volens 0.2.1 — the content-language pin is validated

One string came in unvalidated. The instruction the hook delivers carries exactly one project-controlled value — the content language read from .volens/lang — and it was embedded as found, after stripping ASCII whitespace only. A no-break space, or a whole sentence, survived that; the JSON stayed valid; and the text arrived in a channel framed as instructions, on the machine of anyone who cloned the project.

What changed. The pin is now read as a language tag and nothing else: zh, en, zh-CN, zh-Hans-CN pass. A value that is not a tag is treated like a missing pin — the hook falls back to your preference — and the next sync notice says which language is actually in force, so an ignored pin and a working one no longer look alike. The skill writes a tag rather than the language's own name, and the READMEs say the same. Your user-level preference at ~/.config/volens/lang is your own file and still falls back silently.

Upgrading. codex plugin marketplace upgrade volens pulls the marketplace snapshot and the plugin cache together, and no re-trust is needed: the trusted hash covers the command string, not the script.

If you added the marketplace with --ref (the branch the Codex side was developed on), that ref no longer moves. Remove the marketplace and add it again without a ref so it follows main, which is what the install instructions do.

Also in this release. The opening line names the ChatGPT desktop app among the supported surfaces, where the README already documented installing.

---

Install. Claude Code: /plugin marketplace add https://github.com/funcpn/volens.git, then /plugin install volens@volens. Codex: codex plugin marketplace add https://github.com/funcpn/volens, then codex plugin add volens@volens — the first session asks once to trust the hook; choose Trust all and continue. In the ChatGPT desktop app, installing does not authorize the hook: open the plugin's manage page and choose Trust all under "1 hook needs review before it can run".

Requirements. git on your PATH, git able to reach GitHub, and a bash to run the hook with: macOS and Linux ship one, and on Windows it comes from Git for Windows (the bash.exe under System32 is WSL's launcher and does not count).