Two follow-up review fixes on the interactive-graph webview surface:
- `loadGraphHtml(projectId)` now resolves the projectId-derived path
and verifies the result stays inside `GRAPH_DIR`. The
`socraticode.openInteractiveGraph` command accepts an arbitrary
argument from any caller (palette, sidebar, other extensions), so a
value like `../../etc/passwd` would otherwise escape the cache
directory via `path.join`. Suspicious projectIds are now rejected
with a log entry and the function returns `undefined`.
- `handleWebviewMessage` now opens the document first, then clamps
the requested line number against the document's actual `lineCount`
before constructing a `Range`. The previous `m.line > 0` check
prevented negatives but allowed absurdly large values (e.g.
`Number.MAX_SAFE_INTEGER`) that would build a Range past the end of
the file. Selection is set on the resolved editor.
Lint, typecheck, manifest tests and build all clean.
A pass over the extension surface to address review feedback:
Safety / hardening:
- `graphPanel.ts`: validate `m.path` from the webview before opening
files. Reject absolute paths and any path that escapes the workspace
root (`..`, `/foo`, `C:/...`). Validate the line number is a positive
integer before constructing a `Range`. Surface failures via the output
channel rather than letting the rejection bubble up.
- `mcpProvider.ts`: defensively check that
`vscode.lm.registerMcpServerDefinitionProvider` exists before calling
it. The `engines.vscode: ^1.99.0` field already enforces this on
install, but some VS Code-derived editors mis-report their engine
version. The extension now degrades gracefully (sidebar, commands,
status bar still work) instead of failing activation.
- `commands.ts` and `graphPanel.ts`: wrap `workbench.action.chat.open`
in try/catch. Not every VS Code-compatible editor exposes that
command; falling back to the output channel avoids unhandled
rejections after the user clicked "Open chat".
- `extension.ts`: persist the first-run walkthrough flag only after the
walkthrough command resolves successfully, so a transient failure
doesn't silently skip the onboarding forever.
CI gates:
- `extension-ci.yml` and `extension-release.yml`: run `npm test` between
typecheck and build, so manifest-level smoke regressions can't slip
through to either the PR artefact or the marketplace publishes.
Settings copy:
- `socraticode.env` description: explicitly call out that the setting
is for non-secret config only. Recommend OS environment variables /
local `.env` files for API keys, since workspace settings can sync
via Settings Sync and end up in committed `.vscode/settings.json`.
Quality of life:
- `sidebar.ts` `formatRelative`: clamp the computed seconds to zero so
a file mtime slightly ahead of the local clock doesn't render
"-5s ago".
- `walkthroughs/first-index.md`: corrected the embedding model name
(`nomic-embed-text`, not `mxbai-embed-large`) to match the engine
default in `src/constants.ts`.
Lint / docs:
- `extension/README.md`: hyphenate "Eclipse Theia-based editors".
- `DEVELOPER.md`: add `text` language hint to the directory-tree code
fence (markdownlint MD040). Updated the inline comment for
`settings.ts` to reflect its current shape.
- `README.md`: reflow the "extension vs plugin" callout into a single
blockquote (markdownlint MD028).
Lint, typecheck, manifest tests and build all clean. Engine unit tests
unaffected (706/706 still pass).
Marketplace URL becomes giancarloerra.socraticode (VS Code Marketplace)
and giancarloerra/socraticode (Open VSX), matching the registered
publisher account. The Altaire sponsor link and license contact email
stay as they are; only the publisher slug and the corresponding
shields.io / marketplace URLs in the README change.
Two small additions to the marketplace README:
- Discord badge in the header row, next to GitHub stars. Static
shields.io badge linking to the community Discord. The auto-updating
member-count variant can replace it later if we publish the server
ID.
- New short "SocratiCode Cloud (private beta)" section between
Compatibility and Privacy. Mirrors the wording on socraticode.cloud:
managed infrastructure, webhook-driven indexing, shared team
indexes, SSO/SAML, audit logs, SOC 2 / ISO 27001-aligned controls,
private beta. Request-access link only; no in-extension Cloud
feature is implied.
Marketplace listing now points readers at both the community channel
and the hosted edition without overstating either.
The marketplace listing page is the single biggest conversion surface
for the extension. This pass turns the README into something that
reads as a polished product page, not an in-house engineering note.
Headline changes:
- Editor-neutral framing throughout. The same `.vsix` ships to VS
Code, Cursor, VSCodium, Gitpod, code-server, Theia, Antigravity,
and Particle Workbench. The previous wording was VS Code-first
(Copilot agent mode listed first, "VS Code's MCP host", title with
"for VS Code"). Replaced with editor-agnostic language: "any
MCP-compatible chat or agent in your editor", followed by named
surfaces (Copilot agent mode, Cursor's Agent / Composer, the
Gemini surface in Antigravity, Cline, Continue, Roo Code, others).
- Hero image referenced via raw GitHub URL (absolute, survives both
marketplace renderers).
- Badge row: VS Code Marketplace version + installs, Open VSX
version + downloads, GitHub stars, npm engine version, license.
Marketplace badges 404 until first publish; that's expected.
- Prominent "Full documentation, configuration reference, and
benchmarks on GitHub" link directly under the badges. The extension
README is intentionally short; the engine README is the deep doc.
- Headline benchmark callout up top: 61% less context, 84% fewer
tool calls, 37x faster on the 2.45M-line VS Code codebase, with a
direct anchor link to the full benchmark.
- New "Why bigger teams pick it" section covering refactor safety
on monorepos, multi-repo orgs, tool-independence, air-gapped
deployment, AGPL-3.0 transparency, and the 18+ language list.
- Compatibility section now lists every editor and every AI surface
explicitly, so a Cursor or Antigravity user can recognise their
setup without reading between the lines.
- Settings table simplified around the four real settings, with
`socraticode.env` documented as the single passthrough for every
engine knob (external Qdrant, embedding providers, project IDs,
branch-aware indexing, linked projects).
Manifest tweak:
- Add `galleryBanner` (`#3a3d8c` brand colour, dark theme) so the
Marketplace listing's hero strip matches the icon and the project
website rather than defaulting to grey.
Build, lint, typecheck and the manifest smoke tests are all clean.
Packaged size 216 KB.
A new top-level `extension/` package containing the SocratiCode VS Code
extension. The same `.vsix` artefact ships to both VS Code Marketplace
and Open VSX, which means it installs cleanly in Cursor, VSCodium,
Gitpod, code-server, Eclipse Theia editors, Google Antigravity, and
Particle Workbench in addition to stock VS Code.
What it does:
- Auto-registers the SocratiCode MCP server in VS Code's MCP host via
`vscode.lm.registerMcpServerDefinitionProvider` (VS Code 1.99+).
Copilot agent mode, Cline, Continue, Roo Code and any other
MCP-aware client see SocratiCode's tools without the user editing
any `.vscode/mcp.json`.
- Forwards the user's `socraticode.env` setting to the engine
subprocess unchanged. Power users point at an external Qdrant
(`QDRANT_MODE=external` + `QDRANT_URL` + `QDRANT_API_KEY`), pick an
embedding provider, or set any other engine knob exactly as
documented in the engine README.
- Activity Bar sidebar with "Indexed projects" tree view and welcome
content. Discovers projects by listing graph artefacts the engine
writes to `os.tmpdir()/socraticode-graph/`.
- Webview panel for the interactive graph (`graphPanel.ts`). Reads
the engine's self-contained HTML, wraps it with a tight CSP, injects
a bridge script so node-clicks can `postMessage` back to the
extension and open files in the editor.
- Status-bar item showing "SocratiCode" with click-to-open-sidebar.
Honours the `socraticode.statusBar` setting.
- Two-step getting-started walkthrough (index your project, try
search and the interactive graph). Shown automatically on first
install; re-openable via the command palette.
- Command palette commands: index workspace, open graph, refresh
projects, open walkthrough, show output.
- Output channel for engine logs.
Build: esbuild bundles `src/extension.ts` to `dist/extension.js` (CJS,
node18, sourcemap), `vscode` external. Biome lint and `tsc` strict
mode both clean. Manifest smoke tests via Node's built-in test runner
catch package.json regressions before activation. Packaged size:
~215 KB `.vsix`.
Versioning: extension version tracks the engine version (currently
`1.7.2`). Patch drift is allowed for extension-only hotfixes. The
`scripts/bump-plugin-versions.mjs` hook from the previous commit
already includes `extension/package.json` in its bump list, so future
engine releases keep the extension in lockstep automatically.
Giancarlo Erra