claudemd-cli 0.71.3 → 0.71.4

package/README.md

@@ -371,7 +371,7 @@ claudemd/
 │   └── hooks.json            # authoritative hook registration (v0.1.5+); CC expands ${CLAUDE_PLUGIN_ROOT} here
 ├── commands/                 # 16 slash-command markdown files
 ├── bin/                      # standalone CLI entrypoint (claudemd-lint.js → `npx claudemd-cli` on npmjs.org)
-├── scripts/                  # 18 Node.js scripts + scripts/lib/ (single-source registry, lint, etc.)
+├── scripts/                  # 19 Node.js scripts + scripts/lib/ (single-source registry, lint, etc.)
 ├── spec/                     # shipped v6.25.4 CLAUDE*.md trio + OPERATOR.md + hard-rules.json manifest
 ├── tests/                    # hook shell tests + Node.js tests + integration + fixtures
 ├── docs/                     # ADDING-NEW-HOOK.md + RULE-HITS-SCHEMA.md + superpowers/

package/bin/claudemd-lint.js

@@ -361,7 +361,13 @@ function lintCmd(rawArgs) {
   // ... digit) OR the literal word `baseline`, ratio-class patterns (tagged
   // `@ratio` in their reason column) are suppressed. Non-ratio hedges /
   // adjectives still match.
-  const HAS_NUMERIC_ARROW = /\d\S*\s*(?:→|->|=>)\s*\d/;
+  // `\S{0,64}`, not `\S*` (2026-09-02 audit R11-12): with an unbounded run and
+  // no arrow present, the unanchored scan retries from every offset and
+  // rescans the tail — quadratic, 710ms on a 20k digit run, and this runs on
+  // the RAW file before scan(), so lint.js:150-157's sanitizer fix for the same
+  // family never covered it. A digit-dense lockfile or hash dump hung the
+  // pre-commit hook. 64 is far past any real anchor (`p99 580ms→140ms` is 15).
+  const HAS_NUMERIC_ARROW = /\d\S{0,64}\s*(?:→|->|=>)\s*\d/;
   const HAS_BASELINE = /baseline/i;
   const baselineExempt = HAS_NUMERIC_ARROW.test(text) || HAS_BASELINE.test(text);
 
@@ -405,7 +411,17 @@ function auditCmd(rawArgs) {
     process.exit(2);
   }
 
-  const jsonl = fs.readFileSync(transcriptPath, 'utf8');
+  // Mirrors the `lint --file` read path above (R11-11). The existsSync/statSync
+  // guards a few lines up both PASS on a mode-000 file, so an unreadable
+  // transcript reached this line and exited 1 with a V8 stack — colliding with
+  // the documented `1 = hits found`, which is what CI and pre-commit gate on.
+  let jsonl;
+  try {
+    jsonl = fs.readFileSync(transcriptPath, 'utf8');
+  } catch (e) {
+    process.stderr.write(`audit: failed to read ${transcriptPath}: ${e.message}\n`);
+    process.exit(2);
+  }
 
   // Silent-success guard: parseTranscript intentionally skips unparseable rows
   // (matches transcript-vocab-scan.sh). But if the WHOLE file fails to parse

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.71.3",
+  "version": "0.71.4",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {
@@ -26,10 +26,27 @@
     "test:scripts": "bash -c 'source tests/lib/env-hygiene.sh && claudemd_reset_test_env && node --test tests/scripts/*.test.js'",
     "test:hooks": "for t in tests/hooks/*.test.sh; do bash \"$t\" || exit 1; done",
     "lint:argv": "node scripts/lint-argv.js",
-    "version-check": "node scripts/version-cascade-check.js"
+    "version-check": "node scripts/version-cascade-check.js",
+    "test:coverage": "c8 --all --src=bin --src=scripts --include='bin/**/*.js' --include='scripts/**/*.js' --reporter=text-summary --reporter=html --reports-dir=coverage npm run test:scripts",
+    "lint": "npm run lint:argv && npm run version-check && npm run lint:sh && npm run lint:js",
+    "lint:sh": "F=$(bash tests/lib/shell-files.sh) && shellcheck --severity=warning $F",
+    "lint:js": "eslint bin scripts tests eslint.config.js",
+    "format": "prettier --write bin scripts tests eslint.config.js",
+    "format:check": "prettier --check bin scripts tests eslint.config.js",
+    "metrics": "node scripts/baseline-metrics.js",
+    "check": "npm run lint && npm test"
   },
   "engines": {
     "node": ">=20"
   },
-  "license": "MIT"
+  "license": "MIT",
+  "devDependencies": {
+    "@eslint/js": "10.0.1",
+    "acorn": "8.18.0",
+    "c8": "12.0.0",
+    "eslint": "10.9.1",
+    "globals": "17.12.0",
+    "jscpd": "5.1.1",
+    "prettier": "3.9.6"
+  }
 }