build(deps): bump actions/setup-node from 6.5.0 to 7.0.0

.github/dependabot.yml

@@ -0,0 +1,9 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5

.github/workflows/ci.yml

@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+
+      - name: Set up Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Set up Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Install development dependencies
+        run: npm ci --ignore-scripts
+
+      - name: Validate release payload
+        run: npm run validate

.gitignore

@@ -1,10 +1,18 @@
 node_modules/
+dist/
 coverage/
 .ruff_cache/
 .codegraph/
 .pi/
 .impeccable/
+.vscode/
+.idea/
 __pycache__/
 *.py[cod]
 *.log
+*.tgz
+*.tsbuildinfo
+.env
+.env.*
+!.env.example
 .DS_Store

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 feveromo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

SECURITY.md

@@ -0,0 +1,15 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are provided for the latest release on the `main` branch. The current compatibility boundary is OMP `17.2.11`.
+
+## Reporting a vulnerability
+
+Please report vulnerabilities privately through [GitHub Security Advisories](https://github.com/feveromo/pi-chisel/security/advisories/new). Do not include credentials, private prompts, or other sensitive user data in a public issue.
+
+Include the affected version, impact, reproduction steps, and any suggested mitigation. You should receive an acknowledgement within seven days.
+
+## Data boundary
+
+Chisel sends the unsent draft and, unless context mode is `none`, bounded workspace and session evidence to the selected model provider. It does not persist that request or add it to OMP's session transcript. See [Privacy and data handling](README.md#privacy-and-data-handling) for the complete user-facing behavior.