Skip to content

chore: 0.5.4 cleanup, documentation refresh, and packaging metadata sync - #25

Open
TheStreamCode wants to merge 4 commits into
mainfrom
chore/0.5.4-cleanup-and-docs
Open

chore: 0.5.4 cleanup, documentation refresh, and packaging metadata sync#25
TheStreamCode wants to merge 4 commits into
mainfrom
chore/0.5.4-cleanup-and-docs

Conversation

@TheStreamCode

@TheStreamCode TheStreamCode commented Aug 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

Summary

Maintenance pass for 0.5.4: dead code removal, a smaller webview state message, documentation refresh, and synchronized release/package metadata. No commands, settings, API endpoints, or dashboard behavior change; this remains a backward-compatible patch release.

Changes

Code

  • The dashboard webview no longer receives per-model quotas rows that it never renders; the host still uses them to derive the daily request window.
  • Removed the superseded summarizeStatusBar helper and tests that exercised only dead code; the active compact status-bar behavior is now tested directly.
  • Removed unused webview/index.html; production markup continues to be generated by ChutesWebviewProvider with a per-load CSP nonce.

Tests and release consistency

  • Added src/test/webviewState.test.ts for state projection and host-state immutability.
  • Added src/test/releaseMetadata.test.ts to require package.json, both root lockfile version fields, and CITATION.cff to stay aligned.
  • Fixed the previously missed package-lock.json drift from 0.5.3 to 0.5.4.
  • Suite grows from 69 to 74 tests.

Documentation and repository hygiene

  • Expanded README.md with requirements, Open VSX installation, verified development commands, and repository layout.
  • Rewrote AGENTS.md as a project-specific guide covering architecture, generated files/assets, compatibility, security boundaries, validation gates, and the manual release sequence.
  • Removed obsolete April 2026 pre-implementation plan/design notes under docs/superpowers/; they describe an unshipped architecture, are unreferenced, and remain recoverable from Git history.
  • Synchronized CITATION.cff; added reviewed npm allowScripts; excluded repository-only citation metadata from the VSIX; expanded local artifact ignores.

Verification

  • npm ci
  • strict TypeScript compile for extension host and webview
  • 74 unit/contract tests, 0 failed, 0 skipped
  • dependency audit, 0 vulnerabilities
  • production VSIX generated and inspected
  • VSIX installed into a fresh VS Code profile and discovered as mikesoft.chutes-usage-vscode@0.5.4
  • Interactive Extension Development Host check with a real Chutes API key
  • Live usage/quota response check with a real Chutes API key

Recorded local results on Windows 11:

  • npm run preflight — exit 0
  • Coverage — 89.45% lines, 83.78% branches, 86.67% functions (no configured threshold)
  • npm audit --audit-level=moderate — 0 vulnerabilities
  • chutes-usage-vscode-0.5.4.vsix — 32 files, 286,539 bytes (279.82 KB)
  • SHA-256 — 059CF3CA225724ED05C5239FEF51B1CA6BD9AADDD8FEE325F2F0A8FAF2BC91CF
  • Package identity — mikesoft.chutes-usage-vscode@0.5.4
  • Contents — runtime out/, media/, and user-facing root documents only; no source tests, source maps, node_modules, .env, credential files, or secret-pattern matches
  • Install smoke — passed with VS Code 1.131.0 using isolated user-data and extensions directories; temporary profile removed afterward

The two unchecked checks require a real CHUTES_KEY, which is not present in this environment. Automated webview presentation, bootstrap, message-validation, and state-projection suites cover the boundary changed by this PR.

Privacy and security

Privacy is strictly reduced: per-model quota rows no longer cross the extension-host/webview boundary or enter persisted webview state. CSP nonce handling, validated messages/cached state, SecretStorage, and the https://chutes.ai external-link allowlist remain intact. No new endpoint or permission was added.

Release notes

  • package.json, package-lock.json, CITATION.cff, and CHANGELOG.md all state 0.5.4.
  • The tag and GitHub Release intentionally follow merge and are not created while the protected branch still requires approval.
  • Visual Studio Marketplace and Open VSX publishing remain owner-controlled; neither channel was published from this PR.

TheStreamCode and others added 4 commits August 1, 2026 22:20
@TheStreamCode @claude
refactor: trim the webview state payload and drop dead code
4b3e8e7 
The dashboard webview never reads the per-model `quotas` rows: they are
only used by the extension host to derive the daily request window, and
`webview/types.ts` deliberately omits them. They were still serialized
into every `postMessage` and persisted through `vscode.setState`, so the
host state is now projected down to what the webview renders before it
crosses the boundary.

Also remove code that no longer runs:

- `summarizeStatusBar` and its formatting helper were superseded by
  `summarizeStatusBarCompact` in 0.4.x and reachable only from the test
  suite. The helper also carried a dead `includePrefix` branch that
  selected between two identical strings.
- `webview/index.html` was neither compiled nor packaged; the webview
  markup is generated by `ChutesWebviewProvider` with a per-load CSP
  nonce.

The three tests that covered the removed helper are replaced by tests
that pin the same user-facing guarantees on the compact summary the
status bar actually renders: unverified request usage shows `--` rather
than a misleading `0`, and a zero request limit shows as unlimited.

Ignore rules pick up local build and tooling artifacts, and the VSIX no
longer ships `CITATION.cff`, which is repository metadata.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@TheStreamCode @claude
docs: refresh project documentation and drop obsolete planning notes
26e6c6b 
`README.md` gains a requirements section, the Open VSX install path, the
real development commands taken from `package.json`, and the repository
layout.

`AGENTS.md` is rewritten as a project-specific guide: architecture and
the extension-host/webview split, verified commands, generated files and
assets that must not be edited, the security rules around the API key
and the webview boundary, compatibility constraints, the mandatory
validation gates, and the manual release and publishing sequence.

`docs/superpowers/` held the April 2026 pre-implementation plan and
design notes. They describe a scope the shipped extension no longer
matches — a quotas table in the dashboard, a `GET /model_aliases/` data
source, a `webview/index.html` entry point — and they embed directives
for a specific agent tool. Nothing references them. They remain
available in the Git history.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@TheStreamCode @claude
chore: release version 0.5.4
ceb880e 
Patch release: cleanup, documentation, and packaging metadata only. No
change to commands, settings, API endpoints, or dashboard behavior.

`CITATION.cff` had drifted to 0.5.2 and now tracks the released version,
with the release date, software type, and repository metadata added.

`allowScripts` records the two dependency install scripts that were
reviewed and approved through `npm approve-scripts`, so `npm ci` stays
deterministic on npm 11 and later, where unreviewed install scripts are
first warned about and then blocked.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@TheStreamCode
fix: keep release metadata synchronized
6bd80bd
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@TheStreamCode