Release 0.35.0

CHANGELOG.md

@@ -7,6 +7,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.35.0] - 2026-09-09
+
 ### Added
 
 - The local container feature shares `~/.agents/skills` with Codex and mounts
@@ -15,6 +17,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   links cannot modify the host's shared skill bodies. Existing containers need
   recreation to receive the mounts.
 
+### Fixed
+
+- **The feature's own troubleshooting page no longer claims protection it does
+  not provide.** `What's Protected (Read-Only)` listed `CLAUDE.md` and
+  `settings.json`, both of which are writable from the container and reach the
+  host, and a write to `settings.json` is host command execution because it can
+  name a hook command inline. The README's equivalent section had been
+  corrected; this copy was missed.
+- **The documented way to unblock a refused container create now creates every
+  directory the create needs.** `bind mount source path does not exist` told the
+  reader to make three of the seven mounted directories, so following it left
+  the create refused, and to run `echo '{}' > ~/.claude/settings.json`, which
+  truncates the settings file of anyone who already had one.
+
 ## [0.34.0] - 2026-09-09
 
 ### Fixed

README.md

@@ -19,7 +19,7 @@ one argument instead of a clone, a config file and a build command.
 [![GitHub pull-requests merged](https://badgen.net/github/merged-prs/blooop/devlaunch)](https://github.com/blooop/devlaunch/pulls?q=is%3Amerged)
 [![GitHub release](https://img.shields.io/github/release/blooop/devlaunch.svg)](https://GitHub.com/blooop/devlaunch/releases/)
 [![PyPI](https://img.shields.io/pypi/v/devlaunch)](https://pypi.org/project/devlaunch/)
-[![Conda](https://img.shields.io/badge/conda-v0.34.0-brightgreen?logo=anaconda)](https://prefix.dev/channels/blooop/packages/devlaunch)
+[![Conda](https://img.shields.io/badge/conda-v0.35.0-brightgreen?logo=anaconda)](https://prefix.dev/channels/blooop/packages/devlaunch)
 [![License](https://img.shields.io/github/license/blooop/devlaunch)](https://opensource.org/license/mit/)
 [![Platform](https://img.shields.io/badge/platform-linux--64-blue)](https://github.com/blooop/devlaunch/releases)
 [![Pixi Badge](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/prefix-dev/pixi/main/assets/badge/v0.json)](https://pixi.sh)
@@ -276,7 +276,7 @@ clone, and [docs/cleanup.md](docs/cleanup.md) says what it carries one past and
 
 ```bash
 $ dl --version
-dl 0.34.0
+dl 0.35.0
 ```
 
 `--devcontainer <variant|path>` picks a non-default `devcontainer.json`. A bare name means

rust/Cargo.toml

@@ -11,7 +11,7 @@ members = [
 # The single source of the version (docs/rust-rewrite-plan.md: cutover ships
 # 0.1.0, version read from Cargo.toml).
 [workspace.package]
-version = "0.34.0"
+version = "0.35.0"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/blooop/devlaunch"