Minor release. Several defaults changed, and approvals, execution and hooks now rest on signed, single-use, atomically verified evidence. Full details and commit links in CHANGELOG.md.
Behavior changes
- CAUTION stays inside SLB by default. The hook blocks CAUTION commands and points to
slb requestinstead of raising a Claude Code permission prompt. Setintegrations.hook_caution_action = "ask"for the previous behavior. - Native hook guard.
slb hook installinstalls a native PreToolUse guard and migrates legacy Python registrations; the generated Python script remains the offline fallback. Install edits only SLB's own entry and keeps sibling hooks (#18). - Automatic CAUTION approval is a policy decision.
slb watch --auto-approve-cautionand daemonless waiters approve only due, zero-quorum CAUTION requests (default delay 30s) from an active requester, without fabricating reviewer records. - Status alone is not an approval. Execution re-verifies signed reviewer evidence, quorum, TTL and current policy inside a single-use claim.
- Unloadable policy blocks instead of prompting; an explicit
SLB_HOSTnever falls back to the local daemon. - Native Git operations (destructive changes, rebases) are assessed against immutable snapshots and require signed single-use authorization via installable Git hooks.
Fixed
- Parser: ordinary shell syntax, case statements, heredocs, control flow, script-local literal variables and data here-strings no longer turn into spurious approval prompts (#14, #16, #20); danger hidden behind a literal variable is now exposed.
((X))is classified by what POSIX sh executes (nested subshells), so a destructive command that is also valid Bash arithmetic can no longer pass unclassified.- The native hook's daemon query deadline is configurable instead of a fixed 50 ms (#21).
slb executetakes the session from the global--session-id/-sinstead of a shadowing local flag.- A shutdown request that arrives while the daemon is still starting is a clean stop.
Added
slb execute --backgroundwith a detached supervisor; bounded preflight (dry-run) evidence before review;slb eventsto replay/follow the durable request journal; opt-in blocked-command alerts and journal notices via Agent Mail MCP and webhooks; searchable JSONL audit of blocked hook decisions; Git rollback of tracked and untracked state; cross-project delegated reviews.
Assets
slb_0.5.0_<os>_<arch>.tar.gz (.zip on Windows) for linux/darwin amd64+arm64 and windows amd64, each with a .sha256 sidecar; SHA256SUMS / checksums.txt cover all archives and SHA256SUMS.minisig is the minisign signature (key 1BBD79B28BF718D0, same as v0.4.1). Version, commit and build date are embedded (slb version).