bdo-cli 0.45.3 → 0.45.5

package/CHANGELOG.md

@@ -5,6 +5,61 @@ All notable changes to Bushido (bdo) will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.45.5] (2026-09-20)
+
+### Fixes
+
+- **The hook no longer rewrites a command that feeds a pipe.** The agent
+  only ever sees a pipeline's final output, so rewriting the left side to
+  `bdo …` never saved a token — it only changed what the next program
+  received. `cat src/main.rs | wc -l` counted bdo's truncated view (400)
+  instead of the file (3614); `git log --oneline | wc -l` reported the
+  50-entry cap, not the real 105 commits. Every command is now left exactly
+  as written when a `|` follows it; in a compound, only that segment is
+  exempt (`git status && cat f | wc -l` still becomes
+  `bdo git status && cat f | wc -l`). This generalizes the `find`/`fd`-only
+  exemption from #439.
+
+  **Visible side effect**: commands on the left of a pipe no longer appear
+  in `bdo gain` — bdo isn't in that path anymore. The filtered command whose
+  output the agent actually reads (the pipeline's last, or any unpiped
+  command) is tracked as before.
+
+- **`bdo test --changed`** aborted the whole plan when one language's runner
+  was missing — a machine without `go` never ran the Python tests, with no
+  error beyond the printed plan header. That language now fails and the
+  rest still run.
+
+## [0.45.4] (2026-09-19)
+
+### Security
+
+- **`bdo err` / `bdo test` command injection.** Both joined their argument
+  vector with spaces and handed the string to `sh -c`. An argument containing
+  a space was split into several, and shell metacharacters inside an argument
+  became executable — `bdo err grep 'x; touch F' file` ran `touch`. Both now
+  exec via argv, the shell path is removed, and an empty wrapped command is an
+  error instead of `sh -c ""` exiting 0.
+
+  **Behavior change**: packing shell syntax into a single argument
+  (`bdo test "cargo test && echo ok"`) no longer works — that form and the
+  injection were the same code path. Ask for a shell explicitly and it is
+  delivered intact: `bdo test sh -c 'cargo test && echo ok'`. Every documented
+  usage (`bdo err cargo build`, `bdo test cargo test`) is unaffected.
+
+### Fixes
+
+- **`bdo find <dir>`** — the most common native form, and what the hook
+  produces — was read as a glob pattern searched under `.`, a different command
+  that usually found nothing. A lone argument with a path separator and no glob
+  characters is now the start path. A missing start path exits 1 with find's
+  message instead of reporting zero matches and exiting 0, so `bdo find … &&`
+  chains stop where native find would.
+
+  Together these close the ledger's "compound command / exit code
+  interference" item: the interference was bdo running a different command
+  than the one asked for, not a harness artifact.
+
 ## [0.45.3] (2026-09-19)
 
 ### Security

package/README.md

@@ -88,7 +88,7 @@ Each has a `.sha256` sidecar — verify before extracting.
 ### Verify Installation
 
 ```bash
-bdo --version   # Should show "bdo 0.45.3"
+bdo --version   # Should show "bdo 0.45.5"
 bdo gain        # Should show token savings stats
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.45.3"
+    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.45.5"
   ],
   "author": "Patrick Szymkowiak",
   "bin": {
@@ -91,7 +91,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.45.3",
+  "version": "0.45.5",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"