claudemd-cli 0.9.26 → 0.9.28

package/CHANGELOG.md

@@ -8,6 +8,70 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.9.28] - 2026-05-11
+
+**Patch — spec v6.11.10 → v6.11.11. Hook fix for §11 MEMORY.md read-the-file FP rate (~80% in v0.9.27 self-audit) + spec §11-EXT Tag-specificity SHOULD codifying the complementary authoring discipline.** Two mechanical hook fixes (word-boundary tag match + multi-line trigger collapse) eliminate the 2 substring/anchor FP classes; spec SHOULD addresses the 3rd class (generic exact-word tags) as authoring discipline.
+
+### Fixed
+
+- `[fix]` **`hooks/memory-read-check.sh` word-boundary tag match** — replaces `grep -iF` (literal substring match, no boundaries) with `grep -iE -- "(^|[^a-zA-Z0-9])${ESC_TAG}[a-zA-Z]{0,2}($|[^a-zA-Z0-9])"`. Anchors on non-word-char boundaries; allows 0-2 trailing alpha chars so plurals/declensions still match (`hook` → `hooks` / `hooked`). Tag escaping handles regex meta chars. Eliminates the `cli ⊂ clippy` substring class (FP #5b in v0.9.27 self-audit).
+- `[fix]` **`hooks/memory-read-check.sh` multi-line trigger collapse** — `tr '\n' ' '` before applying TRIGGER_RE so the `^` anchor only matches actual start-of-command, not start-of-each-heredoc-body-line. Eliminates the `git commit -m "$(cat <<EOF\nrelease(v0.9.27): ...\nEOF\n)"` false-trigger class (FP #1, FP #4 in v0.9.27 self-audit).
+
+### Spec changes
+
+- `[change]` **Spec §11-EXT Tag-specificity (SHOULD, v6.11.11)** — tags SHOULD be ≥4 chars AND specific to the memory's topic; generic single-word English tags substring-match incidental occurrences and produce high FP rates. Prefer multi-word phrases. Plugin-side complement to the hook word-boundary fix.
+
+### Tests
+
+- `[test]` **4 new test cases** in `tests/hooks/memory-read-check.test.sh` (Cases 20-23):
+  - Case 20: `cli` tag does NOT substring-match `clippy` (word-boundary)
+  - Case 21: `hook` tag still matches `hooks` plural (declension tolerance)
+  - Case 22: heredoc-body `release(...)` line does NOT trigger (multi-line collapse)
+  - Case 23: regex-meta tag (`v6.9`) escaped — does not match `v6X9`
+- 23/23 passing (was 19/19 pre-fix).
+
+### Operator-side companion (NOT shipped via `/claudemd-update`)
+
+- `[chore]` **`~/.claude/projects/<encoded>/memory/MEMORY.md` tag cleanup** — dropped 12 generic single-word tags across 11 entries; promoted 6 generic tags to multi-word specific phrases. Examples: `[hook, plugin-root, expansion]` → `[plugin-root, hook-expansion]`; `[test, fixture, tdd]` → `[test-fixture, fixture-drift, tdd]`; `[cli, lint, audit, positional, file-flag, ...]` → `[cli-positional, file-flag, silent-success, footgun, sibling-symmetry]`. This is user-global state — operator-managed, version-controlled by user, not shipped through `/claudemd-update`.
+
+### Self-audit grounding
+
+`/claudemd-audit` over the v0.9.27 release session showed 5 hook trips:
+- 1 true positive (`macos` tag → memory IS about macOS shell portability — relevant)
+- 4 false positives — 2 substring-class (mechanical, fixed by hook), 2 multi-line-anchor-class (mechanical, fixed by hook), 1 generic-exact-word-class (authoring discipline, addressed by spec SHOULD + MEMORY.md cleanup)
+
+### Sizing
+
+- core 24550 → 24550 bytes (header bump only).
+- extended 48815 → ~49850 bytes (+1035, new SHOULD section).
+- core 450 bytes headroom (98.20%); extended ~150 bytes headroom (**~99.7% — at-ceiling, v6.11.12 MUST net-delete**).
+
+## [0.9.27] - 2026-05-11
+
+**Patch — new SessionEnd hook `session-end-check.sh` mechanizes core §11 "Session-exit mid-SPINE" HARD self-rule.** First feature shipping under the v6.11.10 §9 Parallel-path HARD regime. Spec unchanged — purely plugin-side enforcement. Hook count 12 → 13. Default ON (Stop hook of comparable plumbing already at default-ON; this hook only writes a `tasks/<slug>-paused.md` checkpoint and stderr warn — never blocks exit).
+
+### Added
+
+- `[feat]` **`hooks/session-end-check.sh` (SessionEnd, timeout 3s)** — at session termination, scans the transcript JSONL for mutation tool_use entries (Edit / Write / NotebookEdit) since the last user-input message and counts VALIDATE signals (Bash matching `node --test|pytest|jest|vitest|npm test|go test|cargo test|bash tests/|tsc|eslint|ruff|clippy|shellcheck|git commit|git push`). If `mutations > 0 AND validates == 0` → writes `<cwd>/tasks/session-end-<short-id>-paused.md` with the last 3 mutation tool calls + suggested verify command, stderrs a one-line `[claudemd] mid-SPINE session-exit: N unvalidated mutation(s)` warn, and appends a `warn` row to rule-hits.jsonl tagged `§11-session-exit`. Single jq pass over `tail -n 200` of transcript. Fail-open + kill-switch `DISABLE_SESSION_END_CHECK_HOOK=1`.
+
+### Tests
+
+- `[test]` **`tests/hooks/session-end-check.test.sh` (new, 9 cases)**: clean exit (Edit + test-runner), mid-SPINE Edit-only, Edit + git commit (commit validates), Write-only, Read-only no-warn, Edit + git push (push validates), kill-switch, missing transcript fail-open, rule-hits row written.
+
+### Changed
+
+- `[change]` **`scripts/lib/hook-registry.js`** — registry length 12 → 13; new entry `session-end-check` (SessionEnd, matcher `*`, timeout 3s, env-var-suffix `SESSION_END_CHECK`).
+- `[change]` **`hooks/hooks.json`** — new `SessionEnd` event with the new hook.
+- `[change]` **`commands/claudemd-toggle.md`** — display-name list adds `session-end-check`.
+- `[change]` **`README.md`** — hook count 12 → 13 in plugin-at-a-glance table; added `DISABLE_SESSION_END_CHECK_HOOK=1` to per-hook kill-switch list.
+- `[change]` **`tests/scripts/hook-registry.test.js`** — `HOOK_REGISTRY.length` pin 12 → 13.
+- `[change]` **`tests/integration/full-lifecycle.test.sh`** — manifest entry-count pin 12 → 13; settings.json residue regex adds `session-end-check`.
+- `[change]` **`tests/scripts/install.test.js`** — `manifest.entries.length` pin 12 → 13.
+
+### Why now (cadence rationale)
+
+T1c was deferred from v0.9.26 ship per the (3) → (1) path so that v6.11.10's §9 Parallel-path HARD promotion stayed clean of mechanical-enforcement scope creep. v0.9.27 ships T1c as a single-concern feat: one new hook, one new test file, three single-source-of-truth registrations + count-pin updates. Independent ship per `feedback_claudemd_ship_from_main_atomic.md` atomic convention.
+
 ## [0.9.26] - 2026-05-10
 
 **Patch — spec v6.11.9 → v6.11.10. First batch-review-driven HARD promotion since v6.10.2 (2026-04-23).** §9 Parallel-path completeness elevated SHOULD → HARD after `tasks/rule-candidates-2026-04.md` 2026-05-10 batch review confirmed both promotion conditions met. New §EXT SHOULD section documenting macOS CI shell portability (3 lessons.md repros). Plugin-side: hard-rules.json gets 13th core entry; spec content + version-pin + manifest-sync only — no hook / runtime behavior change. §13.2 budget cost: 1 new HARD; 20-task counter resets to 0.

package/README.md

@@ -58,10 +58,10 @@ Verify in one command (Linux): `node --version && jq --version && gh --version &
 
 | Layer | Contents |
 |---|---|
-| 12 shell hooks | `banned-vocab-check` · `pre-bash-safety-check` · `ship-baseline-check` · `residue-audit` · `memory-read-check` · `sandbox-disposal-check` · `session-start-check` · `session-summary` · `transcript-vocab-scan` · `transcript-structure-scan` · `version-sync` · `mem-audit` |
+| 13 shell hooks | `banned-vocab-check` · `pre-bash-safety-check` · `ship-baseline-check` · `residue-audit` · `memory-read-check` · `sandbox-disposal-check` · `session-start-check` · `session-summary` · `session-end-check` · `transcript-vocab-scan` · `transcript-structure-scan` · `version-sync` · `mem-audit` |
 | 9 slash commands | `/claudemd-status` · `/claudemd-update` · `/claudemd-audit` · `/claudemd-toggle` · `/claudemd-doctor` · `/claudemd-uninstall` · `/claudemd-rules` · `/claudemd-clean-residue` · `/claudemd-sparkline` |
 | 1 standalone CLI | `claudemd-cli lint` · `claudemd-cli audit` ([npm: `claudemd-cli`](https://www.npmjs.com/package/claudemd-cli)) |
-| Spec v6.11.10 | `~/.claude/CLAUDE.md` · `CLAUDE-extended.md` · `CLAUDE-changelog.md` (backup-before-overwrite) |
+| Spec v6.11.11 | `~/.claude/CLAUDE.md` · `CLAUDE-extended.md` · `CLAUDE-changelog.md` (backup-before-overwrite) |
 
 Install moves any existing `~/.claude/CLAUDE*.md` to `~/.claude/backup-<ISO>/` (last 5 kept automatically). Uninstall offers `keep / restore / delete`; `delete` requires an extra confirmation.
 
@@ -176,6 +176,7 @@ export DISABLE_USER_PROMPT_SUBMIT_HOOK=1         # version-sync (mid-session upg
 export DISABLE_TRANSCRIPT_VOCAB_SCAN_HOOK=1      # PostToolUse §10-V advisory scan
 export DISABLE_TRANSCRIPT_STRUCTURE_SCAN_HOOK=1  # v0.9.10+ — Stop §10 four-section advisory
 export DISABLE_MEM_AUDIT_HOOK=1                  # v0.9.4+ — Stop Why:-less citation advisory
+export DISABLE_SESSION_END_CHECK_HOOK=1          # v0.9.27+ — SessionEnd §11-session-exit mid-SPINE check
 ```
 
 **2a. Per-sub-feature** (v0.4.0+). Sub-flags inside an enabled hook, named without the `_HOOK` suffix:
@@ -302,7 +303,7 @@ claudemd/
 ├── commands/                 # 9 slash-command markdown files
 ├── bin/                      # standalone CLI entrypoint (claudemd-lint.js → `npx claudemd-cli` on npmjs.org)
 ├── scripts/                  # 10 Node.js management scripts + scripts/lib/ (single-source registry, lint, etc.)
-├── spec/                     # shipped v6.11.10 CLAUDE*.md trio + hard-rules.json manifest
+├── spec/                     # shipped v6.11.11 CLAUDE*.md trio + hard-rules.json manifest
 ├── tests/                    # hook shell tests + Node.js tests + integration + fixtures
 ├── docs/                     # ADDING-NEW-HOOK.md + RULE-HITS-SCHEMA.md + superpowers/
 └── .github/workflows/        # ci.yml (ubuntu+macOS × node 20) + npm-publish.yml (tag-triggered)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.9.26",
+  "version": "0.9.28",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {