claudemd-cli 0.9.3 → 0.9.5

package/CHANGELOG.md

@@ -8,6 +8,75 @@ All notable changes to the `claudemd` plugin. This changelog tracks plugin artif
 - **Canonical spec version source**: `spec/CLAUDE.md` top-line title (`# AI-CODING-SPEC vX.Y.Z — Core`) + `spec/CLAUDE-changelog.md` top `##` entry.
 - **Plugin semver vs spec semver** are independent: plugin patch (0.2.0 → 0.2.1) may ship when spec is unchanged (this release); plugin minor (0.1.9 → 0.2.0) ships when spec minor updates (v0.2.0 shipped spec v6.10.0).
 
+## [0.9.5] - 2026-05-10
+
+**Patch — `mem-audit.sh` hotfix (3 bugs introduced in v0.9.4).** Spec unchanged (still v6.11.7); plugin-only patch. The new Stop hook shipped in v0.9.4 silently failed validation on every Stop event ("Hook JSON output validation failed — Invalid input") and produced false-positive missing-marker warnings on legitimate memories. v0.9.5 fixes all three issues and adds `tests/hooks/mem-audit.test.sh` (9/9 cases) to lock them down.
+
+### Fixed
+
+- `[fix]` **Stop event schema mismatch (CRITICAL)** — v0.9.4 emitted `{"hookSpecificOutput": {"hookEventName": "Stop", "additionalContext": "..."}}` to stdout, but Claude Code's hook schema only accepts `hookSpecificOutput` for `PreToolUse` / `UserPromptSubmit` / `PostToolUse` / `PostToolBatch`. **Stop is not on the list.** Every emit was rejected with `Hook JSON output validation failed — (root): Invalid input`. The fix mirrors `residue-audit.sh`: write to stderr only, no JSON output. CC harness surfaces stderr as advisory; Stop cannot block by design either way.
+- `[fix]` **Path double-slash** — error banner showed paths like `<encoded>//memory/feedback_x.md` (double slash after the project dir). Root cause: glob `"$PROJECTS_ROOT"/*/` produces values with trailing slashes, so the join `"$proj_dir/memory"` became `"<dir>/memory"` with `<dir>` already ending `/`. Fix: `proj_dir="${proj_dir%/}"` strips the trailing slash before the join.
+- `[fix]` **Regex matched only one Why-form** — v0.9.4 regex `^\*\*Why:\*\*` matched only `**Why:**` (colon inside bolding), but most memories in the wild use `**Why**:` (colon outside bolding). Both forms are valid per CC `memoryTypes.ts:58` body_structure example. v0.9.5 regex `^\*\*Why(:\*\*|\*\*:)` accepts either; same change for `**How to apply:**` / `**How to apply**:`. This eliminates the v0.9.4 26-file false-positive batch on `~/.claude/projects/-mnt-data-ssd-dev-projects-claudemd/memory/feedback_*.md`.
+
+### Added
+
+- `[test]` **`tests/hooks/mem-audit.test.sh` — 9 cases**: (1) no projects dir → silent, (2) empty memory dir → silent, (3) **Why:** colon-inside-bolding accepted, (4) **Why**: colon-outside-bolding accepted, (5) missing markers → stderr warn, no stdout (locks Stop schema fix), (6) path single-slash format (locks the trailing-slash bug), (7) 24h sentinel debounce, (8) kill-switch DISABLE_MEM_AUDIT_HOOK=1, (9) MEMORY.md index file skipped.
+
+### Compatibility
+
+- **No claude-mem-lite required.** `mem-audit.sh` audits CC built-in auto-memory under `~/.claude/projects/<encoded>/memory/` only. It does NOT depend on `claude-mem-lite`, `claude-mem`, or any other recall-layer plugin. If a user only has the claudemd plugin installed (no recall plugin):
+  - Hook still operates correctly, scanning whatever CC built-in 4-types memories exist.
+  - Zero memory files → silent exit (no projects dir / no relevant files = no output).
+  - Spec wording (§11 + §11-EXT) consistently uses "recall-layer plugin **if present**" — no plugin specifically required.
+- **Comment in `mem-audit.sh:13-21`** documents the independence property explicitly.
+
+### Versioning
+
+- `package.json` 0.9.4 → **0.9.5** (npm).
+- `.claude-plugin/plugin.json` 0.9.4 → **0.9.5**.
+- `.claude-plugin/marketplace.json` two version fields 0.9.4 → **0.9.5**.
+- Spec headers unchanged (v6.11.7 still current); no `spec/CLAUDE-changelog.md` entry — plugin-only patch.
+
+### Validation
+
+- `bash tests/hooks/mem-audit.test.sh` → 9/9 passed.
+- `npm run test:scripts` → 211/211 passed.
+- `bash tests/run-all.sh` → all suites passed including upgrade-lifecycle (v0.2.3/v6.10.1 → current/v6.11.7).
+
+## [0.9.4] - 2026-05-10
+
+**Minor — spec v6.11.7 (CC-source comparative audit) + new `mem-audit` Stop hook.** Driven by side-by-side analysis of upstream `sdscc/src/constants/prompts.ts` + `src/memdir/memoryTypes.ts` against AI-CODING-SPEC v6.11.6 — five spec additions where CC's eval-validated rules were stronger or absent in spec. Plugin manifest version skips `0.9.3` (npm-only release that didn't bump `plugin.json` / `marketplace.json`); v0.9.4 brings all manifests back to a coherent state.
+
+### Spec changes (v6.11.6 → v6.11.7)
+
+- `[fix]` **§10 Specificity No-baseline fallback boundary** (core, +~70 bytes net) — PARTIAL applies to numeric/quantitative claims w/o baseline only, NOT to pure process-completion (commit landed / file created / config applied) when V1-verified. Closes a defensive-PARTIAL drift. Source: CC `prompts.ts:183`.
+- `[change]` **§11 Memory routing** (core +~95 bytes pointer; full body §EXT §11-EXT +~810 bytes) — durable layer (CC built-in 4 types) vs time-sensitive recall layer (e.g. `claude-mem-lite`). One home per fact.
+- `[change]` **§11-EXT user-override filter** — WHAT-NOT-TO-SAVE applies even on explicit "save / 记一下 / remember"; ASK what was *surprising* / *non-obvious*, save only that. Source: CC `memoryTypes.ts:189`.
+- `[change]` **§11-EXT Execution heuristics (CC-borrowed, non-HARD)** — Read-before-propose (`prompts.ts:175`), Diagnose-before-pivot (`prompts.ts:178`), Existing-comment protection (`prompts.ts:161`).
+- `[refactor]` **§10 Banned-vocab quick-list compaction** (core, −~50 bytes).
+
+§13.2 budget cost: 0 (no new HARD added). Sizing post-v6.11.7: core 24558/25000 (442 bytes headroom, **98.23% — tight**); extended 46568/50000 (3432 bytes headroom, 93.14%). Operator note: v6.11.8 should net-delete or migrate marginal core bullets to §EXT before adding new content.
+
+### Plugin changes
+
+- `[feat]` **`hooks/mem-audit.sh` — new Stop hook (advisory, never blocks)**: scans `~/.claude/projects/*/memory/feedback_*.md` + `project_*.md` for missing `**Why:**` / `**How to apply:**` body-structure markers (per CC `memoryTypes.ts:58/76/132/149`). Emits `additionalContext` banner with file paths (max 3 shown + `+N more`); 24h sentinel debounce so it doesn't fire on every Stop. Skips MEMORY.md itself + sub-400-byte stubs. Disable: `DISABLE_MEM_AUDIT_HOOK=1`. Registered in `hooks/hooks.json` (Stop event, after sandbox-disposal-check, before session-summary), `scripts/lib/hook-registry.js`, `commands/claudemd-toggle.md`. Hook count: **10 → 11**.
+
+### Versioning
+
+- `package.json` 0.9.3 → **0.9.4** (npm tag).
+- `.claude-plugin/plugin.json` 0.9.2 → **0.9.4** (catches up — v0.9.3 was an npm-only release that didn't bump plugin manifests).
+- `.claude-plugin/marketplace.json` two version fields 0.9.2 → **0.9.4**.
+- `spec/CLAUDE.md` v6.11.6 → **v6.11.7** (header + body).
+- `spec/CLAUDE-extended.md` v6.11.6 → **v6.11.7**.
+- `spec/CLAUDE-changelog.md` prepended **v6.11.7** entry.
+- `spec/hard-rules.json` `spec_version` v6.11.6 → **v6.11.7**.
+
+### Notes
+
+- Plugin manifest `description` fields stay at major.minor (`v6.11`) per Versioning policy; not touched this release.
+- npm `claudemd-cli@0.9.4` will publish via the `npm-publish.yml` workflow on `v0.9.4` tag push (auto-publish per v0.9.2 onwards).
+- Carryover: v0.9.3 npm tarball (released 2026-05-09 with spec v6.11.4–v6.11.6 batch ship) didn't bump plugin manifests. v0.9.4 reconciles. No user-facing impact — `/claudemd-update` reads `spec/CLAUDE.md` header, not `plugin.json` version, so spec sync was unaffected.
+
 ## [0.9.2] - 2026-05-09
 
 **Patch — npm provenance metadata + first auto-publish via workflow.** v0.9.1 manual publish succeeded but the auto-publish workflow's first triggered run failed twice: first run on the v0.9.1 tag push hit `ENEEDAUTH` (NPM_TOKEN not yet configured); a rerun after token configuration hit `E422` from npm's sigstore provenance verifier — `--provenance` requires `repository.url` in package.json to match the inferred repo URL. v0.9.2 closes that gap and serves as the first end-to-end auto-publish validation.

package/README.md

@@ -10,10 +10,10 @@ Claude Code plugin that enforces **AI-CODING-SPEC v6.11 HARD rules** through she
 
 | Layer | Contents |
 |---|---|
-| 10 shell hooks | `banned-vocab-check` · `pre-bash-safety-check` · `ship-baseline-check` · `residue-audit` · `memory-read-check` · `sandbox-disposal-check` · `session-start-check` · `session-summary` · `transcript-vocab-scan` · `version-sync` |
+| 11 shell hooks | `banned-vocab-check` · `pre-bash-safety-check` · `ship-baseline-check` · `residue-audit` · `memory-read-check` · `sandbox-disposal-check` · `session-start-check` · `session-summary` · `transcript-vocab-scan` · `version-sync` · `mem-audit` (v0.9.4) |
 | 9 slash commands | `/claudemd-status` · `/claudemd-update` · `/claudemd-audit` · `/claudemd-toggle` · `/claudemd-doctor` · `/claudemd-uninstall` · `/claudemd-rules` · `/claudemd-clean-residue` · `/claudemd-sparkline` |
 | 1 standalone CLI | `claudemd-cli lint` · `claudemd-cli audit` (v0.9.0+ — for git pre-commit / CI / cross-agent use; npm package: [`claudemd-cli`](https://www.npmjs.com/package/claudemd-cli); same `banned-vocab.patterns` source as the in-CC hook) |
-| Spec v6.11.3 | `~/.claude/CLAUDE.md` · `CLAUDE-extended.md` · `CLAUDE-changelog.md` (backup-before-overwrite) |
+| Spec v6.11.7 | `~/.claude/CLAUDE.md` · `CLAUDE-extended.md` · `CLAUDE-changelog.md` (backup-before-overwrite) |
 
 If you already have `~/.claude/CLAUDE.md`, install moves your existing files to `~/.claude/backup-<ISO>/` (last 5 kept automatically) before writing the plugin version. Uninstall offers `keep / delete / restore`; `delete` requires an extra confirmation.
 
@@ -285,7 +285,7 @@ claudemd/
 ├── commands/                 # 9 slash-command markdown files
 ├── bin/                      # standalone CLI entrypoint (claudemd-lint.js → `npx claudemd-cli` on npmjs.org)
 ├── scripts/                  # 10 Node.js management scripts + scripts/lib/ (single-source registry, lint, etc.)
-├── spec/                     # shipped v6.11.3 CLAUDE*.md trio
+├── spec/                     # shipped v6.11.7 CLAUDE*.md trio
 ├── tests/                    # hook shell tests + Node.js tests + integration + fixtures
 ├── docs/                     # ADDING-NEW-HOOK.md + RULE-HITS-SCHEMA.md + superpowers/
 └── .github/workflows/ci.yml  # ubuntu + macOS × node 20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemd-cli",
-  "version": "0.9.3",
+  "version": "0.9.5",
   "description": "Standalone CLI for §10-V banned-vocab + transcript scanning. Companion to the claudemd Claude Code plugin (github.com/sdsrss/claudemd) for use in git pre-commit hooks, GitHub Actions, and other agents.",
   "type": "module",
   "bin": {