claudemd-cli 0.23.3 → 0.23.5

package/CHANGELOG.md

@@ -8,6 +8,25 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.23.5] - 2026-06-03
+
+**Patch — `status.js` feature-flag reporting fix: `bashSafetyIndirectCall` misreported as OFF when unset.** `/claudemd-status` showed `bashSafetyIndirectCall: false` even though the indirect-exec unwrap defaults ON — `pre-bash-safety-check.sh` reads `${BASH_SAFETY_INDIRECT_CALL:-1} != 0`. status.js used a stale `=== '1'` (explicit-set) check predating the v0.21.8 default-ON flip, so unset → `false`. **No enforcement impact** — the §8 SAFETY indirect-call coverage (`bash -c "rm -rf $X"` / `eval`) was active the whole time; only the status readout was wrong. Spec unchanged at v6.14.1.
+
+### Fixed
+
+- `scripts/status.js`: `features.bashSafetyIndirectCall` now uses `!== '0'` (mirrors the hook's `:-1` default-ON semantics and the sibling `bashReadonlyFastPath` check) instead of `=== '1'`. Surfaced by a `/claudemd-status` reporting-accuracy check during the v0.23.4 impact-audit follow-up. +2 tests; the stale `reflects env var (v0.6.0)` test (which asserted `unset → false`, encoding the pre-v0.21.8 default-OFF) repurposed to `ON for any non-zero value`.
+
+## [0.23.4] - 2026-06-03
+
+**Patch — ships spec v6.14.1: §2.1 skill-MUST-invoke override clarified.** Resolves the instruction-collision surfaced by the v0.23.3 cross-project impact audit (audit item #5): superpowers / gstack `MUST invoke` skill wording vs §2.1's L0–L2 proceed-without default.
+
+### Changed
+
+- **`spec/CLAUDE.md` §2.1** (core, Δ +136B → 24553B; 447B headroom, 98.21%): the existing "this spec wins for L0–L2" clause is now **bolded** and carries a concrete example — `sp:test-driven-development` ("before writing implementation code") / `gs:investigate` ("do NOT debug directly") MUST-invoke wording does NOT force a clear-scope L1 bug out of fix→test-direct into TDD / investigate ceremony. No rule added or removed (`[clarify]` only); the precedence was already stated, just buried mid-paragraph.
+- Spec version **v6.14.0 → v6.14.1** (patch). Cascade per `feedback_spec_version_bump_cascade_grep.md`: `spec/CLAUDE-extended.md` (title + Recent-changes entry + Sizing line), `spec/CLAUDE-changelog.md` (new entry), `spec/hard-rules.json` (`spec_version`), `tests/integration/upgrade-lifecycle.test.sh` + `tests/scripts/spec-structure.test.js` (version assertions), `README.md`. Manifest `description` fields unchanged (major.minor still `v6.14` per the v0.2.1 versioning policy).
+
+Run `/claudemd-update` to sync the new spec into `~/.claude/CLAUDE*.md` (the current session keeps the old copy until then).
+
 ## [0.23.3] - 2026-06-03
 
 **Patch — three false-positive / telemetry-hygiene fixes surfaced by a cross-project impact audit (daagu + sibling-plugin sessions). All are bugfixes restoring intended hook behavior; spec unchanged at v6.14.0.**

package/README.md

@@ -329,7 +329,7 @@ claudemd/
 ├── commands/                 # 12 slash-command markdown files
 ├── bin/                      # standalone CLI entrypoint (claudemd-lint.js → `npx claudemd-cli` on npmjs.org)
 ├── scripts/                  # 16 Node.js management scripts + scripts/lib/ (single-source registry, lint, etc.)
-├── spec/                     # shipped v6.14.0 CLAUDE*.md trio + OPERATOR.md + hard-rules.json manifest
+├── spec/                     # shipped v6.14.1 CLAUDE*.md trio + OPERATOR.md + hard-rules.json manifest
 ├── tests/                    # hook shell tests + Node.js tests + integration + fixtures
 ├── docs/                     # ADDING-NEW-HOOK.md + RULE-HITS-SCHEMA.md + superpowers/
 └── .github/workflows/        # ci.yml (ubuntu+macOS × node 20) + npm-publish.yml (tag-triggered)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.23.3",
+  "version": "0.23.5",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {