v0.1.2 — allowlist hardening and build log clarity

Patch release. Two fixes from the v0.1.0 read-through.

Security — allowlist host pattern (#3)

The previous curl auto-approve pattern matched lookalike hosts (medium severity, would only fire under prompt-injection). Anchored to the canonical scheme + host:

- "Bash(curl -sS -H \"Authorization: Bearer *\" *public-api.wp-umbrella.com*)"
+ "Bash(curl -sS -H \"Authorization: Bearer *\" https://public-api.wp-umbrella.com/*)"

Applied to .claude/settings.json (project-scoped) and src/skills/umbrella/references/permissions.md (the recommended user-config snippet).

Heads-up if you copied the loose pattern into ~/.claude/settings.json — update yours to the new form. Same single-line replacement.

Build — caveman stderr (#5)

scripts/build.sh was redirecting both stdout and stderr to /dev/null in the caveman compression call, so build failures only printed a generic wrapper message with no underlying cause. Dropped 2>&1. Stdout still suppressed (matches original intent), stderr now flows through to the build log.

Install / update

/plugin update umbrella@wp-umbrella

Still open

Findings #1, #2, #4, #6 from the same read-through remain open and will be addressed in subsequent patches.

Full changelog: v0.1.1...v0.1.2