Contributing

​

Local checks

npm test          # full vitest suite
npm run typecheck # tsc --noEmit
npm run build     # tsc -p tsconfig.json

​

Invariants to keep

• argv-only. Never pass user input through a host shell. Every sbx invocation goes through src/sbx.ts with spawn(bin, args, { shell: false }); only that module may import child_process (a test guards this).
• Containment. All path checks go through the shared helper. Do not hand-roll containment or sanitization at call sites.
• Policy. Do not weaken the bot-enforced permission policy or the re-assert-after-wake behavior.
• No secrets. Never commit tokens, passwords, or .env files. Provider credentials belong in sbx secret, not in code or test fixtures.

​

Host-only checks

node scripts/spike-full-chain.mjs            # sbx + serve + health spike
node scripts/smoke.mjs C:\path\to\project    # create → prompt → abort → remove

​

Docs

npm run docs:dev        # preview at http://localhost:3000
npm run docs:validate   # validate docs.json and pages
npm run docs:links      # check for broken internal links

​

Related

• Security — the invariants in detail.
• Architecture — where each concern lives.
• Changelog — what has shipped.