chore: release v1.9.3

Author: TheStreamCode

.github/dependabot.yml

@@ -0,0 +1,20 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"
+    ignore:
+      # Keep the compiler API surface aligned with engines.vscode (^1.93.0).
+      - dependency-name: "@types/vscode"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+    commit-message:
+      prefix: "chore(deps)"

.github/workflows/ci.yml

@@ -28,10 +28,10 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
           cache: npm
@@ -57,4 +57,4 @@ jobs:
       # published advisory never blocks local development on an unrelated change.
       - name: Audit dependencies
         if: runner.os == 'Linux'
-        run: npm audit --audit-level=moderate
+        run: npm run audit

.gitignore

@@ -3,6 +3,10 @@ out/
 .vscode-test/
 .vsce/
 coverage/
+.env
+.env.*
 *.vsix
 *.log
 *.tsbuildinfo
+.DS_Store
+Thumbs.db

.nvmrc

@@ -0,0 +1 @@
+22

.vscodeignore

@@ -5,11 +5,19 @@ CLAUDE.md
 .vscode/**
 .vscode-test/**
 .vsce/**
+.nvmrc
+.env
+.env.*
 src/**
 test/**
 node_modules/**
+coverage/**
 **/*.map
 **/*.ts
+*.log
+*.vsix
+.DS_Store
+Thumbs.db
 .gitignore
 .gitattributes
 .editorconfig

AGENTS.md

@@ -14,18 +14,24 @@ commands you configure; it never installs, wraps, or modifies a CLI or shell pro
 ```bash
 npm ci                    # install
 npm run compile           # tsc build: src/ -> out/
-npm run watch              # tsc in watch mode
-npm run test:unit          # compile + fast unit tests (node:test against out/*.js)
-npm run test:integration   # compile + real VS Code Extension Development Host smoke test
-npm run test                # unit + integration
-npm run check                # compile + unit + integration + `vsce ls` packaging dry run
-npm run package               # build the .vsix via vsce
+npm run typecheck         # strict tsc check without emitting
+npm run watch             # tsc in watch mode
+npm run test:unit         # compile + fast unit tests (node:test against out/*.js)
+npm run test:integration  # compile + real VS Code Extension Development Host smoke test
+npm run test              # unit + integration
+npm run audit             # dependency advisories at moderate severity or higher
+npm run check             # compile + unit + integration + `vsce ls` packaging dry run
+npm run package           # build the .vsix via vsce
 ```
 
 `npm run check` is what CI runs (`.github/workflows/ci.yml`, matrix over Windows/macOS/Linux) — run
 it before submitting changes. There is no separate lint script; `tsc --strict` is the only static
 check.
 
+Before editing, inspect `git status` and the relevant files. Preserve unrelated local work, keep the
+diff focused, and do not commit generated `out/`, `.vscode-test/`, `.vsce/`, coverage, log, `.env`, or
+`.vsix` content. Do not bump the extension version unless the task is explicitly a release.
+
 Unit tests `require('../out/<name>.js')`, so they run against **compiled output**, never `src/`
 directly. To run a single test file, compile first, then point `node --test` at it:
 
@@ -103,6 +109,15 @@ just to `package.json`.
 commands (see `getEffectiveAgents` in `extension.ts`). The launcher is also disabled outright whenever
 `vscode.workspace.isTrusted` is false. Preserve both when touching config-reading code.
 
+The custom-agent schema rejects unknown properties. `installationDocumentationUrl` accepts only a
+credential-free HTTPS URL, and every path to `vscode.env.openExternal` must pass through
+`normalizeInstallationDocumentationUrl`, including command arguments that bypass settings parsing.
+Never add an `installCommand`, automatic installer, shell-profile mutation, or arbitrary URL scheme.
+
+An agent's `env` belongs only to its terminal. Installation-status checks merge those overrides with
+the extension host environment so a custom `PATH` is reported consistently; Agent Doctor reports and
+raw diagnostic output must continue to exclude environment values and credentials.
+
 ### Command resolution
 
 An agent's `command`/`updateCommand`/`versionCommand` is either a plain string or a
@@ -191,9 +206,22 @@ third-party agent marks.
 `tsconfig.json` uses `NodeNext` modules — relative imports in `src/` need an explicit `.js`
 extension (e.g. `from './agents.js'`) even though the source files are `.ts`. `strict` is on.
 
+### Dependencies, CI, and packaging
+
+Super CLI intentionally has zero runtime dependencies. All packages remain in `devDependencies` and
+the lockfile is authoritative. npm install scripts are reviewed and approved by exact package version
+in `package.json#allowScripts`; when a dependency update introduces a pending script, inspect it and
+update the pin deliberately rather than approving a package name indefinitely.
+
+`.github/dependabot.yml` monitors npm and GitHub Actions weekly. `@types/vscode` is ignored there
+because it must stay exactly aligned with `engines.vscode`; raise the two together. Workflow actions
+must remain pinned to immutable 40-character commit SHAs. `.vscodeignore` is the packaging boundary:
+keep source, tests, local configuration, environment files, source maps, logs, coverage, and generated
+VSIX files out of the artifact, then verify the actual list with `vsce ls`.
+
 ## Release process
 
 From `CONTRIBUTING.md`: version bumps touch `package.json`, `package-lock.json`, `CHANGELOG.md`, and
 `CITATION.cff` together (enforced by a `metadata.test.js` consistency check), followed by
-`npm audit` and `npm run check`, then `npm run package` and a manual install-and-verify pass in a
-clean Extension Development Host before tagging and publishing.
+`npm run audit` and `npm run check`, then `npm run package` and a manual install-and-verify pass in a
+clean Extension Development Host before tagging and publishing the same reviewed VSIX.

CHANGELOG.md

@@ -5,6 +5,31 @@ All notable changes to this project are documented here. The format is based on
 
 ## [Unreleased]
 
+## [1.9.3] - 2026-08-01
+
+### Added
+
+- Added explicit type-check and dependency-audit scripts, weekly Dependabot coverage for npm and
+  GitHub Actions, and a pinned npm install-script approval policy. Updated `actions/setup-node` to
+  its current major release while retaining immutable action references.
+
+### Changed
+
+- Expanded the README and agent guidance with requirements, quick start, environment handling,
+  development commands, build steps, release distribution, and supply-chain conventions.
+- Updated the locked Node.js type definitions within the existing Node 22 compatibility range.
+
+### Fixed
+
+- Restricted external installation documentation to credential-free HTTPS URLs and rejected unknown
+  custom-agent settings at the configuration-schema boundary.
+- Isolated Agent Doctor runner failures so one malformed or unavailable version command cannot abort
+  the complete report.
+- Made executable detection honor each custom agent's configured environment overrides.
+- Removed the integration suite's remaining dependency on `vscode.window.terminals` array order by
+  matching newly created terminals by identity and name.
+- Excluded local environment files, logs, coverage output, and generated VSIX files from packages.
+
 ## [1.9.2] - 2026-08-01
 
 ### Fixed

CITATION.cff

@@ -5,5 +5,5 @@ authors:
   - family-names: Gasperini
     given-names: Michael
 url: "https://github.com/TheStreamCode/super-cli"
-version: "1.9.2"
+version: "1.9.3"
 license: MIT

CONTRIBUTING.md

@@ -4,7 +4,7 @@ Thanks for your interest in improving Super CLI.
 
 ## Prerequisites
 
-- Node.js 22
+- Node.js 22 (the repository includes `.nvmrc`)
 - npm (included with Node.js)
 - VS Code 1.93 or newer for Extension Development Host testing
 
@@ -49,6 +49,10 @@ Thanks for your interest in improving Super CLI.
 - Follow the existing patterns in `src/`; consistency matters more than
   personal preference.
 - Keep user-facing behavior documented in `README.md`.
+- Keep external installation links on credential-free HTTPS URLs. Super CLI opens documentation but
+  never accepts installer commands.
+- Keep credentials out of commands, settings, fixtures, and `.env` files. Use each CLI's supported
+  credential store or local shell environment.
 - Third-party marks must come from an authoritative public source, remain
   limited to product identification, and be recorded in
   [`media/agents/ATTRIBUTION.md`](media/agents/ATTRIBUTION.md) and
@@ -67,11 +71,22 @@ Thanks for your interest in improving Super CLI.
 - Keep PRs focused — one concern per PR is easier to review and merge.
 - Do not commit generated `out/`, `.vsix`, `.vscode-test/`, or `node_modules/` content.
 
+## Dependency and supply-chain changes
+
+- Keep dependency changes in `devDependencies`; Super CLI has zero runtime dependencies.
+- `@types/vscode` must remain aligned with `engines.vscode` and is intentionally ignored by
+  Dependabot. Raise both together only when the extension actually needs a newer VS Code API.
+- npm install scripts are approved by exact package version in `package.json#allowScripts`. If an
+  install reports a new pending script, inspect the package and script before approving it; do not
+  replace the version-pinned entries with an open-ended package-name approval.
+- GitHub Actions must use immutable 40-character commit SHAs. Dependabot keeps both npm dependencies
+  and action references current on a weekly schedule.
+
 ## Release checklist (maintainers)
 
 1. Choose the next semantic version and update `package.json`,
    `package-lock.json`, `CHANGELOG.md`, and `CITATION.cff` together.
-2. Run `npm ci`, `npm audit`, and `npm run check`.
+2. Run `npm ci`, `npm run audit`, and `npm run check`.
 3. Run `npm run package` and inspect the file list reported by `vsce`.
 4. Install the generated VSIX in a clean Extension Development Host and verify
    the sidebar, launcher, settings, toolbar icon, and one terminal launch.

README.md

@@ -21,6 +21,16 @@ model — VS Code itself plus the forks that install from [Open VSX](https://ope
 or from a `.vsix`, such as Cursor, Windsurf, Google Antigravity, Kiro, Trae, VSCodium, and Gitpod. It
 is free, open source, and has no telemetry or automatic CLI installers.
 
+## Requirements
+
+- VS Code `1.93` or newer, or a compatible desktop editor that can install VS Code extensions.
+- At least one supported coding-agent CLI installed and authenticated according to that vendor's
+  documentation. Super CLI never installs or configures the CLI for you.
+- A trusted workspace before launch, update, or version commands can run.
+
+Node.js and npm are required only for developing or packaging Super CLI, not for installing the
+extension or launching an agent.
+
 ## Install Super CLI in VS Code
 
 [Install Super CLI from the Visual Studio Marketplace](https://marketplace.visualstudio.com/items?itemName=mikesoft.vscode-super-cli),
@@ -53,6 +63,18 @@ This extension is unofficial and is not affiliated with, endorsed by, or sponsor
 OpenAI, GitHub, Google, or any other vendor. See the [third-party
 notices](TRADEMARKS.md).
 
+## Quick start
+
+1. Install and authenticate the coding-agent CLI you want to use.
+2. Install Super CLI, open a folder, and trust the workspace after reviewing it.
+3. Open **Super CLI** from the activity bar and select an agent, or run **Super CLI: Launch Coding
+   Agent** from the Command Palette.
+4. Optionally star one or more agents and use `Ctrl+Alt+A` (`Cmd+Alt+A` on macOS) for fast access.
+
+The selected command runs in a native integrated terminal with the active workspace folder as its
+working directory. Super CLI does not proxy the CLI or replace the agent's own authentication and
+settings.
+
 ## Interface
 
 ### Agent sidebar and editor launcher
@@ -171,9 +193,9 @@ reuses a built-in `id` — overrides that built-in (for example to point at a cu
   paths that contain spaces.
 - `icon` — optional [ThemeIcon](https://code.visualstudio.com/api/references/icons-in-labels) id,
   e.g. `sparkle` or `rocket`.
-- `installationDocumentationUrl` — optional verified official installation documentation URL. When
-  the command is missing, Super CLI offers to open this URL in your external browser; it does not run
-  any installation command.
+- `installationDocumentationUrl` — optional verified official HTTPS installation documentation URL.
+  Credential-bearing URLs and non-HTTPS schemes are ignored. When the command is missing, Super CLI
+  offers to open the URL in your external browser; it does not run any installation command.
 - `env` — optional environment variables set for the agent's terminal, e.g. to opt out of a CLI's
   IDE-extension auto-install via its own variable: `{ "CLAUDE_CODE_IDE_SKIP_AUTO_INSTALL": "1" }`.
 - `updateCommand` — optional command to update the CLI. It accepts the same cross-platform string or
@@ -188,6 +210,16 @@ the command runs inside WSL.
 Only the user (global) value of `superCli.agents` is used; workspace overrides are ignored so that
 an untrusted repository cannot inject commands.
 
+### Environment variables and secrets
+
+Super CLI itself requires no environment variables and does not load `.env` files. The optional
+`env` object on a custom agent applies only to that agent's terminal; executable detection uses the
+same overrides so a custom `PATH` is reflected in the sidebar status.
+
+Keep credentials in the CLI vendor's supported credential store or in your normal shell environment.
+Do not commit secrets in settings, command strings, or environment files. `.env` variants are ignored
+by Git and explicitly excluded from VSIX packages as a defensive safeguard.
+
 ## Configuration
 
 | Setting | Default | Description |
@@ -269,8 +301,9 @@ Windows, macOS, Linux, or WSL command variant.
 ### Which AI coding agents are supported?
 
 Claude Code, Codex, GitHub Copilot CLI, Grok, Kilo, Kiro, OpenClaw, Antigravity, OpenCode, Command
-Code, Cursor, Devin CLI, Droid, Crush, Hermes, MiMo Code, Pi, Kimi Code CLI, Qoder CLI, and Qwen Code
-CLI out of the box — plus any CLI you add in `settings.json`.
+Code, Cursor, Devin CLI, Droid, Crush, Hermes, MiMo Code, Pi, Kimi Code CLI, Qoder CLI, Qwen Code CLI,
+Amp, OpenClaude, Oh My Pi, goose, Auggie CLI, Cline CLI, Codebuff, Continue CLI, Mistral Vibe, and Rovo
+Dev CLI out of the box — plus any CLI you add in `settings.json`.
 
 ### Does Super CLI work on Windows, macOS, Linux, and WSL?
 
@@ -286,6 +319,8 @@ integrated terminal.
 If Super CLI is useful to you, consider [sponsoring its development](https://github.com/sponsors/TheStreamCode).
 Bug reports, feature requests, and contributions are welcome on
 [GitHub](https://github.com/TheStreamCode/super-cli).
+Report suspected vulnerabilities privately according to [SECURITY.md](SECURITY.md), not in a public
+issue.
 
 ## Privacy
 
@@ -298,10 +333,47 @@ show the one-time rating nudge described above — neither is ever transmitted a
 Keep credentials in each CLI's supported credential store or environment configuration rather than
 embedding them directly in launch, update, or version command strings.
 
-## Building
+## Development
+
+Development requires Node.js 22, npm, and VS Code 1.93 or newer. The repository includes `.nvmrc` for
+Node version managers. Install the exact locked dependency tree before working:
 
 ```bash
 npm ci
-npm run check     # compile + unit tests + VS Code integration smoke test
-npm run package   # produce the .vsix
 ```
+
+Press `F5` in VS Code to compile and open an Extension Development Host, or use these scripts:
+
+| Command | Purpose |
+| --- | --- |
+| `npm run compile` | Compile strict TypeScript from `src/` to `out/`. |
+| `npm run typecheck` | Run strict TypeScript checks without emitting files. |
+| `npm run watch` | Recompile TypeScript while files change. |
+| `npm run test:unit` | Compile and run the fast `node:test` unit suite. |
+| `npm run test:integration` | Compile and launch the real VS Code Extension Development Host smoke test. |
+| `npm run check` | Run compile, unit tests, integration tests, and the VSIX file-list dry run used by CI. |
+| `npm run audit` | Check the complete dependency tree for moderate-or-higher known vulnerabilities. |
+| `npm run package` | Compile and create an installable `.vsix`. |
+
+There is no separate linter: `tsc --strict`, `noUnusedLocals`, and `noUnusedParameters` are the static
+quality gate. Unit tests execute compiled files from `out/`, never TypeScript source directly. See
+[CONTRIBUTING.md](CONTRIBUTING.md) for code, test, branding, and pull-request conventions.
+
+## Build and distribution
+
+Before producing a release artifact, run the same gates as CI and inspect the VSIX contents:
+
+```bash
+npm ci
+npm run audit
+npm run check
+npm run package
+```
+
+For this project, deployment means publishing the reviewed VSIX rather than deploying a server. A
+maintainer updates `package.json`, `package-lock.json`, `CHANGELOG.md`, and `CITATION.cff` together,
+installs the generated VSIX in a clean Extension Development Host, then publishes that same artifact
+to the Visual Studio Marketplace, Open VSX, and the matching GitHub release. Publishing credentials
+belong in the platform's secret store or local credential manager and must never be committed.
+
+The complete maintainer checklist is in [CONTRIBUTING.md](CONTRIBUTING.md#release-checklist-maintainers).