Security Boundary

What Stylesmith does

• Registers color themes and file icon themes through the extension manifest.
• Uses the diagnostics and editor decoration APIs to display Problem Lens.
• Changes global user settings through VS Code's configuration API and restores managed settings when disabled.
• Stores managed-setting state in its own extension storage.
• Installs a font only when you ask and confirm: the files come from this project’s release, must match a SHA-256 built into Stylesmith, and go to your own font folder, without administrator rights. Fonts are under the SIL Open Font License 1.1 (and the BSD 3-Clause License for 3270) with their licenses saved in Stylesmith’s data, and Stylesmith: Remove Installed Fonts… removes only what Stylesmith installed.
• Does not load workspace-provided or remote CSS or JavaScript, and does not inspect workspace content to choose code to run.
• Bundles optional terminal and Vim add-ons (extras/) as static assets that are copied to your clipboard only when you ask in the menu, and never writes to shell or Vim startup files automatically.

What this boundary means

Stylesmith runs as a local VS Code extension and has the ordinary capabilities granted to extensions. API-only means it does not bypass VS Code's extension model to alter the workbench DOM or installed application files. It is not a guarantee that extension code or its supply chain is risk-free.