fix: address remaining review comments

- complete.ts: Build nameMap first, pass [...nameMap.keys()] to
  fuzzyMatch — eliminates the separate slugs array
- completions.ts: Revert extractSubcommands to for-of loop (more
  efficient than filter.map for small arrays)
- completions.ts: s/whitelist/allowlist in shellVarName JSDoc

Author: BYK

src/lib/complete.ts

@@ -155,10 +155,9 @@ export async function completeOrgSlugs(
     return [];
   }
 
-  const slugs = orgs.map((o) => o.slug);
-  const matched = fuzzyMatch(partial, slugs);
-
   const nameMap = new Map(orgs.map((o) => [o.slug, o.name]));
+  const matched = fuzzyMatch(partial, [...nameMap.keys()]);
+
   return matched.map((slug) => ({
     value: `${slug}${suffix}`,
     description: nameMap.get(slug),

src/lib/completions.ts

@@ -113,10 +113,13 @@ function extractSubcommands(routeMap: {
     hidden: boolean;
   }[];
 }): CommandEntry[] {
-  return routeMap
-    .getAllEntries()
-    .filter((sub) => !sub.hidden)
-    .map((sub) => buildCommandEntry(sub.name.original, sub.target));
+  const subcommands: CommandEntry[] = [];
+  for (const sub of routeMap.getAllEntries()) {
+    if (!sub.hidden) {
+      subcommands.push(buildCommandEntry(sub.name.original, sub.target));
+    }
+  }
+  return subcommands;
 }
 
 /**
@@ -154,7 +157,7 @@ export function extractCommandTree(): CommandTree {
 /**
  * Sanitize a string for use in a shell variable name.
  *
- * Uses a whitelist approach — replaces any character that is not a valid
+ * Uses an allowlist approach — replaces any character that is not a valid
  * shell identifier character (`[a-zA-Z0-9_]`) with an underscore.
  * Input comes from Stricli route/flag names (alphanumeric + hyphen),
  * but the whitelist guards against unexpected characters.