v1.0.2

The audit release: a full re-read of the codebase turned up thirteen
demonstrable defects — every one reproduced with a failing test, a
timeout or a crash before it was fixed, every one now pinned by a
regression test. Two of them could hang the default code path at 100%
CPU on input as ordinary as a README with two links in one line.

Fixed — hangs and crashes

• vp context / prune / diff / watch could hang forever on a
  line with two URLs. The URL-credentials scanner resumed at
  from = found + 3, but found is the offset inside line[from..],
  not in the line — a second :// rewound the scan instead of advancing
  it and the loop cycled forever at 100% CPU. When the rewound offset
  landed inside a multi-byte character, the slice panicked instead. One
  line of README prose with two links was enough. Resume now uses the
  absolute offset, like the prefix scanner one screen up always did.
• --compress hung on any file whose outline came out empty (e.g. a
  source file containing only an unimportant comment line). Out::finish
  popped trailing blanks with the polarity borrowed from Out::push:
  on an empty outline vec the loop condition never became false and
  pop() on an empty vec is a no-op. Both engines (brace and python)
  were affected.
• A deeply nested python file crashed the CLI with SIGABRT.
  heuristic_python recursed once per nested class with no depth cap;
  stack overflow aborts the process and cannot be caught. Structural
  nesting is now capped at 16 levels (deeper than any real-world
  python); below the cap nothing changes, deeper members elide as body
  content.

Fixed — the security gate

• The MCP tools shipped credentials with no secret scan at all.
  vp_prune, vp_context and vp_diff over stdio returned file bodies
  without ever running the scan the CLI gates every write on — the
  agent-facing path was the one exposure path with no warning. The gate
  now runs there too: findings prepend the (redacted) warning to the
  tool result, and a new strictSecrets argument mirrors
  --strict-secrets and refuses to ship the artifact.
• Qualified credential key names were invisible to the scanner.
  The assignment detector's word-boundary check counted _ and - as
  word bytes, so AWS_SECRET_ACCESS_KEY=…, JWT_SECRET=…,
  TWILIO_AUTH_TOKEN=… and the underscore-form sk_live_… stripe key
  could never match — a real leaked secret passed --strict-secrets
  with zero findings. _/- now delimit key-name segments (letters and
  digits still do not: mypassword stays quiet), and env-style detection
  looks at the whole key token. The value-side filters are untouched —
  MAX_TOKEN_AGE=3600 and the docs fixtures stay quiet.
• One key matched by two prefix shapes was reported twice. sk-
  (tail floor 24) overlaps sk-ant-/sk-proj- (floor 20): an
  anthropic-shaped key produced both an anthropic-api-key AND an
  llm-api-key finding. The longest matching shape now claims the
  token; the generic one is the same token under a vaguer name.

Fixed — vp watch

• A save landing while .context was being regenerated was swallowed
  forever. The post-regeneration resnap absorbed any file saved inside
  the regeneration window into the baseline, so no diff could ever fire
  for it again — the artifact silently stayed stale. Changes detected
  between the pre- and post-regeneration snapshots are now re-armed and
  ship on the next quiet poll; the startup generation got the same
  treatment.
• A continuously-written tree never regenerated at all. Regeneration
  required one fully quiet poll; a dev-server log or codegen output
  written faster than the poll interval never went quiet, and .context
  froze at its startup content. A debounce cap (2 s, configurable) now
  forces a refresh even while the tree keeps moving — editor bursts
  still collapse as before.
• A leftover .context was watched when the output had a custom
  name. vp watch -o custom.md treated a stale .context as repo
  content: editing it fired regenerations that could never include it.
  The watcher now applies the scanner's rule — the default output name
  is a vp artifact, unconditionally.

Fixed — TUI

• The task editor ate every q, ignored Backspace, and dead-ended
  Ctrl-C. The key mapping collapsed plain q onto Quit regardless of
  mode, and the editor's catch-all dropped Quit on the floor: typing
  "fix the quic bug" committed "fix the uic bug", typos could not be
  corrected (only Esc-cancelled), and — with raw mode owning Ctrl-C —
  there was no way out of the editor but killing the process. q is a
  letter while the editor is open, Backspace deletes, and Ctrl-C always
  quits.
• The files cursor could stay out of range after a rescan (leaner
  profile, task commit): Up only ever subtracted and nothing re-clamped
  a stale cursor, so the highlight never matched and Enter opened a
  blank preview. The cursor now clamps on every key, and the rescan
  clamps before the next frame.

Fixed — parsing

• A BOM or a multi-line array discarded the entire config. A
  UTF-8 BOM (PowerShell and older Windows editors) made line 1
  unparseable; the canonical one-element-per-line TOML reformatting of
  ignore did the same; a duplicate key silently last-won, producing a
  config matching neither line. BOM is stripped, logical lines assemble
  until array brackets balance (comments per line, commas inside quoted
  globs are content), and duplicates are a TOML-mandated error.
• --flag=value silently became task text. On context and watch
  the glued form fell into the dash-word fallback: vp context --task=fix the login bug ranked files against the literal string
  "--task=fix the login bug" — silently. Glue-splitting now happens
  before flag matching; --task= joins the task words so both quoting
  styles mean the same task, everything after -- stays literal.

v1.0.1

ci(release): fix the checksums rebuild and the GitHub Packages prepar…