claudemd-cli 0.32.3 → 0.34.0

package/CHANGELOG.md

@@ -8,6 +8,23 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.34.0] - 2026-07-11
+
+**Minor — spec v6.16.0: §11-EXT ship-runbook consolidation (SHOULD).** Per project, ship-trigger tags (`ship / release / deploy / 发布 / 发版 / 打tag`) belong to exactly ONE memory file — the project's ship runbook holding the full release flow (pre-ship checks → atomic steps → post-ship); ship-adjacent lessons keep topical tags and are `[[linked]]` from the runbook instead of carrying own ship tags. Effect: the §11 MEMORY.md read-the-file HARD gate costs one predictable Read per ship session instead of tag fan-out. Grounded in memory-read-check telemetry 2026-05-20 → 2026-07-10 (~20 deny events: modal match_count=1, recurring generic-tag FP fan-out, bypass reasons "residual keyword tag hits are FPs"). No hook / script changes — spec text + version cascade only (`hard-rules.json` spec_version field bump; rule is SHOULD, not HARD, per §13.2 budget gates).
+
+- Version cascade: spec headers ×2, `spec/CLAUDE-changelog.md` entry, `hard-rules.json` spec_version, `spec-structure.test.js` (2 asserts + test name), `upgrade-lifecycle.test.sh` NEW_SPEC_VER, README v6.15 → v6.16 family ×3 + repo-tree comment, manifest descriptions ×3 per v0.2.1 policy.
+- §13.1 minor-spacing note: ships one day after v6.15.0 by explicit operator request; the rule is telemetry-derived (7 weeks of rule-hits), which is the risk the spacing discipline guards against.
+- Reference implementation (user-global, not in repo): `feedback_claudemd_ship_from_main_atomic.md` rewritten as claudemd's single ship-tagged runbook; MEMORY.md generic-tag hygiene (`timeout` → `missing-timeout`, `cwd/encoding/projects/underscore` → hyphenated compounds) closing the measured FP sources.
+
+## [0.33.0] - 2026-07-10
+
+**Minor — `/claudemd-clean-residue` now also purges stale `~/.claude/tmp` tool-exhaust (spec §EXT §7-EXT retention).**
+
+- **Feature** (`scripts/clean-residue.js`): new `scanClaudeTmp`/`cleanClaudeTmp` pass over `~/.claude/tmp` — purges depth-1 entries with `mtime > TMP_RETENTION_DAYS` (default 7); per-UID dirs (`claude-<uid>`) are descended one level (children purged, shell kept — the shell's mtime churns while stale sessions pile up inside); dirs carrying a `.keep` marker are exempt (§8.V4 deliberately-retained fixtures). Retention resolution: `--retention-days=N` flag > `TMP_RETENTION_DAYS:` in the invoking project's CLAUDE.md > 7; malformed CLAUDE.md values warn and fall back (no silent-ignore). Still dry-run by default, `--apply` gates deletion, `CLAUDEMD_CLAUDE_TMP_DIR` env is the test seam. Origin: 2026-07-10 manual AUTH'd purge found 550M / 5157 stale entries because spec §7-EXT's "harness SHOULD purge mtime > 7d" had no implementing surface — `residue-audit.sh` only *recommends* the find command (`tasks/tmp-retention-followup.md`; telemetry showed the §8 rm-rf-var hook was NOT the blocker: 715 validated-rm allows vs 206 denies).
+- **Command doc** (`commands/claudemd-clean-residue.md`): documents the new scope, flags, and the active-session-older-than-retention caveat.
+- **Tests**: `tests/scripts/clean-residue.test.js` 14 → 22 (uid-dir descent, `.keep` exemption, dry-run/apply, missing dir, CLI claudeTmp section, retention-days flag shape, CLAUDE.md override + flag precedence).
+- Explicit non-goals kept: no SessionStart auto-clean (§7-EXT "no auto-clean without AUTH"), no §8 safe-path carve-out for `~/.claude/tmp` (prefix allow would open a `$X=../..` traversal FN; §8 is never-downgrade).
+
 ## [0.32.3] - 2026-07-10
 
 **Patch — spec v6.15.1: §0.1 operator-threshold relocation (Candidate 3 net-delete).** Core §0.1's tier promotion/demotion thresholds ("≥3 sessions in 30d" / "≥5 sessions + elaboration wasn't consulted" gates + `/claudemd-rules` demotion recommendation) move to `OPERATOR.md §13.1` — they are operator-executed (`external` enforcement), so Agent-loaded core carried thresholds the Agent cannot act on at runtime. Core keeps the Agent-consumed facts: Tier-2 default landing zone, hard cap, net-delete clause, Sizing tracking. Core 24978 → 24739 bytes (−239B, headroom 261B); OPERATOR.md 7018 → 7546 (+528B, human-only, unbudgeted). Origin: 2026-07-10 core-attention review; Candidate 3 of `tasks/core-net-delete-candidates-v6.14.md`, executed as user-authorized standalone compression (C1 was already consumed by v6.15.0). No hook / script / rule change — `hard-rules.json` `spec_version` only.

package/README.md

@@ -1,12 +1,12 @@
 # claudemd
 
-> A **personal AI-coding discipline harness**: one developer's opinionated **AI-CODING-SPEC v6.15**, encoded as Claude Code shell hooks and shipped with the plugin. Built and dogfooded on my own repos — fork and adapt, don't adopt wholesale.
+> A **personal AI-coding discipline harness**: one developer's opinionated **AI-CODING-SPEC v6.16**, encoded as Claude Code shell hooks and shipped with the plugin. Built and dogfooded on my own repos — fork and adapt, don't adopt wholesale.
 
 [![CI](https://github.com/sdsrss/claudemd/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/sdsrss/claudemd/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/claudemd-cli.svg)](https://www.npmjs.com/package/claudemd-cli)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-claudemd plugs into the Claude Code hook system to **block commits, pushes, and bash commands** that violate AI-CODING-SPEC v6.15 — banned vocabulary in commit messages, `rm -rf $VAR` without variable validation, ship-on-red-CI, unread `MEMORY.md` entries during release flows, and more. The spec itself (`CLAUDE.md` + `CLAUDE-extended.md` + `CLAUDE-changelog.md` + `OPERATOR.md`) ships with the plugin and installs into `~/.claude/`, so the rules Claude Code reads at session start match the rules the hooks enforce. (`OPERATOR.md` is the human-only spec-maintenance handbook — Agent-loaded files are the CLAUDE trio.)
+claudemd plugs into the Claude Code hook system to **block commits, pushes, and bash commands** that violate AI-CODING-SPEC v6.16 — banned vocabulary in commit messages, `rm -rf $VAR` without variable validation, ship-on-red-CI, unread `MEMORY.md` entries during release flows, and more. The spec itself (`CLAUDE.md` + `CLAUDE-extended.md` + `CLAUDE-changelog.md` + `OPERATOR.md`) ships with the plugin and installs into `~/.claude/`, so the rules Claude Code reads at session start match the rules the hooks enforce. (`OPERATOR.md` is the human-only spec-maintenance handbook — Agent-loaded files are the CLAUDE trio.)
 
 A standalone CLI (`npx claudemd-cli`) reuses the same `banned-vocab.patterns` source for git pre-commit hooks, GitHub Actions, and other agents that don't run inside Claude Code.
 
@@ -60,7 +60,7 @@ Verify in one command (Linux): `node --version && jq --version && gh --version &
 | 16 shell hooks | `banned-vocab-check` · `pre-bash-safety-check` · `ship-baseline-check` · `residue-audit` · `memory-read-check` · `memory-prompt-hint` · `mid-spine-yield-scan` · `sandbox-disposal-check` · `session-start-check` · `session-extended-read` · `session-summary` · `session-end-check` · `transcript-vocab-scan` · `transcript-structure-scan` · `version-sync` · `mem-audit` |
 | 15 slash commands | `/claudemd-install` · `/claudemd-status` · `/claudemd-update` · `/claudemd-audit` · `/claudemd-toggle` · `/claudemd-doctor` · `/claudemd-analyze` · `/claudemd-uninstall` · `/claudemd-rules` · `/claudemd-clean-residue` · `/claudemd-sparkline` · `/claudemd-sampling-audit` · `/claudemd-bypass-audit` · `/claudemd-design-adopt` · `/claudemd-statusline` |
 | 1 standalone CLI | `claudemd-cli lint` · `claudemd-cli audit` ([npm: `claudemd-cli`](https://www.npmjs.com/package/claudemd-cli)) |
-| Spec v6.15 | `~/.claude/CLAUDE.md` · `CLAUDE-extended.md` · `CLAUDE-changelog.md` · `OPERATOR.md` (backup-before-overwrite) |
+| Spec v6.16 | `~/.claude/CLAUDE.md` · `CLAUDE-extended.md` · `CLAUDE-changelog.md` · `OPERATOR.md` (backup-before-overwrite) |
 | StatusLine (opt-out) | PS1-style line — `user@host:/path (branch) Model [ctx:N% · 5h:N% · 7d:N%]` (context / 5-hour quota / weekly quota, all **used %**, read from Claude Code's `rate_limits` payload; quota segments auto-hide when the data is absent, or force-hide with `DISABLE_STATUSLINE_QUOTA=1`) — wired into `~/.claude/settings.json` on install **only when the slot is empty**; an existing statusline is left untouched. Skip entirely with `CLAUDEMD_NO_STATUSLINE=1`. Manage via `/claudemd-statusline`. |
 
 Install moves any existing `~/.claude/CLAUDE*.md` to `~/.claude/backup-<ISO>/` (last 5 kept automatically). Uninstall offers `keep / restore / delete`; `delete` requires an extra confirmation.
@@ -338,7 +338,7 @@ claudemd/
 ├── commands/                 # 12 slash-command markdown files
 ├── bin/                      # standalone CLI entrypoint (claudemd-lint.js → `npx claudemd-cli` on npmjs.org)
 ├── scripts/                  # 16 Node.js management scripts + scripts/lib/ (single-source registry, lint, etc.)
-├── spec/                     # shipped v6.15.1 CLAUDE*.md trio + OPERATOR.md + hard-rules.json manifest
+├── spec/                     # shipped v6.16.0 CLAUDE*.md trio + OPERATOR.md + hard-rules.json manifest
 ├── tests/                    # hook shell tests + Node.js tests + integration + fixtures
 ├── docs/                     # ADDING-NEW-HOOK.md + RULE-HITS-SCHEMA.md + superpowers/
 └── .github/workflows/        # ci.yml (ubuntu+macOS × node 20) + npm-publish.yml (tag-triggered)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.32.3",
+  "version": "0.34.0",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {