ver 1.4.2 bump - sandbox mount issue

CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 1.4.2
+
+### Fixed — CoWork sandbox plugin-path resolution
+
+In a remote CoWork sandbox, `${CLAUDE_PLUGIN_ROOT}` can resolve to a host path the
+sandbox can't reach (e.g. `/var/folders/…`), while the plugin is actually mounted under
+`…/mnt/.remote-plugins/…`. Every `python3 "${CLAUDE_PLUGIN_ROOT}/…"` invocation then
+failed until the agent manually located the real path. (Root cause is the harness env
+var, not the plugin — the scripts always used the variable correctly, never a hardcoded
+path — but the plugin now self-heals.)
+
+- SKILL.md and all eight slash commands resolve the scripts path with a fallback:
+  prefer `${CLAUDE_PLUGIN_ROOT}`, else locate the copy under
+  `/sessions/*/mnt/.remote-plugins/*/skills/echo-memory/scripts/`. Reused via
+  `$ECHO`/`$LINT`/`$SWEEP`/`$SDIR`; on a normal host the primary path always wins, so
+  behaviour is unchanged.
+- `echo-health` / `echo-sweep` `allowed-tools` broadened to match the resolved
+  (variable-dir) invocation and the `ls`/`dirname` resolver steps.
+
 ## 1.4.1
 
 ### Fixed — baked credentials now win unconditionally