docs: document Marketplace and Open VSX distribution (v0.1.4)

.vscodeignore

@@ -20,4 +20,3 @@ out/**/*.map
 *.tsbuildinfo
 tsconfig.json
 package-lock.json
-SECURITY_REVIEW.md

AGENTS.md

@@ -22,6 +22,8 @@ These instructions apply to the entire repository. This project is a deliberatel
 - `test/metadata.test.js`: manifest, documentation, workflow, and package-contract tests.
 - `test/integration/`: Extension Host smoke test.
 - `media/`: Marketplace and toolbar artwork; preserve format, dimensions, transparency, and appearance.
+- `scripts/generate-icon.ps1`: deterministic source of `media/icon.png`; it reproduces the published 512x512 artwork byte for byte, so never edit one without the other.
+- `docs/SECURITY_REVIEW.md`: dated security review with file-and-line citations; re-verify the citations when the referenced files move.
 - `out/`, `.vscode-test/`, `node_modules/`, and `*.vsix`: generated or downloaded artifacts; do not commit them.
 
 ## Required Workflow
@@ -65,8 +67,10 @@ Use `npm ci --ignore-scripts` for a clean, reproducible install. Do not replace
 
 - Update `README.md` for requirements, settings, commands, environment behavior, build, or release changes.
 - Add user-visible changes to the `Unreleased` section of `CHANGELOG.md`.
-- For a release, keep versions synchronized in `package.json`, `package-lock.json`, and `CITATION.cff`; update metadata tests when appropriate.
+- For a release, keep versions synchronized in `package.json`, `package-lock.json`, `CITATION.cff`, the README installation section, and `test/metadata.test.js`. `npm version <x.y.z> --no-git-tag-version` is the supported way to update the manifest and the lockfile together.
 - A `v<version>` tag triggers the GitHub release workflow. Do not create tags, push, publish, or upload Marketplace packages unless explicitly authorized.
+- The extension is published as `mikesoft.vscode-kimi-code-cli-launcher` on the VS Code Marketplace and on Open VSX. Both registries are updated manually by the maintainer with `vsce publish` and `ovsx publish`; the required tokens are deliberately absent from this repository, from the shell environment, and from GitHub Actions secrets, so no workflow or agent can publish. Never add them.
+- `main` is protected and requires one approving review. Land changes through a branch and a pull request; never self-approve or bypass the protection.
 - Maintain the unofficial-project and trademark disclaimer. Do not imply endorsement by Moonshot AI or Kimi.
 
 ## Dependency Policy

CHANGELOG.md

@@ -6,6 +6,17 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and
 
 ## Unreleased
 
+## 0.1.4 - 2026-08-01
+
+### Changed
+
+- Documented the VS Code Marketplace and Open VSX installation paths, the `mikesoft.vscode-kimi-code-cli-launcher` extension id, and the manual registry-publishing step
+- Added verified VS Code Marketplace and Open VSX version badges to the README
+
+### Removed
+
+- Dropped an obsolete `.vscodeignore` rule for a security review file that now lives under the already-excluded `docs/` directory
+
 ## 0.1.3 - 2026-08-01
 
 ### Security

CITATION.cff

@@ -5,5 +5,5 @@ authors:
   - family-names: Gasperini
     given-names: Michael
 url: "https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher"
-version: "0.1.3"
+version: "0.1.4"
 license: MIT

README.md

@@ -1,5 +1,7 @@
 # Kimi Code CLI Launcher for VS Code
 
+[![VS Marketplace](https://vsmarketplacebadges.dev/version-short/mikesoft.vscode-kimi-code-cli-launcher.svg)](https://marketplace.visualstudio.com/items?itemName=mikesoft.vscode-kimi-code-cli-launcher)
+[![Open VSX](https://img.shields.io/open-vsx/v/mikesoft/vscode-kimi-code-cli-launcher?label=open%20vsx)](https://open-vsx.org/extension/mikesoft/vscode-kimi-code-cli-launcher)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![GitHub Release](https://img.shields.io/github/v/release/TheStreamCode/vscode-kimi-code-cli-launcher)](https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher/releases/latest)
 [![CI](https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher/actions/workflows/ci.yml/badge.svg)](https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher/actions/workflows/ci.yml)
@@ -16,7 +18,9 @@ The extension uses standard VS Code terminal APIs and is designed for compatible
 | | Kimi Code CLI Launcher |
 | --- | --- |
 | **Purpose** | Launch Kimi Code CLI from the VS Code editor toolbar |
-| **Current release** | `0.1.3` |
+| **Current release** | `0.1.4` |
+| **Available on** | VS Code Marketplace, Open VSX, GitHub Releases |
+| **Extension id** | `mikesoft.vscode-kimi-code-cli-launcher` |
 | **Default command** | `kimi` |
 | **Terminal behavior** | Opens a fresh side terminal for every launch |
 | **Working directory** | Uses the workspace of the active editor when available |
@@ -38,7 +42,7 @@ The extension uses standard VS Code terminal APIs and is designed for compatible
 
 1. Install Kimi Code CLI from the official guide.
 2. Confirm that `kimi --version` works in a regular integrated terminal.
-3. Install this launcher's VSIX from the latest GitHub release.
+3. Install **Kimi Code CLI Launcher** from the [VS Code Marketplace](https://marketplace.visualstudio.com/items?itemName=mikesoft.vscode-kimi-code-cli-launcher) or [Open VSX](https://open-vsx.org/extension/mikesoft/vscode-kimi-code-cli-launcher).
 4. Open a project file and click the blue avatar in the editor toolbar.
 
 Each click starts an independent Kimi Code CLI session in a new side terminal.
@@ -83,10 +87,26 @@ This extension does not install Kimi Code CLI or modify shell configuration.
 
 ## Installation
 
-Download `vscode-kimi-code-cli-launcher-0.1.3.vsix` from the [latest GitHub release](https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher/releases/latest), then run:
+The extension id is `mikesoft.vscode-kimi-code-cli-launcher`.
+
+### VS Code Marketplace
+
+Search for **Kimi Code CLI Launcher** in the Extensions view, open the [Marketplace listing](https://marketplace.visualstudio.com/items?itemName=mikesoft.vscode-kimi-code-cli-launcher), or run:
+
+```bash
+code --install-extension mikesoft.vscode-kimi-code-cli-launcher
+```
+
+### Open VSX
+
+Editors that use the [Open VSX Registry](https://open-vsx.org/extension/mikesoft/vscode-kimi-code-cli-launcher), such as VSCodium, Cursor, and Windsurf, resolve the same extension id from their own Extensions view.
+
+### VSIX from a GitHub release
+
+Download `vscode-kimi-code-cli-launcher-0.1.4.vsix` from the [latest GitHub release](https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher/releases/latest), then run:
 
 ```bash
-code --install-extension vscode-kimi-code-cli-launcher-0.1.3.vsix
+code --install-extension vscode-kimi-code-cli-launcher-0.1.4.vsix
 ```
 
 Alternatively, use **Extensions: Install from VSIX...** from the VS Code Command Palette.
@@ -220,7 +240,16 @@ npm run package
 
 The package is named `vscode-kimi-code-cli-launcher-<version>.vsix` and is intentionally ignored by Git.
 
-For a release, update `package.json`, `package-lock.json`, `CITATION.cff`, and `CHANGELOG.md` together. Commit the validated changes, then push a matching `v<version>` tag. The `Release` workflow verifies the tag/version match, reruns validation and the dependency audit, builds the VSIX, and creates or updates the GitHub release. Marketplace publishing remains a separate maintainer action and requires publisher credentials that must never be committed.
+For a release, update `package.json`, `package-lock.json`, `CITATION.cff`, and `CHANGELOG.md` together. Commit the validated changes, then push a matching `v<version>` tag. The `Release` workflow verifies the tag/version match, reruns validation and the dependency audit, builds the VSIX, and creates or updates the GitHub release.
+
+Registry publishing is a separate, manual maintainer step performed with the VSIX produced above:
+
+```bash
+npx @vscode/vsce publish --packagePath vscode-kimi-code-cli-launcher-<version>.vsix
+npx ovsx publish vscode-kimi-code-cli-launcher-<version>.vsix
+```
+
+Those commands need Marketplace and Open VSX publisher tokens. The tokens are never stored in this repository or in GitHub Actions secrets, so neither CI nor an automated agent can publish on the maintainer's behalf.
 
 ## Troubleshooting
 

package.json

@@ -3,7 +3,7 @@
   "displayName": "Kimi Code CLI Launcher — Run Kimi in VS Code",
   "description": "Launch Kimi Code CLI from the VS Code editor toolbar in one click. Opens a fresh side terminal in your workspace. Unofficial; Windows, macOS and Linux.",
   "publisher": "mikesoft",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "repository": {
     "type": "git",
     "url": "https://github.com/TheStreamCode/vscode-kimi-code-cli-launcher.git"

test/metadata.test.js

@@ -35,7 +35,7 @@ test('package metadata exposes the stable launcher interface', () => {
     'Launch Kimi Code CLI from the VS Code editor toolbar in one click. Opens a fresh side terminal in your workspace. Unofficial; Windows, macOS and Linux.',
   );
   assert.equal(packageJson.publisher, 'mikesoft');
-  assert.equal(packageJson.version, '0.1.3');
+  assert.equal(packageJson.version, '0.1.4');
   assert.equal(JSON.parse(readText('package-lock.json')).version, packageJson.version);
   assert.equal(packageJson.private, true);
   assert.equal(packageJson.icon, 'media/icon.png');
@@ -133,8 +133,19 @@ test('README documents setup, trust, privacy, and official guidance', () => {
   assert.match(readme, /npm run check/);
   assert.match(readme, /## Environment Variables/);
   assert.match(readme, /## Build and Release/);
-  assert.match(readme, /vscode-kimi-code-cli-launcher-0\.1\.3\.vsix/);
-  assert.doesNotMatch(readme, /vscode-kimi-code-cli-launcher-0\.1\.[12]\.vsix/);
+  assert.match(readme, /vscode-kimi-code-cli-launcher-0\.1\.4\.vsix/);
+  assert.doesNotMatch(readme, /vscode-kimi-code-cli-launcher-0\.1\.[123]\.vsix/);
+});
+
+test('README documents every published distribution channel', () => {
+  const readme = readText('README.md');
+
+  assert.match(readme, /marketplace\.visualstudio\.com\/items\?itemName=mikesoft\.vscode-kimi-code-cli-launcher/);
+  assert.match(readme, /open-vsx\.org\/extension\/mikesoft\/vscode-kimi-code-cli-launcher/);
+  assert.match(readme, /code --install-extension mikesoft\.vscode-kimi-code-cli-launcher/);
+  assert.match(readme, /### VS Code Marketplace/);
+  assert.match(readme, /### Open VSX/);
+  assert.match(readme, /### VSIX from a GitHub release/);
 });
 
 test('public governance documents use consistent identity and support links', () => {
@@ -144,7 +155,7 @@ test('public governance documents use consistent identity and support links', ()
   assert.match(readText('SECURITY.md'), /info@mikesoft\.it/);
   assert.match(readText('SUPPORT.md'), /vscode-kimi-code-cli-launcher\/issues/);
   assert.match(readText('CITATION.cff'), /title: "Kimi Code CLI Launcher"/);
-  assert.match(readText('CITATION.cff'), /version: "0\.1\.3"/);
+  assert.match(readText('CITATION.cff'), /version: "0\.1\.4"/);
   assert.match(readText('AGENTS.md'), /user-level configuration only/i);
 });