claudemd-cli 0.50.0 → 0.51.1

package/CHANGELOG.md

@@ -8,6 +8,30 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.51.1] - 2026-07-17
+
+Fix release from the 2026-07-17 four-dimension audit (`docs/comprehensive-audit-2026-07-17-v0.51.0.md`): two latent-bug closures + one CI coverage hole. No spec change (spec stays **v6.20.0**). All three are `fix:` — restoring documented/intended behavior, not new rules.
+
+**What changes for users**: commands that hid the command word behind quotes (`"rm" -rf $X`, `r""m`, `curl … | "bash"`, `ba''sh`) previously slipped past all three §8 gates and now deny. Ordinary quoting (`-m "fix rm usage"`, `echo ""`, quoted `$VAR` targets) is unaffected — the original 283-row corpus re-verdicts byte-identically. Escape hatches unchanged: per-command `[allow-rm-rf-var]` / `[allow-npx-unpinned]` / `[allow-curl-sh]` tokens, or `DISABLE_PRE_BASH_SAFETY_HOOK=1`; prior behavior = pin plugin ≤0.51.0. The deny message itself carries these bypass paths, so affected users see the revert path at the moment of impact.
+
+- **fix(§8): quoted / intra-word-split command words bypassed all three gates** (2026-07-17 audit F1, pre-existing since the sanitize state machine — NOT a 0.51.0 regression). `sanitize_cmd` stripped quoted-string *contents*, so `"rm"` became `""` and `ba""sh` kept its empty pair — the basename compares and the curl-sh sink regex never matched, while bash execs them as `rm`/`bash`. The state machine now unwraps a terminated quote whose body is a simple literal word (`[A-Za-z0-9_./-]+` — what the shell execs after quote removal) and drops an *empty* pair only when glued to a word/quote char on either side; a standalone `echo ""` keeps its token-boundary marker. Closed shapes: `"rm"`/`'rm'`/`r""m`/`"""rm"""`/`rm '-rf'` (rm gate), `"npx"`/`n""px` (npx gate), `curl … | "bash"`/`ba""sh`/`ba''sh`/`'sh'` (curl-sh gate), plus combos with `${IFS}`, wrappers, `$( )`, and leading assignments. Documented residual (deliberate double-evasion, same bar as the heredoc note): quoted runner + indirect payload (`"bash" -c 'rm …'`).
+- **fix(telemetry): cwd encoder was byte-wise in bash, character-wise in JS.** `hook_encode_project` used `tr -c` (a CJK char → `---`) while `paths.js#encodeProjectCwd` and CC itself produce one `-` per character — every JS auditor mis-located `~/.claude/projects/<encoded>` for non-ASCII cwds (latent: all current repos are ASCII-pathed). Now a character-wise bash loop with an explicit ASCII set (no `[a-z]` ranges — locale collation can swallow accented letters), pinned by a new cross-language parity test (ARCH-2: CJK / accented / `+@space` / ASCII fixtures assert bash ≡ JS). Known residual: non-BMP (emoji) counts UTF-16 units in JS vs codepoints in bash.
+- **ci: node matrix [20] → [20, 22].** `memory-maintenance.js`'s real `node:sqlite` query path (Node ≥22.5) was CI-invisible — its test self-skips on 20, so a query/schema regression shipped green. 20 keeps covering the engines-floor degradation path.
+- **test(§8): curl-sh wrapper parity gate is now bidirectional** — new assertion S8_WRAP_ARGLESS ⊆ CURLSH_WRAP (the direction that actually prevents curl-sh FNs when a wrapper is added to the shared arrays; FLAGGED stays legitimately excluded).
+- **docs: ARCHITECTURE.md state-locations** gains the v0.50.0 `bootstrap-failed.json` sentinel line.
+- **Evidence**: corpus 366 → 382 (+11 deny RED, +5 FP-guard); original 283 rows differential = 0 verdict changes; live-hook FN matrix (F1 shapes × evasion-family combos) all deny, FP guards all allow; full `npm test` green; perf-baseline delta ≤5ms per probe; shellcheck clean.
+
+## [0.51.0] - 2026-07-15
+
+Third deferred item from the 2026-07-15 four-dimension audit: the §8 shared-tokenizer consolidation, scoped to the safe single-source subset. No spec change (spec stays **v6.20.0**). **Behaviour-preserving** — every deny/allow verdict is provably unchanged; this is a refactor of the enforcement plumbing, not a rule change.
+
+- **refactor(§8): single-source the rm/npx segment plumbing.** The wrapper name-set was spelled three times and the segment-splitter + wrapper-strip loop were hand-copied between the rm gate and the npx gate (the duplicated-seam class the audit flagged). Extracted into `hooks/lib`-adjacent helpers in the hook: `S8_WRAP_ARGLESS` / `S8_WRAP_FLAGGED` arrays + `s8_in_list`, `s8_split_segments`, and `s8_strip_wrappers` (the ~55-line assignment/exec-wrapper loop, now one copy). Adding a new wrapper is now a one-line array edit instead of a three-site change.
+- **Call-site order preserved per gate.** The rm gate strips wrappers *before* its `{`/`(` opener-strip; the npx gate strips *after* — an asymmetry that makes `{ env rm` a latent miss but `{ env npx` a catch. Both behaviours predate the refactor and are kept exactly; a naive unification would have silently moved a verdict.
+- **test(§8): curl-sh wrapper-set parity gate.** `CURLSH_WRAP` stays a literal regex (rebuilding it from the arrays would add `timeout` and flip `curl x | timeout bash` allow→deny) but a new test asserts its members ⊆ the shared arrays, so the regex and the arrays cannot drift.
+- **Deliberately NOT done**: folding curl-sh's cross-pipe sink detection into the segment/tokenizer model. curl-sh matches *across* a `|` while segments split *on* `|`; unifying it would require re-architecting the gate — the Turing-tarpit the audit explicitly warned against. Recorded as a permanent non-goal in `tasks/audit-2026-07-15-deferred.md`.
+- **Equivalence proof**: `tasks/s8-tokenizer/s8-diff-scan.sh` snapshots the pre-refactor deny/allow verdict for every corpus row (163 deny / 120 allow) and asserts 0 changes after each step; a fresh-context reviewer independently re-ran it against the real pre-refactor hook (git worktree) over 64 adversarial probes with 0 divergence.
+- **Tests**: hook suite 365 → 366 (+curl-sh parity); FN adversarial matrix (12 wrapper bypasses across all three gates) all deny; full `npm test` green; bash-3.2 gate + shellcheck clean; `node scripts/version-cascade-check.js` exit 0 (plugin semver 0.51.0 across 4 sites).
+
 ## [0.50.0] - 2026-07-15
 
 Two deferred items from the 2026-07-15 four-dimension audit (recorded in `tasks/audit-2026-07-15-deferred.md`). No spec change (spec stays **v6.20.0**). Minor bump: one additive user-visible behavior — a new SessionStart notice.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.50.0",
+  "version": "0.51.1",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {