docs(releasing): record the Open VSX publish, and the half of it that is still open

[pa-arth]

RELEASING.md ends with "Whichever way this is resolved, record it here" — and it was already stale in exactly the way it warns about.

The doc was wrong before I touched anything

It said Open VSX served 0.1.0 as of 2026-08-23. The registry actually had 0.3.1 as latest, published 2026-08-23T21:48Z — after that check, by someone who didn't come back to the document. So the privacy liability on latest had already been closed and nobody knew.

Done: 0.3.2 published

latest now resolves to 0.3.2, verified against the API rather than from the CLI's own output. Three things that cost time, written down so they cost it once:

• ovsx publish prints Published before the version exists. The version endpoint 404'd for ~100 seconds while the registry indexed. Poll the API; the success line is not the observation.
• The published bytes are ours, byte-for-byte. Downloaded back and compared: sha256 94bb2036… matches the v0.3.2 tag message and promptster-cli's embedded artifact. The registry does not repackage — so the reproducibility chain holds all the way to what a registry install pulls, which is the claim the whole tag-and-checksum scheme exists to make and which nobody had ever checked end to end.
• ovsx writes the PAT clear-text to ~/.ovsx when it cannot open the OS credential store, in one easy-to-miss line. Deleted. Also: VAR=x cmd -p "$VAR" silently doesn't work — the expansion happens before the assignment, so ovsx falls through to an interactive prompt.

Not done, and stated as such

0.1.0 is still installable by pin. Re-verified against the live registry today rather than carried over from the earlier note:

• hooks onDidChangeWindowState and emits editor_focus from dist/collectors/focus.js
• no command redactor — dist/utils/ holds only editorDetector, logger, pathSanitizer, and dist/collectors/terminal.js has zero occurrences of redact

Publishing over it did not retract it and could not. Removal goes through the registry's admins; that request has not been made. Recorded as open.

What publishing did buy: anything resolving latest — which is what a devcontainer.json customizations.vscode.extensions entry does — now gets a build that honours the promise. That matters the moment a hosted lane ships, since it installs by registry id, not from a local file.

Also: the lint script is removed

eslint is not a devDependency, there is no eslint config in the repo, and ci.yml never invoked it — pnpm run lint could only ever fail with command not found. A script naming a tool the repo doesn't install is worse than no script: it reads as "we lint" and doesn't. Adding a linter for real is its own change.

Gates

tsc -p ./ ✅ · vitest 107/107 across 7 files ✅

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

The PR updates the release record with the verified Open VSX 0.3.2 publication while preserving the outstanding removal task for privacy-incompatible 0.1.0.

• Documents registry indexing delay, artifact checksum verification, and PAT-storage behavior.
• Clarifies the behavior of latest versus pinned legacy versions.
• Removes the nonfunctional lint script from package.json.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified in the documentation or package-script change.

The release instructions align with the pinned Open VSX dependency and documented artifact flow, while removing the lint script does not break any repository workflow or automation.

Important Files Changed

Filename	Overview
RELEASING.md	Accurately records the Open VSX publication outcome, verification steps, credential caveat, and unresolved legacy-version removal.
package.json	Removes an unused lint script whose executable and configuration are not provided and which repository CI does not invoke.

_{Reviews (1): Last reviewed commit: "docs(releasing): record the Open VSX pub..." | Re-trigger Greptile}