v0.2.0

TL;DR

• Daemon now parses commands into binary names - git add cmd/agentjail/update.go no longer blocked
• Hook-config watchdog re-injects the agentjail hook if an agent removes it
• Shield protects hook configs at the kernel level (Seatbelt/Landlock)
• Hook config edits ask instead of deny - approve legitimate changes

---

Added

• Structured command parsing - input.command_binaries field parsed by daemon's shell tokenizer
• Hook-config watchdog - polls ~/.claude/settings.json, ~/.codex/hooks.json, ~/.cursor/hooks.json every 5s
• Shield hook-config protection - macOS Seatbelt denies writes to ~/.claude/, ~/.codex/, ~/.cursor/
• Internal shellparse package - zero-dependency shell command tokenizer

Changed

• Hook config edits (Write/Edit tool) downgraded from deny to ask
• library/no-daemon-kill moved from locked to disableable with --force

Fixed

• False positive: git add cmd/agentjail/update.go no longer blocked
• False positive: ls ~/.claude/skills/ 2>/dev/null no longer blocked
• Duplicate TestFindNetproxyBinary_NotFound declaration (macOS CI fix)

Security

• ADR 0025: layered self-protection model - regex is UX, shield is enforcement, watchdog is self-healing