v0.4.1

Pattern-anchoring fix for #11 with a sibling audit of the builtin rule set, the TUI "Loading..." fix for #10, and a macOS test fix. Full details in CHANGELOG.md.

Fixed

• System-path and flag patterns are anchored to whole tokens (#11). The CRITICAL chmod/chown rules matched /(etc|usr|var|boot|bin|sbin) as a bare substring anywhere in the command, so a project's own chmod +x /home/u/proj/bin/tool (and /opt/app/binary, via the bin prefix) needed two approvals. The system directory now has to be the first component of an absolute path token and end at a path boundary. The audit of the rest of the builtin set fixed the same class elsewhere:
  • rm system-path rule: /home matched /homework, /opt matched /optional, /lib matched /libs.
  • git push ... -f: .*-f(\s|$) fired on any branch ending in -f; the flag must now be its own short-flag token (bundled -fu/-uf still caught).
  • gcloud ... delete --quiet: delete matched inside undelete and --filter=name:delete-me; -q is accepted alongside --quiet.
  • SAFE rm ... .log/.tmp/.bak only looked at the last token, so rm -rf / foo.log was SAFE and skipped review; every target must now end in the extension.
  • A parity test runs the exported Python hook module under python3 and checks it classifies these cases identically to the Go engine.
• Navigated TUI views no longer wedge at "Loading..." (#10): views created on navigation now inherit the last known terminal size instead of waiting for a resize.
• TestDefaultSocketPath_FormatStable no longer fails on macOS ($TMPDIR trailing slash).

Assets

slb_0.4.1_<os>_<arch>.tar.gz (.zip on Windows) for linux/darwin amd64+arm64 and windows amd64, each with a .sha256 sidecar; checksums.txt / SHA256SUMS cover all archives and SHA256SUMS.minisig is the minisign signature. Version, commit and build date are embedded (slb version).