claudemd-cli 0.45.0 → 0.47.0

package/CHANGELOG.md

@@ -8,6 +8,27 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.47.0] - 2026-07-13
+
+**Minor — B-1: npx/runner gate moves to command-position detection, closing the runner-word-in-quoted-message false positive** (the deferred item from v0.46.0). Hook-code only; spec text unchanged (stays v6.19.0). Sandbox-verified against a 32-case FN-matrix + the full corpus before landing.
+
+- **B-1 — command-position runner detection** (`hooks/pre-bash-safety-check.sh`): the npx/bunx/npm-exec/pnpm-dlx/yarn-dlx gate no longer matches the runner name **anywhere** in the flattened command. It now splits into command segments (same boundaries as the rm gate), strips leading env-assignments + transparent wrappers (`env`/`command`/`sudo`/`timeout`/…), and checks whether the segment's **command word** is a runner. Effect: a runner name inside a quoted argument — `git commit -m "add npx setup for $PROJECT"`, `echo npx hello`, `which npx` — is no longer at a command position and is **allowed** (this was the `npx cd ×4` telemetry-FP smell and the user-reported "commit blocked without rm"). Real invocations still deny: `env npx`, `sudo -E npx`, `FOO=bar npx`, `time npx`, `$(npx …)`, `\npx`, `/usr/bin/npx`, and the whole runner family. Pinned/local/lockfile resolution unchanged.
+- **Accepted residual**: `xargs npx <pkg>` (runner as an xargs argument) is now allowed — same long-tail class as the documented `xargs rm` residual (`tasks/s8-false-negative-audit-2026-07-03.md`); env/bypass-token guardrail positioning unchanged.
+- **Corpus** (`tests/fixtures/bash-safety/corpus.tsv`): +9 rows (F9 — quoted-message runner-word allow, wrapper-prefixed runner deny, pinned-under-wrapper allow). Suite 255 → 264.
+- **Tests**: full `npm test` green; shellcheck clean; bash-3.2-safe (only plain string vars + the wrapper-strip loop the rm gate already uses).
+
+## [0.46.0] - 2026-07-13
+
+**Minor — §8 detection-precision batch: close command-grouping/substitution false-negatives (SEC-3) + recognize mktemp-provenance temp cleanup (SEC-4).** Hook-code only; spec text unchanged (stays v6.19.0). From the 2026-07-13 comprehensive audit + the §8 detection-precision design review (`docs/s8-detection-precision-design-2026-07-13.md`). All changes sandbox-verified against the full corpus + adversarial FN-matrix (`DISABLE_RULE_HITS_LOG=1`) before landing.
+
+- **SEC-3 — command-grouping/substitution FN closure** (`hooks/pre-bash-safety-check.sh`): a command inside `$(…)` / `(…)` / `{…;}` / backtick **executes at eval time** but bypassed all three §8 gates. Fixes: the rm segment splitter now breaks on `(` `)` backtick (NOT `{}` — that is brace-`${VAR}` far more often, splitting it corrupted the var target) + strips a leading group opener so `(rm`/`{ rm` is seen as rm + strips grouping chars from the residue; the curl sink tolerates a closing `)`/`}`; the npx anchor gains `(`/`{` so `$(npx …)` is caught. `\npx`/`env npx` wrapper coverage and `${VAR}` targets are preserved (233-case corpus zero-regression).
+- **SEC-4 — mktemp-provenance recognition** (`hooks/pre-bash-safety-check.sh`): `T=$(mktemp -d); … rm -rf "$T"` (the §8.V4 sandbox-disposal idiom, previously denied as an unvalidated var) is now allowed when the target var is assigned **in the same command** from `$(mktemp …)` / `` `mktemp …` `` — mktemp output is a fresh, uniquely-named path. Additive recognition analogous to the existing `${VAR:?}` guard; new telemetry event `rm-rf-allow-provenance`. Cross-command mktemp, fake `mktemp` (`$(echo mktemp)`), transitive vars (`$S/x`), and `..` escapes stay strict.
+- **Test completeness** (`tests/scripts/hard-rules-drift.test.js`): the hard-rules-8 reverse-completeness assertion now enumerates **both** deny idioms (`HIT_SECTIONS+=` and direct `hook_record <hook> <deny-verb> … '§…'`); the prior regex saw only the first, leaving `§10-V` / `§11-memory-read` / `§7-ship-baseline` invisible to the demote-accounting guard.
+- **Corpus** (`tests/fixtures/bash-safety/corpus.tsv`): +22 rows (F7 grouping/substitution deny + FP controls, F8 mktemp-provenance allow + escape/fake/cross-call deny). Suite 233 → 255.
+- **Docs** (`docs/RULE-HITS-SCHEMA.md`): document `rm-rf-allow-provenance` event + section mapping.
+- **Deferred**: the npx command-position anchor rework (fix npx-plain-words-in-quoted-commit-message FP without regressing `env npx` wrapper coverage) needs a wrapper-aware token walk — see `tasks/s8-npx-message-fp-deferred.md`.
+- **Tests**: full `npm test` green (corpus 255/255, node --test all pass, integration lifecycle PASS); shellcheck clean; positioning as guardrail (env/bypass-token still bypass) unchanged.
+
 ## [0.45.0] - 2026-07-13
 
 **Minor — ships spec v6.19.0: §2.2 Runbook fast-path (ship-time token-efficiency relaxation).** When extended would load solely because of ship/release (incl. released-artifact L3) and the project's ship-runbook memory carries a current-version coverage stamp (`covers: §EXT §12 … @ v<spec>`), the ship reads the runbook + targeted-reads the stamped §EXT sections instead of the full ~47KB file. Stamp missing/stale → full load + stamp refresh (self-healing, one full re-read per spec release). All §12 HARD obligations bind unchanged. Companion to the v6.16.0 ship-runbook memory consolidation — the two together make a routine ship cost one runbook Read + ~7KB of targeted spec reads.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.45.0",
+  "version": "0.47.0",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {