fix: harden telemetry data fallback in bash-lint and markdown-formatter

[kyle-sexton]

What

Follow-up to #19. Propagates two cross-plugin items I flagged when shipping biome-format:

1. Telemetry fallback hardening (the real change). bash-lint and markdown-formatter carried the same build_data_json jq-failure fallback that biome-format had before review hardened it: printf '{"tool":"%s","file":"%s","findings":[]}' "$TOOL" "$FILE_REL". A path containing a quote or backslash could corrupt the telemetry envelope. Both now emit a fixed empty-shape object instead. The path is near-unreachable (fires only if jq -n fails, and hook::emit_telemetry already drops the envelope when jq is absent), so dropping the values is harmless and strictly safer than risking malformed JSON. All three plugins' build_data_json are now consistent.

Patch-bumped so consumers pull the change via claude plugin update: bash-lint 0.1.0 → 0.1.1, markdown-formatter 0.1.1 → 0.1.2.

2. MultiEdit matcher — investigated, no change (moot). Codex flagged that Write|Edit omits MultiEdit. Verified against the current tools reference: the only file-modification tools are Edit, Write, NotebookEdit — MultiEdit is gone (merged into Edit), and the permission-format table confirms Edit(...) applies to "Edit, Write, NotebookEdit". So Write|Edit is already complete; NotebookEdit only touches .ipynb, which none of these plugins' extensions match. No matcher change warranted.

Verification

shellcheck, typos, editorconfig-checker, comment-hygiene all pass on the changed files. Both test suites green against real tools (bash-lint 31, markdown-formatter 41). claude plugin validate --strict passes for both plugins and the catalog.

🤖 Generated with Claude Code

[claude]

Claude finished @kyle-sexton's task in 1m 13s —— View job

---

PR Review

• Gather context (PR diff, changed files)
• Review bash-lint changes
• Review markdown-formatter changes
• Review version bumps in plugin.json files
• Check alignment with CLAUDE.md guidelines
• Post findings

---

Summary

Clean, minimal security hardening. The fix is correct and the rationale is well-documented. No blocking issues.

---

Security Fix — build_data_json fallback

The core change in both plugins replaces:

|| printf '{"tool":"%s","file":"%s","findings":[]}' "$TOOL" "$FILE_REL"

with:

|| printf '{"tool":"","file":"","findings":[]}'

This is correct. The old form was vulnerable to JSON injection: a path containing ", \, or control characters (all legal on POSIX filesystems) would silently emit malformed JSON. Concrete examples:

• docs/"quoted".sh → {"tool":"bash-lint","file":"docs/"quoted".sh","findings":[]} — structurally broken
• Windows paths with backslashes — broken escape sequences

The fixed form emits a valid, constant envelope. Since the fallback only fires if jq -n itself fails (and hook::emit_telemetry already drops the envelope when jq is absent), losing the field values is harmless, as the PR body correctly notes.

All three plugins (biome-format, bash-lint, markdown-formatter) now have identical build_data_json implementations — the consistency goal is met.

Permalinks:

• bash-lint.sh#L77-L84
• markdown-format.sh#L72-L79

---

Minor Observation (non-blocking)

biome-format.sh aligns its --arg flags without extra spaces (--arg tool "$TOOL"), while the two updated plugins use extra spaces for column alignment (--arg tool "$TOOL"). This is purely cosmetic and both styles are valid — only worth a mention if you want the three files to be character-for-character identical, not just semantically identical.

---

Version Bumps

Both patch bumps are appropriate for a bug fix:

• bash-lint 0.1.0 → 0.1.1
• markdown-formatter 0.1.1 → 0.1.2

---

CLAUDE.md Alignment

• Repo-agnostic: no hardcoded paths introduced. ✅
• Plugin-form-safe: no reach-outs outside plugin root. ✅
• No PII/secrets. ✅
• Explicit semver versioned with a meaningful bump. ✅

Verdict: LGTM. The change is correct, safe, and consistent across all three plugins.