trackfw 9.3.1 → 9.3.2

package/README.md

@@ -151,21 +151,24 @@ Bash — a team with mixed OS can commit one config and have it work on all mach
 The hook line emitted depends on the shell the agent CLI uses on Windows — a fact of
 the vendor, not of the OS:
 
-| Agent CLI | Shell on Windows | Hook line emitted | Basis |
+| Agent CLI | Shell on Windows | Hook line emitted (D11, ML-6B) | Basis |
 |---|---|---|---|
-| Claude Code | Git Bash (if installed), else PowerShell | `trackfw guard <name>; exit $LASTEXITCODE` | vendor docs (2026-10-04) |
-| Codex CLI | PowerShell | `trackfw guard <name>; exit $LASTEXITCODE` | vendor source (2026-10-04) |
-| Gemini CLI | PowerShell | `trackfw guard <name>; exit $LASTEXITCODE` | vendor source (2026-10-04) |
-| Cursor | PowerShell | `trackfw guard <name>; exit $LASTEXITCODE` | vendor bundle (2026-09-06) |
-| Windsurf | PowerShell | `trackfw guard <name>; exit $LASTEXITCODE` | vendor docs (2026-10-04) |
-| GitHub Copilot | PowerShell / cross-platform `command` field | `trackfw guard <name>; exit $LASTEXITCODE` | vendor docs (2026-10-04) |
-| Kiro | cmd.exe | `trackfw guard <name>` | vendor docs (2026-10-04) |
-| Amazon Q | cmd.exe | `trackfw guard <name>` | vendor source (2026-10-04) |
-
-The `; exit $LASTEXITCODE` suffix is required for PowerShell 5: without it, PowerShell
-converts exit 2 (deny) from the child process into exit 1, and 6 of 8 CLIs treat exit 1
-as a non-blocking error. cmd.exe and bash propagate the exit code directly; they do not
-need the suffix.
+| Claude Code | Git Bash (if installed), else PowerShell | `$LASTEXITCODE=2 2>${null-/dev/null}; trackfw guard <name>; LASTEXITCODE=$((2*!!$?)); exit $LASTEXITCODE` | vendor docs (2026-10-04) |
+| Codex CLI | PowerShell | `$LASTEXITCODE=2 2>${null-/dev/null}; trackfw guard <name>; LASTEXITCODE=$((2*!!$?)); exit $LASTEXITCODE` | vendor source (2026-10-04) |
+| Gemini CLI | PowerShell | `$LASTEXITCODE=2 2>${null-/dev/null}; trackfw guard <name>; LASTEXITCODE=$((2*!!$?)); exit $LASTEXITCODE` | vendor source (2026-10-04) |
+| Cursor | PowerShell | `$LASTEXITCODE=2 2>${null-/dev/null}; trackfw guard <name>; LASTEXITCODE=$((2*!!$?)); exit $LASTEXITCODE` | vendor bundle (2026-09-06) |
+| Windsurf | PowerShell | `$LASTEXITCODE=2 2>${null-/dev/null}; trackfw guard <name>; LASTEXITCODE=$((2*!!$?)); exit $LASTEXITCODE` | vendor docs (2026-10-04) |
+| GitHub Copilot | PowerShell / cross-platform `command` field | `$LASTEXITCODE=2 2>${null-/dev/null}; trackfw guard <name>; LASTEXITCODE=$((2*!!$?)); exit $LASTEXITCODE` | vendor docs (2026-10-04) |
+| Kiro | cmd.exe | `trackfw guard <name> \|\| exit 2` | vendor docs (2026-10-04) |
+| Amazon Q | cmd.exe | `trackfw guard <name> \|\| exit 2` | vendor source (2026-10-04) |
+
+The D11 line (ML-6B, issue #535) is **fail-closed**: if `trackfw` is absent from `PATH`,
+the hook exits with code 2 instead of 0. The seed `$LASTEXITCODE=2` is a PowerShell
+automatic-variable assignment; in sh/bash the resulting `=2: command not found` error is
+silently discarded by `2>${null-/dev/null}` (where `${null-/dev/null}` expands to
+`/dev/null` via bash parameter expansion, and to nothing in PowerShell). When the binary is
+absent, `LASTEXITCODE=$((2*!!$?))` normalizes any non-zero exit to 2; when the guard
+succeeds, it normalizes to 0. For cmd.exe: `|| exit 2` is the native short-circuit.
 
 **What was measured in the VM (Windows 11 ARM64, 2026-10-06):** PowerShell 5, cmd.exe,
 and Git Bash (non-login, explicit PATH to the branch binary) all block

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trackfw",
-  "version": "9.3.1",
+  "version": "9.3.2",
   "description": "Governance CLI for AI-native software delivery and AI coding agents. Enforces traceability: ADR → REQ → ROADMAP → kanban. Native support for Codex, Claude Code, Gemini CLI, Cursor, Copilot, Windsurf, Amazon Q, OpenCode, and Kiro.",
   "keywords": [
     "cli",
@@ -63,11 +63,11 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@trackfw-bin/darwin-arm64": "9.3.1",
-    "@trackfw-bin/darwin-x64": "9.3.1",
-    "@trackfw-bin/linux-arm64": "9.3.1",
-    "@trackfw-bin/linux-x64": "9.3.1",
-    "@trackfw-bin/win32-arm64": "9.3.1",
-    "@trackfw-bin/win32-x64": "9.3.1"
+    "@trackfw-bin/darwin-arm64": "9.3.2",
+    "@trackfw-bin/darwin-x64": "9.3.2",
+    "@trackfw-bin/linux-arm64": "9.3.2",
+    "@trackfw-bin/linux-x64": "9.3.2",
+    "@trackfw-bin/win32-arm64": "9.3.2",
+    "@trackfw-bin/win32-x64": "9.3.2"
   }
 }