shapeup-sdlc 3.18.1 → 3.18.3

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "shapeup-sdlc-plugin",
   "displayName": "ShapeUp SDLC Plugin",
-  "version": "3.18.1",
+  "version": "3.18.3",
   "description": "Shape Up SDLC harness for Claude Code: shaping, intake, orient, scope-mapping, building (T0-verified, sandboxed, scope-contracted), evaluation and QA skills orchestrated by a tech-lead.",
   "author": {
     "name": "Liberty Nguyen",

package/hooks/safety-spine.mjs

@@ -106,14 +106,21 @@ function tokens(segment) {
  * The program names answer it. Arguments are never recorded — they are where a secret, a token or a
  * private path would be — and a basename says which tool ran without saying where it lives.
  *
+ * A `\`-continued line is joined to the one before it FIRST, before any segment split — a shell
+ * reads `cmd \<newline>  --flag x` as one logical line, and so must this. Splitting on the bare
+ * newline first (measured, live) read a multi-line `init run` as one "program" per physical line —
+ * `node`, then `--slug`, then `--auto-level`, each a flag misread as an executable — which is how
+ * a real dispatch and a garbled one produced the same "clean, permitted" shape in the ledger.
+ *
  * @param {string} command - The raw Bash command.
  * @returns {(string|null)} Program basenames joined by " | ", in order, duplicates kept; null when
  *   no segment yields one.
  */
 export function programsOf(command) {
   if (!command || typeof command !== "string") return null;
+  const joined = command.replace(/\\[ \t]*\n/g, " ");
   const names = [];
-  for (const segment of command.split(/\s*(?:\|\||&&|;|\||\n)\s*/).filter(Boolean)) {
+  for (const segment of joined.split(/\s*(?:\|\||&&|;|\||\n)\s*/).filter(Boolean)) {
     const first = commandTokens(segment)[0];
     if (!first) continue;
     const base = first.replace(/^["']|["']$/g, "").split("/").pop();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shapeup-sdlc",
-  "version": "3.18.1",
+  "version": "3.18.3",
   "description": "Shape Up for coding agents \u2014 with gates the agent can't talk its way past. Harness for Claude Code.",
   "bin": {
     "shapeup-sdlc": "bin/init.mjs"

package/skills/qa-edge-hunter/SKILL.md

@@ -189,6 +189,16 @@ Per charter:
        a charter is a license to deviate INSIDE its ground, not a script.
   H.2  Suspected finding → reproduce it (≥1 clean repro) before recording. No repro →
        log in session notes as "unconfirmed observation", NOT a finding.
+       - A claim that something is GONE / vanished / missing from the screen is not
+         reproduced by one tree read (DOM/layout dump) showing no match. Rule out that it
+         is merely COVERED first: dismiss whatever sits in front of it — keyboard, dialog,
+         sheet, toast, modal — and recheck, or confirm with a second signal (a screenshot,
+         scrolling it into view). A node absent from one read and present the moment the
+         overlay closes was never gone; that is not a finding, on any platform.
+       - A claim that a value SURVIVES a restart/relaunch is not reproduced by observing it
+         once after relaunching. Diff it against what a fresh instance shows from its own
+         seed/reset state first. A value that matches the seed is the app re-seeding
+         correctly, not evidence that anything persisted.
   H.3  Confirmed → record it IMMEDIATELY (in the growing WorkResult, not batched to the end
        of the hunt — a crashed session must not lose confirmed findings):
 
@@ -352,3 +362,8 @@ No verdict line exists in this file by design. The Hunter's last words:
 7. **Never invent severity from code reading.** Every finding has a live repro on the
    running app.
 8. **Never gate on Test Surface.** Its absence degrades the hunt; it never blocks it.
+9. **Never call something gone from one tree read.** A DOM/layout dump has no concept of
+   what covers a node — rule out an overlay (keyboard, dialog, sheet, toast) before an
+   absence counts as reproduced (H.2).
+10. **Never call a value "surviving" a relaunch without diffing the seed.** A value that
+    matches the fresh/reset state after a restart is not persistence (H.2).