From 798419668ae99cfc372228d97a14c4f56db522c5 Mon Sep 17 00:00:00 2001 From: Austin Gregg-Smith Date: Wed, 9 Sep 2026 10:19:01 +0000 Subject: [PATCH] Cut 0.35.0 The [Unreleased] section as it stood becomes the release: the container feature learns to share skills between Claude and Codex, plus two corrections to what the feature's own documentation was telling people. `~/.agents/skills` is mounted for Codex alongside Claude's discovery directory, and `~/.claude/shared-skills` is mounted read-only so a relative link can point into it without making the skill body writable from the container. Both storage layouts resolve across differing host and container usernames. The feature creates the missing mount roots and touches no existing skill or link. The documentation fixes are the half worth reading twice, because both were telling a developer something false. The troubleshooting page's `What's Protected (Read-Only)` listed `CLAUDE.md` and `settings.json`, neither of which is protected: a write to either reaches the host, and `settings.json` can name a hook command inline, so that one is host command execution. And the remedy for `bind mount source path does not exist` created three of the seven directories the create needs, so following it left the create refused, while also truncating the reader's `settings.json`. **0.35.0 and not 0.34.1.** No flag moves and the CLI surface is unchanged, so the patch reading is available, and a repo that does not enable this feature sees nothing different. But what a launch produces changes for repos that do: two host directories are mounted that were not, the feature's own version goes 0.5.0 to 0.6.0, and an existing container has to be recreated before it sees either. That is the same test 0.34.0 and 0.33.0 both applied to themselves. Version, lockfile and the README's two references move together, which test_readme_cli_doc holds against `dl --version`; the lockfile follows the workspace version for dl, aid, devlaunch-core, devlaunch-runner and devlaunch-test-support. Cut on a release branch so the version bump is a reviewable diff and the publish fires on the merge. Claude-Session: https://claude.ai/code/session_01HWRhzmUMVpUo5RB6ZNScFH --- CHANGELOG.md | 16 ++++++++++++++++ README.md | 4 ++-- rust/Cargo.lock | 10 +++++----- rust/Cargo.toml | 2 +- 4 files changed, 24 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f1ff7fbb..b6d6652c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +## [0.35.0] - 2026-09-09 + ### Added - The local container feature shares `~/.agents/skills` with Codex and mounts @@ -15,6 +17,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 links cannot modify the host's shared skill bodies. Existing containers need recreation to receive the mounts. +### Fixed + +- **The feature's own troubleshooting page no longer claims protection it does + not provide.** `What's Protected (Read-Only)` listed `CLAUDE.md` and + `settings.json`, both of which are writable from the container and reach the + host, and a write to `settings.json` is host command execution because it can + name a hook command inline. The README's equivalent section had been + corrected; this copy was missed. +- **The documented way to unblock a refused container create now creates every + directory the create needs.** `bind mount source path does not exist` told the + reader to make three of the seven mounted directories, so following it left + the create refused, and to run `echo '{}' > ~/.claude/settings.json`, which + truncates the settings file of anyone who already had one. + ## [0.34.0] - 2026-09-09 ### Fixed diff --git a/README.md b/README.md index a331c420..a932efb6 100644 --- a/README.md +++ b/README.md @@ -19,7 +19,7 @@ one argument instead of a clone, a config file and a build command. [![GitHub pull-requests merged](https://badgen.net/github/merged-prs/blooop/devlaunch)](https://github.com/blooop/devlaunch/pulls?q=is%3Amerged) [![GitHub release](https://img.shields.io/github/release/blooop/devlaunch.svg)](https://GitHub.com/blooop/devlaunch/releases/) [![PyPI](https://img.shields.io/pypi/v/devlaunch)](https://pypi.org/project/devlaunch/) -[![Conda](https://img.shields.io/badge/conda-v0.34.0-brightgreen?logo=anaconda)](https://prefix.dev/channels/blooop/packages/devlaunch) +[![Conda](https://img.shields.io/badge/conda-v0.35.0-brightgreen?logo=anaconda)](https://prefix.dev/channels/blooop/packages/devlaunch) [![License](https://img.shields.io/github/license/blooop/devlaunch)](https://opensource.org/license/mit/) [![Platform](https://img.shields.io/badge/platform-linux--64-blue)](https://github.com/blooop/devlaunch/releases) [![Pixi Badge](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/prefix-dev/pixi/main/assets/badge/v0.json)](https://pixi.sh) @@ -276,7 +276,7 @@ clone, and [docs/cleanup.md](docs/cleanup.md) says what it carries one past and ```bash $ dl --version -dl 0.34.0 +dl 0.35.0 ``` `--devcontainer ` picks a non-default `devcontainer.json`. A bare name means diff --git a/rust/Cargo.lock b/rust/Cargo.lock index 84801814..00c90b5c 100644 --- a/rust/Cargo.lock +++ b/rust/Cargo.lock @@ -13,7 +13,7 @@ dependencies = [ [[package]] name = "aid" -version = "0.34.0" +version = "0.35.0" dependencies = [ "devlaunch-test-support", "dl", @@ -437,7 +437,7 @@ dependencies = [ [[package]] name = "devlaunch-core" -version = "0.34.0" +version = "0.35.0" dependencies = [ "devlaunch-runner", "devlaunch-test-support", @@ -455,7 +455,7 @@ dependencies = [ [[package]] name = "devlaunch-runner" -version = "0.34.0" +version = "0.35.0" dependencies = [ "libc", "portable-pty", @@ -464,7 +464,7 @@ dependencies = [ [[package]] name = "devlaunch-test-support" -version = "0.34.0" +version = "0.35.0" dependencies = [ "devlaunch-runner", "serde", @@ -506,7 +506,7 @@ dependencies = [ [[package]] name = "dl" -version = "0.34.0" +version = "0.35.0" dependencies = [ "clap", "devlaunch-core", diff --git a/rust/Cargo.toml b/rust/Cargo.toml index c239568e..d40c9439 100644 --- a/rust/Cargo.toml +++ b/rust/Cargo.toml @@ -11,7 +11,7 @@ members = [ # The single source of the version (docs/rust-rewrite-plan.md: cutover ships # 0.1.0, version read from Cargo.toml). [workspace.package] -version = "0.34.0" +version = "0.35.0" edition = "2024" license = "MIT" repository = "https://github.com/blooop/devlaunch"