0.44.12 → 0.45.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +56 -0
- package/README.md +3 -3
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -5,6 +5,62 @@ All notable changes to Bushido (bdo) will be documented in this file.
|
|
|
5
5
|
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
|
6
6
|
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
|
7
7
|
|
|
8
|
+
## [0.45.0] (2026-08-16)
|
|
9
|
+
|
|
10
|
+
A security release. Two changes alter behavior you may notice — see
|
|
11
|
+
**Breaking** below.
|
|
12
|
+
|
|
13
|
+
### Breaking
|
|
14
|
+
|
|
15
|
+
- **Copilot no longer inherits Claude's allow rules.** Copilot rewrites were
|
|
16
|
+
evaluated against `permissions::Host::Claude`, so a command you allow-listed
|
|
17
|
+
in Claude Code was auto-approved in Copilot — which never granted it.
|
|
18
|
+
Copilot now keeps its own confirmation boundary, meaning commands that used
|
|
19
|
+
to run unprompted there will ask.
|
|
20
|
+
- **The legacy Cursor shell hook no longer emits `"permission": "allow"`**,
|
|
21
|
+
restoring Cursor's native confirmation for the same reason.
|
|
22
|
+
- **`bdo cc-economics` no longer falls back to `npx --yes ccusage`.** Fetching
|
|
23
|
+
and executing a mutable registry package as a side effect of an analytics
|
|
24
|
+
report is not something a report should do. Install `ccusage` explicitly
|
|
25
|
+
(pinned) to keep using economics reports.
|
|
26
|
+
|
|
27
|
+
### Security
|
|
28
|
+
|
|
29
|
+
- **Installer integrity**: `install.sh` now downloads the release's SHA-256
|
|
30
|
+
sidecar and verifies the archive before extracting. Previously a tampered
|
|
31
|
+
or truncated download was installed unchecked.
|
|
32
|
+
- **Release workflow**: every action is pinned to a commit SHA, and both
|
|
33
|
+
pipe-to-shell installs (cargo-dist, rustup) are gone — replaced by
|
|
34
|
+
`cargo install --locked` and a pinned, checksum-verified `rustup-init`.
|
|
35
|
+
- **Tee files** are created with `O_EXCL` and a random nonce in the filename.
|
|
36
|
+
A pre-planted path — symlink or hardlink included — can no longer be
|
|
37
|
+
written through, nor left at permissions bdo doesn't own.
|
|
38
|
+
- **Tracking database**: the path is rejected if any component is a symlink,
|
|
39
|
+
or if an overridden parent directory is group/other-writable. Permission
|
|
40
|
+
tightening is enforced rather than best-effort.
|
|
41
|
+
- **Hook audit log** opens `O_NOFOLLOW` at 0600 and redacts secrets, matching
|
|
42
|
+
the protection the tracking DB and tee files already had.
|
|
43
|
+
- **Child output capture** is bounded per stream instead of buffered without
|
|
44
|
+
limit.
|
|
45
|
+
|
|
46
|
+
### Fixes
|
|
47
|
+
|
|
48
|
+
- **The documented one-line install was broken**, and had been since the repo
|
|
49
|
+
rename: every copy pointed at `refs/heads/master`, but the default branch is
|
|
50
|
+
`main`. Because `curl -f` yields an empty body on 404, piping to `sh` was a
|
|
51
|
+
silent no-op rather than a visible error. Fixed in all 7 places.
|
|
52
|
+
- `tracking.enabled` and `tracking.history_days` from the config file are now
|
|
53
|
+
honored; tracking previously recorded unconditionally on a hardcoded 90-day
|
|
54
|
+
retention.
|
|
55
|
+
|
|
56
|
+
### Chores
|
|
57
|
+
|
|
58
|
+
- CI guards the release workflow's hardening (`scripts/check-release-hardening.sh`)
|
|
59
|
+
and the installer's checksum check. `release.yml` is cargo-dist-generated, so
|
|
60
|
+
`dist generate` reverts its hardening wholesale — and the workflow keeps
|
|
61
|
+
working afterward, just unpinned, which is exactly the kind of regression
|
|
62
|
+
that otherwise surfaces at the next release.
|
|
63
|
+
|
|
8
64
|
## [0.44.12] (2026-08-16)
|
|
9
65
|
|
|
10
66
|
### Fixes
|
package/README.md
CHANGED
|
@@ -59,7 +59,7 @@ brew tap tedorigawa001/tap && brew install bdo
|
|
|
59
59
|
### Quick Install (Linux/macOS)
|
|
60
60
|
|
|
61
61
|
```bash
|
|
62
|
-
curl -fsSL https://raw.githubusercontent.com/tedorigawa001/TokenReductionTool/refs/heads/
|
|
62
|
+
curl -fsSL https://raw.githubusercontent.com/tedorigawa001/TokenReductionTool-BDO/refs/heads/main/install.sh | sh
|
|
63
63
|
```
|
|
64
64
|
|
|
65
65
|
> Installs to `~/.local/bin`. Add to PATH if needed:
|
|
@@ -85,7 +85,7 @@ Download from [releases](https://github.com/tedorigawa001/TokenReductionTool/rel
|
|
|
85
85
|
### Verify Installation
|
|
86
86
|
|
|
87
87
|
```bash
|
|
88
|
-
bdo --version # Should show "bdo 0.
|
|
88
|
+
bdo --version # Should show "bdo 0.45.0"
|
|
89
89
|
bdo gain # Should show token savings stats
|
|
90
90
|
```
|
|
91
91
|
|
|
@@ -448,7 +448,7 @@ For the best experience, use [WSL](https://learn.microsoft.com/en-us/windows/wsl
|
|
|
448
448
|
|
|
449
449
|
```bash
|
|
450
450
|
# Inside WSL
|
|
451
|
-
curl -fsSL https://raw.githubusercontent.com/tedorigawa001/TokenReductionTool/refs/heads/
|
|
451
|
+
curl -fsSL https://raw.githubusercontent.com/tedorigawa001/TokenReductionTool-BDO/refs/heads/main/install.sh | sh
|
|
452
452
|
bdo init -g
|
|
453
453
|
```
|
|
454
454
|
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"artifactDownloadUrls": [
|
|
3
|
-
"https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.
|
|
3
|
+
"https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.45.0"
|
|
4
4
|
],
|
|
5
5
|
"author": "Patrick Szymkowiak",
|
|
6
6
|
"bin": {
|
|
@@ -91,7 +91,7 @@
|
|
|
91
91
|
"zipExt": ".tar.xz"
|
|
92
92
|
}
|
|
93
93
|
},
|
|
94
|
-
"version": "0.
|
|
94
|
+
"version": "0.45.0",
|
|
95
95
|
"volta": {
|
|
96
96
|
"node": "18.14.1",
|
|
97
97
|
"npm": "9.5.0"
|