Released 0.4.0 with title-derived sandbox names, live config.yaml tracking and skipping of sandbox names the runtime will not release (FR-009, FR-057)

[dzykovic]

Risk & Size

Risk: Low
Size: Small

No source change: version bump, changelog, packaging manifest, and two dev-only
transitive bumps from npm audit fix.

What & Why

Release 0.4.0 — the user-visible payload is PR #26 (title-derived sandbox names, the views
following .sandbox/config.yaml, and remembering sandbox names the Docker Sandboxes
runtime will not release). PR #25 (specs folder layout) is docs/process only and gets no
changelog entry.

Two things beyond the bump, both found by this release's own gates:

• .tmp/** was missing from .vscodeignore, so npx vsce ls showed a local scratch
  checkout (.tmp/readme.md, .tmp/awesome-docker-sbx/**) shipping inside the VSIX. It is
  git-excluded, but vsce honours .vscodeignore only. Fixed there, not by deleting files.
• npm audit reported 2 high findings (brace-expansion, fast-uri), both reached
  only through the dev-only @vscode/vsce and never shipped. npm audit fix took them to
  patch releases; audit is back to 0 findings and the lockfile change is dev-only.

The extension also drops "preview": true — the Marketplace listing stops being flagged
as a preview.

Changes

• package.json: version 0.3.0 → 0.4.0; "preview": true removed.
• CHANGELOG.md: ## [0.4.0] - 2026-08-05 in user language (named sandboxes, live config
  tracking, skipped unusable names, per-sandbox default Dockerfile, preview flag dropped)
  plus the release link definition.
• .vscodeignore: exclude .tmp/**; the comment now says why a git exclude is not enough.
• package-lock.json: brace-expansion 5.0.8 → 5.0.9, fast-uri 3.1.4 → 3.1.5 (dev-only).

How to Verify

1. npm ci — lockfile in sync; npm run verify — exits 0.
2. npm audit — 0 vulnerabilities (was 2 high, dev-only, before the fix above).
3. npx vsce ls — exactly: THIRD_PARTY_NOTICES.txt, README.md, package.json,
   LICENSE, CHANGELOG.md, media/icon.png, dist/extension.js. Nothing else.
4. npx vsce package — produces sandbox-console-0.4.0.vsix (9 files, ~97 KB) with only
   the known bundle-size warning.
5. README listing sanity: both image paths (docs/media/explorer.png, docs/media/create.png)
   exist in the repo, badges/links are absolute, no unpublished-state text. The
   "Verified against sbx v0.31.3" line still matches the installed CLI (sbx version).
6. The packaged VSIX installs cleanly (code --install-extension sandbox-console-0.4.0.vsix --force); the 0.4.0 behaviour was accepted manually before the merge of Made the recipe state truthful: the Explorer and status bar follow config.yaml edits on disk, new-sandbox keys derive from the title, and names claimed by leaked sbx state are remembered and skipped (FR-009, FR-057) #26.

[Copilot]

Pull request overview

Release prep for 0.4.0: updates extension metadata and release artifacts without changing runtime source, aligning the Marketplace/package output with the already-accepted feature work in PR #26.

Changes:

• Bumped extension version to 0.4.0 and removed the Marketplace "preview": true flag.
• Added 0.4.0 release notes and the corresponding GitHub release link in CHANGELOG.md.
• Ensured VSIX packaging excludes local scratch content via .vscodeignore, and updated the lockfile for dev-only transitive audit fixes.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated no comments.

File	Description
package.json	Version bump to 0.4.0 and removed "preview": true to stop marking the listing as preview.
package-lock.json	Lockfile version bump plus dev-only transitive updates (brace-expansion, fast-uri) from npm audit fix.
CHANGELOG.md	Added 0.4.0 entry (dated 2026-08-05) and the [0.4.0] release link definition.
.vscodeignore	Excluded .tmp/** to prevent local scratch content from being included in the packaged VSIX.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.