Added cert utility and documentation

CHANGELOG.md

@@ -1,6 +1,19 @@
 # Changelog
 
-## [Unreleased]
+## [v0.0.5] - 2026-06-01
+
+### Added
+- A **Documentation** webview at the bottom of the VsGit sidebar, plus a
+  full-screen **VsGit: Open Documentation** panel.
+- A searchable component guide and Git glossary with definitions, purpose, and
+  practical usage guidance.
+- A manifest-driven catalog covering all contributed operations and
+  distinguishing Command Palette entries from context-only actions.
+- Extension Host integration tests for activation, complete command
+  registration, repository refresh, and the full Documentation panel.
+- Native Node coverage gates (80% lines, 80% branches, 70% functions), published
+  in CI alongside the verified VSIX artifact.
+- Contributor guidance and a repeatable Marketplace release checklist.
 
 ### Fixed
 - **History graph rendering**: commit lanes now draw as continuous lines. The
@@ -14,6 +27,25 @@
 ### Changed
 - New, distinctive activity-bar icon (a commit-graph DAG) so the container no
   longer reuses the built-in Source Control glyph.
+- **Commit view**: the advanced commit options (Amend / Sign off / GPG) are now
+  hidden by default behind an "Advanced" disclosure, keeping the panel focused on
+  the message and changes. The disclosure state is remembered per webview. A
+  small indicator dot stays on the collapsed toggle whenever amend/sign-off/GPG
+  is checked, so an active option is never silently hidden. Checking Amend now
+  prefills the previous commit's message (via the existing
+  `Repository.headCommitMessage()`) when the message box is empty, restoring the
+  prior draft if Amend is unchecked again untouched. The view's pure helpers
+  (status labels, file-tree grouping, escaping) were extracted into a
+  unit-tested module (`resources/commitView.js`).
+- All tree providers now expose complete screen-reader labels. Custom webview
+  rows, folders, menus, pickers, and rebase controls support keyboard operation,
+  visible focus, live announcements, and forced-colour mode.
+- Repository discovery now runs workspace probes concurrently, coalesces
+  overlapping scans, records scan duration, and loads submodule metadata only
+  when requested.
+- CI and tag publishing now enforce type checks, unit tests, coverage,
+  Extension Host integration, dependency audit, and inspection of the exact
+  packaged VSIX.
 
 ### Security
 - The askpass and editor IPC servers now require a per-session token (passed to
@@ -25,15 +57,22 @@
   values beginning with `-` (option injection) and the `ext::`/`fd::` remote
   transports, applied across the webview-reachable git operations and the diff
   content provider.
+- Declared untrusted and virtual workspaces unsupported because VsGit requires a
+  local checkout and executes repository Git configuration and hooks.
+- Updated development tooling and pinned audited transitive test dependencies;
+  `npm audit --audit-level=high` reports no vulnerabilities.
 
 ### Internal
 - Extracted `parseWorktreeList` and the graph-log line parser into dedicated,
   unit-tested parser modules. Test suite grows from 36 to 60 cases.
+- Added accessibility, Phase 10 contract, packaging, and integration coverage;
+  the Node suite now contains 184 passing tests.
 
 ### Docs
 - Rewrote the README with a detailed feature reference, settings table,
   architecture and security sections, and illustrated `docs/` diagrams of the
   Git Graph panel and the activity-bar trees.
+- Added `CONTRIBUTING.md` and `docs/MARKETPLACE_CHECKLIST.md`.
 
 ## [0.1.0] - 2026-06-01
 

CONTRIBUTING.md

@@ -0,0 +1,116 @@
+# Contributing to VsGit
+
+VsGit is a VS Code extension that delegates Git behavior to the installed
+`git` executable. Changes must preserve that boundary: commands are passed as
+argument arrays, repository output is parsed from machine-readable formats, and
+webviews send intent rather than running Git directly.
+
+## Prerequisites
+
+- Node.js 22
+- npm
+- VS Code 1.85 or newer
+- Git 2.20 or newer
+- `unzip` for final VSIX inspection
+
+Git LFS is optional unless the change exercises LFS operations.
+
+## Set up the repository
+
+```bash
+npm ci
+npm run check-types
+npm test
+npm run build
+```
+
+For live extension development, run `npm run watch`, then launch the Extension
+Development Host with `F5`.
+
+## Repository structure
+
+- `src/git/` — Git execution, repository state, guards, and parsers.
+- `src/commands/` — command registration grouped by workflow.
+- `src/views/` — native VS Code tree and Source Control providers.
+- `src/webviews/` — webview hosts and inline HTML generators.
+- `resources/` — webview clients, styles, fonts, pure helpers, and static tests.
+- `src/test/` — tests that run inside a real VS Code Extension Host.
+
+All Git child processes must go through `GitExecutor`. Do not construct shell
+command strings. Validate refs and remote URLs received from webviews or other
+untrusted surfaces with the existing argument guards.
+
+## Required verification
+
+Run the checks that match the change, then run the complete local gate:
+
+```bash
+npm run verify
+```
+
+The gate includes type-checking, unit/contract tests, native Node coverage
+thresholds, and a production build. Current minimums are:
+
+- 80% lines
+- 80% branches
+- 70% functions
+
+Changes to activation, commands, contributions, or VS Code API integration must
+also pass:
+
+```bash
+npm run test:integration
+```
+
+This launches a clean Extension Development Host and verifies activation,
+command registration, repository refresh, and the documentation panel.
+
+Before release-related changes:
+
+```bash
+npm run package:verify
+```
+
+That command creates `artifacts/vsgit-vscode.vsix` and checks its identity,
+version, required runtime files, size, and absence of source/test artifacts.
+
+## Testing expectations
+
+- Parser changes need focused input/output unit tests.
+- Repository methods need argv and option-injection coverage.
+- Manifest, menu, documentation, and resource contracts belong in
+  `resources/*.test.js`.
+- VS Code lifecycle and command-registration behavior belongs in
+  `src/test/*.integration.test.ts`.
+- A bug fix should include a test that fails without the fix.
+
+Do not lower coverage thresholds to land a change. Add meaningful coverage or
+document why code cannot be exercised and request review.
+
+## Accessibility requirements
+
+Every UI change must remain usable with keyboard-only navigation and across VS
+Code light, dark, and high-contrast themes.
+
+- Use native buttons, inputs, tables, and labels where possible.
+- Custom interactive elements require a role, accessible name, focusability,
+  Enter/Space behavior, and visible focus.
+- Announce asynchronous state changes through a polite or assertive live region.
+- Tree items must provide complete `accessibilityInformation` labels when visual
+  icons, abbreviations, or secondary descriptions carry meaning.
+- Preserve `prefers-reduced-motion` and forced-colour behavior.
+
+## Pull requests
+
+Keep changes focused and preserve unrelated worktree edits. A pull request
+should explain:
+
+1. The user-visible problem and chosen behavior.
+2. Security or destructive-operation implications.
+3. Tests added or updated.
+4. Commands used for verification.
+5. Screenshots or a short recording for material UI changes.
+
+Update `README.md`, `CHANGELOG.md`, and
+`docs/IMPLEMENTATION_PLAN.md` whenever implementation status or public behavior
+changes.