bdo-cli 0.46.1 → 0.47.1

package/CHANGELOG.md

@@ -5,6 +5,48 @@ All notable changes to Bushido (bdo) will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.47.1] (2026-10-17)
+
+### Security
+
+- **Release archives carry GitHub build provenance.** Each platform's archive
+  is attested by the release workflow, so a download can be checked with
+  `gh attestation verify <file> --repo tedorigawa001/TokenReductionTool-BDO`.
+  Unlike the `.sha256` sidecar, which ships in the same release, this proves
+  the file was built by this repository's workflow from the tagged commit.
+
+- **npm releases are staged and need maintainer approval.** CI now runs
+  `npm stage publish` (still via Trusted Publishing), and the trusted publisher
+  is allowed nothing else, so a new `bdo-cli` version goes public only when a
+  maintainer approves it with 2FA. A compromised CI run can no longer publish
+  to npm on its own. The hardening check fails on a direct `npm publish`.
+
+## [0.47.0] (2026-10-17)
+
+### Features
+
+- **`BDO_QUIET=1` silences bdo's advisory notes on stderr** — the
+  reduced-view hint after `bdo read`, the daily "no hook installed / hook
+  outdated" reminder, and the "--raw has no effect" note. Output, errors, the
+  wrapped command's stderr, warnings that bdo misbehaved and the
+  `[full output: …]` pointer are unaffected. A suppressed hook reminder is not
+  spent: it still shows on the next run without `BDO_QUIET`.
+
+### Fixed
+
+- **Unit tests no longer race on, or write to, the real tracking DB.** A test
+  rewrote the process-wide `BDO_DB_PATH` while other tests opened trackers in
+  parallel, and several tests recorded rows into the user's own `history.db`
+  (visible in `bdo gain`). Each test thread now gets a throwaway DB.
+
+### Security
+
+- **npm publishing moved to Trusted Publishing (OIDC).** The release
+  workflow no longer uses a long-lived `NPM_TOKEN` secret: npm verifies a
+  short-lived token GitHub issues to the `publish-npm` job, and the package
+  gets npm provenance. The hardening check fails if a stored npm token comes
+  back (e.g. after `dist generate`).
+
 ## [0.46.1] (2026-10-17)
 
 ### Security

package/README.md

@@ -86,7 +86,14 @@ cargo install --git https://github.com/tedorigawa001/TokenReductionTool-BDO
 
 Download from [releases](https://github.com/tedorigawa001/TokenReductionTool-BDO/releases):
 Archives are named after the crate (`bushido`); the binary inside is `bdo`.
-Each has a `.sha256` sidecar — verify before extracting.
+Each has a `.sha256` sidecar — verify before extracting. From 0.47.1 on, each
+archive also carries GitHub build provenance, which proves it was built by this
+repository's release workflow (the checksum alone cannot: it ships in the same
+release):
+
+```bash
+gh attestation verify bushido-aarch64-apple-darwin.tar.xz --repo tedorigawa001/TokenReductionTool-BDO
+```
 
 - macOS: `bushido-x86_64-apple-darwin.tar.xz` / `bushido-aarch64-apple-darwin.tar.xz`
 - Linux: `bushido-x86_64-unknown-linux-gnu.tar.xz` / `bushido-aarch64-unknown-linux-gnu.tar.xz`
@@ -97,7 +104,7 @@ Each has a `.sha256` sidecar — verify before extracting.
 ### Verify Installation
 
 ```bash
-bdo --version   # Should show "bdo 0.46.1"
+bdo --version   # Should show "bdo 0.47.1"
 bdo gain        # Should show token savings stats
 ```
 
@@ -427,6 +434,15 @@ just runs raw. Raw runs are still tracked, at 0% savings.
 The older per-command switches — `bdo read -l none`, `BDO_NO_TOML=1`,
 `bdo proxy <cmd>` — keep working.
 
+### Quiet mode (`BDO_QUIET=1`)
+
+`BDO_QUIET=1` silences bdo's own advisory notes on stderr: the
+"reduced view — full raw content: …" hint after `bdo read`, the daily
+"no hook installed / hook outdated" reminder, and the "--raw has no effect"
+note. Command output, errors, the wrapped command's own stderr, warnings that
+bdo itself misbehaved (a filter panic, a failed hook integrity check) and the
+`[full output: …]` pointer are unaffected.
+
 ## Examples
 
 **Directory listing:**

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.46.1"
+    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.47.1"
   ],
   "author": "Patrick Szymkowiak",
   "bin": {
@@ -91,7 +91,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.46.1",
+  "version": "0.47.1",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"