bdo-cli 0.47.1 → 0.48.1

package/CHANGELOG.md

@@ -5,6 +5,42 @@ All notable changes to Bushido (bdo) will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.48.1] (2026-10-21)
+
+### Security
+
+- **Hook permission gate: ANSI-C quoting and line-continued substitutions are
+  never auto-allowed.** `$'...'` quoting can hide real separators behind
+  escaped quotes (`git status $'a\'b'; other-cmd; echo $'c\'d'` looked like
+  one allowed `git status`), and a backslash-newline between `$`/`<`/`>` and
+  `(` (`$\⏎(…)`) slipped a command substitution past the gate, letting two
+  allowed commands combine (`git log $\⏎(echo --output=/path)` writes a file).
+  Both now defer to the agent's own permission prompt, across the Claude,
+  Cursor, Gemini and Copilot hooks.
+- **rustls-webpki 0.103.15 → 0.103.16 and webpki-roots 1.0.6 → 1.0.10**
+  (via `ureq`), fixing RUSTSEC-2026-0382 (certificate verification may accept
+  distrusted intermediates) and RUSTSEC-2026-0381 (bundled roots trust
+  distrusted emSign intermediates). Caught by the daily scheduled audit.
+- **`bdo curl` no longer buffers a whole response in memory.** Piped / redirected
+  output now goes straight from curl to the consumer (bytes arrive before the
+  transfer ends, exit status and failure bodies unchanged). On a terminal,
+  bdo captures at most 16 MiB to summarize; a larger response is streamed
+  byte-exact instead of growing memory without bound.
+
+## [0.48.0] (2026-10-17)
+
+### Features
+
+- **`bdo map --grep <PATTERN>`**: keep only the signatures matching a regex
+  (files with no match are dropped), e.g. `bdo map src --grep 'Tracker'`. The
+  footer reports how many of the tree's signatures matched. Combines with
+  `--changed`.
+
+### Fixed
+
+- `bdo map <file>` (a single file) printed an empty header line instead of the
+  file's path.
+
 ## [0.47.1] (2026-10-17)
 
 ### Security

package/README.md

@@ -104,7 +104,7 @@ gh attestation verify bushido-aarch64-apple-darwin.tar.xz --repo tedorigawa001/T
 ### Verify Installation
 
 ```bash
-bdo --version   # Should show "bdo 0.47.1"
+bdo --version   # Should show "bdo 0.48.1"
 bdo gain        # Should show token savings stats
 ```
 
@@ -196,6 +196,21 @@ C++, Java, and Python; respects `.gitignore`.
 `--against origin/main` for the whole-branch diff) — the API surface you touched,
 ideal alongside `bdo review`.
 
+`bdo map --grep <PATTERN>` keeps only the signatures matching a regex, so
+"where is `Tracker` defined, and what takes or returns one?" is one command
+(`(?i)` for case-insensitive, `^pub` for the public surface). Drill into a hit
+with `bdo map <file>` or `bdo read <file> -l outline`.
+
+```
+$ bdo map src --grep 'struct Tracker\b|pub fn is_quiet'
+core/quiet.rs
+  pub fn is_quiet() -> bool { … }
+core/tracking.rs
+  pub struct Tracker { … }
+
+— 2 files, 2 of 2206 signatures match /struct Tracker\b|pub fn is_quiet/ (full source: 2208 lines)
+```
+
 For Python, function bodies are elided with a `…` marker (the analogue of
 `{ … }`), `async def` is handled like `def`, and multi-line signatures are
 folded onto one line:

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.47.1"
+    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.48.1"
   ],
   "author": "Patrick Szymkowiak",
   "bin": {
@@ -91,7 +91,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.47.1",
+  "version": "0.48.1",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"