claudemd-cli 0.55.0 → 0.56.0

package/CHANGELOG.md

@@ -8,6 +8,24 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.56.0] - 2026-07-25
+
+Fix batch from the 2026-07-25 four-dimension audit (`docs/comprehensive-audit-2026-07-25-v0.55.0.md`, local-only per the docs/ gitignore convention). Ships spec **v6.22.0** (minor). Minor bump: the §8 curl-sh and rm-rf-var deny surfaces both widen (user-visible default behavior change).
+
+**What changes for users**: three §8 shapes that previously slipped now deny — a wrapper hiding a path-prefixed fetch or sink binary (`sudo /usr/bin/curl … | sh`, `curl … | sudo /bin/sh`), a `..` walk out of an mktemp-validated var (`rm -rf "$S/../../elsewhere"`), and provenance riding on a command that binds `IFS`. Escape hatches unchanged: `[allow-curl-sh]` / `[allow-rm-rf-var]` tokens, `DISABLE_PRE_BASH_SAFETY_HOOK=1`, or pin the plugin ≤0.55.0; the deny message carries all bypass paths at the moment of impact. Telemetry rows gain a `hook_version` field — consumers reading `~/.claude/logs/claudemd.jsonl` should treat it as optional (null on pre-0.56.0 rows).
+
+- **fix(§8): curl-sh gate missed the canon-after-strip its sibling gates have** (audit F1, the batch's only HIGH). `canon_cmd_words` runs globally at command position, but a transparent wrapper OCCUPIES that position — so `sudo /usr/bin/curl … | sh` reached the gate with the path prefix intact while the rm (`:626`) and npx (`:864`) gates, which re-canonicalize after `s8_strip_wrappers`, denied the identical shape. The curl-sh gate now does the same on the fetch side, and `CURLSH_SINKPFX` tolerates a backslash or a slash-terminated path on the sink word (the sink is regex-matched, not word-looped, so canon cannot reach it there). Both are monotonic — they expose tokens the shell EXECs, never hide one. Corpus 411 → 425 (+14: 8 RED, 3 rm/npx parity analogues, 3 FP guards); full-corpus differential vs the pre-fix hook: 8 allow→deny, 0 deny→allow. A segment lacking the literal `curl`/`wget` now short-circuits before the strip/canon/grep spawns — proven verdict-neutral over all 332 rows.
+- **fix(§8): four mktemp-provenance holes, all found by adversarial review of a change that was then reverted.** `rm -rf "$S/../../home/u/proj"` rode on `$S`'s provenance (provenance certifies where the var points, not where a `..` walk from it lands); `IFS=/` word-split an unquoted provenance target into relative paths deleted from the cwd; `S+=/../../etc` escaped the rebind guard because `canon_cmd_words` did not treat `+=` as an assignment and basenamed the whole word, erasing the bare-name mention the guard counts; `rm -rf "$S" "$EVIL"` passed because condition 3 scanned only the first positional. All four now deny; `S=$(mktemp -d); rm -rf "$S/build"` and the quoted `bak="$(mktemp …)"` idiom still allow.
+- **revert(§8): temp-root literal provenance, built and withdrawn the same day.** It was aimed at the batch's largest DX finding — 86% of §8-rm-rf-var denies (177/205 over 14d) are the agent cleaning its own scratch dirs, which §8.V4 mandates it do. Adversarial review broke it four ways in one pass, three sandbox-confirmed deleting real directories: backslash-escaped traversal (`D=/tmp/\.\./\.\./etc` — hook text ≠ runtime value), subshell / short-circuit / pipeline / background assignments that never bind the parent shell yet land at a "segment head", `..` residue, and `IFS` truncating the captured RHS to a prefix of the runtime value. Root cause is the one `tasks/specs/s8-literal-provenance.md` already records for the rejected v0.48.0 attempt: **text position is not command position, and a captured RHS that merely prefixes the runtime value proves nothing.** All 28 breaking commands ship as F21 `deny` corpus rows so a third attempt cannot pass silently. The friction stays open in `tasks/audit-2026-07-25-deferred.md` — the safe direction is making the harness emit mktemp-shaped scratch paths, not loosening the gate.
+- **fix(audit): the dashboard contradicted the calibration record it is built on.** `selfCompliance()` recomputed status from `precision >= 0.8` alone, so the six detectors 0.54.0 closed reported `collecting (rate withheld…)` — advertising exactly the "keep collecting" posture the 2026-07-24 labeling pass rejected. It now honors `ruleStatus()` / `closedReason` from `sampling-audit.js`; rate stays A4-withheld either way.
+- **feat(telemetry): `hook_version` on every rule-hits row.** The live log holds 242 `stale-root` events across 12 distinct version gaps (worst: 0.37.0 hooks vs 0.41.0 install, 145 prompts over 12.7h) — rows written by a stale registered hook dir were pooled indistinguishably with current ones, making their contribution to calibration unknowable rather than measured-small. Cached per process; null when the manifest is unreadable.
+- **fix(§10-V): unterminated fenced block diverged between the two engines.** `stripIdentifiers` blanked from an unterminated ``` to EOF while the bash hook — whose jq extraction flattens newlines, leaving its fence-awk inert — scanned the claim after it. A terminator guard (fence opens only if a closing fence exists later) restores parity in the HIT direction; same strict-AND-narrowing shape as the §8 heredoc guard, so blanked text is a subset of before. New multi-line parity fixture + a terminated-fence control.
+- **fix(§11-turn-yield): `YIELD_ASK_RE` read the bare `么` of 什么/怎么/这么 as a question particle**, so mid-work statements ("要处理什么边界情况") counted as asks and suppressed the tell. Negative lookbehind; true-ask control arms retained.
+- **spec v6.22.0** (minor): level/precedence seam closure — Iron Law #1 surfaces in core §7 at its true L2+ level (core's only pointer filed it under L3 while §2.2 forbids L2 loading extended); the §11 Tell's "closed" now includes a compliant L1 single-line `Done:` (the four-section-only definition made correct L1 closes self-diagnose as yields); §3's Order line ranks project `CLAUDE.md` explicitly, and §13's drift check states the delegation boundary instead of citing a rank §3 never held; §2's L0 row drops `config`, which contradicted the §0 Fast-Path whitelist and §5 hard-AUTH. Paired net-delete per §0.1 (C9 §9↔§1 double-write, C11 footer pointer dup, §1 `reasoning`): core 24715 → 24714B. §EXT §12 Fallback gains `gs:/document-release` + `/careful`. Two new joins pin the class: Iron Law #1 level-tag consistency (core mention ↔ extended heading) and §3-rank citation coverage.
+- **ci: shellcheck scope 24/53 → all 53 shell files** (audit L2). The excluded set held a live guard-defeating bug of exactly the class the gate exists for: `DISABLE_UPSTREAM_CHECK=1 OUT=$(… bash hook …)` creates a shell variable rather than exporting into the child. Fixed, plus two dead-variable warnings.
+- **test: version pins become dynamic consistency joins** (audit L3) — `spec-structure.test.js` asserted `6.21.2` under a test named `changelog top entry is v6.21.1`, and needed a hand edit every release. Now core ↔ extended ↔ `hard-rules.json` ↔ changelog must agree with each other; "did the release land" stays with `version-cascade-check.js` and the upgrade-lifecycle pin.
+- **docs**: `cross-project-pilot.md` records that `perf-baseline.sh` is hermetic since 0.55.0 (its `cd <pilot-project>` step is now a silent no-op, and `off_ms` is no longer comparable with pre-0.55.0 series); `OPERATOR.md` marks the subject-keyword fix-rate metric as broken as a treadmill gauge (it re-measures 15-20% where content classification puts fix-primary releases near 60-70% — release subjects stopped using the words); the 0.52.0 entry above notes its referenced audit file is a local-only working doc; `RULE-HITS-SCHEMA.md` documents `hook_version`.
+
 ## [0.55.0] - 2026-07-25
 
 Ships spec **v6.21.2** (patch) plus two hermeticity/observability fixes surfaced by the 2026-07-25 spec audit ("按建议执行" pass over the audit's P0-P3).
@@ -42,7 +60,7 @@ Ships spec **v6.21.0** (minor) plus the drift test that pins it. No hook, script
 
 ## [0.52.0] - 2026-07-24
 
-Fix batch from the 2026-07-24 production-readiness audit (`docs/2026-07-24-production-readiness-audit.md`) — items 1-3 and 5-10 of its action table, plus the restocked core net-delete candidate pool (C7-C12, item 4 core-side). Ships spec **v6.20.1** (patch). Minor bump: the curl-sh gate's deny surface widens (user-visible default behavior change).
+Fix batch from the 2026-07-24 production-readiness audit (`docs/2026-07-24-production-readiness-audit.md` — a local-only working file per the docs/ gitignore convention; not distributed, and no longer on disk as of 2026-07-25. The action-table items are restated below) — items 1-3 and 5-10 of its action table, plus the restocked core net-delete candidate pool (C7-C12, item 4 core-side). Ships spec **v6.20.1** (patch). Minor bump: the curl-sh gate's deny surface widens (user-visible default behavior change).
 
 **What changes for users**: wrapper-prefixed fetch-to-shell commands (`sudo curl … | sh`, `nohup curl … | bash`, `FOO=1 curl … | sh`, `timeout 5 curl … | sh`, `( sudo curl … | sh )`) previously slipped past the §8 curl-sh gate and now deny. Escape hatches unchanged: `[allow-curl-sh]` token or `DISABLE_PRE_BASH_SAFETY_HOOK=1`; prior behavior = pin plugin ≤0.51.1. The deny message carries the bypass paths at the moment of impact.
 

package/README.md

@@ -1,12 +1,12 @@
 # claudemd
 
-> A **personal AI-coding discipline harness**: one developer's opinionated **AI-CODING-SPEC v6.21**, encoded as Claude Code shell hooks and shipped with the plugin. Built and dogfooded on my own repos — fork and adapt, don't adopt wholesale.
+> A **personal AI-coding discipline harness**: one developer's opinionated **AI-CODING-SPEC v6.22**, encoded as Claude Code shell hooks and shipped with the plugin. Built and dogfooded on my own repos — fork and adapt, don't adopt wholesale.
 
 [![CI](https://github.com/sdsrss/claudemd/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/sdsrss/claudemd/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/claudemd-cli.svg)](https://www.npmjs.com/package/claudemd-cli)
 [![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-claudemd plugs into the Claude Code hook system to **block commits, pushes, and bash commands** that violate AI-CODING-SPEC v6.21 — banned vocabulary in commit messages, `rm -rf $VAR` without variable validation, ship-on-red-CI, unread `MEMORY.md` entries during release flows, and more. The spec itself (`CLAUDE.md` + `CLAUDE-extended.md` + `CLAUDE-changelog.md` + `OPERATOR.md`) ships with the plugin and installs into `~/.claude/`, so the rules Claude Code reads at session start match the rules the hooks enforce. (`OPERATOR.md` is the human-only spec-maintenance handbook — Agent-loaded files are the CLAUDE trio.)
+claudemd plugs into the Claude Code hook system to **block commits, pushes, and bash commands** that violate AI-CODING-SPEC v6.22 — banned vocabulary in commit messages, `rm -rf $VAR` without variable validation, ship-on-red-CI, unread `MEMORY.md` entries during release flows, and more. The spec itself (`CLAUDE.md` + `CLAUDE-extended.md` + `CLAUDE-changelog.md` + `OPERATOR.md`) ships with the plugin and installs into `~/.claude/`, so the rules Claude Code reads at session start match the rules the hooks enforce. (`OPERATOR.md` is the human-only spec-maintenance handbook — Agent-loaded files are the CLAUDE trio.)
 
 A standalone CLI (`npx claudemd-cli`) reuses the same `banned-vocab.patterns` source for git pre-commit hooks, GitHub Actions, and other agents that don't run inside Claude Code.
 
@@ -60,7 +60,7 @@ Verify in one command (Linux): `node --version && jq --version && gh --version &
 | 16 shell hooks | `banned-vocab-check` · `pre-bash-safety-check` · `ship-baseline-check` · `residue-audit` · `memory-read-check` · `memory-prompt-hint` · `mid-spine-yield-scan` · `sandbox-disposal-check` · `session-start-check` · `session-extended-read` · `session-summary` · `session-end-check` · `transcript-vocab-scan` · `transcript-structure-scan` · `version-sync` · `mem-audit` |
 | 16 slash commands | `/claudemd-install` · `/claudemd-status` · `/claudemd-update` · `/claudemd-refresh` · `/claudemd-audit` · `/claudemd-toggle` · `/claudemd-doctor` · `/claudemd-analyze` · `/claudemd-uninstall` · `/claudemd-rules` · `/claudemd-clean-residue` · `/claudemd-sparkline` · `/claudemd-sampling-audit` · `/claudemd-bypass-audit` · `/claudemd-design-adopt` · `/claudemd-statusline` |
 | 1 standalone CLI | `claudemd-cli lint` · `claudemd-cli audit` ([npm: `claudemd-cli`](https://www.npmjs.com/package/claudemd-cli)) |
-| Spec v6.21 | `~/.claude/CLAUDE.md` · `CLAUDE-extended.md` · `CLAUDE-changelog.md` · `OPERATOR.md` (backup-before-overwrite) |
+| Spec v6.22 | `~/.claude/CLAUDE.md` · `CLAUDE-extended.md` · `CLAUDE-changelog.md` · `OPERATOR.md` (backup-before-overwrite) |
 | StatusLine (opt-out) | PS1-style line — `user@host:dir (branch) Model [ctx:N% · 5h:N% · 7d:N%]` (`dir` = cwd basename; context / 5-hour quota / weekly quota, all **used %**, read from Claude Code's `rate_limits` payload; quota segments auto-hide when the data is absent, or force-hide with `DISABLE_STATUSLINE_QUOTA=1`) — wired into `~/.claude/settings.json` on install **only when the slot is empty**; an existing statusline is left untouched. Skip entirely with `CLAUDEMD_NO_STATUSLINE=1`. Manage via `/claudemd-statusline`. |
 
 Install backs up a hand-written `~/.claude/CLAUDE.md` (any file without the `# AI-CODING-SPEC` H1) to `~/.claude/backup-<ISO>/` before overwriting (last 5 kept automatically). An already-installed claudemd spec is overwritten **without** a backup — deliberate (v0.23.11): the sole backup is always your own content, so `restore` can never return a stale spec instead. Uninstall offers `keep / restore / delete`; `delete` requires an extra confirmation.
@@ -353,7 +353,7 @@ claudemd/
 ├── commands/                 # 16 slash-command markdown files
 ├── bin/                      # standalone CLI entrypoint (claudemd-lint.js → `npx claudemd-cli` on npmjs.org)
 ├── scripts/                  # 18 Node.js scripts + scripts/lib/ (single-source registry, lint, etc.)
-├── spec/                     # shipped v6.21.2 CLAUDE*.md trio + OPERATOR.md + hard-rules.json manifest
+├── spec/                     # shipped v6.22.0 CLAUDE*.md trio + OPERATOR.md + hard-rules.json manifest
 ├── tests/                    # hook shell tests + Node.js tests + integration + fixtures
 ├── docs/                     # ADDING-NEW-HOOK.md + RULE-HITS-SCHEMA.md + superpowers/
 └── .github/workflows/        # ci.yml (ubuntu+macOS × node 20) + npm-publish.yml (tag-triggered)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.55.0",
+  "version": "0.56.0",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {

package/scripts/lib/lint.js

@@ -92,13 +92,28 @@ function posixClassesToJs(regex) {
 // prose and bare-word claims (the real violations) stay intact and still match.
 export function stripIdentifiers(text) {
   if (!text) return text;
-  // 1. Fenced code blocks: line-based fence toggle, mirroring the bash awk
-  //    `/^[[:space:]]*```/{f=!f; next} !f` — drop the ``` marker lines AND the
-  //    body between them. An unterminated fence drops to EOF (in_fence stays on).
+  // 1. Fenced code blocks: line-based fence toggle with a TERMINATOR GUARD
+  //    (2026-07-25 audit): an opening ``` only starts a fence if a closing
+  //    fence line exists later — otherwise it is literal text and everything
+  //    after it stays scannable. Pre-fix an unterminated fence blanked to EOF,
+  //    silently under-counting relative to the live hook: the bash side
+  //    (transcript-vocab-scan.sh) flattens newlines during jq extraction, so
+  //    its fence-awk never fires and an unterminated-fence claim HITs there —
+  //    node=miss/bash=hit was the one divergence a 12-shape differential
+  //    found. Same strict-AND-narrowing shape as the §8 heredoc terminator
+  //    guard: blanked text is a subset of before, so this can only EXPOSE
+  //    more text to the detector, never hide a claim.
+  const lines = text.split('\n');
   const kept = [];
   let inFence = false;
-  for (const line of text.split('\n')) {
-    if (/^\s*```/.test(line)) { inFence = !inFence; continue; }
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (/^\s*```/.test(line)) {
+      if (inFence) { inFence = false; continue; }
+      if (lines.slice(i + 1).some(l => /^\s*```/.test(l))) { inFence = true; continue; }
+      kept.push(line);
+      continue;
+    }
     if (!inFence) kept.push(line);
   }
   return kept.join('\n')