claudemd-cli 0.9.25 → 0.9.27

package/CHANGELOG.md

@@ -8,6 +8,55 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.9.27] - 2026-05-11
+
+**Patch — new SessionEnd hook `session-end-check.sh` mechanizes core §11 "Session-exit mid-SPINE" HARD self-rule.** First feature shipping under the v6.11.10 §9 Parallel-path HARD regime. Spec unchanged — purely plugin-side enforcement. Hook count 12 → 13. Default ON (Stop hook of comparable plumbing already at default-ON; this hook only writes a `tasks/<slug>-paused.md` checkpoint and stderr warn — never blocks exit).
+
+### Added
+
+- `[feat]` **`hooks/session-end-check.sh` (SessionEnd, timeout 3s)** — at session termination, scans the transcript JSONL for mutation tool_use entries (Edit / Write / NotebookEdit) since the last user-input message and counts VALIDATE signals (Bash matching `node --test|pytest|jest|vitest|npm test|go test|cargo test|bash tests/|tsc|eslint|ruff|clippy|shellcheck|git commit|git push`). If `mutations > 0 AND validates == 0` → writes `<cwd>/tasks/session-end-<short-id>-paused.md` with the last 3 mutation tool calls + suggested verify command, stderrs a one-line `[claudemd] mid-SPINE session-exit: N unvalidated mutation(s)` warn, and appends a `warn` row to rule-hits.jsonl tagged `§11-session-exit`. Single jq pass over `tail -n 200` of transcript. Fail-open + kill-switch `DISABLE_SESSION_END_CHECK_HOOK=1`.
+
+### Tests
+
+- `[test]` **`tests/hooks/session-end-check.test.sh` (new, 9 cases)**: clean exit (Edit + test-runner), mid-SPINE Edit-only, Edit + git commit (commit validates), Write-only, Read-only no-warn, Edit + git push (push validates), kill-switch, missing transcript fail-open, rule-hits row written.
+
+### Changed
+
+- `[change]` **`scripts/lib/hook-registry.js`** — registry length 12 → 13; new entry `session-end-check` (SessionEnd, matcher `*`, timeout 3s, env-var-suffix `SESSION_END_CHECK`).
+- `[change]` **`hooks/hooks.json`** — new `SessionEnd` event with the new hook.
+- `[change]` **`commands/claudemd-toggle.md`** — display-name list adds `session-end-check`.
+- `[change]` **`README.md`** — hook count 12 → 13 in plugin-at-a-glance table; added `DISABLE_SESSION_END_CHECK_HOOK=1` to per-hook kill-switch list.
+- `[change]` **`tests/scripts/hook-registry.test.js`** — `HOOK_REGISTRY.length` pin 12 → 13.
+- `[change]` **`tests/integration/full-lifecycle.test.sh`** — manifest entry-count pin 12 → 13; settings.json residue regex adds `session-end-check`.
+- `[change]` **`tests/scripts/install.test.js`** — `manifest.entries.length` pin 12 → 13.
+
+### Why now (cadence rationale)
+
+T1c was deferred from v0.9.26 ship per the (3) → (1) path so that v6.11.10's §9 Parallel-path HARD promotion stayed clean of mechanical-enforcement scope creep. v0.9.27 ships T1c as a single-concern feat: one new hook, one new test file, three single-source-of-truth registrations + count-pin updates. Independent ship per `feedback_claudemd_ship_from_main_atomic.md` atomic convention.
+
+## [0.9.26] - 2026-05-10
+
+**Patch — spec v6.11.9 → v6.11.10. First batch-review-driven HARD promotion since v6.10.2 (2026-04-23).** §9 Parallel-path completeness elevated SHOULD → HARD after `tasks/rule-candidates-2026-04.md` 2026-05-10 batch review confirmed both promotion conditions met. New §EXT SHOULD section documenting macOS CI shell portability (3 lessons.md repros). Plugin-side: hard-rules.json gets 13th core entry; spec content + version-pin + manifest-sync only — no hook / runtime behavior change. §13.2 budget cost: 1 new HARD; 20-task counter resets to 0.
+
+### Changed
+
+- `[change]` **Spec §9 Parallel-path completeness: SHOULD → HARD L2+** — promotion saves 89 bytes by dropping the trailing `(SHOULD now; §13.2 candidate for HARD promotion)` clause. Repros: code-graph-mcp ast_search SQL `ORDER BY` + `LIMIT` truncation, lang_config default-arm always-false dispatch, dead-code `--json` empty-result silent skip, mem v2.49 CJK FTS-vs-LIKE sibling miss. Self-enforced (no per-language-AST mechanical detection feasible at hook layer).
+- `[change]` **Spec §11-EXT macOS CI shell portability (SHOULD)** — new section codifying the implementation contract behind `hooks/lib/platform.sh` + `feedback_macos_shell_portability.md` + `feedback_hook_platform_lib_source.md` memories. Five recurring traps: `stat`/`find -newer` wrapper sourcing, `timeout` GNU-coreutils, BSD `wc -l` padding, `mktemp -d` `/var→/private/var` symlink, post-`git add` `chmod +x` mode preservation.
+
+### hard-rules.json
+
+- `[add]` **13th core HARD entry**: `§9-parallel-path`, `enforcement: "self"`, `confidence: "high"`. HARD tally: 13 core + 4 §EXT-side.
+
+### Tests
+
+- `[test]` `tests/scripts/spec-structure.test.js`, `tests/scripts/spec-hash.test.js`, `tests/integration/upgrade-lifecycle.test.sh` version-pin updated v6.11.9 → v6.11.10.
+
+### Sizing
+
+- core 24643 → 24550 bytes (−93, −0.38% — promotion is a wording change, dropping the trailing candidate clause net-deletes).
+- extended 47747 → 48815 bytes (+1068, +2.24% — new §11-EXT macOS section adds ~870 bytes, Recent-changes turnover net-deletes ~150 bytes).
+- core 24550/25000 (450 bytes headroom, 98.20% — improved from v6.11.9); extended 48815/50000 (1185 bytes headroom, 97.63% — tightened from v6.11.9). v6.11.11 net-delete or migrate preferred.
+
 ## [0.9.25] - 2026-05-10
 
 **Patch — spec v6.11.8 → v6.11.9 fresh-agent-adherence release.** Three reader-side ambiguities surfaced in a second dogfood pass simulating "first time touching this spec, strict-literal execution"; v6.11.8 carry-forward `MUST net-delete or migrate marginal core bullets` honored via two §EXT migrations. Plugin-side: spec content + version-pin + manifest-sync only — no hook / script / runtime behavior change.

package/README.md

@@ -58,10 +58,10 @@ Verify in one command (Linux): `node --version && jq --version && gh --version &
 
 | Layer | Contents |
 |---|---|
-| 12 shell hooks | `banned-vocab-check` · `pre-bash-safety-check` · `ship-baseline-check` · `residue-audit` · `memory-read-check` · `sandbox-disposal-check` · `session-start-check` · `session-summary` · `transcript-vocab-scan` · `transcript-structure-scan` · `version-sync` · `mem-audit` |
+| 13 shell hooks | `banned-vocab-check` · `pre-bash-safety-check` · `ship-baseline-check` · `residue-audit` · `memory-read-check` · `sandbox-disposal-check` · `session-start-check` · `session-summary` · `session-end-check` · `transcript-vocab-scan` · `transcript-structure-scan` · `version-sync` · `mem-audit` |
 | 9 slash commands | `/claudemd-status` · `/claudemd-update` · `/claudemd-audit` · `/claudemd-toggle` · `/claudemd-doctor` · `/claudemd-uninstall` · `/claudemd-rules` · `/claudemd-clean-residue` · `/claudemd-sparkline` |
 | 1 standalone CLI | `claudemd-cli lint` · `claudemd-cli audit` ([npm: `claudemd-cli`](https://www.npmjs.com/package/claudemd-cli)) |
-| Spec v6.11.9 | `~/.claude/CLAUDE.md` · `CLAUDE-extended.md` · `CLAUDE-changelog.md` (backup-before-overwrite) |
+| Spec v6.11.10 | `~/.claude/CLAUDE.md` · `CLAUDE-extended.md` · `CLAUDE-changelog.md` (backup-before-overwrite) |
 
 Install moves any existing `~/.claude/CLAUDE*.md` to `~/.claude/backup-<ISO>/` (last 5 kept automatically). Uninstall offers `keep / restore / delete`; `delete` requires an extra confirmation.
 
@@ -176,6 +176,7 @@ export DISABLE_USER_PROMPT_SUBMIT_HOOK=1         # version-sync (mid-session upg
 export DISABLE_TRANSCRIPT_VOCAB_SCAN_HOOK=1      # PostToolUse §10-V advisory scan
 export DISABLE_TRANSCRIPT_STRUCTURE_SCAN_HOOK=1  # v0.9.10+ — Stop §10 four-section advisory
 export DISABLE_MEM_AUDIT_HOOK=1                  # v0.9.4+ — Stop Why:-less citation advisory
+export DISABLE_SESSION_END_CHECK_HOOK=1          # v0.9.27+ — SessionEnd §11-session-exit mid-SPINE check
 ```
 
 **2a. Per-sub-feature** (v0.4.0+). Sub-flags inside an enabled hook, named without the `_HOOK` suffix:
@@ -302,7 +303,7 @@ claudemd/
 ├── commands/                 # 9 slash-command markdown files
 ├── bin/                      # standalone CLI entrypoint (claudemd-lint.js → `npx claudemd-cli` on npmjs.org)
 ├── scripts/                  # 10 Node.js management scripts + scripts/lib/ (single-source registry, lint, etc.)
-├── spec/                     # shipped v6.11.9 CLAUDE*.md trio + hard-rules.json manifest
+├── spec/                     # shipped v6.11.10 CLAUDE*.md trio + hard-rules.json manifest
 ├── tests/                    # hook shell tests + Node.js tests + integration + fixtures
 ├── docs/                     # ADDING-NEW-HOOK.md + RULE-HITS-SCHEMA.md + superpowers/
 └── .github/workflows/        # ci.yml (ubuntu+macOS × node 20) + npm-publish.yml (tag-triggered)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.9.25",
+  "version": "0.9.27",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {