chore: update version to 0.4.2 and enhance changelog with limits.redact_secrets enforcement

CHANGELOG.md

@@ -758,3 +758,28 @@ This project uses [Semantic Versioning](https://semver.org/).
 - `.gitignore patterns applied` is no longer printed (no signal, dead
   weight).
 - Opening the output folder no longer prints a confirmation line.
+
+
+## [0.4.2] — 2026-08-31
+
+### Added
+- **`limits.redact_secrets` is now enforced.** Previously persisted in
+  config and editable in the config UI but silently ignored by
+  packaging (flagged as a known limitation in 0.4.0). Now, text files
+  already going into the archive are scanned for secret-shaped values
+  — AWS/Google/GitHub/Slack/Stripe/Anthropic/OpenAI keys, JWTs,
+  private-key blocks, and a conservative generic
+  `key`/`secret`/`token`/`password` assignment pattern — and matched
+  values are replaced with `[REDACTED]` before writing. Only scans
+  files already known to be text and within `limits.max_file_size_mb`;
+  binary and oversized files are never touched. Surfaced in a terminal
+  warning and itemized in the `.report.txt` file, never applied
+  silently.
+
+### Changed
+- **`.contextzip/` is now fully local by default, no exceptions.**
+  `config.json` was previously carved out of the workspace's
+  `.gitignore` so it stayed trackable automatically. It's now ignored
+  like everything else in the workspace — nothing under `.contextzip/`
+  is ever pushed unless you explicitly opt in with
+  `git add -f .contextzip/config.json`.

contextzip/__init__.py

@@ -1,6 +1,6 @@
 """contextzip — intelligent codebase packager for AI tools."""
 
-__version__ = "0.4.1"
+__version__ = "0.4.2"
 
 from contextzip.api import (
     FileCollection,

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "contextzip"
-version = "0.4.1"
+version = "0.4.2"
 description = "Intelligently package your codebase for AI tools"
 readme = "README.md"
 requires-python = ">=3.9"