Add BYOK providers and harden launcher

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @TheStreamCode

.github/workflows/ci.yml

@@ -4,22 +4,42 @@ on:
   push:
   pull_request:
 
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   test:
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
     strategy:
+      fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
-        node: [20, 22]
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        node: [22, 24]
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v4
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: npm
-      - run: npm ci
-      - run: npm run lint
-      - run: npm test
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run quality checks
+        run: npm run check
+
+      - name: Audit production dependencies
+        if: matrix.os == 'ubuntu-latest' && matrix.node == 24
+        run: npm audit --omit=dev --audit-level=high
+
+      - name: Verify package contents
+        if: matrix.os == 'ubuntu-latest' && matrix.node == 24
+        run: npm pack --dry-run

CHANGELOG.md

@@ -5,6 +5,18 @@ All notable changes to this project are documented in this file.
 ## [Unreleased]
 
 - Added a standard `.gitattributes` file to normalize line endings across platforms (`* text=auto eol=lf`, with binary markers for image/vsix assets).
+- Added documented built-in presets for OpenRouter, Moonshot AI/Kimi, Alibaba Model Studio Token Plan, and Tencent Cloud Token Plan.
+- Updated the Z.ai Coding Plan fallback to `glm-5.1`.
+- Added `--offline` and `--wire-api completions|responses` support for current Copilot CLI BYOK capabilities.
+- Set the required `COPILOT_MODEL` catalog value separately from `COPILOT_PROVIDER_WIRE_MODEL`.
+- Hardened process launching against Windows shell injection by using shell-free cross-platform spawning.
+- Added standalone Copilot binary discovery that skips the stale VS Code shim when an npm installation is available.
+- Documented a reproducible provider verification matrix with explicit evidence levels.
+- Added strict provider-config validation, model-catalog timeouts, safe same-origin authentication defaults, and case-insensitive secret sanitization.
+- Added a distributable JSON Schema for provider configuration editor support.
+- Improved model ranking for OpenRouter metadata and provider catalogs returned as arrays.
+- Expanded tests, package checks, security documentation, and CI coverage for Node.js 22/24 on Windows, macOS, and Linux.
+- Pinned GitHub Actions to immutable commits and removed the inactive Dependabot auto-merge workflow.
 
 ## 0.1.0
 

CONTRIBUTING.md

@@ -5,15 +5,20 @@ Thanks for your interest in improving copilot-byok-switcher.
 ## Development
 
 ```bash
-npm install
-npm run lint
-npm test
+npm ci
+npm run check
+npm run test:coverage
+npm pack --dry-run
 ```
 
-Keep changes focused and covered by tests under `test/`. The CLI must stay cross-platform (Windows, macOS, Linux) and must never transmit provider API keys anywhere.
+Development requires Node.js 22.13 or newer. Keep changes focused and covered by tests under `test/`. The CLI must remain cross-platform across Windows, macOS, and Linux.
+
+Provider changes must cite the provider's official API documentation in `README.md` and include tests for endpoint, model, aliases, and credential environment names. Never add real credentials, inline secret examples, or unauthenticated cross-origin credential forwarding.
 
 ## Pull Requests
 
 - Add or update tests for behavior changes.
-- Run `npm run lint` and `npm test` before submitting.
+- Run `npm run check` and `npm pack --dry-run` before submitting.
 - Keep user-facing behavior documented in `README.md`.
+- Update `CHANGELOG.md` for user-visible changes.
+- Use a focused title and explain both the behavior change and its verification.