bdo-cli 0.44.12 → 0.45.1

package/CHANGELOG.md

@@ -5,6 +5,89 @@ All notable changes to Bushido (bdo) will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.45.1] (2026-09-05)
+
+The `bdo` binary is unchanged from 0.45.0 — this release fixes the installer
+and the CI guard around it.
+
+### Fixes
+
+- **`install.sh` could never install anything.** It requested
+  `bdo-<target>.tar.gz`, but releases publish `bushido-<target>.tar.xz` — the
+  archive is named after the crate, not the binary, and compressed with xz, so
+  every download 404'd. Adding checksum verification in 0.45.0 didn't reveal
+  this because the failure happens a step earlier. Alongside the name: the
+  explicit `-z` is gone (GNU tar applies a compression flag literally and fails
+  on a valid archive; both tars auto-detect), and the binary is now taken from
+  the `<crate>-<target>/` directory the archive actually contains rather than
+  the archive root.
+- **The installer reported the wrong binary.** `verify()` resolved `bdo`
+  through `PATH`, so another copy shadowing the install directory printed its
+  version — making a good install read as a failed upgrade. It now reports the
+  binary it just installed, by path, and warns when something else on `PATH`
+  will run instead.
+- **`scripts/check-release-hardening.sh` passed mutable action refs.** It
+  blocklisted `@v<digit>` instead of requiring a 40-char commit SHA, so
+  `@main`, `@latest` and `@1.2.3` all reported "hardening intact" — false
+  assurance about the workflow that holds the publish tokens. It now asserts
+  the allowed shape.
+
+## [0.45.0] (2026-08-16)
+
+A security release. Two changes alter behavior you may notice — see
+**Breaking** below.
+
+### Breaking
+
+- **Copilot no longer inherits Claude's allow rules.** Copilot rewrites were
+  evaluated against `permissions::Host::Claude`, so a command you allow-listed
+  in Claude Code was auto-approved in Copilot — which never granted it.
+  Copilot now keeps its own confirmation boundary, meaning commands that used
+  to run unprompted there will ask.
+- **The legacy Cursor shell hook no longer emits `"permission": "allow"`**,
+  restoring Cursor's native confirmation for the same reason.
+- **`bdo cc-economics` no longer falls back to `npx --yes ccusage`.** Fetching
+  and executing a mutable registry package as a side effect of an analytics
+  report is not something a report should do. Install `ccusage` explicitly
+  (pinned) to keep using economics reports.
+
+### Security
+
+- **Installer integrity**: `install.sh` now downloads the release's SHA-256
+  sidecar and verifies the archive before extracting. Previously a tampered
+  or truncated download was installed unchecked.
+- **Release workflow**: every action is pinned to a commit SHA, and both
+  pipe-to-shell installs (cargo-dist, rustup) are gone — replaced by
+  `cargo install --locked` and a pinned, checksum-verified `rustup-init`.
+- **Tee files** are created with `O_EXCL` and a random nonce in the filename.
+  A pre-planted path — symlink or hardlink included — can no longer be
+  written through, nor left at permissions bdo doesn't own.
+- **Tracking database**: the path is rejected if any component is a symlink,
+  or if an overridden parent directory is group/other-writable. Permission
+  tightening is enforced rather than best-effort.
+- **Hook audit log** opens `O_NOFOLLOW` at 0600 and redacts secrets, matching
+  the protection the tracking DB and tee files already had.
+- **Child output capture** is bounded per stream instead of buffered without
+  limit.
+
+### Fixes
+
+- **The documented one-line install was broken**, and had been since the repo
+  rename: every copy pointed at `refs/heads/master`, but the default branch is
+  `main`. Because `curl -f` yields an empty body on 404, piping to `sh` was a
+  silent no-op rather than a visible error. Fixed in all 7 places.
+- `tracking.enabled` and `tracking.history_days` from the config file are now
+  honored; tracking previously recorded unconditionally on a hardcoded 90-day
+  retention.
+
+### Chores
+
+- CI guards the release workflow's hardening (`scripts/check-release-hardening.sh`)
+  and the installer's checksum check. `release.yml` is cargo-dist-generated, so
+  `dist generate` reverts its hardening wholesale — and the workflow keeps
+  working afterward, just unpinned, which is exactly the kind of regression
+  that otherwise surfaces at the next release.
+
 ## [0.44.12] (2026-08-16)
 
 ### Fixes

package/README.md

@@ -59,7 +59,7 @@ brew tap tedorigawa001/tap && brew install bdo
 ### Quick Install (Linux/macOS)
 
 ```bash
-curl -fsSL https://raw.githubusercontent.com/tedorigawa001/TokenReductionTool/refs/heads/master/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/tedorigawa001/TokenReductionTool-BDO/refs/heads/main/install.sh | sh
 ```
 
 > Installs to `~/.local/bin`. Add to PATH if needed:
@@ -76,16 +76,19 @@ cargo install --git https://github.com/tedorigawa001/TokenReductionTool
 ### Pre-built Binaries
 
 Download from [releases](https://github.com/tedorigawa001/TokenReductionTool/releases):
-- macOS: `bdo-x86_64-apple-darwin.tar.gz` / `bdo-aarch64-apple-darwin.tar.gz`
-- Linux: `bdo-x86_64-unknown-linux-musl.tar.gz` / `bdo-aarch64-unknown-linux-gnu.tar.gz`
-- Windows: `bdo-x86_64-pc-windows-msvc.zip`
+Archives are named after the crate (`bushido`); the binary inside is `bdo`.
+Each has a `.sha256` sidecar — verify before extracting.
+
+- macOS: `bushido-x86_64-apple-darwin.tar.xz` / `bushido-aarch64-apple-darwin.tar.xz`
+- Linux: `bushido-x86_64-unknown-linux-gnu.tar.xz` / `bushido-aarch64-unknown-linux-gnu.tar.xz`
+- Windows: `bushido-x86_64-pc-windows-msvc.zip`
 
 > **Windows users**: Extract the zip and place `bdo.exe` somewhere in your PATH (e.g. `C:\Users\<you>\.local\bin`). Run Bushido from **Command Prompt**, **PowerShell**, or **Windows Terminal** — do not double-click the `.exe` (it will flash and close). For the best experience, use [WSL](https://learn.microsoft.com/en-us/windows/wsl/install) where the full hook system works natively. See [Windows setup](#windows) below for details.
 
 ### Verify Installation
 
 ```bash
-bdo --version   # Should show "bdo 0.44.11"
+bdo --version   # Should show "bdo 0.45.1"
 bdo gain        # Should show token savings stats
 ```
 
@@ -448,7 +451,7 @@ For the best experience, use [WSL](https://learn.microsoft.com/en-us/windows/wsl
 
 ```bash
 # Inside WSL
-curl -fsSL https://raw.githubusercontent.com/tedorigawa001/TokenReductionTool/refs/heads/master/install.sh | sh
+curl -fsSL https://raw.githubusercontent.com/tedorigawa001/TokenReductionTool-BDO/refs/heads/main/install.sh | sh
 bdo init -g
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.44.12"
+    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.45.1"
   ],
   "author": "Patrick Szymkowiak",
   "bin": {
@@ -91,7 +91,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.44.12",
+  "version": "0.45.1",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"