keyshot-mcp 0.11.0 → 0.12.0

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to KeyShot MCP are documented in this file.
 
 ## [Unreleased]
 
+## [0.12.0] - 2026-09-01
+
+### Added
+
+- Structured bug and feature request forms, a pull request checklist, support
+  guidance, code ownership, and a bilingual community code of conduct.
+- Weekly Dependabot updates for npm and monthly updates for GitHub Actions.
+- CodeQL analysis for JavaScript and TypeScript changes and a weekly scheduled scan.
+
+### Changed
+
+- Contribution guidance now describes the complete validation suite, real KeyShot
+  testing expectations, compatibility rules, and confidential-asset restrictions.
+- Security guidance now links directly to GitHub private vulnerability reporting.
+- Release validation now checks that required community health files remain present.
+
 ## [0.11.0] - 2026-08-12
 
 ### Added
@@ -39,6 +55,7 @@ All notable changes to KeyShot MCP are documented in this file.
 
 - Documented that scene metadata and preview images may be sent by an MCP client to its configured model provider.
 
-[Unreleased]: https://github.com/truman-t3/keyshot-mcp/compare/v0.11.0...HEAD
+[Unreleased]: https://github.com/truman-t3/keyshot-mcp/compare/v0.12.0...HEAD
+[0.12.0]: https://github.com/truman-t3/keyshot-mcp/compare/v0.11.0...v0.12.0
 [0.11.0]: https://github.com/truman-t3/keyshot-mcp/compare/v0.10.0...v0.11.0
 [0.10.0]: https://github.com/truman-t3/keyshot-mcp/compare/v0.9.1...v0.10.0

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,28 @@
+# Community Code of Conduct / 社区行为准则
+
+## Our standards
+
+KeyShot MCP welcomes designers, developers, testers, technical artists, and
+documentation contributors. Participate respectfully, discuss the work rather than
+the person, accept constructive feedback, and make room for different experience
+levels and languages.
+
+Harassment, discrimination, threats, deliberate disruption, and publication of
+another person's private or confidential information are not accepted. Never upload
+customer assets, private scenes, license data, credentials, or unpublished renders
+without clear authorization from their owner.
+
+Maintainers may edit or remove content, close interactions, or restrict participation
+when behavior puts people, projects, or confidential work at risk. Serious platform
+abuse can also be reported through GitHub's reporting tools.
+
+## 中文说明
+
+KeyShot MCP 欢迎设计师、开发者、测试人员、技术美术和文档贡献者参与。请尊重
+他人，只讨论工作本身，接受建设性反馈，并尊重不同经验水平和语言背景。
+
+社区不接受骚扰、歧视、威胁、蓄意干扰或公开他人隐私和保密信息。未经所有者明确
+授权，不得上传客户资产、私人场景、许可证信息、账号凭据或未公开渲染图。
+
+当行为危害参与者、项目或保密工作时，维护者可以编辑或删除内容、结束讨论或限制
+参与。严重的平台滥用行为也可以通过 GitHub 的举报工具报告。

package/CONTRIBUTING.md

@@ -2,44 +2,93 @@
 
 ## English
 
-Contributions are welcome.
+Contributions are welcome from designers, developers, technical artists, and
+testers. Useful contributions include:
 
-Useful areas:
+- Testing a clean installation or another KeyShot release.
+- Reproducing a workflow problem with generated or non-confidential assets.
+- Improving designer-facing instructions and MCP client examples.
+- Adding focused wrappers for documented KeyShot `lux` APIs.
+- Improving tests, diagnostics, security, or release reliability.
 
-- Test with more KeyShot versions.
-- Improve compatibility with macOS and Linux paths.
-- Add examples for Claude Desktop, Codex, and other MCP clients.
-- Add more precise wrappers for KeyShot `lux` APIs.
+Start with a GitHub Discussion for usage questions. Open an Issue before a large
+implementation so the workflow, KeyShot API availability, compatibility, and safety
+expectations can be agreed first.
 
-Before opening a pull request:
+### Development setup
+
+Requirements: Node.js 20 or newer, pnpm 10, and Python 3.11 or newer.
 
 ```bash
-npm install
-npm run build
-npm run status
+pnpm install --frozen-lockfile
+pnpm run check
+pnpm test
+python -m unittest discover -s tests -p "test_*.py"
+pnpm run format:check
+python -m ruff check scripts tests
+pnpm run docs:tools:check
+node scripts/check-release.mjs
+npm pack --dry-run
 ```
 
-Do not include proprietary KeyShot scenes, license data, customer assets, or private render outputs in issues or pull requests.
+Run `pnpm run smoke:keyshot` only on a computer with a supported, licensed KeyShot
+installation. Record the KeyShot version and operating system in the pull request.
+CI on Linux validates the MCP and bridge logic; it does not verify KeyShot itself.
+
+### Pull requests
 
----
+- Keep changes focused and preserve existing tool names and inputs unless a breaking
+  change has been discussed.
+- Update tests, generated tool documentation, README, Skill, and changelog when the
+  public interface changes.
+- Use generated or clearly redistributable test assets.
+- Explain real KeyShot validation when behavior depends on the `lux` API.
+- Follow the pull request checklist and wait for CI to pass.
+
+Never include proprietary KeyShot scenes, license data, customer assets, credentials,
+private paths, or unpublished renders in Issues, Discussions, commits, or pull requests.
+Report vulnerabilities through GitHub's private security reporting form.
 
 ## 中文
 
-欢迎参与贡献。
+欢迎设计师、开发者、技术美术和测试人员参与。比较有价值的贡献包括：
+
+- 在干净环境或其他 KeyShot 版本上测试安装。
+- 使用项目生成或不保密的素材复现工作流问题。
+- 改进面向设计师的说明和 MCP 客户端示例。
+- 为官方文档公开的 KeyShot `lux` API 增加聚焦的工具封装。
+- 改进测试、诊断、安全和发布可靠性。
 
-比较有价值的方向：
+普通使用问题请先在 GitHub Discussions 讨论。准备较大功能前请先创建 Issue，确认
+工作流、KeyShot API 可用性、兼容范围和安全要求。
 
-- 测试更多 KeyShot 版本。
-- 改进 macOS 和 Linux 路径兼容。
-- 增加 Claude Desktop、Codex 和其他 MCP 客户端示例。
-- 为 KeyShot `lux` API 增加更精确的封装。
+### 开发环境
 
-提交修改前建议先运行：
+需要 Node.js 20 或更高版本、pnpm 10，以及 Python 3.11 或更高版本。
 
 ```bash
-npm install
-npm run build
-npm run status
+pnpm install --frozen-lockfile
+pnpm run check
+pnpm test
+python -m unittest discover -s tests -p "test_*.py"
+pnpm run format:check
+python -m ruff check scripts tests
+pnpm run docs:tools:check
+node scripts/check-release.mjs
+npm pack --dry-run
 ```
 
-请不要在 issue 或 pull request 里上传专有 KeyShot 场景、许可证数据、客户资产或私人渲染结果。
+只有在本机已安装并合法授权 KeyShot 时才运行 `pnpm run smoke:keyshot`，并在 PR 中
+注明操作系统和 KeyShot 版本。Linux CI 只验证 MCP 与 Bridge 逻辑，不代表已经实测
+KeyShot。
+
+### Pull Request
+
+- 保持改动聚焦；除非已讨论破坏性变更，否则保留现有工具名称和输入兼容性。
+- 公共接口变化时同步测试、自动生成工具文档、README、Skill 和 Changelog。
+- 只使用项目生成或明确允许再分发的测试素材。
+- 依赖 `lux` 行为的改动需要说明真实 KeyShot 验证结果。
+- 完成 PR 检查项并等待 CI 通过。
+
+不要在 Issue、Discussion、提交或 PR 中包含专有 KeyShot 场景、许可证数据、客户资产、
+账号凭据、私人路径或未公开渲染图。安全漏洞请通过 GitHub 私密安全报告提交。

package/README.md

@@ -71,9 +71,9 @@ The easiest setup is to send this prompt to an agent that can edit your MCP
 configuration:
 
 ```text
-Install KeyShot MCP 0.11.0 and configure it in my MCP client.
+Install KeyShot MCP 0.12.0 and configure it in my MCP client.
 
-1. Use: npx -y keyshot-mcp@0.11.0
+1. Use: npx -y keyshot-mcp@0.12.0
 2. Find my local keyshot_headless.exe and set KEYSHOT_HEADLESS_EXE to its full path.
 3. Keep outputs in the default KeyShot MCP Outputs folder unless I choose another safe folder.
 4. Keep KEYSHOT_ALLOW_EXTERNAL_OUTPUTS disabled.
@@ -133,7 +133,7 @@ folder, show me a preview, and do not overwrite the original scene.
 
 ### Install
 
-The current release is `0.11.0`.
+The current release is `0.12.0`.
 
 #### Run with npx
 
@@ -144,7 +144,7 @@ No global npm installation is required:
   "mcpServers": {
     "keyshot": {
       "command": "npx",
-      "args": ["-y", "keyshot-mcp@0.11.0"],
+      "args": ["-y", "keyshot-mcp@0.12.0"],
       "env": {
         "KEYSHOT_HEADLESS_EXE": "C:/Program Files/KeyShot Studio/bin/keyshot_headless.exe"
       }
@@ -156,7 +156,7 @@ No global npm installation is required:
 #### Install globally
 
 ```bash
-npm install -g keyshot-mcp@0.11.0
+npm install -g keyshot-mcp@0.12.0
 ```
 
 ```json
@@ -334,10 +334,14 @@ directory. A representative result is included below:
 ### Development
 
 ```bash
-pnpm install
-pnpm check
+pnpm install --frozen-lockfile
+pnpm run check
 pnpm test
 python -m unittest discover -s tests -p "test_*.py"
+pnpm run format:check
+python -m ruff check scripts tests
+pnpm run docs:tools:check
+node scripts/check-release.mjs
 npm pack --dry-run
 ```
 
@@ -345,6 +349,21 @@ CI runs on Windows and Ubuntu with Node.js 20 and 24. Linux CI validates the MCP
 server, bridge logic, metadata, and package; it does not claim that KeyShot itself
 was tested on Linux.
 
+### Community and support
+
+- Ask installation and usage questions in
+  [GitHub Discussions](https://github.com/truman-t3/keyshot-mcp/discussions).
+- Use the structured [Bug report](https://github.com/truman-t3/keyshot-mcp/issues/new?template=bug-report.yml)
+  or [Feature request](https://github.com/truman-t3/keyshot-mcp/issues/new?template=feature-request.yml)
+  forms for actionable project work.
+- Report vulnerabilities through
+  [private vulnerability reporting](https://github.com/truman-t3/keyshot-mcp/security/advisories/new).
+- Read [SUPPORT.md](SUPPORT.md), [CONTRIBUTING.md](CONTRIBUTING.md), and
+  [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md) before sharing diagnostics or contributing.
+
+Never attach customer scenes, proprietary models, license information, credentials,
+or confidential renders to a public post.
+
 ### Roadmap
 
 - Verify additional supported KeyShot releases on real installations.
@@ -390,9 +409,9 @@ KeyShot MCP 在本机处理 KeyShot 文件；但 MCP 客户端可能会把工具
 最简单的安装方式，是把下面这段话发给能够修改 MCP 配置的 Agent：
 
 ```text
-请安装 KeyShot MCP 0.11.0，并配置到我的 MCP 客户端。
+请安装 KeyShot MCP 0.12.0，并配置到我的 MCP 客户端。
 
-1. 使用：npx -y keyshot-mcp@0.11.0
+1. 使用：npx -y keyshot-mcp@0.12.0
 2. 查找本机 keyshot_headless.exe，并把完整路径设置为 KEYSHOT_HEADLESS_EXE。
 3. 默认把结果保存在“文档/KeyShot MCP Outputs”，除非我明确选择其他安全目录。
 4. 保持 KEYSHOT_ALLOW_EXTERNAL_OUTPUTS 关闭。
@@ -445,7 +464,7 @@ KeyShot MCP 在本机处理 KeyShot 文件；但 MCP 客户端可能会把工具
 
 ### 安装
 
-当前正式版本为 `0.11.0`。
+当前正式版本为 `0.12.0`。
 
 #### 使用 npx 免安装运行
 
@@ -454,7 +473,7 @@ KeyShot MCP 在本机处理 KeyShot 文件；但 MCP 客户端可能会把工具
   "mcpServers": {
     "keyshot": {
       "command": "npx",
-      "args": ["-y", "keyshot-mcp@0.11.0"],
+      "args": ["-y", "keyshot-mcp@0.12.0"],
       "env": {
         "KEYSHOT_HEADLESS_EXE": "C:/Program Files/KeyShot Studio/bin/keyshot_headless.exe"
       }
@@ -466,7 +485,7 @@ KeyShot MCP 在本机处理 KeyShot 文件；但 MCP 客户端可能会把工具
 #### 全局安装
 
 ```bash
-npm install -g keyshot-mcp@0.11.0
+npm install -g keyshot-mcp@0.12.0
 ```
 
 ```json
@@ -631,16 +650,31 @@ npm run smoke:keyshot
 ### 开发与测试
 
 ```bash
-pnpm install
-pnpm check
+pnpm install --frozen-lockfile
+pnpm run check
 pnpm test
 python -m unittest discover -s tests -p "test_*.py"
+pnpm run format:check
+python -m ruff check scripts tests
+pnpm run docs:tools:check
+node scripts/check-release.mjs
 npm pack --dry-run
 ```
 
 CI 在 Windows 和 Ubuntu 上使用 Node.js 20、24。Linux CI 验证 MCP 服务、bridge、
 元数据和 npm 包，不表示 KeyShot 软件已经在 Linux 上通过实机测试。
 
+### 社区与支持
+
+- 安装和使用问题请在 [GitHub Discussions](https://github.com/truman-t3/keyshot-mcp/discussions) 提问。
+- 可以复现的问题使用 [Bug 报告](https://github.com/truman-t3/keyshot-mcp/issues/new?template=bug-report.yml)，
+  工作流建议使用 [功能建议](https://github.com/truman-t3/keyshot-mcp/issues/new?template=feature-request.yml)。
+- 安全漏洞通过 [私密安全报告](https://github.com/truman-t3/keyshot-mcp/security/advisories/new) 提交。
+- 公开诊断信息或参与贡献前，请阅读 [SUPPORT.md](SUPPORT.md)、
+  [CONTRIBUTING.md](CONTRIBUTING.md) 和 [CODE_OF_CONDUCT.md](CODE_OF_CONDUCT.md)。
+
+不要在公开内容中附加客户场景、专有模型、许可证信息、账号凭据或保密渲染图。
+
 ### 路线图
 
 - 在更多受支持的 KeyShot 正式版本上完成实机验证。

package/SECURITY.md

@@ -30,8 +30,10 @@ execution.
 
 ### Reporting issues
 
-Report vulnerabilities through a private GitHub security advisory before posting
-technical details publicly.
+Report vulnerabilities through the repository's
+[private vulnerability form](https://github.com/truman-t3/keyshot-mcp/security/advisories/new)
+before posting technical details publicly. Include the affected version, impact,
+reproduction steps, and a safe proof of concept that contains no private assets.
 
 ---
 
@@ -60,4 +62,7 @@ KeyShot MCP 本身不会上传文件、运行远程服务或收集遥测数据
 
 ### 报告安全问题
 
-请先通过 GitHub 私密安全公告报告漏洞，不要直接公开技术细节。
+请先通过仓库的
+[私密安全报告入口](https://github.com/truman-t3/keyshot-mcp/security/advisories/new)
+报告漏洞，不要直接公开技术细节。请说明受影响版本、影响、复现步骤，并确保验证材料
+不包含私人资产。

package/SUPPORT.md

@@ -0,0 +1,28 @@
+# Support / 支持
+
+## English
+
+Use the channel that matches the request:
+
+- Installation and usage questions: [GitHub Discussions](https://github.com/truman-t3/keyshot-mcp/discussions)
+- Reproducible bugs: [Bug report](https://github.com/truman-t3/keyshot-mcp/issues/new?template=bug-report.yml)
+- Workflow proposals: [Feature request](https://github.com/truman-t3/keyshot-mcp/issues/new?template=feature-request.yml)
+- Vulnerabilities: [Private security report](https://github.com/truman-t3/keyshot-mcp/security/advisories/new)
+
+Before posting, run `keyshot_status` and remove license credentials, tokens,
+customer names, private paths, scene files, models, and confidential renders.
+Support is provided by the community on a best-effort basis. KeyShot product,
+license, or account support must be requested from KeyShot.
+
+## 中文
+
+请根据问题选择对应入口：
+
+- 安装和使用问题：[GitHub Discussions](https://github.com/truman-t3/keyshot-mcp/discussions)
+- 可以复现的 Bug：[Bug 报告](https://github.com/truman-t3/keyshot-mcp/issues/new?template=bug-report.yml)
+- 工作流建议：[功能建议](https://github.com/truman-t3/keyshot-mcp/issues/new?template=feature-request.yml)
+- 安全漏洞：[私密安全报告](https://github.com/truman-t3/keyshot-mcp/security/advisories/new)
+
+提交前请先运行 `keyshot_status`，并删除许可证、Token、客户名称、私人路径、
+场景文件、模型和保密渲染图。社区维护者会尽力提供支持；KeyShot 软件、许可证
+或账号问题需要联系 KeyShot 官方支持。

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.11.0";
+export const VERSION = "0.12.0";