v0.5.0

File path detection and temp path risk lowering

write_paths / read_paths

The output now includes write_paths and read_paths fields, detected from redirect operators:

• >, >>, 2>, &> → write_paths
• < → read_paths
• <<, <<< (heredoc/herestring) → skipped (not file paths)
• /dev/null, /dev/stdin, /dev/stdout, /dev/stderr excluded

Available per-command and aggregated at expression level, omitted when empty.

Temp path risk lowering

When all write targets from redirects are under /tmp or /var/tmp, risk is no longer elevated to MEDIUM. This means commands like cat > /tmp/foo.jq stay at LOW risk and are auto-allowed by the hook.

Other changes

• Mark tee as risk: LOW