v0.10.1 — post-v0.10.0 hardening and cleanup

v0.10.1 — post-v0.10.0 hardening and cleanup

A patch release on top of v0.10.0. Resolves a wave of external-review logic and security findings, adds robustness fixes, and lands behavior-preserving internal cleanups. No model-facing behavior change — a default localhost session is unchanged.

External-review logic & security fixes

• Classifier — escalate git mutating verbs and option-encoded paths off auto-run.
• Command output — hard-bounded per read (chunked readline; the final chunk is sliced to the remaining budget so total capture never exceeds the cap).
• HTTP egress — trust_env=False on every httpx client (ollama / fetch / search) so an ambient proxy env var can't reroute traffic.
• Secret redaction — broadened to key-named, JSON-shaped, and prefixed keys (OPENAI_API_KEY, DB_PASSWORD, MY_API_KEY).
• Planner — finalize on a skipped final step; pin the artifact path to the plan workspace.
• Ollama — reject truncated streams (no done sentinel); typed OllamaResponseErrors on malformed or wrong-shaped responses, including streaming chunk shapes (non-dict chunk / message / tool_calls); a non-dict element inside a valid tool_calls list is skipped, not raised.
• Session --resume — reject any session id whose resolved parent escapes the sessions directory (path-traversal guard).
• CLI — guard slash / manual-shell Ctrl+C turns; validate --resume before preload.
• Misc — memory rebuild on /cwd; image-token gate; write-preview placeholder; reserved-name union; uddg redirect-scheme validation; max_results clamp; web fetch no longer flags exact-byte-limit bodies as truncated.

Cleanups (behavior-preserving)

• Dead-code removal, /api/show probe + skill-decision dedup, loader path/traversable dedup, and import/constant hygiene. No behavior change.

Verification

• Phase gate green: ruff check, ruff format --check, mypy shellpilot --strict, pytest — 1255 passing.
• TDD red-first per fix; each fix cluster independently reviewed.
• Docs updated in step: __version__ → 0.10.1, README roadmap, DESIGN status line.