v0.4.0

0.4.0: an allowlist is not an exfiltration control

• Narrower grants (shell_ask, shell_exact, network.allow) instead of a whole binary or the whole network.
• Learning mode counts an ask only after PostToolUse shows it ran, and records in the MCP proxy too; --drop-unused only narrows what the traces cover.
• Secret values never leave (secret_files, secret-egress): a value from a secret file is refused in any request, raw or encoded, even through an allowed origin, an allowlisted curl, a writable directory or an MCP/API argument. The audit keeps no value.
• protected_names protects .env.*, *.pem, .aws... anywhere in the sandbox; protected paths compare without case (.ENV on macOS).
• The hook remembers a tainted session across calls.
• The agent cannot rewrite what judges it: the hook protects the host settings that install it, --protect adds more, and --policy-sha256 pins the policy (hook and MCP proxy).
• Fixes shown at OWASP ROS:SEC 2026: curl -d @.env through an allowlisted binary (#14), the MCP proxy's own policy and audit log (#15), wrong-typed params refused instead of raised (#13).

Behaviour changes are stricter only; see the CHANGELOG. Upgrade: pip install -U vt-agent-firewall.