chore: fleet hygiene (release automation, dependabot, community files)

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,27 @@
+---
+name: Bug report
+about: Report a problem with the model-provider plugin
+title: "[bug] "
+labels: bug
+---
+
+## What happened
+
+A clear description of the bug.
+
+## How to reproduce
+
+- Install path (OpenClaw version, plugin version):
+- Auth method (redact your API key and any secrets):
+- Model + resolution tier (baseline / live catalog / dynamic resolver):
+
+## Expected vs actual
+
+- Expected:
+- Actual (include error output, redacted):
+
+## Environment
+
+- openclaw-command-code version:
+- Node.js version:
+- OS:

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Questions and support
+    url: https://github.com/TheStreamCode/openclaw-command-code/discussions
+    about: Ask usage questions in GitHub Discussions

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,18 @@
+---
+name: Feature request
+about: Suggest an improvement or new capability
+title: "[feat] "
+labels: enhancement
+---
+
+## Problem / motivation
+
+What are you trying to do that's hard or impossible today?
+
+## Proposed solution
+
+What you'd like to see. If it involves a specific model or catalog shape, link or describe it.
+
+## Alternatives considered
+
+## Additional context

.github/dependabot.yml

@@ -0,0 +1,30 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+    groups:
+      npm-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "chore(actions)"
+      include: "scope"
+    groups:
+      actions-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"

.github/pull_request_template.md

@@ -0,0 +1,15 @@
+## Summary
+
+What does this PR change and why?
+
+## How verified
+
+- [ ] `npm run typecheck` passes
+- [ ] `npm run build` passes and committed `dist/` is in sync
+- [ ] `npm test` passes
+- [ ] Added/updated tests for the change
+
+## Notes
+
+- Any new dependency? Why existing ones weren't enough:
+- No secrets/API keys committed.

.github/workflows/ci.yml

@@ -5,13 +5,16 @@ on:
     branches: [main]
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   build-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20
           cache: npm

CHANGELOG.md

@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0] - 2026-08-21
+
+### Added
+
+- Initial release: Command Code (`commandcode.ai`) model-provider plugin for
+  OpenClaw with three-tier model resolution (generated static baseline, live
+  catalog, dynamic resolver).

CODE_OF_CONDUCT.md

@@ -0,0 +1,35 @@
+# Code of Conduct
+
+## Our pledge
+
+We as members, contributors, and maintainers pledge to make participation in this project a
+harassment-free experience for everyone, regardless of age, body size, visible or invisible
+disability, ethnicity, sex characteristics, gender identity and expression, level of experience,
+education, socio-economic status, nationality, personal appearance, race, religion, or sexual
+identity and orientation.
+
+## Our standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Being respectful of differing opinions, viewpoints, and experiences.
+- Giving and gracefully accepting constructive feedback.
+- Focusing on what is best for the community.
+- Showing empathy toward other community members.
+
+Unacceptable behavior includes:
+
+- Harassment, insults, or derogatory comments, and personal or political attacks.
+- Publishing others' private information without explicit permission.
+- Other conduct which could reasonably be considered inappropriate in a professional setting.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the project
+maintainer (see `package.json`). All complaints will be reviewed and investigated promptly and
+fairly. Maintainers are obligated to respect the privacy and security of the reporter.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org),
+version 2.1.

CONTRIBUTING.md

@@ -0,0 +1,35 @@
+# Contributing to openclaw-command-code
+
+Thanks for your interest in improving this project! Bug reports, fixes, docs,
+and tests are all welcome.
+
+## Development setup
+
+```bash
+npm ci
+npm run typecheck
+npm run build
+npm test
+```
+
+CI repeats the same gate and additionally rejects the build when the committed
+`dist/` output is stale — run `npm run build` and commit the refreshed `dist/`
+before pushing.
+
+## Regenerating the model baseline
+
+`src/baseline.models.ts` and the manifest catalog are generated from a single
+projection:
+
+```bash
+node scripts/generate-baseline.mjs
+```
+
+Commit the regenerated files together so the baseline, the manifest, and
+`dist/` stay in sync.
+
+## Pull requests
+
+- Keep changes focused; one concern per PR.
+- Add or update tests (`vitest`) for behavior changes.
+- Never commit API keys, tokens, or account data.

SECURITY.md

@@ -0,0 +1,20 @@
+# Security Policy
+
+## Supported versions
+
+Security fixes target the latest published release and the current `main` branch.
+
+## Reporting a vulnerability
+
+This plugin handles API keys at inference time. Report security issues privately:
+use GitHub's **private vulnerability reporting** (Security Advisories) on this
+repository. If that route is unavailable, email `info@mikesoft.it` with the
+subject `openclaw-command-code Security Report`. Do not open a public issue for
+sensitive findings.
+
+## Credential handling
+
+The Command Code API key belongs in the environment or your auth profile
+(`COMMAND_CODE_API_KEY`). Never commit keys, tokens, or account data to this
+repository, and never paste real credentials into issues, pull requests, or
+test fixtures.