|
1 | 1 | # Contributing |
2 | 2 |
|
3 | | -Thanks for your interest in improving Kimi Code CLI Launcher. |
| 3 | +Thanks for your interest in improving Kimi Code CLI Launcher. Keep changes focused: this is intentionally a small VS Code extension with no production dependencies. |
4 | 4 |
|
5 | | -## Development |
| 5 | +## Architecture |
| 6 | + |
| 7 | +| Path | Responsibility | |
| 8 | +| --- | --- | |
| 9 | +| `src/extension.ts` | VS Code activation, commands, trust gate, and terminal creation | |
| 10 | +| `src/command-utils.ts` | Pure configuration, naming, settings-query, and workspace helpers | |
| 11 | +| `test/*.test.js` | Unit, security-boundary, metadata, and packaging-contract tests | |
| 12 | +| `test/integration/` | Real VS Code Extension Host smoke test | |
| 13 | +| `media/` | Marketplace, toolbar, and README artwork | |
| 14 | + |
| 15 | +The runtime uses VS Code APIs only. Do not add hidden processes, installers, downloads, telemetry, terminal-output inspection, credential handling, or production dependencies without a compelling and reviewed requirement. |
| 16 | + |
| 17 | +## Development Setup |
6 | 18 |
|
7 | 19 | Requirements: |
8 | 20 |
|
9 | | -- Node.js 22.19.0 or later |
10 | | -- npm |
| 21 | +- Node.js 22.19.0 or later; `.nvmrc` selects the maintained Node.js 22 line |
| 22 | +- npm and Git |
11 | 23 | - VS Code `^1.103.0` or later |
| 24 | +- Xvfb for Extension Host tests on a headless Linux machine |
12 | 25 |
|
13 | | -Install dependencies and run the complete validation suite: |
| 26 | +Install exactly the locked dependency graph: |
14 | 27 |
|
15 | 28 | ```bash |
16 | 29 | npm ci --ignore-scripts |
| 30 | +``` |
| 31 | + |
| 32 | +The ignored install scripts belong to optional publishing and signing dependencies. They are not required to compile, test, inspect, or package this extension. |
| 33 | + |
| 34 | +## Validation |
| 35 | + |
| 36 | +| Command | Purpose | |
| 37 | +| --- | --- | |
| 38 | +| `npm run compile` | Compile TypeScript to the ignored `out/` directory | |
| 39 | +| `npm run watch` | Recompile while source files change | |
| 40 | +| `npm run typecheck` | Run strict TypeScript checks without emitting files | |
| 41 | +| `npm run lint` | Lint source and tests with Biome | |
| 42 | +| `npm run format:check` | Verify source and test formatting | |
| 43 | +| `npm run format` | Apply the configured formatter | |
| 44 | +| `npm run test:unit` | Compile and run unit and metadata tests | |
| 45 | +| `npm run test:integration` | Run the VS Code Extension Host smoke test | |
| 46 | +| `npm run check:security` | Audit the locked graph at high severity | |
| 47 | +| `npm run check` | Run lint, formatting, type-checking, all tests, and package inspection | |
| 48 | +| `npm run package` | Build the installable VSIX | |
| 49 | + |
| 50 | +Before opening a pull request, run: |
| 51 | + |
| 52 | +```bash |
17 | 53 | npm run check |
18 | 54 | npm run check:security |
| 55 | +git diff --check |
| 56 | +``` |
| 57 | + |
| 58 | +CI repeats the lockfile audit every Monday. Scheduled runs execute the audit only; pull requests and pushes run the full cross-platform validation and compatibility matrix. |
| 59 | + |
| 60 | +To test the minimum supported VS Code version locally: |
| 61 | + |
| 62 | +```powershell |
| 63 | +$env:VSCODE_TEST_VERSION = '1.103.0' |
| 64 | +npm run test:integration |
| 65 | +``` |
| 66 | + |
| 67 | +On a headless Linux host: |
| 68 | + |
| 69 | +```bash |
| 70 | +xvfb-run -a npm run check |
19 | 71 | ``` |
20 | 72 |
|
21 | | -Keep changes focused and covered by tests. Update the README and changelog when user-facing behavior changes. |
| 73 | +## Security Invariants |
22 | 74 |
|
23 | | -Do not add copied Kimi assets, automatic installers, telemetry, hidden command execution, or credentials. Preserve the user-level-only command setting and Workspace Trust guard. |
| 75 | +- Preserve the Workspace Trust check at the execution boundary. |
| 76 | +- Resolve executable commands from user-level configuration only; ignore workspace and workspace-folder values. |
| 77 | +- Send the command visibly through VS Code's terminal API. |
| 78 | +- Never log commands, credentials, terminal output, or full sensitive paths. |
| 79 | +- Keep `src/command-utils.ts` independent from the VS Code runtime where practical. |
24 | 80 |
|
25 | | -Formatting and linting are enforced by Biome. Run `npm run format` when `npm run format:check` reports differences. |
| 81 | +Add targeted regression tests whenever one of these boundaries changes. Do not add copied Kimi assets, `.env` files, publisher tokens, or automatic installation and authentication flows. |
26 | 82 |
|
27 | 83 | ## Pull Requests |
28 | 84 |
|
29 | | -- Explain the problem and the observable behavior change. |
30 | | -- Add or update targeted tests. |
31 | | -- Preserve Workspace Trust protections. |
32 | | -- Run `npm run check` before submitting. |
33 | | -- Run `npm run check:security` after dependency changes. |
34 | | -- Do not include generated VSIX files. |
| 85 | +- Explain the problem and observable behavior change. |
| 86 | +- Add or update focused tests. |
| 87 | +- Update README and changelog content for user-visible changes. |
| 88 | +- Preserve the existing icon and artwork unless the change specifically concerns visual presentation. |
| 89 | +- Do not commit `out/`, `.vscode-test/`, `node_modules/`, or generated VSIX files. |
| 90 | +- Keep action permissions minimal and pin actions to full commit SHAs. |
| 91 | + |
| 92 | +`main` is protected. Normal contributions land through a branch and pull request with the required checks and maintainer review. |
| 93 | + |
| 94 | +## Packaging and Release |
| 95 | + |
| 96 | +Build a local package only after the complete validation suite passes: |
| 97 | + |
| 98 | +```bash |
| 99 | +npm run check |
| 100 | +npm run check:security |
| 101 | +npm run package |
| 102 | +``` |
| 103 | + |
| 104 | +For a release: |
| 105 | + |
| 106 | +1. Run `npm version <x.y.z> --no-git-tag-version`. |
| 107 | +2. Synchronize the version and real release date in `CITATION.cff`, `CHANGELOG.md`, README installation examples, and metadata tests. |
| 108 | +3. Re-run all validation and inspect `npm run package:list`. |
| 109 | +4. Commit the validated changes and push the matching `v<x.y.z>` tag. |
| 110 | + |
| 111 | +The `Release` workflow verifies the tag/version match, reruns validation and the security audit, packages the VSIX, creates a SHA-256 checksum, and creates or updates the GitHub release. |
| 112 | + |
| 113 | +VS Code Marketplace and Open VSX publishing are separate manual maintainer steps: |
| 114 | + |
| 115 | +```bash |
| 116 | +npx @vscode/vsce publish --packagePath vscode-kimi-code-cli-launcher-<version>.vsix |
| 117 | +npx ovsx publish vscode-kimi-code-cli-launcher-<version>.vsix |
| 118 | +``` |
| 119 | + |
| 120 | +These commands require registry publisher tokens. Tokens are deliberately absent from the repository, local automation, and GitHub Actions. |
0 commit comments