fix(vscode): make the extension's send path work, and close the security holes

.github/workflows/ci.yml

@@ -252,6 +252,31 @@ jobs:
         # platform backends, and the MCP stdio protocol. No GUI input runs.
         run: (cd crates/tui/plugins/computer-use && npm test)
 
+  vscode-extension:
+    name: VS Code extension
+    timeout-minutes: 15
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: extensions/vscode
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with:
+          # The extension targets VS Code >=1.90, whose extension host is
+          # Node 20, and its @types/node pin is ^20. Build and test on the
+          # runtime the extension actually ships against.
+          node-version: 20
+      - name: Install extension dependencies
+        run: npm ci
+      - name: Run VS Code extension suites
+        # extensions/vscode ships node --test suites (api, markdown, sse) that
+        # NO workflow ran: release.yml only reads package.json for a version
+        # string, so the whole client compiled and shipped without its tests or
+        # `tsc` ever running in CI. `npm test` compiles first (tsc -p ./), so
+        # this is the type-check gate for the extension too.
+        run: npm test
+
   safety-gate:
     name: Safety gate
     needs: changes

.gitignore

@@ -22,6 +22,9 @@ codewhale-inference/
 !.env.example
 node_modules/
 .vscode/
+# The extension ships its own dev-loop config (F5 Extension Development Host).
+# Without this negation the bare `.vscode/` above swallows it silently.
+!/extensions/vscode/.vscode/
 .idea/
 *.swp
 *.swo

extensions/vscode/.vscode/launch.json

@@ -0,0 +1,24 @@
+{
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "name": "Run Extension",
+      "type": "extensionHost",
+      "request": "launch",
+      "args": ["--extensionDevelopmentPath=${workspaceFolder}"],
+      "outFiles": ["${workspaceFolder}/out/**/*.js"],
+      "preLaunchTask": "watch"
+    },
+    {
+      "name": "Extension Tests",
+      "type": "node",
+      "request": "launch",
+      "runtimeArgs": ["--test", "out/test"],
+      "cwd": "${workspaceFolder}",
+      "outFiles": ["${workspaceFolder}/out/**/*.js"],
+      "console": "integratedTerminal",
+      "internalConsoleOptions": "neverOpen",
+      "preLaunchTask": "compile"
+    }
+  ]
+}

extensions/vscode/.vscode/tasks.json

@@ -0,0 +1,26 @@
+{
+  "version": "2.0.0",
+  "tasks": [
+    {
+      "label": "watch",
+      "detail": "tsc -p ./ --watch — background compile for the Run Extension launch config",
+      "type": "shell",
+      "command": "npx tsc -p ./ --watch",
+      "options": { "cwd": "${workspaceFolder}" },
+      "isBackground": true,
+      "problemMatcher": "$tsc-watch",
+      "presentation": { "reveal": "never", "panel": "dedicated" },
+      "group": { "kind": "build", "isDefault": true }
+    },
+    {
+      "label": "compile",
+      "detail": "tsc -p ./ — one-shot build into out/",
+      "type": "shell",
+      "command": "npx tsc -p ./",
+      "options": { "cwd": "${workspaceFolder}" },
+      "problemMatcher": "$tsc",
+      "presentation": { "reveal": "silent", "panel": "dedicated" },
+      "group": "build"
+    }
+  ]
+}

extensions/vscode/.vscodeignore

@@ -0,0 +1,6 @@
+src/**
+node_modules/**
+out/test/**
+*.vsix
+tsconfig.json
+package-lock.json

extensions/vscode/README.md

@@ -1,36 +1,68 @@
 # CodeWhale for VS Code
 
-Official Codewhale extension scaffold for local development.
+Official Codewhale extension: an agentic chat sidebar over the local Engine
+Runtime API, with editor context, streaming turns, approvals, and terminal
+parity.
 
-This first slice is intentionally small:
+## What it does
 
-- open Codewhale in an integrated terminal
-- start `codewhale serve --http` in a visible terminal
-- check a local runtime through `/health` and `/v1/runtime/info`
-- show connection state in the status bar
-- show a read-only Agent View with recent runtime thread summaries from
-  `/v1/threads/summary`
-- show recent read-only restore points from `/v1/snapshots`
-- refresh the read-only Agent View automatically so branch/workspace metadata
-  catches up while agents are working
+**Chat sidebar** (primary view):
 
-It does not expose the full chat webview, VS Code Agent View chat/editor
-integration, inline edit application, marketplace publish workflow, or
-retry/undo/snapshot GUI endpoints yet.
+- create, switch, and resume Codewhale threads; every thread stays available
+  from the terminal and the embedded browser client
+- stream turns live over the runtime's replayable SSE contract
+  (`GET /v1/threads/{id}/events?since_seq=…`) with automatic reconnection
+- attach editor context as chips before sending: current selection,
+  active file, or Problems-panel diagnostics
+- resolve tool approvals (allow / deny / remember) and clarification
+  questions inline, hydrated from the thread-detail snapshot so a reload
+  never strands pending work
+- steer a running turn or stop it
+- render agent replies as a safe Markdown subset; every code block gets
+  Copy and Insert-at-cursor actions
+- open changed files from `file_change` items when the runtime includes a path
 
-## Local Use
+**Runtime view** (secondary): connection state, recent thread summaries,
+restore points, and the original terminal launch helpers.
+
+**Connection**: the extension attaches to `codewhale serve --http` on
+`127.0.0.1:7878` by default, starts it in a visible terminal on request, and
+never runs its own agent engine — the runtime is the single turn/event owner.
+
+## Security posture
+
+- Runtime bearer tokens are stored in VS Code SecretStorage via
+  **CodeWhale: Set Runtime Token**; the legacy `codewhale.runtimeToken`
+  setting still works and is migrated into secret storage on first use.
+- The webview renders with a strict CSP (`default-src 'none'`), and all
+  model output is HTML-escaped before any Markdown transform runs; links
+  must be http(s).
+- The chat webview script is a static string — no runtime data is
+  interpolated into it.
+
+## Local use
 
 ```bash
 npm install
-npm run compile
-npm run package
-code --install-extension codewhale-vscode-0.9.11.vsix
+npm test                                # compile + unit tests
+npm run package                         # -> codewhale-vscode-<version>.vsix
+code --install-extension codewhale-vscode-<version>.vsix
 ```
 
-Configure `codewhale.commandPath`, `codewhale.runtimeHost`,
-`codewhale.runtimePort`, `codewhale.runtimeToken`, and
-`codewhale.agentViewRefreshIntervalSeconds` from VS Code settings.
-Set the refresh interval to `0` to disable automatic read-only refreshes.
+Settings: `codewhale.commandPath`, `codewhale.runtimeHost`,
+`codewhale.runtimePort`, `codewhale.agentViewRefreshIntervalSeconds`
+(`0` disables automatic refresh). Commands: **CodeWhale: Ask Codewhale**
+(`ctrl+alt+c` from the editor, also on the editor context menu),
+**CodeWhale: New Chat**, **CodeWhale: Set Runtime Token**,
+**CodeWhale: Start Local Runtime**.
 
 Keep the runtime on `127.0.0.1` unless you deliberately front it with trusted
 local networking controls.
+
+## Not yet built
+
+VS Code-native diff/merge review of agent file changes (blocked on the
+runtime publishing a Files/Changes contract), provider/model switching from
+the composer, retry/undo/restore buttons, and account sign-in surface. The
+runtime's embedded browser client (`codewhale web`) remains the full-feature
+fallback for those flows.