📝 Improve public repository readiness

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,59 @@
+name: Bug report
+description: Report a reproducible problem in chat2shell
+title: '[Bug]: '
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting a bug. Please remove credentials, tokens, private paths, and other sensitive data from logs or examples.
+        For security vulnerabilities, follow https://github.com/nbsp1221/chat2shell/blob/main/SECURITY.md instead of opening a public issue.
+  - type: textarea
+    id: problem
+    attributes:
+      label: What happened?
+      description: Describe the behavior you observed and why it is a problem.
+      placeholder: A clear, concise description of the bug.
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Reproduction
+      description: Provide the smallest sequence of commands or MCP calls that reproduces the issue.
+      placeholder: |
+        1. Run ...
+        2. Call ...
+        3. Observe ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What did you expect to happen?
+    validations:
+      required: true
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Include the relevant versions. Use `not applicable` where needed.
+      value: |
+        - OS:
+        - Node.js:
+        - pnpm:
+        - Docker Sandboxes (`sbx`):
+        - chat2shell commit/version:
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Relevant logs or output
+      description: Optional. Redact credentials, tokens, private paths, and other sensitive values before posting.
+      render: shell
+  - type: textarea
+    id: additional
+    attributes:
+      label: Additional context
+      description: Anything else that would help reproduce or understand the issue.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: true

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,34 @@
+name: Feature request
+description: Propose a concrete improvement to chat2shell
+title: '[Feature]: '
+body:
+  - type: markdown
+    attributes:
+      value: |
+        chat2shell intentionally keeps its scope small. Start with the problem and workflow rather than a preferred implementation.
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What workflow is difficult or impossible today?
+      placeholder: Describe the user problem and when it occurs.
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed outcome
+      description: What should become possible? Implementation details are optional.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: What can you do today, and why is it insufficient?
+  - type: textarea
+    id: scope
+    attributes:
+      label: Scope and boundary impact
+      description: Does this change host access, sandbox authority, persistence, networking, authentication, or the public MCP contract?
+      placeholder: No boundary impact / explain the affected boundary.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,13 @@
+## Summary
+
+- What problem does this change solve?
+- What behavior or implementation changed?
+
+## Verification
+
+- [ ] `pnpm check`
+- [ ] `pnpm test:e2e` when the change crosses the real sandbox boundary
+
+## Notes
+
+Describe any security, lifecycle, compatibility, or rollout considerations that reviewers should know. Remove this section when it is not relevant.

CODE_OF_CONDUCT.md

@@ -0,0 +1,19 @@
+# Code of Conduct
+
+chat2shell aims to be a useful, technically rigorous, and welcoming open-source project.
+
+## Expected behavior
+
+When participating in issues, pull requests, reviews, or discussions:
+
+- be respectful and assume good intent;
+- critique ideas and code rather than people;
+- provide enough technical context for others to understand a claim;
+- accept that maintainers may decline work that does not fit the project's scope;
+- avoid harassment, discrimination, threats, or deliberate disruption.
+
+## Project moderation
+
+Maintainers may edit, hide, lock, or remove contributions that violate these expectations, and may restrict participation when behavior repeatedly disrupts the project.
+
+For sensitive conduct concerns, avoid posting personal details publicly. Use a private GitHub communication channel when one is available, or open a minimal issue asking the maintainer for a private contact path without including sensitive details.

CONTRIBUTING.md

@@ -0,0 +1,75 @@
+# Contributing to chat2shell
+
+Thanks for taking the time to contribute.
+
+chat2shell is intentionally small and security-sensitive. Prefer focused changes that solve a concrete problem without expanding the execution boundary unnecessarily.
+
+## Before you start
+
+- Use the bug report template for reproducible defects.
+- Use the feature request template to explain the problem before proposing a large new capability.
+- For substantial behavior or security-boundary changes, open an issue first so the design can be discussed before implementation.
+- Do not report security vulnerabilities in public issues. See [SECURITY.md](./SECURITY.md).
+- Follow the project [Code of Conduct](./CODE_OF_CONDUCT.md) when participating.
+
+## Development setup
+
+Requirements:
+
+- Node.js 24+
+- pnpm 11.23.0
+- Docker Sandboxes (`sbx`) only when running real E2E tests
+
+Install dependencies:
+
+```bash
+pnpm install --frozen-lockfile
+```
+
+Run the normal quality gate:
+
+```bash
+pnpm check
+```
+
+`pnpm check` verifies formatting, linting, TypeScript, unit/integration tests, and the production bundle.
+
+## Tests
+
+The test suite is intentionally separated by boundary:
+
+- `pnpm test:unit` — small code units with no external resources
+- `pnpm test:integration` — multiple chat2shell components using local resources only
+- `pnpm test:e2e` — real Docker Sandbox microVMs, CodexPro, private Docker, and port exposure
+
+Normal CI runs unit and integration tests. Run E2E tests on a trusted host when changing sandbox lifecycle, workspace modes, CodexPro routing, Bash sessions, or port exposure.
+
+See [test/README.md](./test/README.md) for the canonical test taxonomy.
+
+## Pull requests
+
+Keep pull requests small enough to review as one coherent change.
+
+A good pull request should:
+
+1. Explain the user or maintainer problem being solved.
+2. Avoid unrelated refactors.
+3. Add or update tests for behavior changes.
+4. Keep README/architecture/security documentation in sync when public behavior or trust boundaries change.
+5. Pass `pnpm check` before submission.
+
+The repository uses Gitmoji-style subjects in its history. Keep titles concise and describe the aggregate change; maintainers may squash commits when merging.
+
+## Documentation ownership
+
+Avoid duplicating system invariants across documents:
+
+- `README.md` is the user-facing landing page and quick start.
+- `docs/architecture.md` is the canonical technical description of trust boundaries and runtime behavior.
+- `SECURITY.md` defines vulnerability-reporting guidance and security scope.
+- `test/README.md` defines test boundaries.
+- `ROADMAP.md` contains future product direction, not current guarantees.
+
+## Scope discipline
+
+chat2shell deliberately does not try to be a general-purpose orchestrator. New abstractions, background services, persistence layers, or policy systems should have a demonstrated need before they are added.