claudemd-cli 0.62.0 → 0.62.2

package/CHANGELOG.md

@@ -8,6 +8,24 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.62.2] - 2026-07-27
+
+Second hotfix in the 0.62.0 chain, and the last one: the macOS leg went red on a construct the repo already had a gate for, because that gate could not see the file.
+
+- **fix: `trigger-view-parity.test.sh` used `mapfile`**, which is bash 4+. macOS ships `/bin/bash` 3.2 and the suite runs there, so the job died on `mapfile: command not found` → `CONSUMERS: unbound variable` (`feedback_macos_shell_portability`). Replaced with a `while IFS= read -r` loop, and both `"${CONSUMERS[@]}"` expansions now use the `${arr[@]+…}` form that is `set -u`-safe on bash < 4.4 — the same guard 0.62.0 applied to `rule-hits.test.sh`.
+- **fix: the bash-3.2 construct gate is one script, called from two places.** It lived inline in `ci.yml` and scanned `hooks/` only, so a test suite was outside its scope; and being CI-only, `npm test` could not surface the class — the identical gap 0.62.1 closed for shellcheck, one layer over. `tests/lib/bash32-constructs.sh` now holds the pattern and the scope (hooks + every test suite that runs under `/bin/bash`), and both `ci.yml` and `tests/run-all.sh` call it. Copying the block into the runner would have made it a hand-copied mirror — the drift shape this whole release chain is about.
+- The scanner's two bare-word alternatives are spliced from fragments so the pattern line does not match itself; a detector whose definition site is its own first finding trains everyone to ignore it (`feedback_self_referential_marker_regex`). Verified with four controls: `mapfile`, `declare -A`, `${x^^}` all flagged, a plain script clean, and the scanner reports itself clean.
+
+**What the chain cost, stated plainly:** 0.62.0 shipped with a red ci (shellcheck) and published to npm anyway, because the publish gate ran a suite that never invoked shellcheck. Both hotfixes are the same defect as the release they patch — a gate whose scope did not cover the thing it was written to catch.
+
+## [0.62.1] - 2026-07-27
+
+Hotfix for a red CI on the 0.62.0 tag. No hook, script, or spec behavior changes beyond the lint directive.
+
+- **fix: `HOOK_USER_TURN_JQ` carries a `# shellcheck disable=SC2034` directive.** The constant is consumed by the two hooks that source `hook-common.sh`, which shellcheck cannot see when it lints the library in isolation; its sibling `HOOK_HEREDOC_AWK` escapes the same warning only because it also has an in-file consumer. CI gates shellcheck at warning+, so the 0.62.0 tag went red.
+- **fix: `tests/run-all.sh` runs shellcheck.** This is the reason the failure reached a tag at all. The pre-ship runbook's "npm test green locally" step could not surface a class CI blocks — and worse, `npm-publish.yml` **installs shellcheck as a test prereq and then runs `tests/run-all.sh`**, which never invoked it, so the npm channel's `needs: test` gate was weaker than ci.yml's and 0.62.0 published on a red-at-ci commit. Both channels now run the same check.
+- Scope is every TRACKED `.sh` (52 files), a deliberate superset of `ci.yml`'s explicit list rather than a hand-copied mirror of it — mirrors are the drift shape 0.62.0 exists to fix. Absent shellcheck is a loud SKIP, not a silent pass.
+
 ## [0.62.0] - 2026-07-27
 
 The 2026-07-27 four-dimension audit's fix batch (report: `docs/comprehensive-audit-2026-07-27-v0.61.0.md`). Ships spec v6.24.1.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.62.0",
+  "version": "0.62.2",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {