Release v0.2.0 — Security hardening + Monaco self-hosted · Pinperepette/sublodex

Highlights

Security hardening (covers ~15 review findings):

Auth token + Bearer on /api/* and /ws (no more local processes calling the bun server)
CSP enforce by default (no inline scripts, no third-party CDN)
Path traversal closed on /api/file (local + remote)
sshpass -e instead of -p (no password in ps aux)
ShellType whitelist enforced server-side
identity_file / cwd validated in PTY
shell:allow-execute capability removed
Git input validation on 7 endpoints (checkout, stash pop/drop, discard, diff, stage, unstage, diff-range)

App:

Monaco editor self-hosted (no jsdelivr CDN, app works offline)
Session persistence fix: reload now resumes the right Claude session via --resume
Bun sidecar auto-restart with exponential backoff
WebSocket reconnect no longer leaves UI stuck on streaming
Per-session PTY locking (no head-of-line blocking on slow SSH)