From 27f74a6445ed323c1ded0400de7e68a8274273b7 Mon Sep 17 00:00:00 2001 From: Jona Date: Sat, 17 Oct 2026 00:13:45 -0400 Subject: [PATCH 1/3] Run CI for stacked pull requests --- .github/workflows/ci.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9eb0f53..15488cd 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -4,7 +4,6 @@ on: push: branches: [ main, work ] pull_request: - branches: [ main ] jobs: build: From e8247c0f152986efa90ed86fb5371c55b35ff201 Mon Sep 17 00:00:00 2001 From: Jona Date: Sat, 17 Oct 2026 00:14:25 -0400 Subject: [PATCH 2/3] docs: explain privacy and omit cell values from edit logs (#82) --- PRIVACY.md | 31 +++++++++++++++++++++++++++++++ README.md | 6 ++++++ src/CsvEditorProvider.ts | 2 +- 3 files changed, 38 insertions(+), 1 deletion(-) create mode 100644 PRIVACY.md diff --git a/PRIVACY.md b/PRIVACY.md new file mode 100644 index 0000000..588aad1 --- /dev/null +++ b/PRIVACY.md @@ -0,0 +1,31 @@ +# Privacy and data handling + +CSV does not implement an upload service, analytics client, or extension-specific telemetry collection. Viewing, parsing, searching, sorting, and editing a file use the VS Code document and the extension's bundled code. No account or external processing service is required by CSV. + +## Where processing happens + +VS Code supplies the file's decoded text to the extension. The extension parses that text with the bundled Papa Parse library, sends table content to its VS Code webview, and applies edits through VS Code's document APIs. Saving uses VS Code's normal file-saving behavior and the selected file encoding. + +For a normal local workspace, these operations run on your computer. In Remote SSH, WSL, Dev Containers, or another remote workspace, the extension host and files can be on that remote environment. File contents travel through your existing VS Code connection to display and edit them in the webview. “No external processing service” does not mean that a remote workspace's data stays on your local computer. + +The font picker uses the bundled `font-list` package to enumerate fonts available to the extension host through operating-system helpers. It does not use an online font service. + +## Actions that share information outside the table + +- **Clipboard:** Copying writes the selected contents to the system clipboard; pasting reads clipboard contents supplied by the editor. Other applications, clipboard managers, and operating-system clipboard synchronization may have access to that clipboard. +- **Links:** Ctrl/Cmd+click on a recognized link asks VS Code to open its URL using your configured browser or application. Supported schemes include HTTP, HTTPS, FTP, and email links. The destination receives the URL, including any information in its path or query, according to that application's behavior. CSV does not fetch a link merely to render its text. You can disable link interaction with `csv.clickableLinks`. +- **Support:** If you attach a file, screenshot, or log to a GitHub issue, you are sharing it with that issue's audience. CSV does not submit these materials automatically. + +VS Code's Marketplace connections, updates, Settings Sync, remote services, other extensions, and the browser or application used for links have their own data-handling behavior. They are separate from CSV's runtime processing. + +## Logs and stored state + +The extension writes diagnostic messages to the extension host's console. Routine messages include file paths/URIs, row counts, and the row/column coordinates of an edit; routine edit messages omit the cell value. Errors can still contain document or operation details, and a failed external-link operation can log its URL. Treat extension host logs as potentially containing sensitive information, especially before sharing them for support. The log location and retention are controlled by VS Code and may be in a remote environment. + +CSV's code does not send those logs or cell contents to a telemetry endpoint. This statement does not describe or override VS Code's own telemetry, logging, crash reporting, or another extension's behavior. Consult your editor's privacy policy and settings for those services. + +CSV stores per-file view preferences in VS Code workspace state, keyed by the file URI: header mode, serial-index visibility, separator overrides, and hidden leading rows. Its webview state remembers scroll/selection positions, column widths, row heights, and zoom. These preference records are not a separate copy of the CSV contents. VS Code independently manages the document, undo history, unsaved-file backups, autosave, and any platform synchronization you enable. + +## Scope of these statements + +These statements describe this repository's extension and webview implementation. The main data paths are in [`src/CsvEditorProvider.ts`](src/CsvEditorProvider.ts), [`media/main.js`](media/main.js), [`src/commands.ts`](src/commands.ts), and [`src/extension.ts`](src/extension.ts); runtime dependencies are declared in [`package.json`](package.json). They are not a promise about every VS Code component, remote host, dependency version, or installed extension. Review the version you use and your environment's policies when deciding whether it fits your data requirements. diff --git a/README.md b/README.md index 7dec9d6..696bf41 100644 --- a/README.md +++ b/README.md @@ -191,6 +191,12 @@ npm run compile --- +## Privacy + +CSV processes files through VS Code and bundled libraries, with no extension-specific upload service or telemetry client. Remote workspaces, clipboard operations, links, diagnostic logs, and editor-managed backups have additional data-handling implications. See [Privacy and data handling](PRIVACY.md) for the verified behavior and scope. + +--- + ## Support Have questions, suggestions, or encountered an issue? diff --git a/src/CsvEditorProvider.ts b/src/CsvEditorProvider.ts index 9135ca8..cb9d45e 100644 --- a/src/CsvEditorProvider.ts +++ b/src/CsvEditorProvider.ts @@ -452,7 +452,7 @@ class CsvEditorController { return; } - console.log(`CSV: Updated row ${row + 1}, column ${col + 1} to "${value}"`); + console.log(`CSV: Updated row ${row + 1}, column ${col + 1}`); const config = vscode.workspace.getConfiguration('csv', this.document.uri); const clickableLinks = config.get('clickableLinks', true); const rendered = this.formatCellContent(value ?? '', clickableLinks); From e906bba480c1a2fb4e43425bf8c175fba1da516f Mon Sep 17 00:00:00 2001 From: Jona Date: Sat, 17 Oct 2026 00:16:42 -0400 Subject: [PATCH 3/3] docs: scope document handling to editable views --- PRIVACY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/PRIVACY.md b/PRIVACY.md index 588aad1..da590a5 100644 --- a/PRIVACY.md +++ b/PRIVACY.md @@ -4,7 +4,7 @@ CSV does not implement an upload service, analytics client, or extension-specifi ## Where processing happens -VS Code supplies the file's decoded text to the extension. The extension parses that text with the bundled Papa Parse library, sends table content to its VS Code webview, and applies edits through VS Code's document APIs. Saving uses VS Code's normal file-saving behavior and the selected file encoding. +Normal editable CSV views receive the file's decoded text from VS Code. The extension parses that text with the bundled Papa Parse library, sends table content to its VS Code webview, and applies edits through VS Code's document APIs. Saving in these views uses VS Code's normal file-saving behavior and the selected file encoding. For a normal local workspace, these operations run on your computer. In Remote SSH, WSL, Dev Containers, or another remote workspace, the extension host and files can be on that remote environment. File contents travel through your existing VS Code connection to display and edit them in the webview. “No external processing service” does not mean that a remote workspace's data stays on your local computer. @@ -24,7 +24,7 @@ The extension writes diagnostic messages to the extension host's console. Routin CSV's code does not send those logs or cell contents to a telemetry endpoint. This statement does not describe or override VS Code's own telemetry, logging, crash reporting, or another extension's behavior. Consult your editor's privacy policy and settings for those services. -CSV stores per-file view preferences in VS Code workspace state, keyed by the file URI: header mode, serial-index visibility, separator overrides, and hidden leading rows. Its webview state remembers scroll/selection positions, column widths, row heights, and zoom. These preference records are not a separate copy of the CSV contents. VS Code independently manages the document, undo history, unsaved-file backups, autosave, and any platform synchronization you enable. +CSV stores per-file view preferences in VS Code workspace state, keyed by the file URI: header mode, serial-index visibility, separator overrides, and hidden leading rows. Its webview state remembers scroll/selection positions, column widths, row heights, and zoom. View preferences and saved state can themselves contain sensitive metadata; they are not intended as full-document backups. VS Code independently manages the document, undo history, unsaved-file backups, autosave, and any platform synchronization you enable. ## Scope of these statements