v1.11.0 — execute-only exception for Claude Code skill scripts

Added

• .py / .sh helper scripts under ~/.claude/skills/ are now execute-only exempt from the strict outside-project execute block in block_shell_script_execution. Skills that ship helper scripts (e.g. reader-knowledge-audit's render-report.py, reader-knowledge-audit-loop-hook's arm.sh) were previously unusable from any project other than the one the skill happened to be developed in, since the exec walker has no allowlist by design (an execute-allowlisted write dir would become an RCE escape hatch). The exception is scoped tightly to ~/.claude/skills/**/*.py and ~/.claude/skills/**/*.sh and covers execute only — the Write/Edit/MultiEdit hooks still block any write to that path, so nothing new can land there through Claude's own tool calls.

See CHANGELOG.md for full detail.

v1.10.0 — Windows-smoke CI, jq canary, per-token cygpath, sec 108–114 cluster

Accumulates work since v1.9.0.

Platform & defense-in-depth

• Windows-smoke CI job on windows-latest MSYS2 (#29)
• jq behaviour canary at hook entry (#32 hardening)
• Per-token Windows path rewrite in COMMAND (#34, sec 108–110)
• NTFS reparse-point regression anchor (#31, cd -P traversal verified)

Closed bypass categories

sec 108, 109, 110, 111, 112, 113, 114 — see CHANGELOG.md for per-section detail and commits.

Quality

• Anti-facade skill v2.1.0 dogfooded — F10 empirical-exec caught sec 115 candidate as defending a non-existing bypass; reverted.
• External Codex verification surfaced 2 LOW gaps in sec 112–114 cluster (tar/zip coverage closed in 2ab4c75; parallel-walker risk logged).
• Test suite: 1583 / 1583 green on Linux/macOS; windows-smoke 15 / 15.

README

Adds 7z row to boundary table; Windows-COMMAND / jq-canary / NTFS-reparse to Additional protections; Windows-smoke to CI line.

v1.9.0 — issue #21 remote-dispatch fix

Generic remote_dispatch neutralisation closing issue #21.

Highlights

• remote_dispatch neutralisation across 3 shape classes
• Copilot-review hardening rounds:
  • nsenter / chroot + run-class exclusions
  • kubectl / oc cp flag-value bypass closure
• Tests: 873 / 873 (+39 since 1.8.0)

v1.8.0 — install/rsync walker bypass closures

Security — closes 3 bypass categories in install / rsync walkers

• A. install POSIX double-dash bypass — walker treated -- as just another flag-looking token; quoted "--" (or bare --) followed by an outside-project target slipped through. Fixed in b460e57.
• B. rsync POSIX double-dash bypass — same shape as A in the rsync walker (fix in 5b11dbe; ce011af strips quotes before the -- test so "--" / '--' cannot smuggle the marker past).
• C. install mode/user_group flag-skip bypass — -m MODE / -o OWNER / -g GROUP skip consumed the next token unvalidated; an outside-project path supplied as the "value" left the real target unscanned. Fixed in bab3ffe.

Hardening — Codex review follow-ups

• Surgical flag-skip with quote-aware comparison; settled shape (f76ec34) keeps strip_quotes view for both -- test and -* flag-skip, routes attached --name=PATH through path validation only when name is on the write-target white-list. --mode=, --owner=, --group=, -mPATH etc. deliberately not path-validated.
• Replaced the =/ heuristic with an explicit write-target option white-list (00d7300), eliminating false positives on read-only options that take an absolute path.
• Added rsync --write-batch=FILE / --only-write-batch=FILE to the white-list (8141400).

Quality of life

• session_hint.md now documents $VAR / ${VAR} fail-closed (only $HOME allowed). Was only mentioning $(...); agents repeatedly burned tool calls on P=...; grep "$P" style invocations.
• tests/test_bash_advanced.sh §50 (22 cases) pins the variable-expansion contract.
• tests/test_bypass_reproducers_recent.sh §27 (14 cases) pins attached-flag behavior so future doc drift is caught by the suite.

Refactor

• hooks/guard.sh decomposed into detector clusters (#16) and split into modules (#15).
• tests/test_bypass_reproducers.sh split into _core.sh + _recent.sh (was past 1000 lines).

Tests

821 passed / 0 failed. All 3 closures land via the project TDD flow: one bypass per commit, reproducer fails first, fix commit follows.

Notes

• plugin.json bumped to 1.8.0. Per project invariant, v1.1.0 remains marketplace-latest; this tag is a release marker, not a marketplace publish.
• Full v1.8.0 changelog in CHANGELOG.md.

v1.1.0

Current plugin release on main. Install: claude --plugin-dir /path/to/claude-code-project-boundary or via davepoon/buildwithclaude marketplace. See README for details.