feat: VS Code extension for inline security warnings - #12
Merged
Conversation
Adds a TypeScript extension (vscode-extension/) that scans files on save against the local KShield backend and surfaces findings as editor diagnostics, hover explanations, and Quick Fix actions (apply patch / suppress rule), mirroring the API contract already used by the Rust CLI (cli/src/types.rs, cli/src/http.rs). Verified end-to-end against a live backend: scan-on-save, diagnostic squiggles, hover tooltips, and Quick Fix patch application all work. Closes #5 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
added 6 commits
July 17, 2026 18:58
install.sh, npm installer, Homebrew formula, pip URLs, the CLI's own backend-download URL, the VS Code extension's repository link, and the in-app Docs page all still pointed at the old YTTGlobalServices org and 404'd after the move to YTT-Global. Also fixes a Homebrew CI step that was patching the wrong SHA-256 placeholders, rewords a few doc examples that tripped KShield's own hallucination/secret patterns on its own example strings, and bumps cli/Cargo.toml, npm/package.json, and pyproject.toml to 1.1.0 so the release tag, the CLI's embedded backend URL, and the PyPI build stay in sync.
Adds a 256x256 icon (reused from the Tauri app icon set), a gallery banner color/theme, bugs/homepage links, and a couple more discovery keywords. Drops the leftover "private": true, which has no effect on vsce but is misleading on a package meant to be publicly listed. Verified `vsce package` still produces a clean, warning-free .vsix with the icon bundled correctly. Actual publish still requires a maintainer to run `vsce login ytt-global && vsce publish` with a real Marketplace access token — not something this environment can authenticate to.
package.json and docs referenced "ytt-global" as the vsce publisher, but the actual registered Marketplace publisher (confirmed via the Manage Publishers dashboard) is "YTTGlobal" — vsce matches this exactly, so publishing would have failed with a publisher-not-found error. Left the unrelated "ytt-global/tap/kshield" Homebrew tap references alone; brew tap names are lowercase by convention and resolve case-insensitively to the YTT-Global GitHub org.
kshield-vscode is now published as YTTGlobal.kshield-vscode. Add a Marketplace badge to README.md, lead the VS Code Extension sections in README.md/docs/setup.md/vscode-extension/README.md with the one-line `code --install-extension` command, and demote the manual .vsix build to a "from source" fallback. Publishing docs now describe shipping updates (vsce publish patch|minor|major) rather than the first-time setup, which is done.
analyze_entropy_and_secrets now returns List[Dict[str, Any]] instead of a bare list. Also tracks assets/linkedin-card.html (previously untracked), with its example api_key value reworded so it doesn't literally match KShield's own Generic Assignment secret pattern.
Two independent bugs surfaced by PR #12's CI run: - actions/github-script's createReview call 403'd with "Resource not accessible by integration" — the pr-scan job had no explicit `permissions:` block, so its GITHUB_TOKEN only got read access. Added `pull-requests: write` (and `contents: read`, since setting any permissions block zeroes out everything not listed). - Lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, Cargo.lock) were flagged as "High Entropy Credential" — their sha512 integrity hashes are naturally high-entropy base64 but aren't secrets. Added a .kshield.yml (read by the CLI hook already, via cli/src/config.rs) suppressing these paths, and filtered the same filenames out of the PR-scan's changed-files list directly so CI doesn't even submit them for scanning.
mesrikanthreddy
approved these changes
Jul 18, 2026
mesrikanthreddy
left a comment
mesrikanthreddy
left a comment
Collaborator
There was a problem hiding this comment.
It looks good; I also published the vs code extension to the public repository and that can be directly downloaded by a developer
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a TypeScript extension (vscode-extension/) that scans files on save against the local KShield backend and surfaces findings as editor diagnostics, hover explanations, and Quick Fix actions (apply patch / suppress rule), mirroring the API contract already used by the Rust CLI (cli/src/types.rs, cli/src/http.rs).
Verified end-to-end against a live backend: scan-on-save, diagnostic squiggles, hover tooltips, and Quick Fix patch application all work.
Closes #5