* docs: update README for v2.37 — changelog, extensions, stale refs
- Update "What's New" section from v2.33 to v2.37
- Update extensions table: add Async Jobs and GitHub, remove LSP (Pi SDK core)
- Fix extension count in architecture section (12 → 18)
- Remove stale v2.17 version tags from Token Optimization section
* docs: fix stale references across documentation
- commands.md: update version example from v2.28 to v2.37
- troubleshooting.md: fix Node.js requirement from ≥20.6.0 to ≥22.0.0
- skills.md: fix project-local skills path from .pi/ to .gsd/
- CONTRIBUTING.md: fix scope area paths to include packages/ prefix,
remove incorrect PR #1232 supply chain attack reference
- vscode-extension: fix Node.js requirement, remove hardcoded RPC
command count (changes over time)
* docs: add troubleshooting for command not found after install
Addresses #1542 — npm global bin directory not in PATH is a common
issue on macOS, especially with Homebrew Node, version managers, or
oh-my-zsh git aliases.
- Add "command not found: gsd" section to troubleshooting.md
- Add callout to getting-started.md install section
Adds everything needed to publish the extension to the VS Code Marketplace:
- README.md — full feature documentation with commands table, keyboard
shortcuts, configuration reference, quick start guide, and @gsd chat
participant usage
- CHANGELOG.md — initial 0.1.0 release notes
- .vscodeignore — excludes src/, tsconfig, maps from the .vsix package
- .gitignore — excludes dist/ and *.vsix from version control
- LICENSE — MIT license copied from repo root
- package.json — adds repository, homepage, bugs, keywords, galleryBanner
fields required by the marketplace; adds @vscode/vsce to devDependencies;
adds publish script
Verified: `npm run package` produces a clean 30KB .vsix with no warnings.
Run `npm run publish` with a VSCE_PAT token to publish.
1. Webview CSP nonce (security): Added Content-Security-Policy meta tag
with nonce-based script-src to sidebar.ts. Replaced all inline
onclick handlers with data-command attributes and a single delegated
event listener, which CSP requires over inline handlers.
2. Dead branch in chat-participant.ts: Removed the isSlashCommand
conditional that ran identical code for both paths — slash commands
and regular messages both call sendPrompt() the same way.
3. Restart loop cooldown in gsd-client.ts: Added a 60-second sliding
window that tracks crash timestamps. If the process crashes more
than 3 times within 60 seconds, auto-restart is disabled and an
error is surfaced to the user via the onError event emitter.
