v1.8.0

Minor release: the guard runs on Windows. It guards the PowerShell tool with its own tokenizer and cmdlet table, reads Git Bash path forms the way Git Bash does, and is validated against real Windows in continuous integration (CI) — plus parsing hardening for heredocs, IFS, and loop variables.

Important

On Windows the guard was silently enforcing nothing before this release. All three hook entries invoked python3, which normally resolves to the Microsoft Store alias stub — it exits 9009, and Claude Code treats a failed PreToolUse hook as a non-blocking error. Upgrading turns enforcement on for the first time, so expect prompts on a Windows session that had none. No action is required: the hook now routes through a polyglot launcher that probes interpreters by executing them, and says so on stderr when none works.

PowerShell coverage is deliberately partial — a cmdlet outside the table, a .NET call, or a native .exe is not checked, and the hook does not announce that it skipped them. See Limitations for why that's the posture and what it costs.

Windows

• fix: resolve Python interpreter portably so the hook runs on Windows by @smoochy in #94
• fix: derive the Claude temp root without os.getuid() on Windows by @smoochy in #103
• feat(powershell): guard the PowerShell shell tool (Q51) by @karlkfi in #120
• fix(parsing): read Git Bash path forms the way Git Bash does (Q52) by @karlkfi in #119
• fix(parsing): let a Windows drive prefix be a pure assignment value (Q48) by @karlkfi in #115
• fix: resolve the home directory portably for the read-allow prefix (Q40) by @karlkfi in #108
• fix(parsing): expand a leading ~ from the resolved home (Q43) by @karlkfi in #113
• fix(windows): make the Windows suite pass (Q39) by @karlkfi in #107
• test(ci): validate the guard against real Windows Git Bash (Q44) by @karlkfi in #118

Parsing

• fix(parsing): scan an expanded heredoc body on its own (Q50) by @karlkfi in #122
• fix(parsing): skip $(…) in a quoted-delimiter heredoc body (Q35) by @karlkfi in #117
• fix(parsing): stop propagating when any command may set IFS (Q49) by @karlkfi in #116
• fix(parsing): bind a for list built from an outer loop variable by @karlkfi in #109
• fix(parsing): resolve a for-list glob as its own pattern by @karlkfi in #104
• fix(parsing): bound the loop-variable cross product (Q46) by @karlkfi in #114

friction-report

• fix(friction-report): bucket unmatched reasons as other and scope the path table by @karlkfi in #98
• fix(friction-report): explain an empty result instead of printing zero by @karlkfi in #100
• fix(friction-report): name what the scan cannot see by @karlkfi in #102

Continuous integration (CI), backlog, and documentation-only changes are folded into the changelog link below. Validation: 968 tests pass on macOS (8 skipped); the Windows job runs the same suite under both pwsh and Git Bash behind a skip ceiling.

Full Changelog: v1.7.2...v1.8.0

v1.7.2

Patch release: closes two write-guard gaps where read-exempt directories (e.g. ~/.claude/projects/) could be silently written to.

• fix: treat in-place/output flags (sed -i, gawk -i, yq -i, sort -o) as write mode in read-exempt dirs (Q36) by @karlkfi in #93
• fix: guard positional output files of uniq IN OUT / xxd IN OUT in read-exempt dirs (Q37) by @karlkfi in #93

Full Changelog: v1.7.1...v1.7.2

v1.7.1

Patch release: documentation corrections.

• fix: correct stale claim that Read/Grep/Glob bypass the hook by @karlkfi in #91
• docs: fully-qualify /friction-report slash command references by @karlkfi in #89

Full Changelog: v1.7.0...v1.7.1

v1.7.0

Minor release: parsing hardening for pure substitutions and heredocs, plus a post-cd prompt fix.

• feat: resolve whitelisted pure substitutions in file operands by @karlkfi in #86
• feat: parse heredoc bodies as opaque data before shlex by @karlkfi in #87
• fix: name resolved absolute paths in post-cd prompts; correct untracked-cd docs by @karlkfi in #88

Full Changelog: v1.6.0...v1.7.0

v1.6.0

Minor release: the guard now reaches into command substitutions and host-temp file creation, closing several bypasses around mktemp and shell wrappers.

• feat: guard commands inside quoted "$(…)"/backtick substitution bodies (Q33) by @karlkfi in #82
• feat: guard host-temp writes via unguarded redirects and mktemp (Q26) by @karlkfi in #77
• feat: guard commands prefixed by shell keywords (Q28) by @karlkfi in #74
• feat: decode mktemp combined short flags (Q32) by @karlkfi in #80
• feat: honor inline TMPDIR= literal in mktemp default location (Q34) by @karlkfi in #81
• feat: resolve for VAR in <literal list> loop variables by @karlkfi in #73
• feat: friction-report flags a stale installed version (Q30) by @karlkfi in #76
• Split glued operator runs into separate tokens (Q27) by @karlkfi in #75

Full Changelog: v1.5.0...v1.6.0

v1.5.0

Minor release: the guard now extends to Claude Code's native file tools, not just Bash.

• feat: guard native Read/Grep/Glob and widen Edit/Write (Q29) by @karlkfi in #69
• docs: migrate backlog to counter + Deferred format, install lint gate by @karlkfi in #68

Full Changelog: v1.4.0...v1.5.0

v1.4.0

Minor release: a new worktree-aware write boundary, plus several false-positive reductions in command parsing.

• feat: worktree-aware boundary — deny writes into sibling checkouts by @karlkfi in #67
• feat: resolve literal in-command variable assignments before flagging runtime-expanded args by @karlkfi in #63
• feat: exempt same-project sibling session scratch reads by @karlkfi in #65
• feat: resolve whitelisted pure substitutions in cd targets by @karlkfi in #64
• fix: eliminate false-positive file-arg tokens (comments, heredoc bodies, literal $) by @karlkfi in #66

Full Changelog: v1.3.0...v1.4.0

v1.3.0

Minor release: opt-in exemption for ~/.claude/projects/ reads via ALLOWED_READ_PREFIXES.

• feat: add ALLOWED_READ_PREFIXES to exempt ~/.claude/projects/ reads by @karlkfi in #57

Full Changelog: v1.2.0...v1.3.0

v1.2.0

Minor release: host-wide temp (/tmp) paths now deny by default and steer to a repo-local scratch dir, configurable via env vars.

• feat: deny host-wide temp (/tmp) paths, steer to repo-local scratch by @karlkfi in #55

Plus internal agent-guidance updates (#54).

Full Changelog: v1.1.0...v1.2.0

v1.1.0

Minor release: a new prompt-reduction toolkit (/friction-report) plus several parsing-accuracy improvements that cut avoidable confirmation prompts.

New surface

• Add /friction-report slash command + transcript analyzer to measure where Bash permission prompts accumulate by @karlkfi in #53, #46, #51

Parsing accuracy

• Track cd-shifts when resolving redirect targets (Q16) by @karlkfi in #52
• Allow the current session's own Claude temp scratch (Q21) by @karlkfi in #49
• Drop fd-prefixed redirect tokens instead of misreading them as files (Q20) by @karlkfi in #48
• Expand ~/~/… to $HOME instead of flagging it (Q19) by @karlkfi in #47

Docs

• Promote vendored-source-over-global-cache guidance (Q22) by @karlkfi in #50

Full Changelog: v1.0.2...v1.1.0