bdo-cli 0.45.7 → 0.46.1

package/CHANGELOG.md

@@ -5,6 +5,69 @@ All notable changes to Bushido (bdo) will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.46.1] (2026-10-17)
+
+### Security
+
+- **rustls 0.23.45 → 0.23.46** (via `ureq`), fixing RUSTSEC-2026-0346
+  (`Debug` impls for client session values expose TLS secrets, medium),
+  RUSTSEC-2026-0347, RUSTSEC-2026-0348 and RUSTSEC-2026-0349 (including an
+  unauthenticated ServerHello downgrading later connections to classical key
+  exchange, low). Caught by the daily scheduled `cargo audit` run. No code
+  changes.
+
+- **CI actions pinned to commit SHAs.** `ci.yml` used mutable refs
+  (`actions/checkout@v6`, `dtolnay/rust-toolchain@1.91`), so whoever controls
+  those tags or branches could change what runs on every PR. They are now
+  pinned like `release.yml`, every checkout drops its credentials
+  (`persist-credentials: false`), and the hardening check runs against
+  `ci.yml` too, so an unpinned action fails CI.
+
+## [0.46.0] (2026-10-04)
+
+### Features
+
+- **`--raw` / `BDO_RAW=1`: unreduced output for every command.** One switch
+  replaces the per-command escape hatches, meaning "run as if bdo weren't
+  there":
+
+  ```bash
+  bdo --raw git log            # identical to `git log`, byte for byte, same exit code
+  bdo --raw read src/main.rs   # the whole file
+  BDO_RAW=1 bdo cargo test     # env form, e.g. for a whole session
+  ```
+
+  A command with a same-named program runs it with your arguments unchanged;
+  `err` / `test` / `summary` run what they wrap; `read` shows the full file;
+  commands that run a differently named tool (`lint`, `format`, `vitest`,
+  `jest`, `prisma`, `playwright`) do the same work with bdo's output
+  reduction and parsing-only flags (`--reporter=json` and the like) removed —
+  but keep flags that change what runs, such as vitest's `run` and black's
+  `--check`, so raw mode never hangs in watch mode or rewrites files.
+  bdo-only commands (`gain`, `map`, …) run as usual. Raw runs are tracked at
+  0% savings.
+
+  Put `--raw` before the subcommand; `BDO_RAW=1` works anywhere and leaves the
+  hook's rewriting unchanged. `bdo read -l none`, `BDO_NO_TOML=1` and
+  `bdo proxy` keep working, and `bdo read`'s reduced-view hint now suggests
+  `bdo --raw read <file>`.
+
+### Fixes
+
+- **`bdo lint` mangled output-format options.** `bdo lint ruff check
+  --output-format text .` ran `ruff text .` — `check` and the option were
+  dropped, the option's value left behind. `bdo lint eslint -f stylish` passed
+  `-f json -f stylish`, so eslint used stylish and bdo's JSON parse failed.
+  Each linter's format option is now handled as one unit, in either spelling.
+- **`bdo --raw` or `bdo -v` with no subcommand** tried to run `--raw` / `-v`
+  as a program and exited 127. It's now a usage error.
+
+### Chores
+
+- The dependency audit (`cargo audit`) runs daily in CI, not only on push —
+  a new advisory against a locked dependency no longer waits for the next
+  commit to surface.
+
 ## [0.45.7] (2026-09-26)
 
 ### Features

package/README.md

@@ -97,7 +97,7 @@ Each has a `.sha256` sidecar — verify before extracting.
 ### Verify Installation
 
 ```bash
-bdo --version   # Should show "bdo 0.45.7"
+bdo --version   # Should show "bdo 0.46.1"
 bdo gain        # Should show token savings stats
 ```
 
@@ -399,8 +399,34 @@ Antigravity, Copilot, Cursor), or set explicitly via `BDO_AGENT=<name>`. Command
 ```bash
 -u, --ultra-compact    # ASCII icons, inline format (extra token savings)
 -v, --verbose          # Increase verbosity (-v, -vv, -vvv)
+--raw                  # No filtering at all — run as if bdo weren't there
 ```
 
+### Raw output (`--raw` / `BDO_RAW=1`)
+
+When you need the exact, unreduced output — a checksum, a precise count, an
+error message bdo would trim — use one switch for every command:
+
+```bash
+bdo --raw git log            # identical to `git log`, byte for byte, same exit code
+bdo --raw read src/main.rs   # the whole file
+BDO_RAW=1 bdo cargo test     # env var form, e.g. for a whole session
+```
+
+- A command with a same-named program (`git`, `ls`, `cargo`, `grep`, …) runs
+  that program with your arguments unchanged.
+- `err` / `test` / `summary` run the command they wrap.
+- `read` shows the full file.
+- bdo-only commands (`gain`, `map`, …) have no unfiltered form and run as usual.
+
+Put `--raw` **before** the subcommand: after it, the flag belongs to the
+wrapped command (`git log --raw` is git's own option). `BDO_RAW=1` works
+anywhere, and leaves the hook's rewriting unchanged — the rewritten command
+just runs raw. Raw runs are still tracked, at 0% savings.
+
+The older per-command switches — `bdo read -l none`, `BDO_NO_TOML=1`,
+`bdo proxy <cmd>` — keep working.
+
 ## Examples
 
 **Directory listing:**

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.45.7"
+    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.46.1"
   ],
   "author": "Patrick Szymkowiak",
   "bin": {
@@ -91,7 +91,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.45.7",
+  "version": "0.46.1",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"