bdo-cli 0.45.2 → 0.45.4

package/CHANGELOG.md

@@ -5,6 +5,54 @@ All notable changes to Bushido (bdo) will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.45.4] (2026-09-19)
+
+### Security
+
+- **`bdo err` / `bdo test` command injection.** Both joined their argument
+  vector with spaces and handed the string to `sh -c`. An argument containing
+  a space was split into several, and shell metacharacters inside an argument
+  became executable — `bdo err grep 'x; touch F' file` ran `touch`. Both now
+  exec via argv, the shell path is removed, and an empty wrapped command is an
+  error instead of `sh -c ""` exiting 0.
+
+  **Behavior change**: packing shell syntax into a single argument
+  (`bdo test "cargo test && echo ok"`) no longer works — that form and the
+  injection were the same code path. Ask for a shell explicitly and it is
+  delivered intact: `bdo test sh -c 'cargo test && echo ok'`. Every documented
+  usage (`bdo err cargo build`, `bdo test cargo test`) is unaffected.
+
+### Fixes
+
+- **`bdo find <dir>`** — the most common native form, and what the hook
+  produces — was read as a glob pattern searched under `.`, a different command
+  that usually found nothing. A lone argument with a path separator and no glob
+  characters is now the start path. A missing start path exits 1 with find's
+  message instead of reporting zero matches and exiting 0, so `bdo find … &&`
+  chains stop where native find would.
+
+  Together these close the ledger's "compound command / exit code
+  interference" item: the interference was bdo running a different command
+  than the one asked for, not a harness artifact.
+
+## [0.45.3] (2026-09-19)
+
+### Security
+
+- **RUSTSEC-2026-0285**: `rustls` 0.23.37 → 0.23.45 (transitive, via `ureq`
+  for telemetry). TLS 1.3 handshake messages were incorrectly accepted across
+  encryption level boundaries. Only reachable when telemetry is enabled, which
+  is off by default. Caught by the `cargo audit` CI gate on an unrelated
+  docs-only PR five days after the advisory was published.
+
+### Fixes
+
+- **README badge**: the CI badge pointed at a `Security Check` workflow that
+  does not exist and rendered as a broken image. Now points at `ci.yml`.
+  Repository links in both READMEs updated from the pre-rename
+  `TokenReductionTool` to `TokenReductionTool-BDO`, and a stale
+  `tree/master` link to `tree/main`.
+
 ## [0.45.2] (2026-09-11)
 
 ### Security

package/README.md

@@ -7,13 +7,13 @@
 </p>
 
 <p align="center">
-  <a href="https://github.com/tedorigawa001/TokenReductionTool/actions"><img src="https://github.com/tedorigawa001/TokenReductionTool/workflows/Security%20Check/badge.svg" alt="CI"></a>
-  <a href="https://github.com/tedorigawa001/TokenReductionTool/releases"><img src="https://img.shields.io/github/v/release/tedorigawa001/TokenReductionTool" alt="Release"></a>
+  <a href="https://github.com/tedorigawa001/TokenReductionTool-BDO/actions"><img src="https://github.com/tedorigawa001/TokenReductionTool-BDO/actions/workflows/ci.yml/badge.svg" alt="CI"></a>
+  <a href="https://github.com/tedorigawa001/TokenReductionTool-BDO/releases"><img src="https://img.shields.io/github/v/release/tedorigawa001/TokenReductionTool-BDO" alt="Release"></a>
   <a href="https://opensource.org/licenses/Apache-2.0"><img src="https://img.shields.io/badge/License-Apache_2.0-blue.svg" alt="License: Apache 2.0"></a>
 </p>
 
 <p align="center">
-  <a href="https://github.com/tedorigawa001/TokenReductionTool">Website</a> &bull;
+  <a href="https://github.com/tedorigawa001/TokenReductionTool-BDO">Website</a> &bull;
   <a href="#installation">Install</a> &bull;
   <a href="docs/guide/resources/troubleshooting.md">Troubleshooting</a> &bull;
   <a href="docs/contributing/ARCHITECTURE.md">Architecture</a>
@@ -70,12 +70,12 @@ curl -fsSL https://raw.githubusercontent.com/tedorigawa001/TokenReductionTool-BD
 ### Cargo
 
 ```bash
-cargo install --git https://github.com/tedorigawa001/TokenReductionTool
+cargo install --git https://github.com/tedorigawa001/TokenReductionTool-BDO
 ```
 
 ### Pre-built Binaries
 
-Download from [releases](https://github.com/tedorigawa001/TokenReductionTool/releases):
+Download from [releases](https://github.com/tedorigawa001/TokenReductionTool-BDO/releases):
 Archives are named after the crate (`bushido`); the binary inside is `bdo`.
 Each has a `.sha256` sidecar — verify before extracting.
 
@@ -88,7 +88,7 @@ Each has a `.sha256` sidecar — verify before extracting.
 ### Verify Installation
 
 ```bash
-bdo --version   # Should show "bdo 0.45.2"
+bdo --version   # Should show "bdo 0.45.4"
 bdo gain        # Should show token savings stats
 ```
 
@@ -496,7 +496,7 @@ Bushido supports 14 AI coding tools. Each integration rewrites shell commands to
 | **OpenClaw** | `openclaw plugins install ./openclaw` | Plugin TS (before_tool_call) |
 | **Pi** | `bdo init -g --agent pi` (global) | TypeScript extension (tool_call) |
 | **Hermes** | `bdo init --agent hermes` | Python plugin adapter (terminal command mutation via `bdo rewrite`) |
-| **Mistral Vibe** | Planned ([#800](https://github.com/tedorigawa001/TokenReductionTool/issues/800)) | Blocked on upstream |
+| **Mistral Vibe** | Planned ([#800](https://github.com/tedorigawa001/TokenReductionTool-BDO/issues/800)) | Blocked on upstream |
 | **Kilo Code** | `bdo init --agent kilocode` | .kilocode/rules/bdo-rules.md (project-scoped) |
 | **Google Antigravity** | `bdo init --agent antigravity` | .agents/rules/antigravity-bdo-rules.md (project-scoped) |
 
@@ -534,7 +534,7 @@ brew uninstall bdo           # If installed via Homebrew
 
 ## Documentation
 
-- **[docs/guide](https://github.com/tedorigawa001/TokenReductionTool/tree/master/docs/guide)** — full user guide (installation, supported agents, what gets optimized, analytics, configuration, troubleshooting)
+- **[docs/guide](https://github.com/tedorigawa001/TokenReductionTool-BDO/tree/main/docs/guide)** — full user guide (installation, supported agents, what gets optimized, analytics, configuration, troubleshooting)
 - **[INSTALL.md](INSTALL.md)** — detailed installation reference
 - **[ARCHITECTURE.md](docs/contributing/ARCHITECTURE.md)** — system design and technical decisions
 - **[CONTRIBUTING.md](CONTRIBUTING.md)** — contribution guide
@@ -588,11 +588,11 @@ export BDO_TELEMETRY_DISABLED=1   # Blocks telemetry regardless of consent
 
 ## StarMapper
 
-<a href="https://starmapper.bruniaux.com/tedorigawa001/TokenReductionTool">
+<a href="https://starmapper.bruniaux.com/tedorigawa001/TokenReductionTool-BDO">
   <picture>
     <source media="(prefers-color-scheme: dark)" srcset="https://starmapper.bruniaux.com/api/map-image/tedorigawa001/TokenReductionTool?theme=dark" />
     <source media="(prefers-color-scheme: light)" srcset="https://starmapper.bruniaux.com/api/map-image/tedorigawa001/TokenReductionTool?theme=light" />
-    <img alt="StarMapper" src="https://starmapper.bruniaux.com/api/map-image/tedorigawa001/TokenReductionTool" />
+    <img alt="StarMapper" src="https://starmapper.bruniaux.com/api/map-image/tedorigawa001/TokenReductionTool-BDO" />
   </picture>
 </a>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.45.2"
+    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.45.4"
   ],
   "author": "Patrick Szymkowiak",
   "bin": {
@@ -91,7 +91,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.45.2",
+  "version": "0.45.4",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"