veil-mcp v0.4.0

veil-mcp v0.4 — hardening release

A pass over six external critiques, with nine additional issues fixed from an
adversarial multi-agent review (two were genuine classifier under-flagging — the
unsafe direction).

Highlights

• sh_detail survives a server restart. New disk-backed record store: records
  persist to a per-project dir under the OS state location, capped + TTL-pruned,
  with atomic id reservation and atomic writes. Best-effort — degrades to
  memory-only on a read-only FS, never fails a run.
• veil init — one command to drop the "prefer sh_run" nudge into a project's
  CLAUDE.md (idempotent). Closes the setup-friction gap.
• sh_plan is segment-aware — cat f | grep x is read-only, cd b && rm f is
  destructive, instead of an opaque complex. Relabeled honestly as a static safety
  pre-check, not an execution dry-run.

Safety fixes

• find -exec shred / -execdir rm / -exec /bin/rm / -exec git reset --hard now
  classify as destructive (were read-only).
• Quoted subcommands classify like the bare form (git "reset" --hard is destructive).
• Backslash-escaped operators stay literal.

Docs

Value proposition repositioned (structure + safety first, token economy as a
consequence); sandbox framed as opt-in best-effort (unavailable in containers, by
design); a "verify it yourself" section with reproducible steps.

Install

claude mcp add veil -- npx -y github:vkmtx/veil-mcp
npx -y github:vkmtx/veil-mcp init

Validation

typecheck · 196 smoke assertions · backtest 89.7% · 86 stress probes, 0 anomalies —
green on macOS and Linux (CI matrix).

Full changelog: CHANGELOG.md