fix(vscode): make the packaged .vsix actually load (Refs #62)

[hyperpolymath]

Why

Executing #62 ("package & publish the .vsix") surfaced that the premise — "everything that could be done is done; just run vsce package" — was wrong. The build produced a non-functional .vsix.

Root cause: PR #58 switched the compile to --vscode-extension codegen, whose auto-glue emits a top-level require("@hyperpolymath/affine-vscode") (an unpublished npm package — see the vendored adapter's own header), while the repo still routed activation through the hand-written src/index.cjs + vendored src/affine-vscode-adapter.cjs. So VS Code loaded src/index.cjs → require("../out/extension.cjs") → MODULE_NOT_FOUND: @hyperpolymath/affine-vscode → crash on activation.

Fix (uses affinescript's documented mechanism, no affinescript change)

• Adapter specifier: compile/vscode:prepublish now pass --vscode-extension-adapter=../src/affine-vscode-adapter.cjs. affinescript compile --help documents this flag exactly for "vendoring a custom adapter"; the auto-glue now requires the already-vendored adapter by relative path (resolves offline, no npm package).
• main → ./out/extension.cjs: the directly-loadable entry the --vscode-extension codegen is designed to produce (fix(vscode-ext): correct affinescript compile invocation + document build #58/#105's stated end-state). The now-redundant src/index.cjs is removed.
• vscode:prepublish: no longer shells through npm run (repo CLAUDE.md bans npm) — it is the affinescript invocation directly.
• .vscodeignore added; .gitignore extended to ignore bun/deno lockfiles and the built *.vsix (Release artefact, not git), consistent with chore: gitignore package-lock.json (mirror Cargo.lock policy) #57.

Verification

• out/extension.cjs loads standalone (no MODULE_NOT_FOUND).
• From the packaged .vsix's bundled tree, extraImports() returns {Vscode, VscodeLanguageClient} with only host-provided vscode stubbed; newLanguageClient/registerCommand are functions; activate/deactivate present.
• my-lang-0.3.0.vsix (324 files, 466 KB) packages with the full vscode-languageclient transitive closure bundled and Node-resolvable.

Build was done with bun (Deno's .deno/-nested node_modules is structurally incompatible with the flat, Node-resolvable tree a .vsix requires — a legitimate fall-through in the Deno→bun→… package-manager policy).

Refs #62

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 35 issues detected

Severity	Count
🔴 Critical	6
🟠 High	11
🟡 Medium	18

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Issue in quality.yml",
    "type": "missing_workflow",
    "file": "quality.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "Issue in security-policy.yml",
    "type": "missing_workflow",
    "file": "security-policy.yml",
    "action": "create",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action hyperpolymath/standards/.github/workflows/governance-reusable.yml@main needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "high"
  },
  {
    "reason": "unwrap_or(0) with dangerous default (1 occurrences, CWE-754)",
    "type": "unwrap_dangerous_default",
    "file": "/home/runner/work/my-lang/my-lang/_exploratory/me-scaffolding/crates/parser/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "critical"
  },
  {
    "reason": "expect() in hot path (80 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/my-lang/my-lang/_exploratory/me-scaffolding/crates/parser/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (1 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/my-lang/my-lang/my-ssg/src/generator.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "expect() in hot path (5 occurrences, CWE-754)",
    "type": "expect_in_hot_path",
    "file": "/home/runner/work/my-lang/my-lang/crates/my-mir/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "medium"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (26 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/my-lang/my-lang/crates/my-fmt/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (1 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/my-lang/my-lang/crates/my-hir/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  },
  {
    "reason": "unwrap() without prior check -- DoS via panic (3 occurrences, CWE-754)",
    "type": "unwrap_without_check",
    "file": "/home/runner/work/my-lang/my-lang/crates/my-llvm/src/lib.rs",
    "action": "flag",
    "rule_module": "code_safety",
    "severity": "high"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence