v0.7.0

Coding agents, supply-chain verification, and stronger isolation. Run coding agents one-shot inside the sandbox, gate dependencies with vuln scans and a strict lockfile, and optionally give each box its own kernel.

Added

Coding agents

• sluice agent <name> [args] runs an agent in the sandbox; trailing args run it one-shot (e.g. sluice agent claude -p "fix the failing test"). No name lists every preset with its auth variable and whether that variable is set on your host.
• Two new presets, qwen and crush, bringing the set to nine (claude, codex, gemini, aider, cursor, opencode, amp, qwen, crush).
• Pre-run auth check warns when a preset's API-key variable is unset, and a multi-agent guard points you to git worktree when a directory is already wired to a different agent.

Supply chain

• sluice lock --scan runs a host-side Grype or Trivy vulnerability scan of the box, with --fail-on <severity> to gate the build.
• sluice lock --enforce makes the lockfile a strict gate (build fails on package drift). Inventory now covers cargo alongside apk/npm/pip/gem/go, and lockfiles export as CycloneDX or SPDX via --format.
• Base-image SBOM attestation: the published GHCR base image ships a CycloneDX SBOM, cosign-signed keyless.

Isolation

• SLUICE_RUNTIME=kata runs a box as an own-kernel micro-VM instead of a shared-kernel container, where available.

Control plane

• sluice -b/--box <name> targets any box from outside its directory; sluice ls gained a posture/orphan dashboard; sluice rm / prune remove boxes; version --json and learn public-suffix wildcards round out scripting support.
• Egress receipts now report per-host byte volume, and opt-in TLS interception (SSL-bump) is available for scoped deep inspection.

Changed

• Shell completions install automatically via Homebrew and install.sh (bash + zsh).

Full changelog: v0.6.0...v0.7.0