claudemd-cli 0.26.1 → 0.27.0

package/CHANGELOG.md

@@ -8,6 +8,24 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.27.0] - 2026-07-10
+
+**Minor — post-compaction §11 re-read reminder (new SessionStart behavior) + spec v6.14.2 wording patch.** First implementation tranche of `docs/spec-optimization-plan-2026-07-10.md` (P6 items F1–F4).
+
+- **Compaction re-read reminder** (`hooks/session-start-check.sh`): SessionStart events with `source=="compact"` (auto or manual compaction — verified against code.claude.com/docs/en/hooks) now emit a one-line `additionalContext` banner: re-read the active plan + spec state per core §11 before continuing L2+ work. Rationale: §11 post-compaction re-read is a self-enforced rule guarding exactly the state where model attention is least reliable — it depended on the very attention it protects; the banner makes it hook-assisted. Advisory only, never blocks. **Opt-out**: `DISABLE_COMPACT_REREAD_REMINDER=1` (README §2a). Telemetry event: `session-start / compact-reminder / §11`.
+- **Behavior change on compact events**: `source=="compact"` now exits early — bootstrap, upgrade-banner, and summary-banner no longer run on compaction. They are session-START concerns; re-running `install.js` mid-session on a compaction event was never desirable. Startup / resume / clear paths are unchanged (stdin is now parsed whenever `jq` is present, previously only when `CLAUDE_SESSION_ID` was unset — needed for the `source` field; no observable difference on those paths).
+- **Spec v6.14.2** (patch — wording only, no rule change; detail in `spec/CLAUDE-changelog.md`): (1) extended header load-scope "review" → "pre-ship review", aligning with core §2.2 (per-task code review does not load extended); (2) trigger-word lists marked non-exhaustive with `e.g.` (quality-slider / depth-triggers / HACK / EMERGENCY / three-strike / continuation-cancel-switch) — detector-consumed lists (§11 mid-SPINE tell) stay exact; (3) context7 hard references conditionalized to "docs-lookup for API claims (e.g. context7, if available)" + a §12 fallback-table row (WebFetch official docs).
+- **Tests**: `session-start.test.sh` 14 → 17 — compact banner emits exactly ONE JSON object (`jq -s length == 1`, per the v0.23.13 double-emit lesson); `DISABLE_COMPACT_REREAD_REMINDER=1` suppresses; compact does NOT spawn bootstrap even when the manifest is missing. Version-pin cascade updated (`spec-structure.test.js`, `upgrade-lifecycle.test.sh`, `hard-rules.json#spec_version`).
+
+## [0.26.2] - 2026-07-07
+
+**Patch — dogfood QA hardening: three false-positive / data-loss fixes surfaced by an end-to-end usage pass.** All `fix:` (restore intended behavior); spec unchanged (stays v6.14.1). No new user-facing features.
+
+- **statusLine multi-supersede data loss** (`scripts/lib/statusline.js`): `/claudemd-statusline adopt --supersede=A` then `--supersede=B` on a composite host overwrote the single `{superseded:<prov>}` restore record, so `remove()` restored only B — A was permanently lost from the host registry. The record is now a `{superseded:[…]}` list: `adopt()` appends (dedup by id), `remove()` restores ALL entries in reverse order (front-insert) so they regain their original relative order. Legacy singular records written by ≤0.26.1 are still restored (`readSupersededList()` normalizes both shapes), so an upgrade taken mid-supersede loses nothing.
+- **banned-vocab `-am` false positive** (`hooks/banned-vocab-check.sh`): the commit-message extractor matched `-m`/`--message` but not combined short-flag blocks, so `git commit -am "…"` (one of the most common forms) fell through to the whole-command fallback — a banned word in a *chained* segment (`git commit -am "clean fix" && npm run comprehensive-x`) falsely denied a clean-message commit that the identical `-m` form passed. The extract + strip regexes now use `-[[:alpha:]]*m` (matches `-m`/`-am`/`-vam`; a strict superset — bare `-m` still matches with zero leading alphas).
+- **§10-V identifier/path FP in the standalone CLI + transcript scan** (`scripts/lib/lint.js`, `bin/claudemd-lint.js`, `hooks/transcript-vocab-scan.sh`): the v0.23.19 Path 2 sanitizer was never ported to two siblings. `claudemd-cli lint` (used in git pre-commit hooks / CI) flagged commit messages naming a file/branch/backtick-identifier that embeds a high-fire word (`refactor comprehensive-parser.js` → exit 1 → **blocked commit**); `transcript-vocab-scan` inflated §10-V advisory telemetry the same way. Added `stripIdentifiers()` (new `lib/lint.js` export) + a `scan({sanitize})` opt-in wired into the CLI `lint`/`audit` paths, and the mirror awk+sed in `transcript-vocab-scan.sh`. Rule set: fenced blocks → inline backtick spans → slashed-path runs → bare `name.ext` files (lowercase-extension only, so decimals/versions like `3.5x`/`v6.14` survive and a baseline-less ratio claim is not swallowed — no false negative). Bare hyphenated identifiers with no extension/slash (`robust-retry`) remain a residual FP, the same `\b`-boundary limitation Path 2 has.
+- **Tests (+8 → 611 Node tests; +5 shell hook tests)**: `statusline-adopt.test.js` multi-supersede + legacy-singular restore; `lint.test.js` `stripIdentifiers` + `scan({sanitize})` FP-fix + FN-guards; `banned-vocab.test.sh` 41 → 44 (`-am`/`-vam` isolation); `transcript-vocab-scan.test.sh` 12 → 14 (identifier-only clean / bare-prose-beside-id still fires).
+
 ## [0.26.1] - 2026-07-06
 
 **Patch — post-release review hardening of v0.26.0 statusLine coexistence.** Three fixes from an independent post-ship review (`superpowers:requesting-code-review`); no user-visible behavior change on the normal path. Spec unchanged (stays v6.14.1).

package/README.md

@@ -198,6 +198,11 @@ export DISABLE_SESSION_SUMMARY_BANNER=1    # v0.8.0+ — only the SessionStart b
                                            # the data is captured for /claudemd-audit
                                            # but no additionalContext line is injected.
 
+export DISABLE_COMPACT_REREAD_REMINDER=1   # v0.27.0+ — only the post-compaction §11
+                                           # re-read reminder banner (SessionStart with
+                                           # source=="compact"); compact events still
+                                           # skip bootstrap/upgrade-banner either way.
+
 export DISABLE_BATCH_CADENCE_ADVISORY=1    # v0.19.2+ — only the §13.2 batch-review
                                            # cadence advisory inside session-end-check;
                                            # mid-SPINE warn-on-unvalidated-mutation
@@ -333,7 +338,7 @@ claudemd/
 ├── commands/                 # 12 slash-command markdown files
 ├── bin/                      # standalone CLI entrypoint (claudemd-lint.js → `npx claudemd-cli` on npmjs.org)
 ├── scripts/                  # 16 Node.js management scripts + scripts/lib/ (single-source registry, lint, etc.)
-├── spec/                     # shipped v6.14.1 CLAUDE*.md trio + OPERATOR.md + hard-rules.json manifest
+├── spec/                     # shipped v6.14.2 CLAUDE*.md trio + OPERATOR.md + hard-rules.json manifest
 ├── tests/                    # hook shell tests + Node.js tests + integration + fixtures
 ├── docs/                     # ADDING-NEW-HOOK.md + RULE-HITS-SCHEMA.md + superpowers/
 └── .github/workflows/        # ci.yml (ubuntu+macOS × node 20) + npm-publish.yml (tag-triggered)

package/bin/claudemd-lint.js

@@ -252,7 +252,7 @@ function lintCmd(rawArgs) {
   const HAS_BASELINE = /baseline/i;
   const baselineExempt = HAS_NUMERIC_ARROW.test(text) || HAS_BASELINE.test(text);
 
-  const hits = scan(text, { excludeRatio: baselineExempt });
+  const hits = scan(text, { excludeRatio: baselineExempt, sanitize: true });
   if (json) {
     process.stdout.write(formatJSON({ scope: 'lint', text, hits }) + '\n');
   } else {
@@ -332,7 +332,7 @@ function auditCmd(rawArgs) {
   const patterns = readPatterns();
   const annotated = turns.map(t => ({
     ...t,
-    hits: scan(t.text, { excludeRatio: !includeRatio, patterns }),
+    hits: scan(t.text, { excludeRatio: !includeRatio, patterns, sanitize: true }),
   }));
   const flaggedCount = annotated.reduce((n, t) => n + (t.hits.length > 0 ? 1 : 0), 0);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.26.1",
+  "version": "0.27.0",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {

package/scripts/lib/lint.js

@@ -80,8 +80,47 @@ function posixClassesToJs(regex) {
   return out;
 }
 
-export function scan(text, { excludeRatio = false, patterns } = {}) {
+// stripIdentifiers — remove code / identifier / path regions before §10-V
+// matching so a filename, branch, or backtick span quoting a high-fire word is
+// not read as a value claim. `\b` treats '-', '/', '.' as word boundaries, so
+// `\bcomprehensive\b` fires INSIDE `comprehensive-parser.js` or a branch name
+// `docs/comprehensive-audit`. Mirrors hooks/banned-vocab-check.sh's v0.23.19
+// Path 2 sanitizer (fenced blocks → inline backtick spans → slashed-path runs)
+// and adds a bare dotted-file token strip, because the CLI's primary input —
+// commit messages — commonly names bare files (`refactor comprehensive-parser.js`)
+// without backticks or a leading path. Token classes are ASCII-only so 中文
+// prose and bare-word claims (the real violations) stay intact and still match.
+export function stripIdentifiers(text) {
+  if (!text) return text;
+  // 1. Fenced code blocks: line-based fence toggle, mirroring the bash awk
+  //    `/^[[:space:]]*```/{f=!f; next} !f` — drop the ``` marker lines AND the
+  //    body between them. An unterminated fence drops to EOF (in_fence stays on).
+  const kept = [];
+  let inFence = false;
+  for (const line of text.split('\n')) {
+    if (/^\s*```/.test(line)) { inFence = !inFence; continue; }
+    if (!inFence) kept.push(line);
+  }
+  return kept.join('\n')
+    // 2. Inline backtick spans.
+    .replace(/`[^`]*`/g, ' ')
+    // 3. Slashed-path runs (branch names, file paths, URLs) — Path 2's rule.
+    .replace(/[A-Za-z0-9._@~-]*\/[A-Za-z0-9._/@~-]*/g, ' ')
+    // 4. Bare dotted-file tokens (foo.js, comprehensive-parser.ts) — CLI
+    //    extension. The extension must start with a LOWERCASE letter, which
+    //    (a) excludes decimals / versions ("3.5x", "v6.14") whose ".5x"/".14"
+    //    could otherwise swallow a baseline-less ratio claim → false negative,
+    //    and (b) excludes sentence-boundary typos ("comprehensive.Next", capital
+    //    after the dot) so a real claim isn't stripped. Only true `name.ext`
+    //    identifiers with a lowercase extension are removed.
+    .replace(/[A-Za-z0-9_-]+\.[a-z][a-z0-9]*/g, ' ');
+}
+
+export function scan(text, { excludeRatio = false, patterns, sanitize = false } = {}) {
   if (!text) return [];
+  // Sanitize identifier/path regions when asked (CLI lint/audit opt in). Match
+  // against the stripped text; the caller keeps the original for display.
+  const scanText = sanitize ? stripIdentifiers(text) : text;
   const pats = patterns || readPatterns();
   const hits = [];
   for (const p of pats) {
@@ -92,7 +131,7 @@ export function scan(text, { excludeRatio = false, patterns } = {}) {
     } catch {
       continue; // bad regex — skip (fail-open)
     }
-    const m = text.match(re);
+    const m = scanText.match(re);
     if (m) hits.push({ match: m[0], regex: p.regex, reason: p.reason, isRatio: p.isRatio });
   }
   return hits;