claudemd-cli 0.49.1 → 0.51.0

package/CHANGELOG.md

@@ -8,6 +8,28 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.51.0] - 2026-07-15
+
+Third deferred item from the 2026-07-15 four-dimension audit: the §8 shared-tokenizer consolidation, scoped to the safe single-source subset. No spec change (spec stays **v6.20.0**). **Behaviour-preserving** — every deny/allow verdict is provably unchanged; this is a refactor of the enforcement plumbing, not a rule change.
+
+- **refactor(§8): single-source the rm/npx segment plumbing.** The wrapper name-set was spelled three times and the segment-splitter + wrapper-strip loop were hand-copied between the rm gate and the npx gate (the duplicated-seam class the audit flagged). Extracted into `hooks/lib`-adjacent helpers in the hook: `S8_WRAP_ARGLESS` / `S8_WRAP_FLAGGED` arrays + `s8_in_list`, `s8_split_segments`, and `s8_strip_wrappers` (the ~55-line assignment/exec-wrapper loop, now one copy). Adding a new wrapper is now a one-line array edit instead of a three-site change.
+- **Call-site order preserved per gate.** The rm gate strips wrappers *before* its `{`/`(` opener-strip; the npx gate strips *after* — an asymmetry that makes `{ env rm` a latent miss but `{ env npx` a catch. Both behaviours predate the refactor and are kept exactly; a naive unification would have silently moved a verdict.
+- **test(§8): curl-sh wrapper-set parity gate.** `CURLSH_WRAP` stays a literal regex (rebuilding it from the arrays would add `timeout` and flip `curl x | timeout bash` allow→deny) but a new test asserts its members ⊆ the shared arrays, so the regex and the arrays cannot drift.
+- **Deliberately NOT done**: folding curl-sh's cross-pipe sink detection into the segment/tokenizer model. curl-sh matches *across* a `|` while segments split *on* `|`; unifying it would require re-architecting the gate — the Turing-tarpit the audit explicitly warned against. Recorded as a permanent non-goal in `tasks/audit-2026-07-15-deferred.md`.
+- **Equivalence proof**: `tasks/s8-tokenizer/s8-diff-scan.sh` snapshots the pre-refactor deny/allow verdict for every corpus row (163 deny / 120 allow) and asserts 0 changes after each step; a fresh-context reviewer independently re-ran it against the real pre-refactor hook (git worktree) over 64 adversarial probes with 0 divergence.
+- **Tests**: hook suite 365 → 366 (+curl-sh parity); FN adversarial matrix (12 wrapper bypasses across all three gates) all deny; full `npm test` green; bash-3.2 gate + shellcheck clean; `node scripts/version-cascade-check.js` exit 0 (plugin semver 0.51.0 across 4 sites).
+
+## [0.50.0] - 2026-07-15
+
+Two deferred items from the 2026-07-15 four-dimension audit (recorded in `tasks/audit-2026-07-15-deferred.md`). No spec change (spec stays **v6.20.0**). Minor bump: one additive user-visible behavior — a new SessionStart notice.
+
+**What changes for users**: when a background `install.js` upgrade fails (non-zero exit or 10s timeout), the NEXT session now shows a one-line `[claudemd] background upgrade failed …` notice instead of failing silently into `~/.claude/logs/claudemd-bootstrap.log` only. No action needed on upgrade; opt out with `export DISABLE_BOOTSTRAP_FAIL_BANNER=1`.
+
+- **feat: in-session banner for background install failures.** Both background `install.js` runners (SessionStart bootstrap + UserPromptSubmit piggy-back) now record failures to a sentinel (`~/.claude/.claudemd-state/bootstrap-failed.json`); the next SessionStart banners it once (sentinel consumed via rename; a repeat failure re-arms it) and retries. A versions-match session clears a stale sentinel silently — no banner over healthy state. Emitted on the mismatch / no-manifest paths only, where the hook writes no other stdout object, so the single-JSON-object contract holds. New rule-hits event `bootstrap-fail-banner` (registered in `docs/RULE-HITS-SCHEMA.md`).
+- **refactor: single-source the background install spawn.** The two hand-copied detached-spawn blocks (session-start-check.sh / version-sync.sh) — the same duplicated-seam class as the 0.49.1 findings — consolidated into `hook_spawn_install` in `hooks/lib/hook-common.sh` (10s ceiling, detached, log-append, sentinel write/clear).
+- **ci: tag pushes now run the full test matrix.** `ci.yml` previously triggered only on push-to-main + PR, so the marketplace channel (which serves the git tag/release directly) had no tag-time check — only the npm channel was gated (`npm-publish.yml`, Linux-only). Tags matching `v*.*.*` now run the full ubuntu+macos matrix; the atomic ship's main-push + tag-push duplicate run on the same commit is the accepted cost for channel parity.
+- **Tests**: session-start.test.sh 18 → 22 cases (failure-sentinel write, single-object banner emit + consume, match-path stale-sentinel cleanup, `DISABLE_BOOTSTRAP_FAIL_BANNER=1` suppression); version-sync.test.sh 8 → 9 (piggy-back failure writes sentinel). Failure injection via a PATH-prepended fake `node` shim.
+
 ## [0.49.1] - 2026-07-15
 
 Audit follow-up (2026-07-15 four-dimension review): three duplicated seams consolidated to a single source with a parity gate. No spec change (spec stays **v6.20.0**); all `fix:`/refactor, no user-facing feature.

package/README.md

@@ -204,6 +204,12 @@ export DISABLE_COMPACT_REREAD_REMINDER=1   # v0.27.0+ — only the post-compacti
                                            # source=="compact"); compact events still
                                            # skip bootstrap/upgrade-banner either way.
 
+export DISABLE_BOOTSTRAP_FAIL_BANNER=1     # v0.50.0+ — only the SessionStart banner
+                                           # reporting that a PRIOR session's background
+                                           # install.js upgrade failed; the failure
+                                           # sentinel + bootstrap.log trail keep being
+                                           # written so the state stays diagnosable.
+
 export DISABLE_BATCH_CADENCE_ADVISORY=1    # v0.19.2+ — only the §13.2 batch-review
                                            # cadence advisory inside session-end-check;
                                            # mid-SPINE warn-on-unvalidated-mutation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.49.1",
+  "version": "0.51.0",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {