chore(release): v0.2.1

Bump all version carriers (plugin.json, package.json, README badge,
SKILL.md frontmatter) and record the release in the changelog.

Also backfills the missing [0.2.0] changelog section: that release shipped
without one, which would have left the changelog jumping 0.1.0 -> 0.2.1.
Content reconstructed from the v0.2.0 commit, not from its subject line.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CvTviFeoMCKJcALATRempy

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "coord",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Local mailbox for coordination between Claude Code sessions in different repositories. Directed messages and broadcasts as plain Markdown files on your own disk, injected as context at session start. Local, private, no network.",
   "author": {
     "name": "Kjell Tore Guttormsen"

CHANGELOG.md

@@ -5,6 +5,47 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.1] - 2026-07-25
+
+### Fixed
+
+- Broadcast self-delivery: `coord-send --broadcast` left no seen-set entry for
+  the sender, so the announcing repo got its own announcement injected at its
+  next session start. The delivered filename is now recorded in
+  `_broadcast/seen/<sender>` at delivery time, reusing the existing per-repo
+  seen set rather than adding a second exclusion mechanism. Filtering on the
+  `from:` field at read time was rejected: `from:` is sender-controlled, so it
+  would let any repo suppress a broadcast for another by forging the field.
+  The seen file is keyed by the raw sender name (the read side keys it
+  unsanitized, so the two must agree); senders containing a slash, or equal to
+  `.`/`..`, skip the marking rather than escape the directory.
+
+### Added
+
+- Selftest: 64 -> 68 checks, covering sender self-exclusion, unaffected
+  delivery to other repos, self-exclusion for sender names that are not
+  shell-clean, and the seen-marking path-escape guard.
+
+## [0.2.0] - 2026-07-24
+
+Hardening pass over the three CLIs.
+
+### Fixed
+
+- Atomic delivery: the temp file is created inside the destination directory
+  (dot-prefixed, invisible to the inbox glob), so the final rename never
+  crosses filesystems and readers never observe a half-written message.
+- `.` and `..` are rejected explicitly in the `--reply-to` and `coord-done`
+  name guards instead of relying on downstream failure.
+
+### Added
+
+- `-h`/`--help` on `coord-inbox.sh`, making usage output uniform across the
+  three CLIs.
+- Selftest: 48 -> 64 checks, closing gaps around the default mailbox path via
+  `HOME` fallback, malformed frontmatter on the read path, and a read-only
+  destination directory.
+
 ## [0.1.0] - 2026-07-24
 
 First public release: extraction of a battle-tested personal mechanism into a

CLAUDE.md

@@ -52,5 +52,6 @@ verify with `scripts/check-versions.mjs`. Never hand-edit a ref.
 ## Hardening roadmap
 
 Empty — the post-v0.1.0 queue (atomic delivery, `.`/`..` rejection,
-selftest gaps, uniform `-h`) shipped in v0.2.0. `coord-inbox.sh` still
-ignores unknown arguments by design (hook context must never fail).
+selftest gaps, uniform `-h`) shipped in v0.2.0; broadcast self-delivery
+shipped in v0.2.1. `coord-inbox.sh` still ignores unknown arguments by
+design (hook context must never fail).

README.md

@@ -6,7 +6,7 @@
 
 *AI-generated: all code produced by Claude Code through dialog-driven development.*
 
-![Version](https://img.shields.io/badge/version-0.2.0-blue)
+![Version](https://img.shields.io/badge/version-0.2.1-blue)
 ![Platform](https://img.shields.io/badge/platform-Claude_Code_Plugin-purple)
 ![Hooks](https://img.shields.io/badge/hooks-1-green)
 ![Skills](https://img.shields.io/badge/skills-1-orange)

package.json

@@ -1,6 +1,6 @@
 {
   "name": "coord",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "private": true,
   "type": "module",
   "engines": {

skills/coord-send/SKILL.md

@@ -12,7 +12,7 @@ description: >-
   beskjed til Y og Z", "kringkast at …", "svar på coord-meldingen", "når Z er ferdig,
   varsle X". Trigger even when the user names a repo plus something to convey without
   saying "coord" explicitly — routing a message to another repo IS this skill.
-version: "0.2.0"
+version: "0.2.1"
 ---
 
 # coord-send — natural-language front door for inter-repo messages