v1.9.19 — v1.11.1 bundle (4 upstream cold-adopter cures)

Bundles bassclef substrate v1.11.1 with 4 upstream cold-adopter cures.

4 upstream cures land to adopters:

• pre-push-shellcheck.sh consults lib/install-written-paths.sh + honors state-marker SKIP bypass (bassclef-upstream#2253 + #2254). First git push after bassclef init no longer BLOCKs on 72 shellcheck findings.
• /onboard-repo OAuth preflight uses claude-oauth-probe.sh with gtimeout/shim fallback (bassclef-upstream#2255). Reports OAUTH_OK on macOS without gnu coreutils.
• auto-save-schedule.sh probes $CLAUDE_PROJECT_DIR/.claude/hooks/ first (bassclef-upstream#2257). Installer succeeds without a sibling bassclef checkout.
• /onboard-repo Phase 2.7 Concise prompt carries a preamble + default flipped Y → n (bassclef-upstream#2256). Opt-in stays explicit.

Plus trailing housekeeping — ~ → $HOME prose cleanup (bassclef-upstream#2261).

Install: npm install -g @thebassclef/lite@1.9.19

Release context: Session V closes the one-cycle gap between upstream v1.11.1 and adopter npm. Session U closed clean on v1.9.18 bundling v1.11.0; peer bassclef-upstream-c7 shipped v1.11.1 within hours.

Full test tier GREEN: vitest 525/525 · typecheck · install harness 11/11 · bassclef-pin 8/8 · sync-bassclef-version 6/6 · nuke-and-fresh-install 14/14 · pack+andon clean · fast shell tier 14/14 · docker cold-adopter smoke 11m58s.

PR: #451 · Session V plan: docs/next-session-plan-2026-10-18-session-v-v1.9.19-republish.md

v1.9.18 — v1.11.0 bundle + cli#188 pin + andon-cure (first npm release)

Patch release — first npm release carrying bassclef substrate v1.11.0 + cli#188 dynamic substrate pin + cli#439 dev-repo version file + andon-cure.

Why v1.9.18 (not v1.9.17)

v1.9.17 was tagged + GitHub-released on 2026-10-18 (commit 4af3b11) but never reached npm. The publish workflow (run 39084375792) failed at the andon scan step on you@example.com in the bundled onboard-repo SKILL body. PR #442 (SHA 2b5d1658) cured the andon trip with one per-file FILE_ALLOWLIST entry + ADR-004 §Ordered steps check 9 amendment. v1.9.18 bundles the v1.9.17 content plus that cure.

Three closures from v1.9.17 (shipping now via v1.9.18)

• cli#188 (structural root) — .bassclef-pin at repo root replaces 3 hardcoded v1.X.Y sites in .github/workflows/publish.yml. Sync PR advances one file instead of three YAML sites. Drift class closes at the mechanism.
• cli#438 (drift at root) — pin bumped v1.8.0 → v1.11.0. First release bundling actual current substrate since 2026-10-07.
• cli#439 (dev-repo surface) — bassclef-version.json at bassclef-cli root; statusline reads local file first.

Three adopter cures ride in from bassclef v1.11.0

• /onboard-repo preflight cluster (upstream#2248) — closes 6 cold-adopter friction tickets (upstream#2232-#2237).
• New .claude/hooks/pre-push-shellcheck.sh (upstream#2108) — PreToolUse Bash matcher on git push.
• lib/tier-dependency-audit.sh walk_graph_bfs_inbound rewritten O(N × M) → O(N + M).

Test matrix

• vitest 525/525 PASS (was 523; +2 new andon T13a/T13b)
• typecheck clean
• install harness 11 PASS / 1 skip
• CI: pr-checks + ADR-059 + docker-smoke all GREEN
• Local pack+andon: clean, exit 0

Related

• Closes cli#188, cli#438, cli#439 (via PR #440 content)
• Supersedes v1.9.17 (tagged but never shipped)
• Also filed this session: cli#441 (bump-version postcondition bug)

Full changelog: https://github.com/sunj-labs/bassclef-cli/blob/main/CHANGELOG.md

v1.9.17 — dynamic substrate pin + v1.11.0 bundle

Patch release bundling bassclef substrate v1.11.0 + structural cure for publish-pipeline pin drift.

Three closures

• cli#188 (structural root) — .bassclef-pin at repo root replaces 3 hardcoded v1.X.Y sites in .github/workflows/publish.yml. Sync PR advances one file instead of three YAML sites. Drift class closes at the mechanism.
• cli#438 (drift at root) — pin bumped v1.8.0 → v1.11.0. First release bundling actual current substrate since 2026-10-07. Four prior cli releases (1.9.13 → 1.9.16) shipped v1.8.0 behind metadata that claimed v1.10.1.
• cli#439 (dev-repo surface) — bassclef-version.json at bassclef-cli root; statusline reads local file first via resolver chain candidate #2.

Three adopter cures ride in from bassclef v1.11.0

• /onboard-repo preflight cluster (upstream#2248) — closes 6 cold-adopter friction tickets (#2232 + #2233 + #2234 + #2235 + #2236 + #2237). New Phase 0 subsections (CLI check + OAuth probe + git identity preflight). Phase 1.0 writes temperance marker up-front. Phase 1.0a repo-name collision helper. Phase 1.2 free + private preflight. Phase 2.0 VALUE-first opt-in prompt pattern.
• New .claude/hooks/pre-push-shellcheck.sh (upstream#2108) — PreToolUse Bash matcher on git push; scans staged .sh files; BLOCKs on un-allowlisted shellcheck findings. Lite manifest 456 → 457 entries.
• lib/tier-dependency-audit.sh walk_graph_bfs_inbound rewritten O(N × M) → O(N + M). 11000-node BFS now sub-second. Unblocks tier-graph-closure sanity sweep.

New files

• .bassclef-pin — pin source (one line)
• bassclef-version.json — dev-repo statusline source
• scripts/sync-bassclef-version.mjs — idempotent sync helper
• 2 Tier 0 test files (14 new tests, all GREEN)
• 2 use case docs

Test matrix

• vitest 523/523 PASS (9.4s)
• typecheck clean
• install harness 11 PASS / 1 skip
• nuke-and-install tier-0 14/14 PASS
• cli#188 new tests 8/8 PASS
• cli#439 new tests 6/6 PASS
• full shell tier 84/86 (2 pre-existing free-tier-403 RED anchors — strings don't match v1.11.0's cure form; not caused by this release; follow-on cli-N)
• CI: pr-checks + ADR-059 + docker-smoke all GREEN

Related

• Closes cli#188, cli#438, cli#439
• Depends on bassclef v1.11.0 (release_sha fcf192d8)
• Also filed: cli#441 (bump-version postcondition bug — pre-existing; hit twice in this release)

Full changelog: https://github.com/sunj-labs/bassclef-cli/blob/main/CHANGELOG.md

v1.9.16 — bundle bassclef substrate v1.10.1

Bundle bassclef substrate v1.10.1 (Longrun 2 scorer stack + Phase 2.7 install-class hotfix) in one patch cycle.

Upstream scope

• release_sha: 90e9af92134f9d9bc90b7da5b02096a1dfdeff20
• source_sha: 9aebf658b1b9c751758bb9a4e554bfbb515e7006
• v1.10.0 (17 commits since v1.9.6): Longrun 2 scorer stack cluster — per-turn density + appositive measurement + Fitbit-for-prose steering loop
• v1.10.1 (1-line hotfix): .claude/skills/onboard-repo/concise-prompt.sh header flipped from install-class: operator → install-class: project so Phase 2.7 of /onboard-repo sources the helper cleanly
• lite-manifest: 454 → 455 entries

New building blocks shipped to adopters

• lib/prose-marker.sh — shared marker writer + reader deep module
• .claude/hooks/turn-prose-density-measure.sh — Stop event hook; writes per-turn hyphenated-compound density marker
• .claude/skills/onboard-repo/concise-prompt.sh — Phase 2.7 helper for Anthropic Concise output style opt-in
• standards/prose-marker-format.md v1.0 — marker JSON shape + scorer registry + 25-term density allowlist
• scripts/measure-prose-baseline.py — reusable measurement script

Why this matters for adopters

• Scorer stack is opt-in via prose_discipline.scorer_track: true in .claude/bassclef-configs.jsonc. Default-off preserves adopter contract per ADR-049.
• /onboard-repo Phase 2.7 prompts for Anthropic Concise output style (Y/n/skip). jq read-modify-write preserves every pre-existing operator setting.
• The Phase 2.7 cure prevents the ENOENT every adopter answering Y would have hit on v1.10.0.

Tests passed

• vitest 523/523 (62 test files)
• typecheck clean
• install harness 11/11 (install → init → sync end-to-end against bundled v1.10.1)
• Tier 0 shell characterization 41/41
• CI 3/3 GREEN (test + typecheck, cross-repo contracts, docker cold-adopter smoke 11m14s)

Refs

• Upstream release: https://github.com/sunj-labs/bassclef/releases/tag/v1.10.1
• Public PRs: sunj-labs/bassclef#1538 (v1.10.0) + sunj-labs/bassclef#1539 (v1.10.1 hotfix)
• cli PR: #433

🤖 Generated with Claude Code

https://claude.ai/code/session_01GaYMvHqaSqJPUH5sCkwSi1

v1.9.15 — bassclef substrate v1.9.6 (install-written-paths bulk-rebuild cure)

What's new

Patch bump republishing @thebassclef/lite with bassclef substrate v1.9.6 bundled. Zero cli source change — one upstream cure propagates via prepublishOnly sibling-copy into dist/lite/.

The cure

install_written_paths_rebuild_from_lite_manifest bulk-rebuild (bassclef-upstream#2200 / PR #2201).

Fixes the 451×700ms serial-register loop PR #2174 introduced. Prior serial path timed out and left state/install-written-paths.json with ~8 of 451 entries every session. Discipline hooks (identifier-leak-scrub + pre-commit-gate 3-marker gate) false-fired on paths that should have been in the manifest.

New path reads the lite catalog once and rebuilds the manifest in a single pass. Fresh adopters pick up the fast lib via bassclef init; existing adopters pick it up via bassclef-sync at next session.

Carriers

• dist/lite/lib/install-written-paths.sh (byte-identical to upstream v1.9.6 HEAD per diff -q)
• dist/lite/.claude/hooks/session-reflection.d/83-install-written-paths-rebuild.sh

Install

npm install -g @thebassclef/lite@1.9.15

Or let bassclef-sync carry the fix forward at next session.

Verification

• 523/523 vitest tests pass
• Typecheck clean
• 4/4 shell flow tests pass
• Bundle verified byte-identical to upstream v1.9.6 HEAD

Refs

• Carriers: bassclef-upstream#2200, bassclef-upstream#2201, bassclef-upstream 452ce75c, bassclef-upstream v1.9.6 tag
• Peer coord: bassclef-upstream-b1
• PR: #430

🤖 Generated with Claude Code

v1.9.12 — v1.9.3 bundle sync + install-written-paths convergence + ADR-011 drivers

Added

• Bassclef substrate pin bumped v1.8.0 → v1.9.3 — bundle sync carries the Session N cures (install-written-paths mediation + CLI init.manifest.json fallback, pre-commit-gate matcher, write-state-marker lite tier retag, artifact-ingestion HTML-comment tolerance, local-serve --lan cure) plus the v1.9.3 hotfix stamping lite-manifest.json manifest_version 0.0.0 → 1.17.1.
• Install-written-paths convergence from cli-side (src/lib/install-written-paths.ts). bassclef init now writes state/install-written-paths.json so bassclef-upstream discipline hooks (pre-commit-identifier-leak-scrub, pre-commit-gate 3-marker section) skip dispatcher-installed files instead of firing false-positive BLOCKs on an adopter's first commit. Closes bassclef-upstream#2036 Finding #8 Class A.
• 5 adopter-anchor drivers at scripts/tests/smoke-drive-adopter-{2138,2139,2140,2142,2143}-*.test.sh per ADR-011 D1+D2. Post-flip GREEN-confirms shape; each driver pins a specific Session N cure anchor against the shipped dist/lite/ bundle.
• 4 flow drivers at scripts/tests/smoke-drive-flow-{install-first-commit,launch-local-serve-phone,write-marker-use-marker,agent-write-hook-scan}.sh per ADR-011 D3. Flow registry at scripts/tests/smoke-drive-flows-registry.sh per D4.

Notes

• The v1.9.3 bundle unblocks the manifest-version regression that parked the v1.9.2 bundle sync branch — cli bundler expected major 1.x; v1.9.2 shipped 0.0.0; v1.9.3 stamps 1.17.1.

v1.9.11

chore: release v1.9.11 — bassclef v1.8.0 bundle sync (closes 6 cli cu…

v1.9.10 — bassclef substrate v1.7.1 Q1 cures

Session G v1.7.1 cascade — ships 7 Q1 Sam + Louis first-5-min friction cures from bassclef v1.7.1.

Cured in this release

• #306 bash 3.2 associative arrays stripped from shipped /onboard-repo SKILL.md. Adopters on macOS no longer hit declare -A errors at the label step.
• #308 PyYAML trace anchor.
• #316 /longrun flow.
• #321 extract-intent.
• #331 /autonomous SKILL.md carries a self-contained ## Lite procedure block. Lite adopters can run /autonomous start without the strategy/ sibling.
• #332 hosting_platform cure landed in 3 adopter-visible surfaces: /launch Phase 0b hosting ask, /build Phase 7 branches, /deploy-prod tier contract.
• Meta cure for capability-probe.sh.

Regression anchors

Three Session F drivers flipped from RED-detect to GREEN-assert:

• smoke-drive-adopter-306-bash32.test.sh — asserts 0 declare -A hits per bundle.
• smoke-drive-adopter-331-autonomous-lite.test.sh — asserts ## Lite procedure anchor present.
• smoke-drive-adopter-332-hosting-platform.test.sh — asserts 3 of 3 cli#332 cure HTML anchors present.

Any future bundle sync that removes a cure lights up CI red.

Follow-ups

Two Session F drivers remain RED after bundle sync and stay open:

• #322 /launch template L640-641 still ships the old appetite: yaml key — v1.7.1 cure was partial.
• #329 adr-discipline-check.sh shipped but settings.json wiring remains missing — predicted per Session G plan L41.

Status comments on both tickets name the state and point at the next upstream cycle.

Refs

• bassclef v1.7.1 release: https://github.com/sunj-labs/bassclef/releases/tag/v1.7.1
• Session G plan: docs/next-session-plan-2026-10-05-session-g-v1-7-1-bundle-sync.md
• Session G risk ledger: docs/risk-ledgers/2026-10-05-session-g-v1-7-1-bundle-sync.md
• Session G PRs: #362 bundle sync, #363 driver-306 flip, #364 driver-331 flip, #365 driver-332 flip, #366 release cascade.

v1.9.9 — Kunal adopter cures bundled

v1.9.9 — Kunal adopter cures bundled

Credit: Reported by Kunal V., adopter at @thebassclef/lite. Thank you for the 10-finding report that drove bassclef release 2026-10-03-89ceaa15 (upstream tag v1.7.0). cli v1.9.9 bundles 8 of those 10 cures into the shipped substrate.

---

Problem (≤500 chars): cli v1.9.8 bundled bassclef v1.6.5 substrate. Kunal V. filed 10 findings in bassclef-upstream#2036 after his first adopter session — 8 are hard blocks or active harm (auto-save pushing /Users/<name>/ paths to git, zsh wiping PATH on every state-reading skill, /build returning zero steps on template-authored specs). bassclef release-2026-10-03-89ceaa15 fixed 8 of 10. cli#295 pulls that release into dist/lite/ so npm adopters land on cured substrate.

---

Goal

Pull bassclef v1.7.0 into cli's shipped substrate. Preserve the per-finding RCA shape so downstream readers see one audit-visible chain per Kunal finding across every surface (upstream PR body + cli release notes + bassclef-web changelog).

What ships

• Bump .github/workflows/publish.yml bassclef pin v1.6.5 → v1.7.0 across 3 refs (L136 + L151 tag-assert + L281; L152 error prose matches).
• dist/lite/ rebuild via prepublishOnly picks up cured substrate at publish time.
• Pre-mortem light ledger at docs/risk-ledgers/2026-10-03b-cli-295-bundle-sync.md (Linus + Nygard + Saltzer-Schroeder).

Cures inherited — per Kunal finding

Each cure is authored upstream; cli ships the bundle. See upstream PR body for full implementation detail — bassclef-upstream#1523.

#1 Trace-log privacy leak (upstream PR #2041)

• Symptom (what Kunal saw): trace.log files committed to his adopter repo carried /Users/kunal/... paths; auto-save push surfaced these to git history.
• Root cause (upstream): 3 compounding gaps — adopter template .gitignore lacked docs/sdlc-traces/; trace-helper.sh logged absolute paths; save-state.sh ran no leak check before commit.
• Fix (bundled in v1.7.0): trace_log() now strips repo root via _trace_repo_root() helper; lib/identifier-leak-check.sh sources before git commit in save-state.sh; shipped .gitignore adds docs/sdlc-traces/.
• cli verification: grep -c "sanitize\|/Users/" dist/lite/.claude/hooks/trace-helper.sh returns > 0 after bundle rebuild. ls dist/lite/lib/identifier-leak-check.sh resolves.

#2 /build Phase 1 awk range (upstream PR #2043)

• Symptom: /build on any template-authored spec returned zero steps.
• Root cause: awk range /^## Steps enumerated/,/^## / closed on its own start line because ^## matches ^## Steps enumerated.
• Fix (bundled in v1.7.0): flag-based extractor accepts both Steps and Workunits heading forms during ADR-040 D1 grace window.
• cli verification: grep -c "Steps\\|Workunits" dist/lite/.claude/skills/build/SKILL.md > 0 after bundle rebuild.

#3 Template heading mismatch (upstream PR #2043)

• Symptom: Combined with #2 — template said ## Workunits enumerated while SKILL expected ## Steps enumerated.
• Root cause: ADR-040 D1 renamed WU → step in prose but missed templates/spec-template.md.
• Fix (bundled in v1.7.0): template heading renamed to ## Steps enumerated; SKILL regex accepts both forms during grace window.
• cli verification: grep -c "## Steps enumerated" dist/lite/templates/spec-template.md > 0 after bundle rebuild.

#4 SKIP_* env-reach override recipes (upstream PR #2042)

• Symptom: SKIP_FOO=1 git commit ... recipe from BLOCK banners did not bypass the hook.
• Root cause: PreToolUse Bash hooks run in Claude Code's process env; inline SKIP_FOO=1 <cmd> sets the var in git's subshell, not the hook's env.
• Fix (bundled in v1.7.0): lib/skip-env-inline-check.sh parses tool_input.command for inline prefix + falls back to process env. Applied across 6 PreToolUse Bash hooks.
• cli verification: ls dist/lite/lib/skip-env-inline-check.sh resolves after bundle rebuild.

#5 Shipped example path triggered own CCF-3 guard (upstream PR #2042)

• Symptom: Operator-path guard fired on a verbatim /Users/kunal/... example in a shipped install guide.
• Root cause: Example path in presence/install/schedule-auto-save.taskscheduler.md matched the CCF-3 regex. The guard fired correctly; the shipped content was the defect.
• Fix (bundled in v1.7.0): rewrote the example as prose — removed the literal /Users/<name>/ pattern.
• cli verification: grep -c "/Users/" dist/lite/presence/install/schedule-auto-save.taskscheduler.md returns 0 after bundle rebuild.

#6 zsh PATH kill (upstream PRs #2043 + #2045)

• Symptom: Any state-reading skill failed silently (commands not found) when lib/state.sh sourced from zsh.
• Root cause: zsh ties path and PATH as linked variables. local path="..." wiped PATH for function scope under zsh (invisible under bash).
• Fix (bundled in v1.7.0, two upstream PRs):
  • PR #2043: renamed local path= → local p= across 7 functions in lib/state.sh
  • PR #2045: closed the full class across 10 more lib files (24 more occurrences)
• cli verification: grep -rn "local path=" dist/lite/lib/*.sh returns 0 after bundle rebuild.

#9 Free-tier GitHub branch-protection docs (upstream PR #2044)

• Symptom: /onboard-repo Phase 1.2 hit HTTP 403 on free-tier private repos with no fallback path documented.
• Root cause: SKILL assumed gh api always succeeds (authored against Pro-tier accounts).
• Fix (bundled in v1.7.0): three paths documented before the API call (make public, upgrade, skip local); fallback writes .claude/onboard-notes.md marker.
• cli verification: grep -c "upgrade\\|public\\|local-only" dist/lite/.claude/skills/onboard-repo/SKILL.md > 0 after bundle rebuild.

/temperance + /luminary + /loop discipline

• /temperance fired at feature/295-bundle-sync-v1.7.0 branch kickoff. Scope — bundle sync via semver pin (v1.6.5 → v1.7.0); not SHA. Drift trigger — any additional ref beyond L136/L151/L281, or build parity failure.
• /luminary primary lens linus-torvalds — adopter contract preserved via semver pin (v1.7.0, not SHA fallback). Supporting lenses michael-nygard + saltzer-schroeder ran through pre-mortem light (3 lenses × 5 risks; ledger at docs/risk-ledgers/2026-10-03b-cli-295-bundle-sync.md).
• /loop iteration count 1. Outcome — RED then GREEN. Pin shift (SHA → semver) folded mid-prep when peer bassclef-upstream-d3 surfaced v1.7.0 tag; 5 SHA-pin risks (L1-L5) dissolved; semver path preserved cleanly.

Test plan

• npm run build passes.
• npm run prepublish-bundle-substrate.mjs (or prepublishOnly lifecycle) rebuilds dist/lite/ against upstream v1.7.0.
• Verify dist/lite/ carries cures — grep sanitize code in trace-helper, grep identifier-leak-check.sh exists, grep skip-env-inline-check.sh exists.
• npm test passes (vitest suite GREEN).
• npm run typecheck passes.
• CI docker-smoke on v1.9.9 npm package exit 0 or exit 3 (expected-detection class per prior pattern).
• Publish workflow armed; Touch ID at npm-publish env gate.
• npm view @thebassclef/lite dist-tags.latest reports 1.9.9 within ~3 minutes of publish.

Out of scope

• Driver authoring for cli#294 (5 adopter-regression smoke drivers against post-cure substrate) — deferred to next session per plan doc Step 2-6.
• Kunal findings #7 + #8 + #10 — upstream Slot 5-6 in docs/next-session-plan-2026-10-04-kunal-slots-5-6.md.
• bassclef-web docs-gen shape alignment — upstream ticket candidate per peer message.

Refs

• Umbrella: bassclef-upstream#2036 (10 findings, 8 shipped in v1.7.0, 3 open)
• Upstream release: bassclef-upstream PR #1523 (squash-merged 2026-10-03T11Z at commit 6bc46199; tagged v1.7.0)
• cli ticket: cli#295 (closed by this PR)
• Parent: cli#294 (driver authoring; resumes next session)
• RCA-tracking spec: bassclef-upstream#2039

v1.9.8

Fixes cli#281 — cold adopters now see the substrate version at the statusline instead of bassclef · ?.

What ships

• bassclef init copies two files to ~/.claude/ — dispatcher at bassclef-statusline-dispatcher.sh and rich impl at bassclef-statusline.sh.
• Migration from cli ≤ v1.9.6 lands without --force — legacy dispatcher gets replaced by rich impl via isLegacyDispatcher check; legacy statusLine command in settings.json migrates via isLegacyStatuslineCommand check.
• 7 new Tier 0 rich-impl assertions (RED-first Beck TDD).

Refs

• Closes #281
• Related: bassclef-upstream#1961 (statusline feature ship)
• Related: bassclef-upstream#1981 defect A1 (dispatcher self-loop guard)

See CHANGELOG.md [1.9.8] for the full row-level detail.