feat: add one-time rating nudge and resolve dependency vulnerabilities for v1.3.0

Show a single, non-repeating notification after 20 successful launches
asking for a Marketplace/Open VSX rating, using the native extension.open
command so it works correctly across VS Code, Cursor, Windsurf, and
Antigravity. The launch counter and shown flag live only in local
extension state; nothing is tracked or transmitted.

Also resolved all 4 reported high-severity dependency vulnerabilities
(fast-uri, js-yaml, linkify-it, brace-expansion), all transitive through
the @vscode/vsce build tool and never shipped with the packaged extension.

Author: TheStreamCode

CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [1.3.0] - 2026-07-24
+
+### Added
+
+- Added a one-time rating nudge shown after 20 successful launches, stored only in local extension
+  state and never repeated regardless of the response.
+
+### Fixed
+
+- Resolved all reported dependency vulnerabilities in the build/release toolchain (`fast-uri`,
+  `js-yaml`, `linkify-it`, `brace-expansion`, all transitive through `@vscode/vsce`); none of these
+  ship with or run inside the packaged extension.
+
 ## [1.2.0] - 2026-07-24
 
 ### Added

CITATION.cff

@@ -5,5 +5,5 @@ authors:
   - family-names: Gasperini
     given-names: Michael
 url: "https://github.com/TheStreamCode/super-cli"
-version: "1.2.0"
+version: "1.3.0"
 license: MIT

README.md

@@ -89,6 +89,9 @@ defined explicitly for Windows, macOS, and Linux; WSL deliberately selects the L
   changes your shell profile.
 - **Native integrated terminal.** Each agent runs in a real VS Code terminal, inheriting your
   shell, `PATH`, and environment. No bundled emulator, no runtime dependencies.
+- **One-time rating nudge.** After 20 successful launches, Super CLI shows a single notification
+  asking for a Marketplace rating. It never repeats after that, however you respond, and the launch
+  count lives only in this extension's local state — nothing is sent anywhere.
 
 ## Adding or overriding an agent
 
@@ -223,7 +226,9 @@ Bug reports, feature requests, and contributions are welcome on
 
 This extension does not collect telemetry, analytics, or personal data. It never installs CLIs or
 modifies shell profiles; it only runs launch and user-requested update commands in your integrated
-terminal, plus bounded version commands when you explicitly run Agent Doctor.
+terminal, plus bounded version commands when you explicitly run Agent Doctor. The only state it
+keeps locally is your configuration (favorite, hidden built-ins) and a launch counter used solely to
+show the one-time rating nudge described above — neither is ever transmitted anywhere.
 
 Keep credentials in each CLI's supported credential store or environment configuration rather than
 embedding them directly in launch, update, or version command strings.

package-lock.json

@@ -3,7 +3,7 @@
   "displayName": "Super CLI: Claude Code, Codex & AI Agent Launcher",
   "description": "Launch Claude Code, Codex CLI, Copilot CLI, Google Antigravity, OpenCode, Kiro, OpenClaw, Qoder CLI and other AI coding agents from one VS Code sidebar.",
   "publisher": "mikesoft",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/TheStreamCode/super-cli.git"

package.json

@@ -31,6 +31,14 @@ export function shouldOfferFavoriteAfterLaunch(
   return offerFavorite && launched && selectedId !== favoriteId;
 }
 
+/** Successful launches before the one-time rating prompt is offered. */
+export const RATING_PROMPT_LAUNCH_THRESHOLD = 20;
+
+/** Returns whether a successful launch should trigger the one-time rating prompt. */
+export function shouldOfferRatingAfterLaunch(launchCount: number, ratingPromptShown: boolean): boolean {
+  return !ratingPromptShown && launchCount >= RATING_PROMPT_LAUNCH_THRESHOLD;
+}
+
 function sortAgents(agents: readonly Agent[]): Agent[] {
   return [...agents].sort(compareAgentsByLabel);
 }

src/agent-view.ts

@@ -9,7 +9,12 @@ import {
   resolveAgents,
   resolveCommandPlatform,
 } from './agents.js';
-import { buildAgentSections, compareAgentsByLabel, shouldOfferFavoriteAfterLaunch } from './agent-view.js';
+import {
+  buildAgentSections,
+  compareAgentsByLabel,
+  shouldOfferFavoriteAfterLaunch,
+  shouldOfferRatingAfterLaunch,
+} from './agent-view.js';
 import { executableExistsOnPath, isExecutableFile } from './command-utils.js';
 import { buildDoctorReport, inspectAgents, type DoctorResult } from './doctor.js';
 import { resolveAgentIcon } from './icons.js';
@@ -197,9 +202,42 @@ export function activate(context: vscode.ExtensionContext): void {
     }
   };
 
+  // Offers a one-time, local-only rating prompt once the user has launched agents enough to be a
+  // genuine fan. No usage data ever leaves the machine: the launch count and prompt-shown flag are
+  // both stored in this extension's own globalState. Fire-and-forget like the update-completion
+  // notice in terminal.ts, so a pending toast never blocks the launch command itself.
+  const maybeOfferRatingPrompt = (): void => {
+    const launchCount = context.globalState.get<number>('launchCount', 0) + 1;
+    void context.globalState.update('launchCount', launchCount);
+
+    const ratingPromptShown = context.globalState.get<boolean>('hasShownRatingPrompt', false);
+    if (!shouldOfferRatingAfterLaunch(launchCount, ratingPromptShown)) {
+      return;
+    }
+
+    void context.globalState.update('hasShownRatingPrompt', true);
+    void vscode.window.showInformationMessage(
+      'Enjoying Super CLI? A quick rating helps other developers find it.',
+      'Rate Super CLI',
+    ).then((choice) => {
+      if (choice === 'Rate Super CLI') {
+        void vscode.commands.executeCommand('extension.open', context.extension.id);
+      }
+    });
+  };
+
+  const launchAndMaybeOfferRating = async (agent: Agent): Promise<boolean> => {
+    const launched = await launchAgent(agent, context, terminalSequence++);
+    if (launched) {
+      maybeOfferRatingPrompt();
+    }
+
+    return launched;
+  };
+
   const launchWithStatusGuard = async (agent: Agent): Promise<boolean> => {
     if (installStatus.get(agent.id) !== false) {
-      return launchAgent(agent, context, terminalSequence++);
+      return launchAndMaybeOfferRating(agent);
     }
 
     const actions = agent.installationDocumentationUrl
@@ -215,7 +253,7 @@ export function activate(context: vscode.ExtensionContext): void {
     } else if (selection === 'Open Settings') {
       await openExtensionSettings(context);
     } else if (selection === 'Launch Anyway') {
-      return launchAgent(agent, context, terminalSequence++);
+      return launchAndMaybeOfferRating(agent);
     }
 
     return false;

src/extension.ts

@@ -5,6 +5,8 @@ const {
   buildAgentGroups,
   buildAgentSections,
   shouldOfferFavoriteAfterLaunch,
+  shouldOfferRatingAfterLaunch,
+  RATING_PROMPT_LAUNCH_THRESHOLD,
 } = require('../out/agent-view.js');
 
 const agents = [
@@ -53,3 +55,10 @@ test('favorite prompt is offered only after a successful launch', () => {
   assert.equal(shouldOfferFavoriteAfterLaunch(false, true, 'codex', ''), false);
   assert.equal(shouldOfferFavoriteAfterLaunch(true, true, 'codex', 'codex'), false);
 });
+
+test('rating prompt is offered exactly once, only once the launch threshold is reached', () => {
+  assert.equal(shouldOfferRatingAfterLaunch(RATING_PROMPT_LAUNCH_THRESHOLD - 1, false), false);
+  assert.equal(shouldOfferRatingAfterLaunch(RATING_PROMPT_LAUNCH_THRESHOLD, false), true);
+  assert.equal(shouldOfferRatingAfterLaunch(RATING_PROMPT_LAUNCH_THRESHOLD + 100, false), true);
+  assert.equal(shouldOfferRatingAfterLaunch(RATING_PROMPT_LAUNCH_THRESHOLD, true), false);
+});