fix: harden telemetry data fallback in bash-lint and markdown-formatter

plugins/bash-lint/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "bash-lint",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Auto-format and lint shell scripts on edit via shfmt + ShellCheck, using the consuming repo's own .editorconfig and .shellcheckrc.",
   "author": {
     "name": "Melodic Software",

plugins/bash-lint/hooks/bash-lint.sh

@@ -68,16 +68,19 @@ else
 fi
 
 # Build the telemetry data object for the current TOOL/FILE_REL. $1 is the
-# findings JSON array. jq is authoritative; the string fallback keeps telemetry
-# best-effort if jq fails (findings collapse to [] since they can't be re-quoted
-# safely without jq).
+# findings JSON array. jq is authoritative. The fallback is a fixed empty-shape
+# object — NOT an interpolation of TOOL/FILE_REL, which could inject quotes or
+# backslashes from a path and corrupt the envelope. The fallback is essentially
+# unreachable in practice (it fires only if `jq -n` fails, and when jq is absent
+# hook::emit_telemetry drops the envelope anyway), so losing the values here is
+# harmless and strictly safer than emitting malformed JSON.
 build_data_json() {
   jq -n \
     --arg tool     "$TOOL" \
     --arg file     "$FILE_REL" \
     --argjson findings "$1" \
     '{tool:$tool,file:$file,findings:$findings}' 2>/dev/null \
-    || printf '{"tool":"%s","file":"%s","findings":[]}' "$TOOL" "$FILE_REL"
+    || printf '{"tool":"","file":"","findings":[]}'
 }
 
 # A section header governs shell files when it is the `[*]` catch-all or names a

plugins/markdown-formatter/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "markdown-formatter",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Auto-format and lint Markdown on edit via markdownlint-cli2, using the consuming repo's own markdownlint config.",
   "author": {
     "name": "Melodic Software",

plugins/markdown-formatter/hooks/markdown-format.sh

@@ -63,16 +63,19 @@ else
 fi
 
 # Build the telemetry data object for the current TOOL/FILE_REL. $1 is the
-# findings JSON array. jq is authoritative; the string fallback keeps telemetry
-# best-effort if jq fails (findings collapse to [] since they can't be re-quoted
-# safely without jq).
+# findings JSON array. jq is authoritative. The fallback is a fixed empty-shape
+# object — NOT an interpolation of TOOL/FILE_REL, which could inject quotes or
+# backslashes from a path and corrupt the envelope. The fallback is essentially
+# unreachable in practice (it fires only if `jq -n` fails, and when jq is absent
+# hook::emit_telemetry drops the envelope anyway), so losing the values here is
+# harmless and strictly safer than emitting malformed JSON.
 build_data_json() {
   jq -n \
     --arg tool     "$TOOL" \
     --arg file     "$FILE_REL" \
     --argjson findings "$1" \
     '{tool:$tool,file:$file,findings:$findings}' 2>/dev/null \
-    || printf '{"tool":"%s","file":"%s","findings":[]}' "$TOOL" "$FILE_REL"
+    || printf '{"tool":"","file":"","findings":[]}'
 }
 
 MDLINT=()