v0.2.0

Changelog

Features

• 86a7238: feat: add --version flag with build-injected version info (@harperreed)
• 6aec3ad: feat: propagate context.Context through RemoteClient for cancellation (@harperreed)
• df7653e: feat: support PULSE_API_KEY, PULSE_TEAM_ID, PULSE_API_URL env vars (@harperreed)

Bug fixes

• 2687559: fix: URL-escape teamID to prevent path traversal (@harperreed)
• 3d810b4: fix: add file locking to SetIdentity and MarkSynced (@harperreed)
• 38066d9: fix: cap HTTP response body reads to 1MiB to prevent OOM (@harperreed)
• 5fa17f7: fix: make ValidSections immutable via getter returning copy (@harperreed)
• 0db83ff: fix: resolve symlinks in ReadEntry to prevent traversal (@harperreed)
• 7ee5da5: fix: update go-sdk to v1.4.1 to fix CVE GO-2026-4773 and GO-2026-4770 (@harperreed)
• 1a0c01a: fix: use comma-ok type assertion in setup wizard to prevent panic (@harperreed)
• e5afb5a: fix: validate --type and --limit CLI flags (@harperreed)
• af91448: fix: validate process_thoughts requires sections and type enum values (@harperreed)

Other

• 7198d5b: refactor: use globalRemoteClient instead of creating duplicates (@harperreed)