vsdiff 0.2.0 — Guided review, beside the code

Follow the explanation into the diff

vsdiff gives humans and coding agents a shared review loop. The agent writes
chapters and stops tied to real Git hunks. You review the code in VS Code or a
local browser, ask questions inline, and send structured feedback back to the
agent.

This first open-source release includes:

• A review map that opens as a normal tab or pins beside the code.
• Inline conversations, expandable guides, saved drafts, and a focused layout
  for narrow browser panes.
• Working-tree, index, commit, and branch reviews; CLI and MCP tools for the
  authoring and feedback loop.
• A runnable payment-retry demo and a recorded walkthrough with captions.
• MIT-licensed source and a manually installed VSIX. No Marketplace, OpenVSX,
  or npm publication.

Install

Use Node.js 22+, pnpm 9.15.9, Git, and VS Code 1.104+ with code on PATH.

git clone https://github.com/albertusdev/vsdiff.git
cd vsdiff
pnpm install --frozen-lockfile
pnpm build
node scripts/install-cli.mjs
code --install-extension dist/vsdiff.vsix --force
pnpm demo

Or unpack vsdiff-0.2.0-source.tar.gz and run the same commands from its root.
The CLI wrapper points at the checkout, so keep it after installation.
For a browser demo, use VSDIFF_EDITOR=web pnpm demo.

Security and verification

Launch testing found and fixed problems in the optional dev bridge, Git program
execution during reads, repository-controlled launcher settings, HTML guide
containment, and anonymous browser access. Browser mode now requires a private
connection token. Historical and staged reviews display the selected snapshots.

See release-verification.md for the adversarial checks, actual browser workflow,
and limits. This is maintainer testing, not an independent security certification.
Linux was exercised; macOS and editor forks were not. Native Windows install
scripts are not supported in this release.

Downloads

• vsdiff.vsix — editor extension, including the MIT license.
• vsdiff-0.2.0-source.tar.gz — reviewed source with commit identity in BUILD-INFO.txt.
• vsdiff-demo.mp4 and vsdiff-demo.vtt — walkthrough and captions.
• release-verification.md — scope, findings, and remaining limits.
• SHA256SUMS — checksums for these assets.

Keep authenticated browser URLs and local review files private. For vulnerability
reports, follow SECURITY.md.