fix: resolve #96 and #97 and release 1.0.2

[lightsifter]

Change

• inspect with outline cursor + matchIndex returns metadata only, no source block (v1.0.1) #96: inspecting an outline item (cursor + matchIndex) now returns the symbol's version-checked source with a syntax boundary instead of metadata only.

• bug: mode=files silently omits gitignored filename matches, reports complete coverage, and rejects ignorePolicy #97: mode: "files" reports policy-filtered coverage when ignore rules skip files, states how many ignored files match the query (with examples), accepts ignorePolicy: "include", and shows each candidate's score and ranking reason in text and compact model output.

• Redaction: keeps the source's own quoting, so an unquoted .env value is no longer shown as quoted. Code that reads a secret (env.get("DB_PASS"), os.environ["KEY"]) stays visible.

• Path-only inspect: mode: "inspect" with path and no line opens the file from line 1.

• Request shapes from real agent sessions: each of these was rejected although its intent was unambiguous, and is now served.

  • mode: "files": limit, redundant scope: "strict", wildcard or glob queries.
  • mode: "inspect": paths, and targets/matchIndices above five, paged with an exact nextRequest.
  • sourceCursor together with its own path.
  • Single-term anyOf/allOf, the mode: "anyOf"/"allOf" aliases, and anyOf with mode: "summary".
  • Python roles, through a bounded lexical scanner.

  Every rewrite is disclosed in details.requestNotes and as [Request note: …] lines.

• Version bumped to 1.0.2 in every manifest; CHANGELOG updated.

Fixes #96
Fixes #97

Validation

• bun run check
• bun run pack:check: npm 11.15.0 dry run verified sift-light@1.0.2.
• Reviewed the final diff and shipped artifacts.

Also run locally:

• bun run check:local: 516 passed, 3 conditional skips, 0 failed. Node smoke test and benchmark passed.
• bun run test:mcp-hosts: Claude Code, Codex and Kimi stdio flows passed.
• Real Codex (gpt-6-luna) evaluation against the local build: 16 scenarios × 2 instruction variants gave 32/32 passing runs, with 0 of 142 sift-light calls failing. Against npm 1.0.1, 335 of 1385 calls (24%) failed.

Compatibility and risks

• Additive: requests that previously failed are now accepted, and existing valid requests keep their behavior.
• Outline cursor inspection now returns source, where it previously returned metadata only.
• mode: "files" coverage can now be policy-filtered where it was complete before.
• Redaction: an unquoted value that starts as letters followed by ( or [ (for example abc(123) is no longer masked. This keeps code that reads a secret visible and is documented in the CHANGELOG.
• Rollback: reinstall 1.0.1.

Documentation

• Updated user-facing documentation where needed (README, README.zh-CN, CHANGELOG, tool schema descriptions).
• No private source, tests, internal documents, credentials or logs are included.

AI assistance

• Written by Kiro (Claude family model), which executed every validation listed above.
• The maintainer requested and authorized the release. The final diff has not had a separate human line-by-line review.