claudemd-cli 0.41.0 → 0.42.0

package/CHANGELOG.md

@@ -8,6 +8,15 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.42.0] - 2026-07-13
+
+**Minor — §8 command-name canonicalization parity + `$IFS` fixed-point fold (roadmap SEC-2, L3).** Product of the 2026-07-13 production-readiness re-audit (`docs/production-readiness-audit-2026-07-13.md`), which found SEC-1 (v0.39.0) closed the `\rm` / `/bin/rm` command-name evasion for the **rm gate only** — the npx and curl-into-shell gates still let path-prefixed / backslash-escaped runners through. Spec unchanged (stays v6.17.0). This is a §8 SAFETY enforcement change; positioning is unchanged — §8 remains a guardrail (env vars / `[allow-*]` tokens still bypass), not an adversarial security boundary. Closing these makes the gate fire on **natural command spellings** (`/usr/bin/npx`, `\curl`), not on obfuscation.
+
+- **SEC-2 F5 command-position canonicalization** (`hooks/pre-bash-safety-check.sh`): new `canon_cmd_words` awk pass strips a leading backslash and a path prefix from the **first token after a true command separator** (`^ ; & | ( { ` backtick ` newline`) — never a plain-space-preceded argument. This gives the npx/curl gates the same command-name awareness the rm gate's token loop already had. Now denied (were allowed): `\npx pkg`, `/usr/bin/npx pkg`, `\curl url | sh`, `/usr/bin/curl url | sh`, `curl url | /bin/sh`, and path/backslash runners after a `;`/`|`/`&&` separator. No false-positive on argument-position paths: `echo foo/npx bar`, `cat /usr/bin/rm` still pass (the arg is space-preceded, not command position).
+- **SEC-2 F6 `$IFS` fixed-point fold** (`hooks/pre-bash-safety-check.sh`): the bare-`$IFS` fold `s/\$IFS([^A-Za-z0-9_]|$)/ \1/` consumed the trailing delimiter into the backref, so an **adjacent** `$IFS$IFS` left the second copy unfolded after one pass (`rm$IFS$IFS-rf$IFS$X` → allow). The bare form now loops to a fixed point (folding only removes `$IFS`, so it decreases monotonically and terminates); `$IFSFOO` (distinct var) stays untouched.
+- **Red-team corpus** (`tests/fixtures/bash-safety/corpus.tsv`): +12 cases (F5×6 deny + F5-fp×3 pass + F6×1 deny + F6-fp×1 pass) wired into the CI-gated `pre-bash-safety.test.sh`, so this FN class fails the build if it reopens. Corpus 221 → 233 cases.
+- **Tests**: `pre-bash-safety.test.sh` 233/233; full `npm test` green (node --test 675/675, integration full+upgrade lifecycle PASS); shellcheck clean; bash-3.2 portability gate clean. All 6 original bypass vectors re-confirmed deny + all FP controls allow on the real hook (`DISABLE_RULE_HITS_LOG=1`, no telemetry pollution).
+
 ## [0.41.0] - 2026-07-12
 
 **Minor — latent-cleanup batch (roadmap B2): detector-parity, encoding-helper dedup, install validate-before-move, strict toggle argv, architecture-doc refresh.** Closes the five B2 items from the 2026-07-12 production-readiness audit. Spec unchanged (stays v6.17.0). No user-visible enforcement change.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.41.0",
+  "version": "0.42.0",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {