minor security improvements
list supports negated queries
commands documented in README
*really* working tag querying ("list" command)