claudemd-cli 0.25.0 → 0.26.0

package/CHANGELOG.md

@@ -8,6 +8,27 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.26.0] - 2026-07-06
+
+**Minor — statusLine multi-provider coexistence.** When a composite host (code-graph) owns the `statusLine` slot, `/claudemd-statusline` now registers claudemd as a *guest* provider in the host's registry so both segments render (`claudemd | code-graph`), instead of clobbering the slot. Empty-slot behavior is unchanged. Spec content unchanged (v6.14.1).
+
+- **Adaptive strategy** (`scripts/lib/statusline.js` + new `scripts/lib/statusline-hosts.js`): `detect()` reports `absent | claudemd | host | foreign`. `host` → guest-register (front of the host registry, absolute-path command so code-graph's `execFileSync` runner — which expands `~` but not `$HOME` — can run it); `absent` → own the slot (v0.25.x); non-composite `foreign` → report/`--force` (host-wrap deferred to v0.26.1, see `tasks/statusline-host-wrap-deferred.md`).
+- **Supersede consent**: `/claudemd-statusline` offers to replace a detected hand-made PS1 provider (`--supersede=<id>`, saved for restore) or keep both — never silent.
+- **Install**: a composite host in the slot yields a `host-detected` note (run `/claudemd-statusline`) — install never writes another plugin's registry.
+- **remove/uninstall**: guest mode unregisters claudemd from the host registry (restoring a superseded provider) and deletes the renderer; the host keeps the slot.
+- **M2**: renderer strips embedded newlines in cwd/model (one-line guarantee). **M5**: CLI default is human-readable, `--json` for machine output; `--supersede=<id>` added.
+- **Tests (+24 → 598 Node tests)**: `statusline-hosts.test.js` (adapter), plus host/guest/supersede cases across `statusline-adopt.test.js`, `statusline-cli.test.js`, `install.test.js`.
+
+## [0.25.1] - 2026-07-06
+
+**Patch — post-release review hardening of the v0.25.0 statusLine detector: a present-but-unrecognised `statusLine` slot is now treated as `foreign` (never overwritten by the empty-slot install), closing a latent hole in the never-clobber invariant.** No behavior change for any valid Claude Code config; spec unchanged (stays v6.14.1).
+
+- **`detect()` presence check (`scripts/lib/statusline.js`):** classification now keys on slot *presence*, not command-parseability. Any present slot that isn't claudemd's `{command:"…claudemd-statusline.sh"}` — a bare string, `{}`, `{command:""}`, `{command:123}`, or an alternate `type` — reads as `foreign`, so the empty-slot install skips it instead of collapsing it to `absent` and clobbering it. Only a missing / `null` / `""` slot is `absent`. CC's real slot is `{type:"command",command:"<string>"}` (already classified `foreign` and skipped), so no confirmed valid config reached the old path: this is defense-in-depth on the #1 "never touch a foreign slot" invariant, not a fix to observed data loss.
+- **Stale prev cleanup:** a plain empty-slot `set` now clears any leftover `statusline-prev.json` from an earlier `--force` undone out-of-band, so a later `remove` empties the slot instead of resurrecting the stale foreign command.
+- **Tests (+4 → 574 Node tests):** `statusline-adopt.test.js` locks the foreign-shape classification (bare string / `{}` / empty / numeric / alt-`type` all skip untouched), the absent boundary (`null` / `""` / missing still adopt), and the stale-prev case; `uninstall.test.js` now ships a renderer fixture so `beforeEach` exercises a real install-time statusLine set, and asserts the no-manifest uninstall still un-wires a claudemd slot and deletes the renderer (constraint-#5 no-manifest sub-case, previously unasserted).
+
+Provenance: `superpowers:requesting-code-review` whole-feature audit of `60312c8..cce65ee` — 0 Critical, 1 Important (the detector hole above), 5 Minor; verdict "Ready to merge: Yes" for v0.25.0 with this patch recommended. Minors M2 (renderer newline-strip) and M5 (`--json` / `--dry-run` UX) deferred to `tasks/statusline-v0251-deferred.md`.
+
 ## [0.25.0] - 2026-07-05
 
 **Minor — statusLine auto-registration: a new PS1-style statusLine — `user@host:/path (branch) Model [ctx:N%]` — with a semantic context-pressure color (`[ctx:N%]` green <50%, yellow 50–79%, red ≥80%).** Spec content unchanged (stays v6.14.1).

package/README.md

@@ -115,7 +115,7 @@ Per-hook timeout (3-5s in `hooks.json`); timeout = treated as exit 0 (pass) per
 | `/claudemd-sparkline [--days=A,B,C]` | v0.8.4+ R-N9 — per-`spec_section` cumulative counts of signal events across 3 windows (default 30/60/90d). Trend arrow compares per-period rate; `(newly active)` / `(silenced)` annotations flag activation/deactivation transitions. Markdown block suitable for CHANGELOG header pre-release. |
 | `/claudemd-clean-residue [--apply]` | Dry-run-by-default cleanup of stale `claudemd-sync-*` sentinels and historical `claudemd-(mockgh\|work).*` test sandboxes. |
 | `/claudemd-design-adopt [check\|remove]` | v0.24.0 — for a UI project, generate a thin, fact-based `DESIGN.md` from its real design-token sources (deterministic detector `scripts/design-detect.js`; evidence-gated rules menu; never invents values) and wire a sentinel block into project CLAUDE.md. `check` verifies pointers resolve; `remove` unwires. Always shows the diff and asks before writing. Manual/opt-in — no SessionStart hook, nothing auto-fires. |
-| `/claudemd-statusline [check\|remove] [--force]` | v0.25.0 — register claudemd's PS1-style statusLine into `~/.claude/settings.json`. Default adopts into an empty slot; `check` reports the current owner with no writes; `remove` restores the prior statusline (or clears the slot) and deletes `~/.claude/claudemd-statusline.sh`; `--force` takes over another provider's slot, saving its command so `remove` can restore it. Always shows the diff and asks before writing. Install-time auto-adopt is empty-slot-only (opt-out: `CLAUDEMD_NO_STATUSLINE=1`). |
+| `/claudemd-statusline [check\|remove] [--force]` | v0.25.0 — register claudemd's PS1-style statusLine into `~/.claude/settings.json`. Default adopts into an empty slot; `check` reports the current owner with no writes; `remove` restores the prior statusline (or clears the slot) and deletes `~/.claude/claudemd-statusline.sh`; `--force` takes over another provider's slot, saving its command so `remove` can restore it. Always shows the diff and asks before writing. Install-time auto-adopt is empty-slot-only (opt-out: `CLAUDEMD_NO_STATUSLINE=1`). When another composite provider (e.g. code-graph) owns the slot, claudemd registers as a guest so both segments render; `--supersede=<id>` replaces a named provider. |
 | `/claudemd-uninstall` | Pre-uninstall cleanup: clears manifest + state + log + legacy `settings.json` hook entries. Run BEFORE `/plugin uninstall claudemd@claudemd` (see [Uninstall](#uninstall)). |
 
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {