Harden release workflows and refresh repository presentation

.github/workflows/ci.yml

@@ -35,8 +35,11 @@ jobs:
           node-version: '22'
           cache: npm
 
+      - name: Set up npm
+        run: npm install --global npm@11.16.0 --ignore-scripts
+
       - name: Install dependencies
-        run: npm ci
+        run: npm ci --strict-allow-scripts
 
       - name: Audit dependencies
         run: npm run audit

.github/workflows/publish-open-vsx.yml

@@ -27,17 +27,50 @@ jobs:
         with:
           node-version: '22'
 
-      - name: Download verified GitHub Release asset
+      - name: Download and verify GitHub Release asset
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ inputs.tag }}
         run: |
+          if [[ ! "$RELEASE_TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]; then
+            echo "Release tag must use the stable vMAJOR.MINOR.PATCH format." >&2
+            exit 1
+          fi
+
+          expected="${RELEASE_TAG#v}"
+          asset_name="vscode-copilot-cli-launcher-${expected}.vsix"
+          asset_path=".vsce/${asset_name}"
           mkdir -p .vsce
+
+          release_digest="$(gh release view "$RELEASE_TAG" \
+            --repo "$GITHUB_REPOSITORY" \
+            --json assets \
+            --jq '.assets[] | select(.name == "'"$asset_name"'") | .digest')"
+          if [[ ! "$release_digest" =~ ^sha256:[0-9a-f]{64}$ ]]; then
+            echo "GitHub Release asset is missing an exact SHA-256 digest." >&2
+            exit 1
+          fi
+
           gh release download "$RELEASE_TAG" \
             --repo "$GITHUB_REPOSITORY" \
-            --pattern 'vscode-copilot-cli-launcher-*.vsix' \
+            --pattern "$asset_name" \
             --dir .vsce
-          test "$(find .vsce -maxdepth 1 -name '*.vsix' | wc -l)" -eq 1
+
+          actual_digest="sha256:$(sha256sum "$asset_path" | cut -d ' ' -f 1)"
+          if [ "$actual_digest" != "$release_digest" ]; then
+            echo "Downloaded VSIX does not match the GitHub Release digest." >&2
+            exit 1
+          fi
+
+          package_name="$(unzip -p "$asset_path" extension/package.json | jq -r '.name')"
+          package_publisher="$(unzip -p "$asset_path" extension/package.json | jq -r '.publisher')"
+          package_version="$(unzip -p "$asset_path" extension/package.json | jq -r '.version')"
+          test "$package_name" = 'vscode-copilot-cli-launcher'
+          test "$package_publisher" = 'mikesoft'
+          test "$package_version" = "$expected"
+
+          echo "VSIX_PATH=$asset_path" >> "$GITHUB_ENV"
+          echo "EXPECTED_VERSION=$expected" >> "$GITHUB_ENV"
 
       - name: Verify Open VSX credential
         env:
@@ -49,22 +82,19 @@ jobs:
       - name: Publish release asset
         env:
           OVSX_PAT: ${{ secrets.OVSX_PAT }}
-        run: npx --yes ovsx@1.0.2 publish --packagePath "$(find .vsce -maxdepth 1 -name '*.vsix' -print -quit)"
+        run: npx --yes ovsx@1.0.2 publish --packagePath "$VSIX_PATH"
 
       - name: Verify live version
-        env:
-          EXPECTED_VERSION: ${{ inputs.tag }}
         run: |
-          expected="${EXPECTED_VERSION#v}"
           for attempt in {1..12}; do
             current="$(curl --fail --silent --show-error \
               https://open-vsx.org/api/mikesoft/vscode-copilot-cli-launcher \
               | jq -r '.version')"
-            if [ "$current" = "$expected" ]; then
+            if [ "$current" = "$EXPECTED_VERSION" ]; then
               echo "Open VSX is live at version $current."
               exit 0
             fi
             sleep 5
           done
-          echo "Expected Open VSX version $expected, but found $current." >&2
+          echo "Expected Open VSX version $EXPECTED_VERSION, but found $current." >&2
           exit 1

AGENTS.md

@@ -19,9 +19,10 @@ no internal endpoints, customer data, credentials, or unreleased claims.
   `target: ES2022`, `strict: true`.
 - Runtime: the VS Code extension host. Declared engine floor is `^1.103.0`; `@types/vscode` must
   stay aligned with it.
-- Tooling runtime: **Node.js 22** (the version CI uses).
-- Package manager: **npm**, with the committed `package-lock.json`. Do not introduce a second
-  package manager, lockfile, or a `packageManager` field — a metadata test asserts its absence.
+- Tooling runtime: **Node.js 22** with **npm 11.16.0** (the versions CI uses).
+- Package manager: **npm 11.16.0**, with the committed `package-lock.json`. Do not introduce a
+  second package manager, lockfile, or a `packageManager` field — a metadata test asserts its
+  absence.
 - npm install scripts are denied unless their exact package version appears in `allowScripts`.
   Review the script before approving it with `npm approve-scripts`; never broaden an existing
   approval or carry it to a new dependency version without re-reviewing that version.
@@ -46,7 +47,7 @@ no internal endpoints, customer data, credentials, or unreleased claims.
 ## Required Commands
 
 ```powershell
-npm ci
+npm ci --strict-allow-scripts
 npm run check
 npm run audit
 ```
@@ -58,7 +59,7 @@ npm run audit
 - Build a release candidate only after those pass:
 
 ```powershell
-npm run package -- --out .vsce/vscode-copilot-cli-launcher-<version>.vsix
+npm run package -- -- --out .vsce/vscode-copilot-cli-launcher-<version>.vsix
 ```
 
 ## Generated and Ignored Files
@@ -140,15 +141,15 @@ target registry after publication:
 
 ## Mandatory Validation Before Handoff
 
-1. `npm ci` succeeds from the committed lockfile.
+1. `npm ci --strict-allow-scripts` succeeds from the committed lockfile.
 2. `npm run check` passes end to end (compile, unit, metadata, integration, `vsce ls`).
 3. `npm run audit` reports no high-severity advisories.
 4. `npm run package` produces a VSIX whose file list contains only `out/*.js`, `media/icon.png`,
    `package.json`, and the root documentation and licence files — no sources, tests, maps,
    lockfile, or local tooling.
 5. Version references are synchronized and `CHANGELOG.md` has a dated entry with real changes only.
-6. `npm ci` emits no pending `allowScripts` warning; any newly requested install script is reviewed
-   and pinned to its exact package version before approval.
+6. `npm ci --strict-allow-scripts` emits no pending `allowScripts` warning; any newly requested
+   install script is reviewed and pinned to its exact package version before approval.
 
 ## Instructions for AI Agents
 

CHANGELOG.md

@@ -6,6 +6,17 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+### Changed
+
+- Reorganized the README around a concise product overview, direct installation links, verified compatibility boundaries, and a compact security and privacy summary; moved detailed diagnostics into a dedicated troubleshooting guide.
+- Corrected npm 11 argument forwarding in the documented release-candidate packaging command so `vsce` receives the requested output path.
+- Pinned CI and contributor tooling to npm 11.16.0 and made clean installs fail when a dependency install script is not covered by the exact-version `allowScripts` policy.
+- Hardened the Open VSX workflow to verify the release tag, exact asset name, GitHub SHA-256 digest, and packaged extension identity before publishing.
+
+### Security
+
+- Updated the lockfile to resolve high-severity development-tooling advisories in `fast-uri`, `js-yaml`, and `undici` without adding runtime dependencies.
+
 ## [0.2.10] - 2026-08-01
 
 ### Fixed

CONTRIBUTING.md

@@ -4,10 +4,10 @@ Thanks for your interest in improving Copilot CLI Launcher.
 
 ## Development
 
-Use Node.js 22 and the npm version bundled with it. Install the exact dependency graph from the lockfile, then run the complete validation suite:
+Use Node.js 22 with npm 11.16.0. Install the exact dependency graph from the lockfile while enforcing the reviewed install-script allowlist, then run the complete validation suite:
 
 ```bash
-npm ci
+npm ci --strict-allow-scripts
 npm run check
 npm run audit
 ```