[ciotlos]

Summary

Full architectural remediation addressing streaming reliability, security, VS Code standards, and configuration management.

Streaming Reliability

• SDK client timeouts (5min streaming, 30s control plane, 10s connection)
• CancellationToken wired to AbortController for proper request abort
• SDK client caching per region for connection reuse
• Retry logic for transient errors (429, 5xx, network drops)
• Typed stream as AsyncIterable<ConverseStreamOutput> instead of any

Security

• Bearer token scoped to individual SDK calls via try/finally (no longer in global process.env)
• Removed OpenRouter third-party API call — replaced with bundled static model metadata
• Sensitive key redaction in logger (apiKey, secret, token → [REDACTED])
• API key format validation with warning on unexpected format
• Env var cleanup in deactivate()

Standards

• Provider registration disposable pushed to context.subscriptions
• Removed dead chatEndpoints code
• Fixed all 56 lint issues → 0 errors, 0 warnings

Configuration

• Removed no-op bedrock.selectModel command
• Removed redundant "More Settings" QuickPick option
• Settings now respect workspace scope when a workspace is open

Docs

• Architecture diagram (Mermaid) with data flow table
• Updated README: commands, features, model list
• Added .kiro/ to .gitignore

Version

• Bumped to 0.2.0

What was tested

• npm run compile — zero errors
• npm run lint — zero errors, zero warnings
• Manual verification of all security constraints (grep for process.env, fetch, openrouter)