fix: support spaces in quoted vault.get() arguments

[keeb]

Summary

• Fix the vault.get() regex in model_resolver.ts to allow spaces inside
  quoted arguments (e.g. vault.get("infra", "Client ID"))
• Uses alternation: quoted args match any char except the closing quote,
  unquoted args preserve current no-space behavior
• Updates match extraction for the new capture group positions

Fixes #902

Test Plan

• Added 6 new unit tests in vault_expression_test.ts:
  • Spaces in double-quoted key
  • Spaces in single-quoted key
  • 1Password-style path with slashes and spaces
  • Spaces in quoted vault name
  • Spaces in both vault name and key
  • Mixed quoted vault name with unquoted key
• Added containsVaultExpression detection test for quoted args with spaces
• All 3677 existing tests pass (no regression)
• deno check, deno lint, deno fmt all pass

🤖 Generated with Claude Code

[github-actions]

Code Review

Blocking Issues

None.

Suggestions

None — this is a clean, well-scoped fix. The regex alternation correctly handles quoted arguments (with spaces) vs unquoted arguments, the group extraction logic is correct, and test coverage is thorough with 7 new tests covering the key scenarios (spaces in keys, vault names, both, mixed quoting, and 1Password-style paths). The containsVaultExpression detection function already works correctly since it only checks for the presence of vault.get( without parsing arguments.

[github-actions]

Adversarial Review

Critical / High

None.

Medium

None.

Low

1. model_resolver.ts:835 — .+? does not handle escaped quotes inside quoted arguments.
   If a secret key ever contains the same quote character used to delimit the argument (e.g., vault.get("infra", "API Key \"prod\"")), the non-greedy .+? would stop at the backslash-escaped quote, producing an incorrect key like API Key \. This is a pre-existing limitation (the old regex had the same restriction via [^'"\x60\s,]+) and is unlikely in practice since vault key names rarely contain quotes. Mentioning for completeness only — not a regression.

2. model_resolver.ts:835 — Unquoted branch [^\s,)]+ will match stray quote characters.
   If a user writes malformed input like vault.get("foo, bar) (missing closing quote), the quoted branch fails and the unquoted branch matches "foo (since " is not excluded from [^\s,)]+). This would produce a vault name of "foo with a literal quote. Again, not a regression from the old pattern and only triggers on syntactically invalid input.

Verdict

PASS — The regex change correctly extends vault expression parsing to support spaces in quoted arguments. The alternation structure is sound, group numbering is correct, the containsVaultExpression detection pattern needed no change (it's a simpler presence check), and the test coverage is thorough with 6 new test cases covering the key scenarios (spaces in key, vault name, both, mixed quoted/unquoted, 1Password-style paths). No regressions to existing behavior.