# Contributing to LexAI

Thanks for helping improve LexAI. This project is a monorepo with three user-facing packages plus a shared library.

## Code of Conduct

Please read and follow the [Code of Conduct](CODE_OF_CONDUCT.md).

## Ways to contribute

- Bug reports and reproducible issues
- Documentation fixes
- Small, focused pull requests (one concern per PR)
- Discussions on design when a change is large or security-sensitive

## Development setup

**Requirements:** Node.js **22+**, npm 11+ (see `packageManager` in root `package.json`).

```bash
git clone https://git.juankibin.space/kibin/LexAI.git
cd LexAI
npm run install:all
```

### Useful scripts (from repo root)

| Script | Purpose |
| --- | --- |
| `npm run chrome:dev` | Chrome extension with hot reload |
| `npm run chrome:build` | Production Chrome build |
| `npm run chrome:typecheck` / `chrome:test` | Typecheck & unit tests |
| `npm run vscode:build` / `vscode:typecheck` | VS Code extension |
| `npm run cli:build` / `cli:typecheck` | CLI Prompt Builder |
| `npm run typecheck:all` / `build:all` | All packages |

Shared code lives in `src/lib/`. **Do not** import `@lib/crypto` or `@lib/messaging` from `packages/vscode` or `packages/cli` (Chrome-only).

### Package-specific notes

- **Chrome:** load unpacked from `packages/chrome/.output/chrome-mv3` after build. Selection/replace is DOM-timing-sensitive — verify on a real page for UI changes.
- **VS Code:** build then F5 or Install from VSIX (`packages/vscode`).
- **CLI:** set `LEXAI_API_KEY`; never commit keys or put them in `~/.lexai/config.json`.

## Pull request process

1. Fork / branch from `main` (or `develop` if that is the active integration branch).
2. Keep changes scoped; update docs when behavior changes.
3. Run the checks that touch your change, at minimum:
   - Shared lib / Chrome: `npm run chrome:typecheck` and `npm run chrome:test`
   - VS Code: `npm run vscode:typecheck` and `npm run vscode:build`
   - CLI: `npm run cli:typecheck` and `npm run cli:build`
4. Open a PR using the [pull request template](.gitea/PULL_REQUEST_TEMPLATE.md).
5. Do not include secrets, API keys, or personal data in commits or screenshots.

## Security

If you discover a vulnerability (especially around API key handling or data exfiltration), **do not** open a public issue with exploit details. Contact the maintainer privately (see the Chrome Web Store listing / repository owner).

## License

By contributing, you agree that your contributions will be licensed under the [MIT License](LICENSE).