Version bumped to 3.16.0 across the 20 tracked parity targets plus the ClawHub
stage. The OpenCode plugin package stays at 1.0.1 and the Pi extension at
1.2.5: this cycle touched hooks/ and .codex/hooks/, neither package.
CHANGELOG entry for #239 including the two scope calls stated rather than left
to be discovered (FileChanged deferred, the standalone skill route unchanged);
README releases-table row; Raymond Manaloto's CONTRIBUTORS entry extended with
#239. Suite size pinned at 706 in README and llms.txt with its guard.
Version bumped to 3.15.0 across the 20 tracked parity targets plus the ClawHub
stage. The OpenCode plugin package goes to 1.0.1 and the bundled Pi extension
to 1.2.5, since both changed in this cycle.
CHANGELOG entry for #236, #237 and #238; README releases-table row; Raymond
Manaloto added to CONTRIBUTORS.md for all three. Suite size pinned at 696 in
README and llms.txt with its guard.
The resolver description in the English SKILL.md files said PLAN_ID "checks
first, then falls back"; it now states that a set PLAN_ID is a binding. The
five translated variants keep the old sentence until it can be translated
properly rather than shipped as English text under a localized heading.
Version 3.13.0 across the tracked parity set and the ClawHub stage;
CHANGELOG entry; Hermes Agent listed under Tier 2 in the English
SKILL.md host tables and MIGRATION.md.
Version bump across the 19 parity targets, CHANGELOG, CONTRIBUTORS, and the
README releases row for the POSIX shell fix in PR #228.
Also repairs the v3.11.0 changelog entry, which warned that shell hooks must
not emit JSON with echo and then carried two raw newlines of its own inside
the code spans for the escape sequence it was describing.
Version bump across the 19 parity targets, CHANGELOG, CONTRIBUTORS, and the
README releases row for the skills/i18n move that closes#130.
Also adds docs/languages.md, the page the translations never had, and
collapses the README FAQ by default.
Version bump across the 19 parity targets, CHANGELOG, CONTRIBUTORS and the
README releases table. Ships PR #223, #222 and #224 by @Whxuan0701 plus the
three defects the merge audit turned up.
Version bump across the 19 parity-locked files, CHANGELOG, CONTRIBUTORS
and the README releases table.
Closes#217. Acts on the #130 drift audit without deleting the language
variants: they carry 39.8K of the project's 89.3K installs, and skills.sh
has no pruning job, so removing the directories would have left five
permanent listings advertising an install that fails rather than taking
them down. #130 stays open for the one cost that remains, the five extra
descriptions per session on the plugin route.
Suite 411 to 417.
Closes#212, #211, #210.
#212: a Codex thread whose cwd was a shared parent injected an unrelated
project's plan on every hook fire. PWF_PLAN_ROOT binds resolution to a project
root by absolute path, which a cwd relative PLAN_ID slug could not express,
and an ambiguous cwd refuses to inject rather than guessing.
Verifying that report exposed three more failures: PLANNING_DISABLED=1 was
inoperative on eleven of thirteen install routes, the Stop hook could never
find its script on six hosts, and eight shipped PowerShell scripts could not
be parsed by Windows PowerShell 5.1 at all, leaving Cursor injection and both
Chinese variants' init-session dead on Windows.
#211: a provider error made the Pi extension queue another request into the
same failing provider, up to the auto continue limit, burying the original
error. The status bar also stopped tracking the plan once execution was
approved. Bundled extension 1.2.3.
#210: injection determinism is now asserted rather than assumed, five routes
that had never received the v2.40 timestamp normalization were fixed, and the
skill text no longer attributes a whole workflow token measurement to per tool
call recitation.
Suite 311 to 411 passing, 282 to 467 subtests, 48 Pi extension tests, IDE
folder sync clean.
Version bump across the 18-entry parity set, CHANGELOG entry covering the
resolver fix and the cross-project transcript guard, CONTRIBUTORS entry for
@seathatflowsinourveins, README release row.
Version bump across the 18-entry parity set, CHANGELOG entry with the
security notes from the two-model release gate, CONTRIBUTORS entry for
@fd44fdg, README release row.
The Stop scalar never dispatched on macOS or Linux (the PowerShell branch
was always selected because check-complete.ps1 ships on every platform)
and was a silent no-op anywhere CLAUDE_SKILL_DIR was unset (the :- install
path fallback can never substitute because the probed variable is always a
non-empty string). Both the legacy completion advisory and the v3
completion gate were dead in those environments. The scalar now selects
targets by file existence and dispatches by platform, PowerShell only
under MINGW/MSYS/CYGWIN, sh elsewhere. Windows output is unchanged.
Patched in all 14 SKILL.md variants that carry the scalar.
session-catchup probed a ~/.claude/projects name that Claude Code never
writes for POSIX paths (leading dash stripped) or paths containing an
underscore (replaced with a dash), so recovery after /clear silently
found nothing there. The mapper now probes the exact spelling first,
keeps both legacy spellings for stores created by older versions, and
settles ambiguity via the cwd recorded in the newest session file.
Propagated to every shipped copy including the older-generation root,
.hermes, and .mastracode scripts.
Also: the attestation SHA cache is keyed on the absolute plan path so two
projects can no longer share a slot and report a false PLAN TAMPERED;
resolve-plan-dir.ps1 reaches parity with the sh resolver (slug filter,
task_plan.md requirement in the newest-dir scan, fail-closed containment);
ledger-append.sh no longer truncates summaries mid-codepoint (UTF-8-safe
trim via iconv with a pure-sh fallback).
New long-run features, all opt-in or additive: structure-aware injection
(PWF_INJECT=smart or an inject-smart .mode token) keeps the active phase,
phase counts, and the last three decisions in the window late in long
plans; a Next Step section in both plan templates plus a sixth reboot
question; session-catchup annotates tool results (ok or FAILED with the
first error line) instead of only listing attempts.
Infrastructure: macos-latest joins the CI matrix, a BSD-userland
simulation harness runs the script fleet without realpath, readlink,
flock, or sha256sum on the Linux leg, and .gitattributes pins LF for
scripts. SEO surfaces: llms.txt rewritten as a Q&A page, three
problem-query docs pages, plugin.json and CITATION.cff keyword hygiene.
Suite grows from 217 to 301 passed, 11 skipped, on Windows and both
existing CI legs; default hook output stays byte-identical to v2.43
(legacy invariant proven by the existing invariant tests).
Ships .agents/skills/planning-with-files/ so tools reading the
cross-tool Agent Skills path natively (Zed, Amp, Warp, Devin,
Antigravity, Gemini CLI, Cursor) discover the current skill from a
plain git clone. Full canonical surface: SKILL.md, references, six
templates, complete script set including hook dispatchers, ledger
tooling, and plan-doctor.
Wired into both maintenance systems so it cannot silently rot:
sync-ide-folders.py gains a .agents manifest (and now ships
plan-doctor.sh to every synced IDE folder), the SKILL.md joins the
bump-version.py parity set and the version-parity test (18 locked
entries). AGENTS.md and the bump-version.py docstring describe the
actual parity set. docs/gemini.md routes new installs through the
standard path instead of the intentionally lagged .gemini variant.
18-file parity bump to 3.7.0, CHANGELOG entry, README release row and
version heading.
17-file parity bump (canonical + 5 language + 8 IDE SKILL.md variants,
plugin.json, marketplace.json, CITATION.cff). .continue, .gemini, .pi,
.kiro remain on their own versioning per release scope. CHANGELOG entry,
README release row, version heading, plan-mode handoff FAQ, and the
supported-agents answer refreshed to the 2026 .agents/skills landscape.
Codex on Windows: extend the WSL launcher skip to the Store WindowsApps
alias and add regression tests for both launcher locations. Fold the CI
workflow and test portability work (PRs #198, #199 by @Yigtwxx) into the
release entry.
Pi extension 1.2.1: deliver tool_call recitations and the tamper notice
as nextTurn instead of steer so they can no longer be consumed by
interactive tools blocking the turn (issue #206, diagnosed by @jschmied).
Version bump to 3.5.1 across the 17-file parity set, CHANGELOG,
CONTRIBUTORS, README badge and releases table.
Ships PR #205 (@yolo0731) plus the #203 Pi close-marker fix, the #202 lifecycle
documentation, the language-command namespace correction, and the README v3
command and hook surface.
Bumps the 17-file parity set to 3.5.0 (.continue, .gemini, .pi, and .kiro stay
behind by design). Adds the v3.5.0 CHANGELOG entry, credits @yolo0731,
@ziyu4huang, and @kcinzgg in CONTRIBUTORS, and updates the README version badge
and releases table.
Codex on Windows runs each hook command through the native command
interpreter, not a POSIX shell. The .codex/hooks.json commands were POSIX
only (sh, python3, 2>/dev/null, $HOME, trailing || true), so python3 hit
the Microsoft Store alias, the redirection was an invalid path, and the
|| true success guard failed because true is not a Windows command. Every
hook exited non-zero and Codex reported "hook exited with code 1".
Add a per-hook commandWindows override, the sanctioned Codex mechanism.
The POSIX command is untouched, so macOS and Linux are byte for byte
unchanged. On Windows all seven hooks route through a new launcher,
.codex/hooks/pwf-hook.cmd, which picks a real Python (py -3, falling back
to python, never the Store python3 alias) and always exits 0. The three
shell hooks route through a new front door, .codex/hooks/run_sh.py.
codex_hook_adapter.run_shell_script resolves the Git for Windows sh.exe by
anchoring on git.exe and the standard install roots, so the shell scripts
run even when Git's usr\bin is off PATH, and hands session-catchup.py a
real interpreter via PYTHON_BIN. docs/codex.md Windows section rewritten.
Version bump 3.4.0 to 3.4.1 across the 17-file parity set. New tests: a
cross-platform guard that every hook declares a commandWindows free of the
POSIX tokens that break on Windows, and a Windows-only run_sh.py end-to-end
test. Reported by @mahdiit.
Version bumped to 3.2.0 across the 17 parity-locked files via
scripts/bump-version.py. .continue, .gemini, .pi, and .kiro lag
intentionally, now documented directly in AGENTS.md.
CHANGELOG, CONTRIBUTORS, and README updated. docs/evals.md gets a new
Test 4 documenting the functional verification of v3's long-running-session
mechanism on Windows, the two bugs it found, and what was fixed.
The v3.1.2 description refresh added a colon (AI coding agents: keeps), but the English SKILL.md carry the description field unquoted, so the frontmatter became invalid YAML (mapping values are not allowed here), which can break skill loading and the model-triggering description. v3.1.3 quotes the description across the canonical file and the seven English IDE variants; the parsed value is identical and the translated variants were already quoted. The clawhub-upload bundle was corrected the same way.
Adds tests/test_skill_frontmatter_valid.py: loads every SKILL.md frontmatter as YAML and guards against an unquoted description containing a colon-space. The version-parity check is a regex and missed this. Version bumped to 3.1.3 across the 17 parity files. Suite: 184 passed, 4 skipped.
Adopts PR #186 by @shunfeng8421 (closes#185). The documented session-catchup command used ${CLAUDE_PLUGIN_ROOT}, which the plugin runtime sets only inside hook execution, so skill-only installs (npx skills add, Codex, Cursor) running it in a shell got an empty variable and a broken /scripts path. Fixed with SKILL_DIR="${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/skills/planning-with-files}".
Also: extend the same fallback to the .hermes variant ($HERMES_HOME, bash + PowerShell) which #186 missed; refresh the 8 English SKILL.md descriptions for discoverability (Use-when trigger unchanged, translations untouched); bump to 3.1.2 across the 17 parity files; CHANGELOG, CONTRIBUTORS (@shunfeng8421, ack @xwang118), README, CITATION. Suite: 180 passed, 4 skipped, 0 failed.
Documentation-only patch on top of PR #184 by @Fat-Jan. The docs/codex.md verification command greped '^codex_hooks\s', which stopped matching after Codex moved its canonical feature key to 'hooks' in 0.129.0 (openai/codex#20522). Updated to '^(hooks|codex_hooks)\s' and aligned the troubleshooting sentence to cover both names.
Version bumped to 3.1.1 across the 17 parity-locked files via scripts/bump-version.py. CHANGELOG [3.1.1], CONTRIBUTORS (@Fat-Jan), README badge + releases row, CITATION date updated. Suite: 180 passed, 4 skipped, 0 failed.
Adopts PR #180 (@2023Anita, closes#178), PR #181 (@GongYuanCaiJi), PR #175 and
PR #174 (@mvanhorn, close#163 and #164), each preserving the contributor as
commit author. Bumps the 17 parity-locked files to 3.1.0, adds the CHANGELOG
entry, credits all three contributors in CONTRIBUTORS.md, and updates the README
version badge and releases table. Python suite 180 passed / 4 skipped.
Version bump across the 17-file parity set plus the kiro suffix scheme
(3.0.0-kiro). CHANGELOG entry for v3.0.0. README: v3 banner, version
badge, positioning line under the title, releases-table row. CITATION.cff
date-released updated. media/v3-banner.png now tracked for the README
top; the oversized variant stays gitignored permanently.
Merges two contributor PRs from @carterusedulm2-maker filed on 2026-05-25 plus
v2.42 transparency documentation surfaced by a deep audit of the v2.38.0
turn-loop integration on the same date.
PR #169 (4443737, by @carterusedulm2-maker): replaces the bash-only
"while [[ $# -gt 0 ]]" loop condition in init-session.sh with the POSIX
"while [ $# -gt 0 ]" across the 8 mirrored copies. The script's shebang is
"#!/usr/bin/env bash", but tests/test_init_session_slug.py:27 invokes the
script via ["sh", str(INIT_SH), *args] which bypasses the shebang and runs
the body under dash on Ubuntu, where [[ ... ]] is a syntax error. Behavior
identical under bash; the change only restores compatibility under dash so
the slug-mode test suite runs portably.
PR #170 (c5afda4, by @carterusedulm2-maker): documents an optional Topic
Handoff Pattern in docs/quickstart.md and docs/workflow.md for splitting
unrelated topics across .planning/<slug>/ directories or a manual
handoffs/<topic>.md detail layer alongside progress.md. Documentation only;
no shipped script reads handoffs/.
Install-scope transparency (canonical SKILL.md, README, CHANGELOG): the
v2.38.0 turn-loop integration shipped /plan-goal and /plan-loop as
plugin-scoped slash commands under commands/. Skill-only installs via
"npx skills add" or ClawHub land at ~/.claude/skills/planning-with-files/
and never see the commands/ folder. Previous SKILL.md wording read as if
all install routes received the wrappers; they do not. v2.42.0 documents
the split in the Turn-Loop Integration section and adds a manual fallback
procedure that lets the agent reproduce /plan-goal and /plan-loop semantics
by issuing Claude Code's native /goal and /loop primitives directly. The
manual procedure also covers the disable-model-invocation refusal pattern
tracked in anthropics/claude-code issues #26251 and #41417 where some
sessions decline to fire the wrapper even when the user types it.
PreCompact hook, /loop and /goal primitive integration, and the
templates/loop.md planning-aware loop template ship to both install routes
as before; only the slash-command convenience wrappers are plugin-scoped.
Version bumped to 2.42.0 across 17 parity-locked files via
scripts/bump-version.py. .continue, .gemini, .pi, .kiro lag intentionally
per AGENTS.md release scope.
Tests: 130 pass, 2 skip (Windows exec-bit, pre-existing since v2.34.1),
0 fail. Security audit completed 2026-05-25 (.planning/2026-05-25-
security-audit/findings.md): semgrep 0 findings on 23 critical scripts,
no preinstall/postinstall in any package.json, no remote fetches in shipped
runtime code, SLUG_RE path-traversal defense parity confirmed across the
14 SKILL.md variants, attestation + delimiter framing intact.
Web research basis for the transparency block: Anthropic skill docs at
code.claude.com/docs/en/skills confirm that prompt-based slash commands
are the blessed Claude Code pattern (matches bundled skills like /loop,
/goal, /run, /verify, /debug). Quote: "Unlike most built-in commands,
which execute fixed logic directly, bundled skills are prompt-based: they
give Claude detailed instructions and let it orchestrate the work using
its tools." The commands/ and skills/ directories are now unified per
Anthropic: "Custom commands have been merged into skills." Plugin scope
still distinguishes installation surface from npx skills add.
ClawHub upload pending: clawhub-upload/SKILL.md synced to 2.42.0 by the
bumper; manual upload to clawhub.io is the maintainer's separate step.
PR #167 (merged by @gauravvojha): test_script_permissions.py now carries a class-level pytest.mark.skipif for sys.platform == 'win32'. The two pre-existing Windows exec-bit failures (present since v2.34.1) skip cleanly on NTFS while still running on Linux and macOS. Post-merge repair: the upstream patch landed with a duplicate standalone function and a nested method inside it; the class-level skipif was re-applied, imports re-sorted, and the orphaned function removed, so test logic stays identical. Closes#166.
PR #168 (merged by @CleanDev-Fix): adds docs/attestation-locking.md, a new page covering the attest-plan.sh write path, atomic temp-rename guarantee, optional flock advisory lock, macOS Windows Git Bash WSL fallback table, and the slug-mode parallel workflow. Linked from the canonical SKILL.md Security Boundary section. Closes#165.
Version bumped to 2.41.0 across the 17 parity-locked files via scripts/bump-version.py. Tests: 130 pass, 2 skip, 0 fail.
Ships v2.40.1 on top of @TomXPRIME's PR #158 (merged via rebase, full
authorship preserved on the prior commit).
Version bumped to 2.40.1 across 14 SKILL.md variants, plugin.json,
marketplace.json, and CITATION.cff via scripts/bump-version.py.
.continue, .gemini, .pi, .kiro lag intentionally per CLAUDE.md
release scope.
README catch-up: the Releases & Session Recovery table was at v2.38.1.
Added v2.40.1, v2.40.0, v2.39.0 rows and bumped Current Version header
+ Version badge to v2.40.1.
CONTRIBUTORS.md: @TomXPRIME entry extended with PR #158 work.
Tests: 130 pass / 2 pre-existing Windows exec-bit failures
(test_script_permissions, unchanged from v2.40.0 and unrelated to this
release). Parity test passes.
Bug fixes (items 1-5 in proposal_v2_40.md):
1. Hook resolution order inverted across UserPromptSubmit, PreToolUse, PreCompact.
Slug-mode now wins over legacy root task_plan.md when both exist. Closes the
bug where an active .planning/<slug>/ plan was silently bypassed in favor of
the root file. Resolution chain: PLAN_ID env > .planning/.active_plan >
newest .planning/<slug>/ by mtime > root fallback.
2. .active_plan target dir is validated. Dead pointers fall through cleanly.
3. .active_plan content is regex-validated as ^[A-Za-z0-9_][A-Za-z0-9._-]*$.
Whitespace-only and path-traversal corruption fall through instead of
producing weird path lookups. Tests cover whitespace, ../escape, and
leading-dot cases.
4. check-complete.sh wires into resolve-plan-dir.sh when no path arg given.
Restores slug-mode parity for any caller that invokes the script without an
explicit plan path.
5. Pi extension dangerous-command detection uses word-boundary regex. Benign
git push origin <branch> no longer triggers the warning; only --force,
--mirror, +ref, plus rm -rf, sudo, chmod 777/a+rwx, git reset --hard, git
clean -fd, fork bombs, dd to /dev/[sh]d[a-z].
Performance (items 6, 7):
6. mtime-keyed SHA-256 cache under ${TMPDIR:-/tmp}/pwf-sha cuts redundant hash
work on warm cache. Caches the result keyed by absolute plan-file path,
stores mtime + hash, skips sha256sum when mtime unchanged.
7. KV-cache hygiene on injected progress.md tail. Sub-second timestamps and
timezone-suffix forms are normalized to a stable epoch-zero form so the
model's prefix cache stays warm across turns. Manus-aligned.
Portability + races (items 19, 20):
19. resolve-plan-dir.sh portable mtime fallback chain: GNU stat -> BSD stat ->
date -r -> python3 -> python -> perl -> 0. Multi-plan workflows stop
silently degrading on non-GNU systems.
20. attest-plan.sh uses atomic temp+rename with optional flock guard.
Concurrent legacy-mode attestations stop producing truncated files that
triggered false [PLAN TAMPERED] warnings.
Tests: 130 pass / 2 pre-existing Windows exec-bit failures unchanged. +20 new
tests vs v2.39.0. See CHANGELOG for full inventory.
Version bumped to 2.40.0 across 14 SKILL.md variants + plugin.json +
marketplace.json + CITATION.cff via scripts/bump-version.py. .continue,
.gemini, .pi, .kiro lag intentionally.
Adds a bundled TypeScript extension under .pi/skills/planning-with-files/extensions/planning-with-files/
that maps Pi lifecycle events onto the same behavior the skill provides on Claude Code (PR #157 by
@TomXPRIME). Event surface: session_start, before_agent_start, tool_call, tool_result, agent_end,
session_before_compact, session_shutdown, input. Four modes: auto (DeepSeek-aware), parity,
cache-safe, notify. Attestation gate shares the v2.37 .attestation file. Four slash commands
registered (/plan-status, /plan-attest, /plan-goal, /plan-loop). 12 new contract tests.
Fixes docs/codex.md to use the canonical [features] hooks = true key (Issue #154 by @DLI1996),
with a deprecated-alias note so users on older configs keep working.
Version bumped to 2.39.0 across 14 SKILL.md variants, plugin.json, marketplace.json, CITATION.cff
via scripts/bump-version.py. .pi npm scheme bumped 1.0.1 -> 1.1.0 for the extension surface.
.continue, .gemini, .kiro lag intentionally.
Tests: 110 pass, 2 pre-existing Windows exec-bit failures unrelated to this release.
Hook commands embedded `'---BEGIN PLAN DATA---'` and `'---END PLAN DATA---'`
as plan-injection delimiters (v2.36.1, reinforced in v2.37 attestation).
Frontmatter parsers that split on the literal `---` substring to locate the
closing fence read the first `---` inside the hook command as the fence,
truncating the YAML mid-string. Claude Code's skill-discovery loader behaves
this way, so the description shown in the in-product skill list was a
fragment of the hook command tail instead of the documented description.
Real YAML parsers always handled the frontmatter correctly, so hook
execution and tamper attestation were never affected; only the displayed
metadata was wrong.
Swap delimiter shape to `===BEGIN PLAN DATA===` / `===END PLAN DATA===`
across canonical SKILL.md, all five language variants, the .codebuddy/
.codex/.cursor adapter mirrors, and the clawhub-upload bundle. Same
delimiter shape, same model-side framing semantics; `===` does not
collide with YAML's document separator.
Version bumped to 2.38.1 across 14 SKILL.md variants, plugin.json,
marketplace.json, CITATION.cff via scripts/bump-version.py. .continue,
.gemini, .pi, .kiro lag intentionally.
Surfaced by @bmyury via Discussion #153.
PreCompact hook fires on /compact and autoCompact. When task_plan.md is
present, surfaces a reminder to flush in-context progress to progress.md
before compaction completes and prints the active Plan-SHA256 if attested.
Stays silent without a plan. Exit 0 always; never blocks compaction.
/plan-goal composes with Claude Code's /goal (v2.1.139, May 12 2026).
Derives a termination condition from the active plan so /goal stops the
agent when the plan-file is genuinely complete, not just when the
conversation looks done.
/plan-loop composes with /loop (v2.1.72+). Default 10-minute tick re-reads
planning files, runs check-complete, nudges a progress.md entry if the
last tick produced no change. templates/loop.md ships a planning-aware
default for ~/.claude/loop.md so bare /loop works grounded in the plan.
OpenCode session-catchup rewritten for the SQLite migration (sst/opencode
dev @ 2026-05-14). Reads ${XDG_DATA_HOME:-~/.local/share}/opencode/opencode.db
read-only via URI, scopes by session.directory, surfaces unsynced planning
edits. Verified against a real 162 MB OpenCode database (94 sessions, 56
unsynced parts correctly extracted from the lovable-at-home directory).
Codex gains a PermissionRequest adapter that surfaces a one-line plan
reminder when an active plan exists. Read-only; never blocks.
Tests: +19 covering PreCompact behavior, slash command file structure,
OpenCode SQLite catchup with a synthetic schema-matching DB, and Codex
PermissionRequest emit/silent behavior. 98 tests passing.
Deliberately not changed: paths glob (auto-invocation behavior risk),
wholesale !command swap (would freeze attestation hash and defeat v2.37
tamper gate), native Plan Mode panel integration (no plugin API
documented), language variant consolidation (separate breaking-change
track). PreCompact lives in the canonical SKILL.md + 5 language variants
+ clawhub-upload; other IDE mirrors keep their existing compaction
hooks until per-IDE PreCompact adapters land in a future release.
Closes#150 (hash attestation): adds an opt-in second layer of defense for
plan injection. After v2.36.1 wrapped task_plan.md content in BEGIN/END
delimiters, the model still parsed the bytes. v2.37.0 adds /plan-attest, a
slash command that locks the current task_plan.md content with a SHA-256
stored at .planning/<active-plan>/.attestation (parallel-plan mode) or
./.plan-attestation (legacy mode). UserPromptSubmit and PreToolUse hooks
recompute the hash on every fire and emit "[PLAN TAMPERED — injection
blocked]" instead of plan content on mismatch. When attestation is set, the
injected context also carries a Plan-SHA256: line for audit. New helper:
scripts/attest-plan.sh and .ps1 with --show / --clear modes, propagated to
all six IDE mirrors that ship scripts.
Closes#151 (parity-locked version bumper): names the regression class
behind v2.34.1, v2.36.0, v2.36.2, v2.36.3 (one of N parity-locked files
forgotten on bump). Fixes it surgically without overshooting into
"regenerate all SKILL.md from canonical" (per-IDE frontmatter and per-
language prose are intentionally divergent). New
scripts/bump-version.py atomically bumps the parity set in one shot. New
tests/test_skill_md_version_parity.py fails the build the moment any
parity-locked file diverges from the canonical version. .continue,
.gemini, .pi, .kiro stay on their separate schemes and are surfaced in
every bump-version run so the omission is explicit.
Other changes:
- tests/test_canonical_script_sync.py: removed leftover duplicate
CanonicalScriptSyncTests class block (lines 99 to 137); SHARED_SCRIPTS
extended to ten entries for attest-plan.{sh,ps1}.
- scripts/sync-ide-folders.py: SCRIPTS manifest extended to cover
attest-plan helpers; existing eight scripts unchanged.
- canonical SKILL.md Security Boundary section: documents the two layers
of defense and the /plan-attest workflow.
- 14 SKILL.md variants + plugin.json + marketplace.json + CITATION.cff
bumped to 2.37.0 via scripts/bump-version.py (.continue / .gemini /
.pi / .kiro left on their own schemes per release scope rule).
Tests: 78 pass, 2 pre-existing Windows exec-bit failures unchanged.
resolve-plan-dir.{sh,ps1} and set-active-plan.{sh,ps1} were added to
scripts/ in v2.36.0 but never reached skills/planning-with-files/scripts/
or the IDE mirror folders. Users installing via npx skills could not use
the parallel planning workflow because the required scripts were absent.
Adds all four scripts to the canonical skill location. Updates
sync-ide-folders.py SCRIPTS manifest to include them, and propagates to
all IDE mirrors via the sync tool (24 new files across 6 IDE folders).
Strengthens test_canonical_script_sync.py to cover all 8 user-facing
scripts (was 4), so this class of gap trips the regression test going
forward.
Documents resolve-plan-dir.sh and set-active-plan.sh in the canonical
SKILL.md Scripts section with usage descriptions and a parallel task
workflow example.
Closes the v2.36.0 regression where slug-mode init-session.sh shipped only in
scripts/ and never reached skills/planning-with-files/scripts/ or the nine IDE
mirror folders. Users installing via npx skills or any IDE folder silently
received the v2.0.0 legacy-only script.
Also synced:
- analytics template support in init-session.ps1 (missed since v2.29.0)
- /usr/bin/env bash shebang in IDE mirror check-complete.sh files (drift from v2.35.1)
Adds tests/test_canonical_script_sync.py: byte-comparison assertion between
scripts/ and skills/planning-with-files/scripts/ for init-session and
check-complete, plus sync-ide-folders.py --verify assertion to catch IDE mirror
drift in CI going forward.
Closes security audit findings from skills.sh platform audits.
Stop hook: replace broad Get-ChildItem -Recurse over ~/.claude/plugins/cache
with resolution through $CLAUDE_SKILL_DIR env var first, then two specific
known install paths. Removes arbitrary code execution risk from cache
directory poisoning.
PowerShell ExecutionPolicy: Bypass -> RemoteSigned across all 14 SKILL.md
variants. RemoteSigned allows local scripts while blocking unsigned downloaded
scripts. Bypass was flagged as privilege escalation by Gen Agent Trust Hub.
Prompt injection delimiters: UserPromptSubmit and PreToolUse hooks now wrap
injected plan content in ---BEGIN PLAN DATA--- / ---END PLAN DATA--- markers
with explicit model instruction to treat contents as structured data and ignore
embedded instructions. Addresses the lack of sanitization boundary flagged in
the PROMPT_INJECTION finding.
Security Boundary docs: updated to document delimiter contract and add
explicit instruction that findings.md content (third-party web/search results)
must be treated as raw data. Addresses Snyk W011 third-party content exposure.
Closes#146, #147, #148.
Parallel plan isolation (#148, @shawnli1874): init-session.sh slug mode
creates .planning/YYYY-MM-DD-<slug>/ for each task. set-active-plan.sh/.ps1
switch the active plan pointer. resolve-plan-dir.sh/.ps1 provide the
resolution chain ($PLAN_ID env, .active_plan file, newest plan dir, legacy
fallback). All four Codex hooks route through the resolver. resolve_latest_dir
now requires task_plan.md to be present, preventing system dirs like sessions/
from being selected as plan dirs. short_uuid() probes each Python candidate
before trusting command -v, fixing silent failure on Windows Store aliases.
Codex session isolation (#146, @githubYiheng): sessions attach to a plan by
creating .planning/sessions/<session_id>.attached. user-prompt-submit.sh,
pre_tool_use.py, stop.py, and post_tool_use.py all gate on session attachment
before injecting context or blocking. Legacy mode preserved when
.planning/sessions/ does not exist.
Hermes integration notes (#147, @09ashishkapoor): docs/hermes.md gains an
Integration Notes section covering current support level, what is not full
parity with hook-native platforms, recommended integration pattern, and a
tradeoffs table.
34 new tests across five files. Version bumped to 2.36.0 across 14 SKILL.md
variants, plugin.json, marketplace.json, and CITATION.cff.
- Add Hermes adapter (PR #136 by @bailob): full skill bundle, Python adapter, /plan + /plan-status commands, 20 unit tests. Platform 17.
- Fix Pi PowerShell session-catchup missing quote (PR #137 by @xiaolai, closes part of #140)
- Cap session-catchup output at 100 lines with labeled prefix (PR #138 by @xiaolai, closes part of #140)
- Prefer known system Python paths over PATH in hook scripts (PR #139 by @xiaolai, closes part of #140)
- Add Hermes badge to README, bump IDE count to 17+, add hermes keyword in plugin.json
- Bump 14 SKILL.md variants, plugin.json, marketplace.json, CITATION.cff to 2.35.0
- Update CONTRIBUTORS.md: @bailob, @xiaolai added; total 36+
Restores .codex/hooks.json and .codex/hooks/ scripts that were wiped when
master was rewritten during v2.32.0 (closes#132, original work by @Leon-Algo
in PR #120). Codex users now have full lifecycle hook parity with Claude Code,
Cursor, and Copilot: SessionStart, UserPromptSubmit, PreToolUse, PostToolUse,
and Stop hooks all active.
Also includes:
- Tessl skill-review CI from PR #131 (@popey)
- Exec bit fix from PR #122 (@Leon-Algo) + regression test
- Duplicate metadata.version key fixed in .codebuddy, .cursor, .mastracode,
.opencode, and .codex SKILL.md files
- docs/codex.md rewritten to cover hooks installation and protocol
- CONTRIBUTORS.md: added @Leon-Algo, @YSAA1, @kevinaimonster, @wd041216-bit;
updated @lasmarois entry to include PR #37; total now 32+
- Version bumped to 2.34.0 across all 17 SKILL.md variants, plugin.json,
marketplace.json, and CITATION.cff
OthmanAdi