cursor-guard 4.7.0 → 4.7.3

package/README.md

@@ -25,6 +25,10 @@ When Cursor's AI agent edits your files, there's a risk of accidental overwrites
 - **Proactive change-velocity alerts (V4)** — Auto-detects abnormal file change patterns and raises risk warnings
 - **Backup health dashboard (V4)** — One-call comprehensive view: strategy, counts, disk usage, protection scope, health status
 - **Web dashboard (V4.2)** — Local read-only web UI at `http://127.0.0.1:3120` — see health, backups, restore points, diagnostics, protection scope at a glance. Dual-language (zh-CN / en-US), auto-refresh every 15s, multi-project support
+- **IDE extension (V4.7)** — Full dashboard embedded in VSCode/Cursor/Windsurf as a WebView tab + status bar alert indicator + sidebar project tree. No browser needed
+- **One-click hot restart (V4.5.8)** — Dashboard detects new versions and offers in-place server restart without losing state
+- **Shadow incremental hard links (V4.5.4)** — Unchanged files are hard-linked to save disk space and I/O
+- **Strong protection mode (V4.5.4)** — `always_watch: true` auto-starts watcher with MCP server, ensuring zero protection gaps
 
 ---
 
@@ -124,6 +128,11 @@ After installation, your directory structure should look like this:
     │       └── app.js
     ├── mcp/
     │   └── server.js                   # MCP Server (9 tools)
+    ├── vscode-extension/               # IDE Extension (V4.7)
+    │   ├── extension.js                # Extension entry point
+    │   ├── package.json                # Extension manifest
+    │   ├── lib/                        # Modules (dashboard-manager, webview, status-bar, tree-view, poller)
+    │   └── media/                      # Icons (SVG + PNG)
     ├── bin/
     │   ├── cursor-guard-backup.js      # CLI: npx cursor-guard-backup
     │   ├── cursor-guard-doctor.js      # CLI: npx cursor-guard-doctor
@@ -388,6 +397,7 @@ The skill activates on these signals:
 | `references/bin/cursor-guard-doctor.js` | CLI entry: `npx cursor-guard-doctor` |
 | `references/dashboard/server.js` | Dashboard HTTP server + REST API |
 | `references/dashboard/public/` | Dashboard web UI (index.html, style.css, app.js) |
+| `references/vscode-extension/` | IDE Extension: WebView dashboard, status bar, sidebar tree, commands |
 | `references/auto-backup.ps1` / `.sh` | Thin wrappers (Windows / macOS+Linux) |
 | `references/guard-doctor.ps1` / `.sh` | Thin wrappers (Windows / macOS+Linux) |
 | `references/recovery.md` | Recovery command templates |
@@ -400,6 +410,33 @@ The skill activates on these signals:
 
 ## Changelog
 
+### v4.7.0 — IDE Extension
+
+- **Feature**: VSCode/Cursor/Windsurf extension — full dashboard as WebView tab, status bar alert indicator, sidebar TreeView with project status, Command Palette integration
+- **Feature**: Auto-activation on `.cursor-guard.json` detection, dashboard server runs in extension host process (zero subprocess overhead)
+- **Adapt**: `fetchJson()` supports `__GUARD_BASE_URL__` for WebView; `copyText()` bridges to `vscode.env.clipboard` when in IDE
+
+### v4.6.x — Alert UX Overhaul
+
+- **Fix**: Alert countdown now updates every second (was only on 15s page refresh)
+- **Fix**: Alert file details modal now shows per-file "Copy Restore Command" buttons
+- **Fix**: Backup stale threshold changed to `max(interval*10, 300)s` (min 5 min); only checks when watcher is running
+- **Feature**: Alert history always accessible (both active and no-alert states), persisted in `localStorage`
+- **Feature**: Alert history as modal dialog with nested file detail drill-down
+
+### v4.5.x — Protection Hardening
+
+- **Fix**: Shadow hard-link ordering bug (previous snapshot was always empty directory)
+- **Fix**: `changedFiles` now filters ignored paths from git diff output
+- **Feature**: Alert structured file list — per-file path, action, +/- lines, sortable tables
+- **Feature**: Shadow incremental hard links — unchanged files linked to previous snapshot, saving disk space
+- **Feature**: `always_watch: true` config — watcher auto-starts with MCP server, zero protection gaps
+- **Feature**: Dashboard server singleton — multiple projects share one port, hot-add new projects
+- **Feature**: Dashboard version detection + one-click hot restart (`/api/restart` endpoint)
+- **Feature**: File detail modal with per-file restore command copy buttons
+- **Feature**: `cursor-guard-init` auto-creates `.cursor-guard.json`; `backup_interval_seconds` alias supported
+- **License**: Changed from MIT to BSL 1.1 (source available, commercial use requires author authorization)
+
 ### v4.4.0 — V4 Final
 
 - **Fix**: First snapshot now generates "Added N: file1, file2, ..." summary instead of blank — previously the very first backup had no summary because there was no parent tree to diff against
@@ -489,6 +526,16 @@ The skill activates on these signals:
 
 ---
 
+## Support / Donate
+
+This is an independent open-source project maintained by a solo developer. If Cursor Guard has saved your code or your time, consider buying me a coffee :)
+
+| WeChat Pay | Alipay |
+|:---:|:---:|
+| <img src="media/wechat-pay.png" alt="WeChat Pay" width="200"> | <img src="media/alipay.jpg" alt="Alipay" width="200"> |
+
+---
+
 ## License
 
-MIT
+[BSL 1.1 (Business Source License)](LICENSE) — Source code is freely available for viewing, modification, and non-commercial use. Commercial use requires authorization from the author. Auto-converts to Apache 2.0 on 2056-03-22.

package/README.zh-CN.md

@@ -25,6 +25,10 @@
 - **主动变更频率告警（V4）** — 自动检测异常文件变更模式并发出风险预警
 - **备份健康看板（V4）** — 一次调用全面查看：策略、数量、磁盘占用、保护范围、健康状态
 - **Web 仪表盘（V4.2）** — 本地只读 Web 页面 `http://127.0.0.1:3120`——健康状态、备份、恢复点、诊断、保护范围一目了然。中英双语、每 15 秒自动刷新、支持多项目监控
+- **IDE 扩展（V4.7）** — 完整仪表盘嵌入 VSCode/Cursor/Windsurf，WebView 标签页 + 状态栏告警指示器 + 侧边栏项目树。无需打开浏览器
+- **一键热重启（V4.5.8）** — 仪表盘检测到新版本时可原地重启服务，不丢失状态
+- **Shadow 增量硬链接（V4.5.4）** — 未变更文件硬链接到上次快照，节省磁盘空间和 I/O
+- **强保护模式（V4.5.4）** — `always_watch: true` 让 watcher 随 MCP server 自动启动，确保零保护缺口
 
 ---
 
@@ -124,6 +128,11 @@ git clone https://github.com/zhangqiang8vipp/cursor-guard.git .cursor/skills/cur
     │       └── app.js
     ├── mcp/
     │   └── server.js                   # MCP Server（9 个工具）
+    ├── vscode-extension/               # IDE 扩展（V4.7）
+    │   ├── extension.js                # 扩展入口
+    │   ├── package.json                # 扩展清单
+    │   ├── lib/                        # 模块（dashboard-manager、webview、status-bar、tree-view、poller）
+    │   └── media/                      # 图标（SVG + PNG）
     ├── bin/
     │   ├── cursor-guard-backup.js      # CLI：npx cursor-guard-backup
     │   ├── cursor-guard-doctor.js      # CLI：npx cursor-guard-doctor
@@ -388,6 +397,7 @@ code --install-extension .
 | `references/bin/cursor-guard-doctor.js` | CLI 入口：`npx cursor-guard-doctor` |
 | `references/dashboard/server.js` | 仪表盘 HTTP 服务 + REST API |
 | `references/dashboard/public/` | 仪表盘 Web UI（index.html、style.css、app.js） |
+| `references/vscode-extension/` | IDE 扩展：WebView 仪表盘、状态栏、侧边栏树、命令面板 |
 | `references/auto-backup.ps1` / `.sh` | 薄封装（Windows / macOS+Linux） |
 | `references/guard-doctor.ps1` / `.sh` | 薄封装（Windows / macOS+Linux） |
 | `references/recovery.md` | 恢复命令模板 |
@@ -400,6 +410,33 @@ code --install-extension .
 
 ## 更新日志
 
+### v4.7.0 — IDE 扩展
+
+- **功能**：VSCode/Cursor/Windsurf 扩展 — 完整仪表盘作为 WebView 标签页嵌入，状态栏告警指示器，侧边栏 TreeView 项目状态，命令面板集成
+- **功能**：检测到 `.cursor-guard.json` 自动激活，Dashboard 服务在扩展宿主进程内运行（零额外进程开销）
+- **适配**：`fetchJson()` 支持 `__GUARD_BASE_URL__` 用于 WebView；`copyText()` 在 IDE 中通过 `postMessage` 桥接到 `vscode.env.clipboard`
+
+### v4.6.x — 告警 UX 大优化
+
+- **修复**：告警倒计时现在每秒更新（之前仅在 15 秒页面刷新时更新）
+- **修复**：告警文件详情弹窗支持每文件「复制恢复命令」按钮
+- **修复**：备份过时阈值改为 `max(interval*10, 300)` 秒（至少 5 分钟）；仅在 watcher 运行时检查
+- **功能**：告警历史始终可访问（无论是否有活跃告警），使用 `localStorage` 持久化
+- **功能**：告警历史作为弹窗展示，支持嵌套查看文件详情
+
+### v4.5.x — 保护加固
+
+- **修复**：Shadow 硬链接顺序 bug（上次快照总是空目录）
+- **修复**：`changedFiles` 现在过滤忽略路径
+- **功能**：告警结构化文件列表 — 每文件路径、操作、+/- 行数，支持排序
+- **功能**：Shadow 增量硬链接 — 未变更文件链接到上次快照，节省磁盘空间
+- **功能**：`always_watch: true` 配置 — watcher 随 MCP server 自动启动，零保护缺口
+- **功能**：Dashboard 服务单例 — 多项目共享一个端口，热加载新项目
+- **功能**：Dashboard 版本检测 + 一键热重启（`/api/restart` 端点）
+- **功能**：文件详情弹窗 + 每文件恢复命令复制按钮
+- **功能**：`cursor-guard-init` 自动创建 `.cursor-guard.json`；支持 `backup_interval_seconds` 别名
+- **许可证**：从 MIT 变更为 BSL 1.1（源码可见，商业使用需作者授权）
+
 ### v4.4.0 — V4 收官版
 
 - **修复**：首次快照现在会生成 "Added N: file1, file2, ..." 摘要，而不是空白——之前第一次备份因为没有 parent tree 对比所以 summary 始终为空
@@ -489,6 +526,16 @@ code --install-extension .
 
 ---
 
+## 支持 / 捐赠
+
+这是一个独立开发者维护的开源项目。如果 Cursor Guard 拯救过你的代码或节省了你的时间，欢迎请我喝杯咖啡 :)
+
+| 微信支付 | 支付宝 |
+|:---:|:---:|
+| <img src="media/wechat-pay.png" alt="微信支付" width="200"> | <img src="media/alipay.jpg" alt="支付宝" width="200"> |
+
+---
+
 ## 许可证
 
-MIT
+[BSL 1.1（商业源代码许可证）](LICENSE) — 源代码自由查看、修改和非商业使用。商业使用需获得作者授权。2056-03-22 之后自动转为 Apache 2.0。

package/ROADMAP.md

@@ -3,8 +3,8 @@
 > 本文档描述 cursor-guard 从 V2 到 V7 的长期演进方向。
 > 每一代向下兼容，低版本功能永远不废弃。
 >
-> **当前版本**：`V4.7.0`  
-> **文档状态**：`V2` ~ `V4.7.0` 已完成交付（含 V5 intent/audit 基础），`V5` 主体规划中
+> **当前版本**：`V4.7.3`  
+> **文档状态**：`V2` ~ `V4.7.3` 已完成交付（含 V5 intent/audit 基础），`V5` 主体规划中
 
 ## 阅读导航
 
@@ -734,6 +734,40 @@ V4 经过 4 轮系统性代码审查，修复了以下关键问题：
 }
 ```
 
+### V4.7.3：可视化图表侧边栏 ✅
+
+| 组件 | 说明 |
+|------|------|
+| **`sidebar-webview.js`** | 新增 `WebviewViewProvider`，在 Activity Bar 侧边栏底部渲染自定义 HTML/CSS 图表面板 |
+| **状态徽章行** | 4 个彩色卡片一行排列：Watcher（绿/红）、Alerts（红/绿）、Health（绿/黄/红）、Files（蓝） |
+| **告警横幅** | 活跃告警时显示红色横幅：文件数 + 窗口时间 + 阈值 + 倒计时 |
+| **进度条图表** | Backup Statistics 区域用 4 根彩色进度条展示：Git 备份数、Shadow 快照数、Git 磁盘、Shadow 磁盘，附系统剩余空间 |
+| **备份时间线** | Recent Backups 区域用圆点 + 时间 + 类型 + 摘要的紧凑列表展示最近 6 条备份 |
+| **健康问题列表** | 逐条展示 health issues，黄/红圆点标注严重度 |
+| **保护范围标签** | 用绿色/红色药丸标签展示 protect/ignore 规则 |
+| **快捷操作栏** | 4 个 hover 高亮按钮：Dashboard / Snapshot / Start / Stop |
+| **数据推送** | Poller 每 5 秒通过 `postMessage` 推送完整数据到 WebviewView，实时更新所有图表 |
+| **TreeView 精简** | 上方 TreeView 只保留项目概要（名称/状态/操作），详细数据全在图表面板 |
+
+### V4.7.2：Sidebar Mini Dashboard + Watcher 修复 ✅
+
+| 修复/增强 | 说明 |
+|----------|------|
+| **Watcher 无限重启修复** | `startWatcher` 误用 `lib/auto-backup.js`（库模块），改为正确的 CLI 入口 `bin/cursor-guard-backup.js`；新增防重复检查（已有进程则跳过） |
+| **TreeView Mini Dashboard** | 侧边栏从简单列表重构为 7 个信息密集的折叠区：Watcher 详情（PID/启动时间/策略）、告警详情（倒计时/文件列表 top 10）、近期备份（最近 8 条 + 摘要/时间/类型）、统计（git/shadow 数量 + 磁盘占用 + 系统剩余空间）、健康检查（逐条 issue）、保护范围（protect/ignore 规则 + 文件数）、快捷操作 |
+| **Poller 完整数据** | 后台轮询从只拉 `dashboard` scope 改为拉取完整 page data（含 backups/scope/doctor），驱动 TreeView 展示更多信息 |
+| **彩色区分** | 7 个 section 使用不同 ThemeColor（绿=正常/红=告警/蓝=备份/紫=统计/橙=配置/黄=警告），项目节点根据状态显示 Protected/Unprotected/ALERT |
+
+### V4.7.1：IDE 插件 Bug 修复 + UX 增强 ✅
+
+| 修复/增强 | 说明 |
+|----------|------|
+| **P1 Bug 修复** | `snapshotNow` 中 `loadConfig` 返回 `{cfg, loaded, error, warnings}`，但代码直接传了整个对象。修复为解构 `const { cfg } = loadConfig()` |
+| **WebView CSP** | WebView 缺少 Content-Security-Policy meta 标签，导致 `fetch` 请求被浏览器安全策略阻止（failed to fetch）。添加 CSP 允许 `connect-src` 到 Dashboard Server |
+| **一键启动/停止 Watcher** | `Start Watcher` / `Stop Watcher` 命令从提示文字改为实际 `spawn` 子进程启动和 `SIGTERM` 停止 |
+| **TreeView 彩色化** | 所有图标使用 `ThemeColor`（绿色=正常、红色=告警/停止、蓝色=备份、紫色=统计）。项目节点根据状态显示 Protected/Unprotected/ALERT。新增 Quick Actions 折叠区（Open Dashboard / Snapshot Now / Start/Stop Watcher / Refresh） |
+| **StatusBar 增强** | Watcher 未运行时显示 `$(eye-closed) Guard: Unprotected`；告警时图标动画 `$(bell~spin)` |
+
 ### V4.7.0：IDE 集成（VSCode/Cursor Extension） ✅
 
 | 组件 | 说明 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cursor-guard",
-  "version": "4.7.0",
+  "version": "4.7.3",
   "description": "Protects code from accidental AI overwrite or deletion in Cursor IDE — mandatory pre-write snapshots, review-before-apply, local Git safety net, and deterministic recovery. | 保护代码免受 Cursor AI 代理意外覆写或删除——强制写前快照、预览再执行、本地 Git 安全网、确定性恢复。",
   "keywords": [
     "cursor",
@@ -51,6 +51,7 @@
     "references/mcp/",
     "references/dashboard/",
     "references/vscode-extension/",
+    "media/",
     "references/config-reference.md",
     "references/config-reference.zh-CN.md",
     "references/cursor-guard.example.json",

package/references/vscode-extension/extension.js

@@ -6,8 +6,9 @@ const { WebViewProvider } = require('./lib/webview-provider');
 const { StatusBarController } = require('./lib/status-bar');
 const { GuardTreeView } = require('./lib/tree-view');
 const { Poller } = require('./lib/poller');
+const { SidebarDashboardProvider } = require('./lib/sidebar-webview');
 
-let dashMgr, poller, statusBar, treeView, webviewProvider;
+let dashMgr, poller, statusBar, treeView, webviewProvider, sidebarProvider;
 
 async function activate(context) {
   dashMgr = new DashboardManager();
@@ -15,8 +16,11 @@ async function activate(context) {
   statusBar = new StatusBarController(poller);
   treeView = new GuardTreeView(poller, dashMgr);
   webviewProvider = new WebViewProvider(context, dashMgr);
+  sidebarProvider = new SidebarDashboardProvider(poller);
 
   context.subscriptions.push(
+    vscode.window.registerWebviewViewProvider('cursorGuardDashboard', sidebarProvider),
+
     vscode.commands.registerCommand('cursorGuard.openDashboard', () => {
       if (!dashMgr.running) {
         vscode.window.showWarningMessage('Cursor Guard: no projects detected. Add .cursor-guard.json to your workspace.');
@@ -40,16 +44,38 @@ async function activate(context) {
       poller.forceRefresh();
     }),
 
-    vscode.commands.registerCommand('cursorGuard.startWatcher', () => {
-      vscode.window.showInformationMessage(
-        'Cursor Guard: run `cursor-guard-backup --path <dir> --dashboard` in terminal to start the watcher.'
-      );
+    vscode.commands.registerCommand('cursorGuard.startWatcher', async () => {
+      const folders = vscode.workspace.workspaceFolders;
+      if (!folders || folders.length === 0) {
+        vscode.window.showWarningMessage('Cursor Guard: no workspace folder open.');
+        return;
+      }
+      const projectPath = folders[0].uri.fsPath;
+      const existingPid = dashMgr.getWatcherPid(projectPath);
+      if (existingPid) {
+        vscode.window.showInformationMessage(`Cursor Guard: watcher already running (PID ${existingPid})`);
+        return;
+      }
+      const pid = dashMgr.startWatcher(projectPath);
+      if (pid) {
+        vscode.window.showInformationMessage(`Cursor Guard: watcher started (PID ${pid})`);
+        setTimeout(() => poller.forceRefresh(), 2000);
+      } else {
+        vscode.window.showWarningMessage('Cursor Guard: failed to start watcher');
+      }
     }),
 
-    vscode.commands.registerCommand('cursorGuard.stopWatcher', () => {
-      vscode.window.showInformationMessage(
-        'Cursor Guard: stop the watcher by terminating its terminal process (Ctrl+C).'
-      );
+    vscode.commands.registerCommand('cursorGuard.stopWatcher', async () => {
+      const folders = vscode.workspace.workspaceFolders;
+      if (!folders || folders.length === 0) return;
+      const projectPath = folders[0].uri.fsPath;
+      const stopped = dashMgr.stopWatcher(projectPath);
+      if (stopped) {
+        vscode.window.showInformationMessage('Cursor Guard: watcher stopped');
+        setTimeout(() => poller.forceRefresh(), 1000);
+      } else {
+        vscode.window.showWarningMessage('Cursor Guard: no running watcher found');
+      }
     }),
 
     vscode.commands.registerCommand('cursorGuard.refreshTree', () => {
@@ -61,6 +87,7 @@ async function activate(context) {
     poller,
     treeView,
     webviewProvider,
+    sidebarProvider,
   );
 
   const started = await dashMgr.autoStart(vscode.workspace.workspaceFolders);
@@ -83,6 +110,7 @@ function deactivate() {
   if (statusBar) statusBar.dispose();
   if (treeView) treeView.dispose();
   if (webviewProvider) webviewProvider.dispose();
+  if (sidebarProvider) sidebarProvider.dispose();
   if (dashMgr) dashMgr.dispose();
 }
 

package/references/vscode-extension/lib/dashboard-manager.js

@@ -3,6 +3,7 @@
 const fs = require('fs');
 const path = require('path');
 const http = require('http');
+const { spawn } = require('child_process');
 
 const CONFIG_FILE = '.cursor-guard.json';
 
@@ -66,18 +67,69 @@ class DashboardManager {
     return this.fetchApi(`/api/page-data?id=${projectId}${scopeParam}`);
   }
 
+  async getFullPageData(projectId) {
+    return this.fetchApi(`/api/page-data?id=${projectId}`);
+  }
+
+  async getBackupFiles(projectId, hash) {
+    return this.fetchApi(`/api/backup-files?id=${projectId}&hash=${hash}`);
+  }
+
   async snapshotNow(projectPath) {
     if (!projectPath) return;
     try {
       const { createGitSnapshot } = require('../../lib/core/snapshot');
       const { loadConfig } = require('../../lib/utils');
-      const cfg = loadConfig(projectPath);
+      const { cfg } = loadConfig(projectPath);
       return createGitSnapshot(projectPath, cfg, { message: 'guard: manual snapshot via IDE extension' });
     } catch (e) {
       return { status: 'error', error: e.message };
     }
   }
 
+  startWatcher(projectPath) {
+    if (!projectPath) return null;
+    const existingPid = this.getWatcherPid(projectPath);
+    if (existingPid) return existingPid;
+    const cliScript = path.resolve(__dirname, '..', '..', 'bin', 'cursor-guard-backup.js');
+    const child = spawn(process.execPath, [cliScript, '--path', projectPath], {
+      cwd: projectPath,
+      stdio: 'ignore',
+      detached: true,
+      env: { ...process.env, GUARD_SPAWNED_BY_EXT: '1' },
+    });
+    child.unref();
+    return child.pid;
+  }
+
+  stopWatcher(projectPath) {
+    if (!projectPath) return false;
+    try {
+      const lockPath = path.join(projectPath, '.cursor-guard-backup.lock');
+      if (!fs.existsSync(lockPath)) return false;
+      const lockData = JSON.parse(fs.readFileSync(lockPath, 'utf-8'));
+      if (lockData.pid) {
+        process.kill(lockData.pid, 'SIGTERM');
+        try { fs.unlinkSync(lockPath); } catch { /* ok */ }
+        return true;
+      }
+    } catch { /* ok */ }
+    return false;
+  }
+
+  getWatcherPid(projectPath) {
+    try {
+      const lockPath = path.join(projectPath, '.cursor-guard-backup.lock');
+      if (!fs.existsSync(lockPath)) return null;
+      const lockData = JSON.parse(fs.readFileSync(lockPath, 'utf-8'));
+      if (lockData.pid) {
+        process.kill(lockData.pid, 0);
+        return lockData.pid;
+      }
+    } catch { /* not running */ }
+    return null;
+  }
+
   dispose() {
     this._instance = null;
   }

package/references/vscode-extension/lib/poller.js

@@ -41,8 +41,14 @@ class Poller {
       const projects = await this._dashMgr.getProjects();
       if (!Array.isArray(projects)) return;
       for (const p of projects) {
-        const pageData = await this._dashMgr.getPageData(p.id, 'dashboard');
-        this._data.set(p.id, { ...p, dashboard: pageData?.dashboard || null });
+        const fullData = await this._dashMgr.getFullPageData(p.id);
+        this._data.set(p.id, {
+          ...p,
+          dashboard: fullData?.dashboard || null,
+          backups: fullData?.backups || [],
+          scope: fullData?.scope || null,
+          doctor: fullData?.doctor || null,
+        });
       }
       this._emit();
     } catch { /* non-critical */ }

package/references/vscode-extension/lib/sidebar-webview.js

@@ -0,0 +1,383 @@
+'use strict';
+
+const vscode = require('vscode');
+
+class SidebarDashboardProvider {
+  constructor(poller) {
+    this._poller = poller;
+    this._view = null;
+    this._sub = poller.onChange(data => this._push(data));
+  }
+
+  resolveWebviewView(webviewView) {
+    this._view = webviewView;
+    webviewView.webview.options = { enableScripts: true };
+    webviewView.webview.html = _getHtml();
+
+    webviewView.webview.onDidReceiveMessage(msg => {
+      if (msg.cmd === 'ready') this._push(this._poller.data);
+      if (msg.cmd === 'exec') vscode.commands.executeCommand(msg.command);
+    });
+
+    webviewView.onDidChangeVisibility(() => {
+      if (webviewView.visible) this._push(this._poller.data);
+    });
+  }
+
+  _push(data) {
+    if (!this._view?.visible) return;
+    const payload = {};
+    for (const [id, p] of data) {
+      payload[id] = {
+        name: p.name || id,
+        dashboard: p.dashboard,
+        backups: (p.backups || []).slice(0, 6),
+      };
+    }
+    this._view.webview.postMessage({ type: 'update', data: payload });
+  }
+
+  dispose() {
+    this._sub?.dispose();
+  }
+}
+
+function _getHtml() {
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="UTF-8">
+<style>
+:root {
+  --bg: #1e1e2e;
+  --surface: #282838;
+  --border: #383850;
+  --text: #cdd6f4;
+  --dim: #6c7086;
+  --green: #a6e3a1;
+  --red: #f38ba8;
+  --yellow: #f9e2af;
+  --blue: #89b4fa;
+  --purple: #cba6f7;
+  --orange: #fab387;
+  --teal: #94e2d5;
+  --radius: 6px;
+}
+* { margin: 0; padding: 0; box-sizing: border-box; }
+body {
+  font: 11px/1.5 -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+  color: var(--text);
+  background: transparent;
+  padding: 8px;
+}
+.card {
+  background: var(--surface);
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  padding: 8px 10px;
+  margin-bottom: 6px;
+}
+.card-title {
+  font-size: 9px;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.8px;
+  color: var(--dim);
+  margin-bottom: 6px;
+}
+.status-row {
+  display: flex;
+  gap: 6px;
+  margin-bottom: 6px;
+}
+.status-badge {
+  flex: 1;
+  text-align: center;
+  padding: 6px 4px;
+  border-radius: var(--radius);
+  background: var(--bg);
+  border: 1px solid var(--border);
+}
+.status-badge .icon { font-size: 16px; display: block; }
+.status-badge .label { font-size: 9px; color: var(--dim); margin-top: 2px; }
+.status-badge .value { font-size: 11px; font-weight: 700; }
+.status-badge.ok { border-color: var(--green); }
+.status-badge.ok .value { color: var(--green); }
+.status-badge.warn { border-color: var(--yellow); }
+.status-badge.warn .value { color: var(--yellow); }
+.status-badge.danger { border-color: var(--red); }
+.status-badge.danger .value { color: var(--red); }
+.status-badge.info { border-color: var(--blue); }
+.status-badge.info .value { color: var(--blue); }
+
+.alert-bar {
+  background: rgba(243,139,168,0.15);
+  border: 1px solid var(--red);
+  border-radius: var(--radius);
+  padding: 6px 10px;
+  margin-bottom: 6px;
+  text-align: center;
+}
+.alert-bar .alert-title { color: var(--red); font-weight: 700; font-size: 12px; }
+.alert-bar .alert-detail { color: var(--dim); font-size: 10px; margin-top: 2px; }
+.alert-bar.hidden { display: none; }
+
+.bar-group { margin-bottom: 4px; }
+.bar-label {
+  display: flex;
+  justify-content: space-between;
+  font-size: 10px;
+  margin-bottom: 2px;
+}
+.bar-label .name { color: var(--text); }
+.bar-label .val { color: var(--dim); font-weight: 600; }
+.bar-track {
+  height: 6px;
+  background: var(--bg);
+  border-radius: 3px;
+  overflow: hidden;
+}
+.bar-fill {
+  height: 100%;
+  border-radius: 3px;
+  transition: width 0.4s ease;
+}
+.bar-fill.blue { background: var(--blue); }
+.bar-fill.purple { background: var(--purple); }
+.bar-fill.green { background: var(--green); }
+.bar-fill.orange { background: var(--orange); }
+.bar-fill.teal { background: var(--teal); }
+
+.backup-list { list-style: none; }
+.backup-item {
+  display: flex;
+  align-items: center;
+  gap: 6px;
+  padding: 3px 0;
+  border-bottom: 1px solid var(--border);
+  font-size: 10px;
+}
+.backup-item:last-child { border: none; }
+.backup-dot {
+  width: 6px; height: 6px;
+  border-radius: 50%;
+  flex-shrink: 0;
+}
+.backup-dot.auto { background: var(--blue); }
+.backup-dot.snapshot { background: var(--purple); }
+.backup-dot.restore { background: var(--orange); }
+.backup-time { color: var(--dim); white-space: nowrap; }
+.backup-type { font-weight: 600; min-width: 36px; }
+.backup-summary { color: var(--dim); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; flex: 1; }
+
+.scope-tags { display: flex; flex-wrap: wrap; gap: 3px; margin-top: 4px; }
+.scope-tag {
+  font-size: 9px;
+  padding: 1px 6px;
+  border-radius: 10px;
+  background: var(--bg);
+}
+.scope-tag.protect { color: var(--green); border: 1px solid var(--green); }
+.scope-tag.ignore { color: var(--red); border: 1px solid var(--red); }
+
+.health-row { display: flex; align-items: center; gap: 4px; font-size: 10px; padding: 2px 0; }
+.health-dot { width: 5px; height: 5px; border-radius: 50%; flex-shrink: 0; }
+
+.actions-row { display: flex; gap: 4px; flex-wrap: wrap; }
+.action-btn {
+  flex: 1;
+  min-width: 70px;
+  padding: 5px 4px;
+  font-size: 9px;
+  font-weight: 600;
+  text-align: center;
+  border: 1px solid var(--border);
+  border-radius: var(--radius);
+  background: var(--bg);
+  color: var(--text);
+  cursor: pointer;
+  transition: all 0.15s;
+}
+.action-btn:hover { border-color: var(--blue); color: var(--blue); }
+
+.empty-state {
+  text-align: center;
+  padding: 20px;
+  color: var(--dim);
+  font-size: 11px;
+}
+
+.ring-chart {
+  position: relative;
+  width: 56px; height: 56px;
+  margin: 0 auto 4px;
+}
+.ring-chart svg { transform: rotate(-90deg); }
+.ring-chart .ring-bg { stroke: var(--bg); }
+.ring-chart .ring-fill { transition: stroke-dashoffset 0.6s ease; }
+.ring-label {
+  position: absolute;
+  top: 50%; left: 50%;
+  transform: translate(-50%, -50%);
+  font-size: 12px;
+  font-weight: 700;
+}
+</style>
+</head>
+<body>
+<div id="root">
+  <div class="empty-state">Waiting for data...</div>
+</div>
+<script>
+const vscode = acquireVsCodeApi();
+window.addEventListener('message', e => {
+  if (e.data.type === 'update') render(e.data.data);
+});
+vscode.postMessage({ cmd: 'ready' });
+
+function render(projects) {
+  const ids = Object.keys(projects);
+  if (ids.length === 0) {
+    document.getElementById('root').innerHTML = '<div class="empty-state">No projects detected</div>';
+    return;
+  }
+  let html = '';
+  for (const id of ids) {
+    const p = projects[id];
+    const d = p.dashboard;
+    if (!d) { html += '<div class="empty-state">Loading ' + esc(p.name) + '...</div>'; continue; }
+    html += renderProject(p.name, d, p.backups || []);
+  }
+  html += renderActions();
+  document.getElementById('root').innerHTML = html;
+  document.querySelectorAll('.action-btn').forEach(btn => {
+    btn.addEventListener('click', () => vscode.postMessage({ cmd: 'exec', command: btn.dataset.cmd }));
+  });
+}
+
+function renderProject(name, d, backups) {
+  let h = '';
+
+  // Status badges row
+  const wOk = d.watcher?.running;
+  const hasAlert = d.alerts?.active;
+  const health = d.health?.status || 'unknown';
+
+  h += '<div class="status-row">';
+  h += badge(wOk ? '👁' : '🚫', 'Watcher', wOk ? 'Running' : 'Stopped', wOk ? 'ok' : 'danger');
+  h += badge(hasAlert ? '🔔' : '✅', 'Alerts', hasAlert ? (d.alerts.latest?.fileCount || '!') : 'None', hasAlert ? 'danger' : 'ok');
+  h += badge('💚', 'Health', health, health === 'healthy' ? 'ok' : health === 'critical' ? 'danger' : 'warn');
+  h += badge('📁', 'Files', d.protectionScope?.fileCount || 0, 'info');
+  h += '</div>';
+
+  // Alert bar
+  if (hasAlert) {
+    const a = d.alerts.latest;
+    const remain = a.expiresAt ? Math.max(0, Math.ceil((new Date(a.expiresAt).getTime() - Date.now()) / 1000)) : 0;
+    const display = remain > 60 ? Math.floor(remain/60) + 'm ' + (remain%60) + 's' : remain + 's';
+    h += '<div class="alert-bar">';
+    h += '<div class="alert-title">⚠ ' + (a.fileCount||'?') + ' files changed in ' + (a.windowSeconds||'?') + 's</div>';
+    h += '<div class="alert-detail">Threshold: ' + (a.threshold||'?') + ' · Expires: ' + display + '</div>';
+    h += '</div>';
+  }
+
+  // Backup stats bars
+  const gitC = d.counts?.git?.commits || 0;
+  const shadowC = d.counts?.shadow?.snapshots || 0;
+  const maxC = Math.max(gitC, shadowC, 1);
+  const gitDisk = d.diskUsage?.git?.display || '0B';
+  const shadowDisk = d.diskUsage?.shadow?.display || '0B';
+  const gitBytes = d.diskUsage?.git?.bytes || 0;
+  const shadowBytes = d.diskUsage?.shadow?.bytes || 0;
+  const maxBytes = Math.max(gitBytes, shadowBytes, 1);
+
+  h += '<div class="card">';
+  h += '<div class="card-title">Backup Statistics</div>';
+  h += bar('Git backups', gitC, gitC / maxC * 100, 'blue');
+  h += bar('Shadow snapshots', shadowC, shadowC / maxC * 100, 'purple');
+  h += bar('Git disk', gitDisk, gitBytes / maxBytes * 100, 'teal');
+  h += bar('Shadow disk', shadowDisk, shadowBytes / maxBytes * 100, 'orange');
+  if (d.disk) {
+    h += '<div class="bar-label" style="margin-top:4px"><span class="name">System free</span><span class="val">' + d.disk.freeGB + ' GB</span></div>';
+  }
+  h += '</div>';
+
+  // Recent backups timeline
+  h += '<div class="card">';
+  h += '<div class="card-title">Recent Backups</div>';
+  if (backups.length === 0) {
+    h += '<div style="color:var(--dim);font-size:10px">No backups yet</div>';
+  } else {
+    h += '<ul class="backup-list">';
+    for (const b of backups) {
+      const time = b.timestamp ? new Date(b.timestamp).toLocaleTimeString([], {hour:'2-digit',minute:'2-digit',second:'2-digit'}) : '?';
+      const type = b.type || 'auto';
+      const dotClass = type === 'git-snapshot' ? 'snapshot' : type === 'pre-restore' ? 'restore' : 'auto';
+      const typeLabel = type === 'git-snapshot' ? 'snap' : type === 'pre-restore' ? 'pre-rst' : 'auto';
+      const summary = b.summary ? truncate(b.summary, 30) : '';
+      const files = b.filesChanged ? b.filesChanged + ' files' : '';
+      h += '<li class="backup-item">';
+      h += '<span class="backup-dot ' + dotClass + '"></span>';
+      h += '<span class="backup-time">' + time + '</span>';
+      h += '<span class="backup-type">' + typeLabel + '</span>';
+      h += '<span class="backup-summary">' + esc(files + (files && summary ? ' · ' : '') + summary) + '</span>';
+      h += '</li>';
+    }
+    h += '</ul>';
+  }
+  h += '</div>';
+
+  // Health issues
+  if (d.health?.issues?.length > 0) {
+    h += '<div class="card">';
+    h += '<div class="card-title">Health Issues</div>';
+    for (const issue of d.health.issues) {
+      const critical = issue.includes('critically') || issue.includes('requires Git');
+      h += '<div class="health-row"><span class="health-dot" style="background:' + (critical ? 'var(--red)' : 'var(--yellow)') + '"></span>' + esc(issue) + '</div>';
+    }
+    h += '</div>';
+  }
+
+  // Protection scope
+  h += '<div class="card">';
+  h += '<div class="card-title">Protection Scope</div>';
+  const protect = d.protectionScope?.protect || ['**'];
+  const ignore = d.protectionScope?.ignore || [];
+  h += '<div style="font-size:10px;margin-bottom:4px">' + (d.protectionScope?.fileCount || 0) + ' files monitored</div>';
+  h += '<div class="scope-tags">';
+  for (const p of protect) h += '<span class="scope-tag protect">✓ ' + esc(p) + '</span>';
+  for (const i of ignore.slice(0, 6)) h += '<span class="scope-tag ignore">✗ ' + esc(i) + '</span>';
+  if (ignore.length > 6) h += '<span class="scope-tag ignore">+' + (ignore.length - 6) + ' more</span>';
+  h += '</div></div>';
+
+  return h;
+}
+
+function renderActions() {
+  return '<div class="card"><div class="card-title">Quick Actions</div><div class="actions-row">'
+    + '<button class="action-btn" data-cmd="cursorGuard.openDashboard">🖥 Dashboard</button>'
+    + '<button class="action-btn" data-cmd="cursorGuard.snapshotNow">📸 Snapshot</button>'
+    + '<button class="action-btn" data-cmd="cursorGuard.startWatcher">▶ Start</button>'
+    + '<button class="action-btn" data-cmd="cursorGuard.stopWatcher">⏹ Stop</button>'
+    + '</div></div>';
+}
+
+function badge(icon, label, value, cls) {
+  return '<div class="status-badge ' + cls + '">'
+    + '<span class="icon">' + icon + '</span>'
+    + '<span class="value">' + esc(String(value)) + '</span>'
+    + '<span class="label">' + label + '</span>'
+    + '</div>';
+}
+function bar(name, val, pct, color) {
+  return '<div class="bar-group"><div class="bar-label"><span class="name">' + name + '</span><span class="val">' + val + '</span></div>'
+    + '<div class="bar-track"><div class="bar-fill ' + color + '" style="width:' + Math.max(pct, 2) + '%"></div></div></div>';
+}
+function esc(s) { return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;'); }
+function truncate(s, n) { return s.length > n ? s.slice(0, n) + '...' : s; }
+</script>
+</body>
+</html>`;
+}
+
+module.exports = { SidebarDashboardProvider };

package/references/vscode-extension/lib/status-bar.js

@@ -14,16 +14,19 @@ class StatusBarController {
   }
 
   _setIdle() {
-    this._item.text = '$(shield) Guard';
+    this._item.text = '$(shield) Guard: init...';
     this._item.backgroundColor = undefined;
+    this._item.color = new vscode.ThemeColor('statusBar.foreground');
   }
 
   _update(data) {
     let hasAlert = false;
     let watcherRunning = false;
     let alertFileCount = 0;
+    let projectCount = 0;
 
     for (const [, p] of data) {
+      projectCount++;
       const d = p.dashboard;
       if (!d) continue;
       if (d.alerts?.active) {
@@ -34,17 +37,25 @@ class StatusBarController {
     }
 
     if (hasAlert) {
-      this._item.text = `$(warning) Guard: ${alertFileCount} files!`;
+      this._item.text = `$(bell~spin) Guard: ${alertFileCount} files!`;
       this._item.backgroundColor = new vscode.ThemeColor('statusBarItem.warningBackground');
-      this._item.tooltip = `Cursor Guard — ALERT: ${alertFileCount} files changed rapidly`;
+      this._item.color = undefined;
+      this._item.tooltip = `Cursor Guard — ALERT: ${alertFileCount} files changed rapidly. Click to open dashboard.`;
     } else if (watcherRunning) {
       this._item.text = '$(shield) Guard: OK';
       this._item.backgroundColor = undefined;
-      this._item.tooltip = 'Cursor Guard — watcher running, no alerts';
+      this._item.color = new vscode.ThemeColor('statusBar.foreground');
+      this._item.tooltip = 'Cursor Guard — watcher running, no alerts. Click to open dashboard.';
+    } else if (projectCount > 0) {
+      this._item.text = '$(eye-closed) Guard: Unprotected';
+      this._item.backgroundColor = undefined;
+      this._item.color = new vscode.ThemeColor('statusBar.foreground');
+      this._item.tooltip = 'Cursor Guard — watcher NOT running. Click to open dashboard, or use Command Palette > Start Watcher.';
     } else {
       this._item.text = '$(shield) Guard';
       this._item.backgroundColor = undefined;
-      this._item.tooltip = 'Cursor Guard — watcher not running';
+      this._item.color = new vscode.ThemeColor('statusBar.foreground');
+      this._item.tooltip = 'Cursor Guard — no projects detected';
     }
   }
 

package/references/vscode-extension/lib/tree-view.js

@@ -2,6 +2,15 @@
 
 const vscode = require('vscode');
 
+const C = {
+  green: new vscode.ThemeColor('charts.green'),
+  red: new vscode.ThemeColor('charts.red'),
+  yellow: new vscode.ThemeColor('charts.yellow'),
+  blue: new vscode.ThemeColor('charts.blue'),
+  purple: new vscode.ThemeColor('charts.purple'),
+  orange: new vscode.ThemeColor('charts.orange'),
+};
+
 class GuardTreeView {
   constructor(poller, dashMgr) {
     this._poller = poller;
@@ -11,32 +20,37 @@ class GuardTreeView {
 
     this._treeView = vscode.window.createTreeView('cursorGuardProjects', {
       treeDataProvider: this,
-      showCollapseAll: true,
+      showCollapseAll: false,
     });
 
     this._sub = poller.onChange(() => this._onDidChange.fire());
   }
 
   refresh() { this._onDidChange.fire(); }
+  getTreeItem(el) { return el; }
 
-  getTreeItem(element) { return element; }
-
-  getChildren(element) {
-    if (!element) return this._getRootItems();
-    if (element.contextValue === 'project') return this._getProjectChildren(element.projectId);
+  getChildren(el) {
+    if (!el) return this._getRootItems();
+    if (el.contextValue === 'project') return this._getProjectStatus(el.projectId);
     return [];
   }
 
   _getRootItems() {
     const data = this._poller.data;
     if (data.size === 0) {
-      return [new TreeItem('No projects detected', 'info', { icon: 'info' })];
+      return [_item('No projects detected', 'info', { icon: 'info', color: C.yellow, desc: 'Add .cursor-guard.json' })];
     }
     const items = [];
     for (const [id, p] of data) {
-      const item = new TreeItem(p.name || id, 'project', {
-        icon: 'folder',
-        description: p.pathLabel,
+      const d = p.dashboard;
+      const hasAlert = d?.alerts?.active;
+      const watcherOk = d?.watcher?.running;
+      const color = hasAlert ? C.red : watcherOk ? C.green : C.yellow;
+      const status = hasAlert ? `ALERT ${d.alerts.latest?.fileCount || ''} files` : watcherOk ? 'Protected' : 'Unprotected';
+      const item = _item(p.name || id, 'project', {
+        icon: hasAlert ? 'bell' : watcherOk ? 'shield' : 'eye-closed',
+        color,
+        desc: status,
         collapsible: vscode.TreeItemCollapsibleState.Expanded,
       });
       item.projectId = id;
@@ -45,59 +59,41 @@ class GuardTreeView {
     return items;
   }
 
-  _getProjectChildren(projectId) {
-    const p = this._poller.data.get(projectId);
-    if (!p?.dashboard) return [new TreeItem('Loading...', 'loading', { icon: 'loading~spin' })];
+  _getProjectStatus(pid) {
+    const p = this._poller.data.get(pid);
+    if (!p?.dashboard) return [_item('Loading...', 'loading', { icon: 'loading~spin', color: C.blue })];
     const d = p.dashboard;
     const items = [];
 
-    const watcherStatus = d.watcher?.running ? 'Running' : 'Stopped';
-    const watcherIcon = d.watcher?.running ? 'eye' : 'eye-closed';
-    const watcherItem = new TreeItem(`Watcher: ${watcherStatus}`, 'watcher', { icon: watcherIcon });
-    if (d.watcher?.pid) watcherItem.description = `PID ${d.watcher.pid}`;
-    items.push(watcherItem);
-
-    if (d.lastBackup?.git) {
-      const ago = this._relativeTime(d.lastBackup.git.timestamp);
-      items.push(new TreeItem(`Last Backup: ${ago}`, 'backup', { icon: 'git-commit' }));
+    if (d.watcher?.running) {
+      const w = _item('Watcher: Running', 'watcher', { icon: 'eye', color: C.green, desc: `PID ${d.watcher.pid || '?'}` });
+      items.push(w);
+    } else {
+      const w = _item('Watcher: Stopped', 'watcher', { icon: 'eye-closed', color: C.red });
+      w.command = { command: 'cursorGuard.startWatcher', title: 'Start Watcher' };
+      w.tooltip = 'Click to start watcher';
+      items.push(w);
     }
 
-    if (d.counts) {
-      const gitCount = d.counts.git?.commits || 0;
-      const shadowCount = d.counts.shadow?.snapshots || 0;
-      items.push(new TreeItem(`Backups: ${gitCount} git, ${shadowCount} shadow`, 'counts', { icon: 'database' }));
-    }
-
-    if (d.alerts?.active) {
-      const a = d.alerts.latest || {};
-      const alertItem = new TreeItem(
-        `ALERT: ${a.fileCount || '?'} files in ${a.windowSeconds || '?'}s`,
-        'alert',
-        { icon: 'warning' }
-      );
-      alertItem.description = `threshold: ${a.threshold}`;
-      items.push(alertItem);
-    }
+    const gitC = d.counts?.git?.commits || 0;
+    const shadowC = d.counts?.shadow?.snapshots || 0;
+    const lastAgo = d.lastBackup?.git?.relativeTime || 'never';
+    items.push(_item(`Backups: ${gitC + shadowC}`, 'stat', { icon: 'history', color: C.blue, desc: `last ${lastAgo}` }));
 
     const health = d.health?.status || 'unknown';
-    const healthIcon = health === 'healthy' ? 'pass' : health === 'critical' ? 'error' : 'warning';
-    const healthItem = new TreeItem(`Health: ${health}`, 'health', { icon: healthIcon });
-    if (d.health?.issues?.length > 0) {
-      healthItem.description = d.health.issues[0];
-    }
-    items.push(healthItem);
+    const hColor = health === 'healthy' ? C.green : health === 'critical' ? C.red : C.yellow;
+    const hIcon = health === 'healthy' ? 'pass-filled' : health === 'critical' ? 'error' : 'warning';
+    items.push(_item(`Health: ${health}`, 'health', { icon: hIcon, color: hColor }));
 
-    return items;
-  }
+    const openItem = _item('Open Dashboard', 'action', { icon: 'browser', color: C.blue });
+    openItem.command = { command: 'cursorGuard.openDashboard', title: 'Open' };
+    items.push(openItem);
 
-  _relativeTime(ts) {
-    const diff = Date.now() - new Date(ts).getTime();
-    const sec = Math.floor(diff / 1000);
-    if (sec < 60) return `${sec}s ago`;
-    const min = Math.floor(sec / 60);
-    if (min < 60) return `${min}m ago`;
-    const hr = Math.floor(min / 60);
-    return `${hr}h ago`;
+    const snapItem = _item('Snapshot Now', 'action', { icon: 'device-camera', color: C.purple });
+    snapItem.command = { command: 'cursorGuard.snapshotNow', title: 'Snap' };
+    items.push(snapItem);
+
+    return items;
   }
 
   dispose() {
@@ -107,13 +103,12 @@ class GuardTreeView {
   }
 }
 
-class TreeItem extends vscode.TreeItem {
-  constructor(label, contextValue, opts = {}) {
-    super(label, opts.collapsible || vscode.TreeItemCollapsibleState.None);
-    this.contextValue = contextValue;
-    if (opts.icon) this.iconPath = new vscode.ThemeIcon(opts.icon);
-    if (opts.description) this.description = opts.description;
-  }
+function _item(label, ctx, opts = {}) {
+  const ti = new vscode.TreeItem(label, opts.collapsible || vscode.TreeItemCollapsibleState.None);
+  ti.contextValue = ctx;
+  if (opts.icon) ti.iconPath = new vscode.ThemeIcon(opts.icon, opts.color);
+  if (opts.desc) ti.description = opts.desc;
+  return ti;
 }
 
 module.exports = { GuardTreeView };

package/references/vscode-extension/lib/webview-provider.js

@@ -57,9 +57,19 @@ class WebViewProvider {
     const token = this._dashMgr.token || '';
     const nonce = _getNonce();
 
+    const csp = [
+      `default-src 'none'`,
+      `style-src ${webview.cspSource} 'unsafe-inline'`,
+      `script-src 'nonce-${nonce}' ${webview.cspSource}`,
+      `font-src ${webview.cspSource}`,
+      `img-src ${webview.cspSource} data:`,
+      `connect-src ${baseUrl}`,
+    ].join('; ');
+
     html = html.replace(
       '</head>',
-      `<script nonce="${nonce}">
+      `<meta http-equiv="Content-Security-Policy" content="${csp}">
+<script nonce="${nonce}">
   window.__GUARD_TOKEN__ = "${token}";
   window.__GUARD_BASE_URL__ = "${baseUrl}";
   window.__IN_VSCODE__ = true;

package/references/vscode-extension/package.json

@@ -66,6 +66,11 @@
         {
           "id": "cursorGuardProjects",
           "name": "Projects"
+        },
+        {
+          "id": "cursorGuardDashboard",
+          "name": "Dashboard",
+          "type": "webview"
         }
       ]
     },