bdo-cli 0.49.0 → 0.49.2

package/CHANGELOG.md

@@ -5,6 +5,55 @@ All notable changes to Bushido (bdo) will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.49.2] (2026-10-31)
+
+### Security
+
+- **`bdo grep` no longer lets ripgrep run a program.** bdo translates grep to
+  rg and forwarded extra arguments, including rg's `--pre <cmd>` (runs `<cmd>`
+  on every searched file) and `--hostname-bin <cmd>`. Native grep rejects
+  these as unknown options, so a hook-rewritten `grep -rn x . --pre rm` — which
+  a `grep` allow rule auto-approves — deleted the files it searched. bdo grep
+  now refuses `--pre`, `--pre-glob` and `--hostname-bin` (also `--opt=value`)
+  in the path, `-t` value and extra arguments, including under `--raw`, and
+  passes the pattern with `-e` so a pattern like `--pre` is searched for, not
+  parsed as a flag.
+- **`bdo read` streams instead of loading unbounded input.** `cat` / `head` /
+  `tail` become `bdo read`, which loaded the whole file to filter it:
+  `/dev/zero` grew memory until the process was killed, a FIFO showed nothing
+  until the writer closed, and a multi-gigabyte log was held in memory. Files
+  that are not regular files, or are over 16 MiB, are now streamed unfiltered
+  and byte-exact (non-UTF-8 included), honouring `-m` / `--tail-lines`, in
+  bounded memory: `-m` counts newlines chunk by chunk (~8 MB RSS for 200 MB of
+  `/dev/zero`); `--tail-lines` scans a regular file backwards from the end
+  (a 300 MB single-line file: ~10 MB RSS) and keeps at most a 16 MiB window of
+  input that cannot be seeked (`/dev/zero` holds at ~38 MB RSS, warning when
+  the requested lines did not fit).
+
+## [0.49.1] (2026-10-29)
+
+### Security
+
+- **Redaction: values starting with `-` and multi-part shell words.** A secret
+  beginning with `-` was left in plain text for env assignments
+  (`DATABASE_PASSWORD=-…`), `curl -u alice:-…`, mysql `-p-…` and
+  `password=-…` — only a value after a `--flag` may be the next flag. And a
+  value the shell reads as one word but built from several quoted and
+  unquoted parts was masked only in part (`--password "abc"defgh` kept
+  `defgh`) or not at all (`abc"d e"f`). The whole word is now masked; a value
+  that is exactly one quoted string still keeps its quotes, so JSON stays
+  valid, and `""`, `''` and `$VAR` / `"$VAR"` references are left alone.
+- **Redaction: `curl -u` arguments are one shell word too.** A credential
+  quoted as a whole and continued after the quote — `curl -u 'alice:abc'defgh`
+  — kept `defgh`, because the quoted-argument rule stopped at the closing
+  quote. The `-u` / `--user` / `-uUSER` / `--user=` argument is now captured
+  as one shell word and split at its first `:`: the user is kept and the rest
+  of the word masked, with quotes re-balanced. No `:` (curl prompts) and
+  `$VAR` references the shell expands (unquoted or in `"…"`) are left alone,
+  while a `$` inside `'…'` is literal and masked
+  (`curl -u 'alice:$literalSecret9'`). `--user` must be followed by `=` or a
+  space, so `--user-agent=client:1.0` is not touched.
+
 ## [0.49.0] (2026-10-29)
 
 ### Security

package/README.md

@@ -119,7 +119,7 @@ gh attestation verify "$(brew --cache bushido)" --repo tedorigawa001/TokenReduct
 ### Verify Installation
 
 ```bash
-bdo --version   # Should show "bdo 0.49.0"
+bdo --version   # Should show "bdo 0.49.2"
 bdo gain        # Should show token savings stats
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "artifactDownloadUrls": [
-    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.49.0"
+    "https://github.com/tedorigawa001/TokenReductionTool-BDO/releases/download/v0.49.2"
   ],
   "author": "Patrick Szymkowiak",
   "bin": {
@@ -91,7 +91,7 @@
       "zipExt": ".tar.xz"
     }
   },
-  "version": "0.49.0",
+  "version": "0.49.2",
   "volta": {
     "node": "18.14.1",
     "npm": "9.5.0"