TheStreamCode · TheStreamCode · Aug 8, 2026 · Aug 8, 2026 · Aug 8, 2026
@@ -0,0 +1,97 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8">
+    <meta name="viewport" content="width=1280, initial-scale=1">
+    <title>Kimi Code CLI Launcher social preview</title>
+    <style>
+      * { box-sizing: border-box; }
+      html, body { width: 1280px; height: 640px; margin: 0; overflow: hidden; }
+      body {
+        color: #f8fbff;
+        background:
+          radial-gradient(circle at 78% 18%, rgba(80, 181, 255, .24), transparent 28%),
+          radial-gradient(circle at 18% 88%, rgba(19, 113, 224, .20), transparent 32%),
+          linear-gradient(135deg, #080d19 0%, #0b1426 52%, #101d34 100%);
+        font-family: Inter, ui-sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI", sans-serif;
+      }
+      .frame {
+        position: relative;
+        display: grid;
+        grid-template-columns: 320px 1fr;
+        align-items: center;
+        gap: 74px;
+        width: 100%;
+        height: 100%;
+        padding: 72px 86px;
+      }
+      .frame::before {
+        content: "";
+        position: absolute;
+        inset: 22px;
+        border: 1px solid rgba(129, 196, 255, .14);
+        border-radius: 34px;
+        pointer-events: none;
+      }
+      .mark {
+        width: 292px;
+        height: 292px;
+        filter: drop-shadow(0 30px 60px rgba(0, 0, 0, .42));
+      }
+      .eyebrow {
+        margin: 0 0 18px;
+        color: #75c7ff;
+        font-size: 24px;
+        font-weight: 700;
+        letter-spacing: .16em;
+        text-transform: uppercase;
+      }
+      h1 {
+        max-width: 720px;
+        margin: 0;
+        font-size: 68px;
+        font-weight: 760;
+        letter-spacing: -.045em;
+        line-height: .98;
+      }
+      .tagline {
+        max-width: 690px;
+        margin: 26px 0 34px;
+        color: #b8c9df;
+        font-size: 29px;
+        line-height: 1.32;
+      }
+      .platforms {
+        display: flex;
+        gap: 12px;
+        margin: 0;
+        padding: 0;
+        list-style: none;
+      }
+      .platforms li {
+        padding: 9px 15px;
+        color: #dcecff;
+        background: rgba(255, 255, 255, .055);
+        border: 1px solid rgba(151, 207, 255, .18);
+        border-radius: 999px;
+        font-size: 18px;
+        font-weight: 600;
+      }
+    </style>
+  </head>
+  <body>
+    <main class="frame">
+      <img class="mark" src="../media/icon.png" alt="">
+      <section>
+        <p class="eyebrow">VS Code extension</p>
+        <h1>Kimi Code CLI Launcher</h1>
+        <p class="tagline">Open Kimi in a fresh, workspace-aware side terminal — in one click.</p>
+        <ul class="platforms" aria-label="Supported platforms">
+          <li>Windows</li>
+          <li>macOS</li>
+          <li>Linux</li>
+        </ul>
+      </section>
+    </main>
+  </body>
+</html>
@@ -5,6 +5,9 @@ on:
     branches:
       - main
   pull_request:
+  workflow_dispatch:
+  schedule:
+    - cron: '17 6 * * 1'
 
 permissions:
   contents: read
@@ -15,6 +18,7 @@ concurrency:
 
 jobs:
   validate:
+    if: github.event_name != 'schedule'
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
     strategy:
@@ -49,6 +53,7 @@ jobs:
         run: xvfb-run -a npm run check
 
   compatibility:
+    if: github.event_name != 'schedule'
     name: Compatibility (${{ matrix.os }}, VS Code ${{ matrix.vscode }})
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15

@@ -42,7 +42,12 @@ jobs:
         run: npm run check:security
 
       - name: Build VSIX
-        run: npm run package
+        shell: bash
+        run: |
+          npm run package
+          PACKAGE_VERSION="$(node -p "require('./package.json').version")"
+          VSIX="vscode-kimi-code-cli-launcher-$PACKAGE_VERSION.vsix"
+          sha256sum "$VSIX" > "$VSIX.sha256"
 
       - name: Create or update GitHub release
         shell: bash
@@ -52,7 +57,7 @@ jobs:
           PACKAGE_VERSION="$(node -p "require('./package.json').version")"
           VSIX="vscode-kimi-code-cli-launcher-$PACKAGE_VERSION.vsix"
           if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
-            gh release upload "$GITHUB_REF_NAME" "$VSIX" --clobber
+            gh release upload "$GITHUB_REF_NAME" "$VSIX" "$VSIX.sha256" --clobber
           else
-            gh release create "$GITHUB_REF_NAME" "$VSIX" --generate-notes --title "$GITHUB_REF_NAME" --verify-tag
+            gh release create "$GITHUB_REF_NAME" "$VSIX" "$VSIX.sha256" --generate-notes --title "Kimi Code CLI Launcher $GITHUB_REF_NAME" --verify-tag
           fi
@@ -6,6 +6,7 @@ out/**/*.map
 .env.*
 !.env.example
 *.vsix
+*.vsix.sha256
 *.tgz
 .vscode-test/
 .vsce/

@@ -6,6 +6,26 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ## Unreleased
 
+## 0.1.5 - 2026-08-08
+
+### Added
+
+- Added a real Extension Host workflow image and a custom, reproducible GitHub social preview
+- Added SHA-256 checksum assets to GitHub releases
+
+### Changed
+
+- Reworked the README around installation, product value, trust boundaries, and the distinction from the official Kimi extension
+- Moved detailed development, validation, packaging, and release guidance into `CONTRIBUTING.md`
+- Standardized GitHub release titles and prepared curated release notes
+
+### Security
+
+- Updated transitive `js-yaml` and `undici` development dependencies to remediate current high-severity advisories
+- Added behavioral regression coverage proving that programmatic launches remain blocked in untrusted workspaces and workspace-controlled commands are ignored
+- Added a weekly lockfile security audit without re-enabling periodic dependency version-update pull requests
+- Expanded required `main` checks to cover dependency auditing, compatibility, and CodeQL, and applied branch protection to administrators
+
 ## 0.1.4 - 2026-08-02
 
 ### Changed

@@ -5,6 +5,6 @@ authors:
   - family-names: Gasperini
     given-names: Michael
 url: "https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher"
-version: "0.1.4"
-date-released: "2026-08-02"
+version: "0.1.5"
+date-released: "2026-08-08"
 license: MIT
@@ -1,34 +1,120 @@
 # Contributing
 
-Thanks for your interest in improving Kimi Code CLI Launcher.
+Thanks for your interest in improving Kimi Code CLI Launcher. Keep changes focused: this is intentionally a small VS Code extension with no production dependencies.
 
-## Development
+## Architecture
+
+| Path | Responsibility |
+| --- | --- |
+| `src/extension.ts` | VS Code activation, commands, trust gate, and terminal creation |
+| `src/command-utils.ts` | Pure configuration, naming, settings-query, and workspace helpers |
+| `test/*.test.js` | Unit, security-boundary, metadata, and packaging-contract tests |
+| `test/integration/` | Real VS Code Extension Host smoke test |
+| `media/` | Marketplace, toolbar, and README artwork |
+
+The runtime uses VS Code APIs only. Do not add hidden processes, installers, downloads, telemetry, terminal-output inspection, credential handling, or production dependencies without a compelling and reviewed requirement.
+
+## Development Setup
 
 Requirements:
 
-- Node.js 22.19.0 or later
-- npm
+- Node.js 22.19.0 or later; `.nvmrc` selects the maintained Node.js 22 line
+- npm and Git
 - VS Code `^1.103.0` or later
+- Xvfb for Extension Host tests on a headless Linux machine
 
-Install dependencies and run the complete validation suite:
+Install exactly the locked dependency graph:
 
 ```bash
 npm ci --ignore-scripts
+```
+
+The ignored install scripts belong to optional publishing and signing dependencies. They are not required to compile, test, inspect, or package this extension.
+
+## Validation
+
+| Command | Purpose |
+| --- | --- |
+| `npm run compile` | Compile TypeScript to the ignored `out/` directory |
+| `npm run watch` | Recompile while source files change |
+| `npm run typecheck` | Run strict TypeScript checks without emitting files |
+| `npm run lint` | Lint source and tests with Biome |
+| `npm run format:check` | Verify source and test formatting |
+| `npm run format` | Apply the configured formatter |
+| `npm run test:unit` | Compile and run unit and metadata tests |
+| `npm run test:integration` | Run the VS Code Extension Host smoke test |
+| `npm run check:security` | Audit the locked graph at high severity |
+| `npm run check` | Run lint, formatting, type-checking, all tests, and package inspection |
+| `npm run package` | Build the installable VSIX |
+
+Before opening a pull request, run:
+
+```bash
 npm run check
 npm run check:security
+git diff --check
+```
+
+CI repeats the lockfile audit every Monday. Scheduled runs execute the audit only; pull requests and pushes run the full cross-platform validation and compatibility matrix.
+
+To test the minimum supported VS Code version locally:
+
+```powershell
+$env:VSCODE_TEST_VERSION = '1.103.0'
+npm run test:integration
+```
+
+On a headless Linux host:
+
+```bash
+xvfb-run -a npm run check
 ```
 
-Keep changes focused and covered by tests. Update the README and changelog when user-facing behavior changes.
+## Security Invariants
 
-Do not add copied Kimi assets, automatic installers, telemetry, hidden command execution, or credentials. Preserve the user-level-only command setting and Workspace Trust guard.
+- Preserve the Workspace Trust check at the execution boundary.
+- Resolve executable commands from user-level configuration only; ignore workspace and workspace-folder values.
+- Send the command visibly through VS Code's terminal API.
+- Never log commands, credentials, terminal output, or full sensitive paths.
+- Keep `src/command-utils.ts` independent from the VS Code runtime where practical.
 
-Formatting and linting are enforced by Biome. Run `npm run format` when `npm run format:check` reports differences.
+Add targeted regression tests whenever one of these boundaries changes. Do not add copied Kimi assets, `.env` files, publisher tokens, or automatic installation and authentication flows.
 
 ## Pull Requests
 
-- Explain the problem and the observable behavior change.
-- Add or update targeted tests.
-- Preserve Workspace Trust protections.
-- Run `npm run check` before submitting.
-- Run `npm run check:security` after dependency changes.
-- Do not include generated VSIX files.
+- Explain the problem and observable behavior change.
+- Add or update focused tests.
+- Update README and changelog content for user-visible changes.
+- Preserve the existing icon and artwork unless the change specifically concerns visual presentation.
+- Do not commit `out/`, `.vscode-test/`, `node_modules/`, or generated VSIX files.
+- Keep action permissions minimal and pin actions to full commit SHAs.
+
+`main` is protected. Normal contributions land through a branch and pull request with the required checks and maintainer review.
+
+## Packaging and Release
+
+Build a local package only after the complete validation suite passes:
+
+```bash
+npm run check
+npm run check:security
+npm run package
+```
+
+For a release:
+
+1. Run `npm version <x.y.z> --no-git-tag-version`.
+2. Synchronize the version and real release date in `CITATION.cff`, `CHANGELOG.md`, README installation examples, and metadata tests.
+3. Re-run all validation and inspect `npm run package:list`.
+4. Commit the validated changes and push the matching `v<x.y.z>` tag.
+
+The `Release` workflow verifies the tag/version match, reruns validation and the security audit, packages the VSIX, creates a SHA-256 checksum, and creates or updates the GitHub release.
+
+VS Code Marketplace and Open VSX publishing are separate manual maintainer steps:
+
+```bash
+npx @vscode/vsce publish --packagePath vscode-kimi-code-cli-launcher-<version>.vsix
+npx ovsx publish vscode-kimi-code-cli-launcher-<version>.vsix
+```
+
+These commands require registry publisher tokens. Tokens are deliberately absent from the repository, local automation, and GitHub Actions.
-Original file line number
+Diff line change
@@ Expand Up / @@ -6,6 +6,7 @@ out/**/*.map @@
     .env.*
     !.env.example
     *.vsix
+    *.vsix.sha256
     *.tgz
     .vscode-test/
     .vsce/
@@ Expand Down @@