v0.11.3

Rename Task → Agent to match Claude Code's tool rename. Add SDK adapter and comprehensive test suites (206 tests).

v0.11.2

Fix false positive in permissions checker: generic Bash or Bash(*) in allow no longer triggers CRITICAL warning when a more specific Bash(*lockbox-prompt*) in ask overrides it. Models Claude Code's specificity-based precedence correctly.

v0.11.1

Fix install skill precedence docs: generic Bash(*) in allow is fine with specific Bash(lockbox-prompt) in ask. Add local development instructions to CLAUDE.md.

v0.11.0

Replace delegate approval gate with lockbox-prompt script.

Claude Code auto-approves echo as a built-in safe command, bypassing ask rules entirely. The delegate now loads the /lockbox:prompt skill and runs a named lockbox-prompt shell script to trigger the permission prompt.

Breaking: Users must update their permissions.ask entry. Run /lockbox:install to check.

• New ask pattern: Bash(*lockbox-prompt*)
• Permissions checker warns CRITICAL if lockbox-prompt is auto-allowed
• lockbox-prompt must be in ask, never allow — auto-approving it bypasses the approval gate

v0.10.3

Install skill now detects rogue settings.local.json in plugin cache that silently auto-approves delegate sub-agents. Also checks project-level settings.

v0.10.2

Remove skipDangerousModePermissionPrompt check from install skill and permissions checker — lockbox already detects and blocks dangerous mode at runtime, making the settings-level warning redundant.

v0.10.1

Include dangerous mode detection, session transcript taint classification, and install skill updates missing from 0.10.0.

v0.10.0

Dangerous mode detection, session transcript taint classification, git reset moved to safe. See changelog in README.

v0.9.2

Recommend Task(lockbox:delegate) in ask instead of broad Task. Broad Task still accepted as fallback without warning.

v0.9.1

Remove echo 'lockbox:clean' mechanism. Once locked, a session stays locked — delegate for external actions or start a new session.

• Single approval point (delegate prompt review)
• Removed Bash permission checks from install skill and permissions checker
• Simplified escape skill and docs