claudemd-cli 0.48.0 → 0.48.1

package/CHANGELOG.md

@@ -8,6 +8,17 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.48.1] - 2026-07-15
+
+**Patch — three §8 pre-detector silent bypasses closed (D1 brace-subpath, D2 arithmetic/quoted `<<` fakes a heredoc). Bugfix restoring intended deny behavior; no new gate, no §8 detector added.**
+
+- **D1 — `canon_cmd_words` tore `${VAR}/subpath` apart.** It set command position on `{`, so `rm -rf "${SP}/build"` was basenamed to `rm -rf "${build"`, erasing the `${SP}` the var-detector greps for → the segment was skipped (ALLOW). Only shapes with a `/` after the `{` were mangled, landing the bypass precisely on the dangerous subpath class; `rm -rf "${HOME}/"` (empty `HOME` = `rm -rf /`, the ValveSoftware/steam-for-linux#3671 residue case) bypassed too. Fix: `{` re-opens command position only as a real brace-group introducer (`{ rm; }`), guarded on the preceding char not being `$`. Introduced with `canon_cmd_words` in v0.42.0 (SEC-2).
+- **D2 — a `<<` left-shift / quoted `<<` faked a heredoc and blanked the following command.** `heredoc_re` matched any `<<word`, so `$((1<<bits))`, `$[a<<b]`, `let a<<b`, and a `<<` inside a quoted string (`echo "a<<b"; rm -rf $EVIL`) all set `in_heredoc`, truncated the line at `<<`, and blanked every following line — deleting the rm/npx/curl from the text **all three** detectors scan (blinds the whole gate, not one detector). Fix (root cause, closes the class without enumerating shell syntaxes): treat `<<TAG` as a heredoc only when a matching terminator line actually exists later. A genuine heredoc always closes with its tag; a shift / quoted `<<` / comparison never does. The new heredoc-detection condition is a strict `AND`-narrowing of the old one, so it can only make detection *less* aggressive → expose more text to the deny-on-match detectors → never a new bypass (proven by a differential old-vs-new sweep: 0 inputs newly allowed).
+- **Found by** an adversarial fresh-subagent review (2026-07-15). D1/D2 were reproduced against the shipped hook, fixed, and RED-proven; the review's follow-up (`$[…]` / `let` / quoted `<<`, all the same class) folded into the same terminator-guard fix and a second review round confirmed the invariant holds.
+- **Also — multi-window refresh note.** `/claudemd-refresh`, `refresh-plugin.sh`, and README §Update now tell users to run `/reload-plugins` in **other open Claude Code windows**: a refresh removes the old versioned plugin-cache dir those sessions pinned their hook paths to at startup, so they error on every hook event (enforcement absent) until reloaded.
+- **Residuals** (documented in the hook; deliberate-crafting territory that does not clear the "ordinary mistake" bar, so not chased): indirect-name rebind (`unset "$T"`, `trap 'S=' DEBUG`), and a fake heredoc whose tag is repeated as a bare line to acquire a coincidental terminator (present in the original code too — this fix does not widen it). `IFS=/; rm -rf $SP/build` was probed and denies.
+- **Tests**: pre-bash-safety corpus +17 rows (10 deny + 7 FP-pass controls) in `tests/fixtures/bash-safety/corpus.tsv`, all RED-proven against the committed pre-fix hook (347→357 with the fix). Full `npm test` green.
+
 ## [0.48.0] - 2026-07-15
 
 **Minor — one-command plugin refresh: `/claudemd-refresh`.** Closes the update-UX gap: the upgrade banner used to teach a 4-command paste sequence; now it names one command. Detection (v0.4.0 `upstream_check`, 24h-throttled `git ls-remote`) and post-refresh spec/manifest sync (version-sync hook / SessionStart bootstrap) were already automatic — this release ships the missing middle step.

package/README.md

@@ -260,6 +260,8 @@ Manual fallback (e.g. the `claude` CLI is not on PATH):
 
 Or open the interactive UI via `/plugin` → **Installed** tab → select `claudemd` → follow upgrade prompts.
 
+> **Other open Claude Code windows:** run `/reload-plugins` in each of them too. A refresh removes the old versioned plugin-cache dir, but every already-running session pinned its hook paths to that dir at startup — those windows error on every hook event (claudemd enforcement is off there) until they reload or restart.
+
 After the plugin upgrade, sync the shipped spec into `~/.claude/`:
 
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.48.0",
+  "version": "0.48.1",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {