chore(packaging): update .vscodeignore and add CSP to sidebar webview

.vscodeignore

@@ -2,4 +2,8 @@
 node_modules/**
 *.vsix
 CONTRIBUTING.md
+CODE_OF_CONDUCT.md
 .gitignore
+.github/**
+scripts/**
+tests/**

CHANGELOG.md

@@ -20,6 +20,7 @@ Format based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 - Dispose previous Sidebar webview message listener on view reopen to prevent memory leaks (Fixes #30).
 - Add configurable Weekend Streak Protection (codecritter.weekendStreakProtection) to protect streaks over Saturday and Sunday (Fixes #31).
 - Clean up corrupted Unicode Mojibake artifacts in media/sidebar.html (Fixes #28).
+- Update .vscodeignore to exclude internal scripts/tests/CI and add Content-Security-Policy to sidebar webview (Fixes #29).
 
 ---
 

media/sidebar.html

@@ -3,6 +3,7 @@
 <head>
 <meta charset="UTF-8">
 <meta name="viewport" content="width=device-width, initial-scale=1.0">
+<meta http-equiv="Content-Security-Policy" content="default-src 'none'; style-src 'unsafe-inline'; script-src 'unsafe-inline';">
 <style>
   :root {
     --pet-body:      __THEME_BODY__;

tests/sidebar.test.js

@@ -112,3 +112,19 @@ test('Issue #28: media/sidebar.html renders clean UTF-8 emojis without Mojibake
   assert.equal(sidebarHtml.includes('dY"S'), false, 'must not contain Mojibake dY"S');
   assert.equal(sidebarHtml.includes('📊 Full Dashboard'), true, 'must render standard 📊 Full Dashboard button');
 });
+
+test('Issue #29: media/sidebar.html includes strict Content-Security-Policy meta tag', () => {
+  const sidebarHtml = fs.readFileSync(path.join(__dirname, '..', 'media', 'sidebar.html'), 'utf8');
+  assert.match(
+    sidebarHtml,
+    /<meta\s+http-equiv=["']Content-Security-Policy["']/i,
+    'sidebar.html must define a Content-Security-Policy'
+  );
+});
+
+test('Issue #29: .vscodeignore excludes internal scripts, tests, and CI workflows', () => {
+  const vscodeignore = fs.readFileSync(path.join(__dirname, '..', '.vscodeignore'), 'utf8');
+  assert.ok(vscodeignore.includes('scripts/**'), '.vscodeignore must exclude scripts/**');
+  assert.ok(vscodeignore.includes('.github/**'), '.vscodeignore must exclude .github/**');
+  assert.ok(vscodeignore.includes('tests/**'), '.vscodeignore must exclude tests/**');
+});