polish: ship-ready repo chrome, rewrite README, add wiki + social preview

README: replaced three prose-heavy sections with conversation-contrast code
block, before/after table, and a mermaid topology. Added mandatory Limitations
and vs-raw-ssh comparison sections. Removed banned marketing phrase.

CHANGELOG: wrote [3.2.2] section from git history covering the host-key MITM
fix, cwd shell-injection fix, SFTP/exec/sftp/forwardOut/shell passthrough
fixes, 13 aligned tool schemas, and CI upgrades. Split prior work into [3.2.1].

Repo chrome: SECURITY.md with private disclosure flow and hardening checklist,
CODEOWNERS gating security-sensitive paths, dependabot weekly (npm + actions),
codeql.yml with security-extended queries, release.yml triggered on tag push
with changelog extraction and tag-vs-package version guard, YAML issue forms
replacing markdown templates, .editorconfig, .nvmrc.

package.json: description 287->136 chars, keywords 37->8 (deduped search-poisoning
variants).

Wiki: 10 pages (~1050 lines) with mermaid diagrams and GitHub alert callouts.
Covers home, getting-started, configuration, tool reference (51 tools across
7 groups), architecture, security model, recipes (10 real workflows), and
troubleshooting. Staged at /tmp/claude-code-ssh.wiki awaiting GitHub wiki
bootstrap.

Social preview: 1280x640 flat-typography PNG rendered from SVG via rsvg-convert.
Dark charcoal background, single green accent, monospace "claude-code-ssh" with
tagline. Old hero image preserved as assets/repo-image-legacy.png.

Docs: fixed two marksman diagnostics (dead DEPLOYMENT_GUIDE.md link in
BACKUP_GUIDE; ambiguous CLAUDE.md link in TOOL_MANAGEMENT).

CLAUDE.md: corrected 6 -> 7 groups, added gamechanger to group list.

.eslintrc.json: added argsIgnorePattern/varsIgnorePattern/caughtErrorsIgnorePattern
for the "^_" convention, removing six spurious warnings in plan-tools.js.

Author: hunchom

.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab
+
+[*.{sh,bash}]
+indent_size = 2

.eslintrc.json

@@ -13,7 +13,7 @@
     "linebreak-style": ["error", "unix"],
     "quotes": ["error", "single"],
     "semi": ["error", "always"],
-    "no-unused-vars": ["warn"],
+    "no-unused-vars": ["warn", { "argsIgnorePattern": "^_", "varsIgnorePattern": "^_", "caughtErrorsIgnorePattern": "^_" }],
     "no-console": ["warn", { "allow": ["warn", "error"] }],
     "no-trailing-spaces": ["error"],
     "eol-last": ["error", "always"],

.github/CODEOWNERS

@@ -0,0 +1,9 @@
+# Default: all files reviewed by the repo owner.
+*   @hunchom
+
+# Security-sensitive paths — require owner review explicitly.
+/src/stream-exec.js         @hunchom
+/src/tools/exec-tools.js    @hunchom
+/src/tools/db-tools.js      @hunchom
+/SECURITY.md                @hunchom
+/.github/workflows/         @hunchom

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,88 @@
+name: Bug report
+description: Something broken in claude-code-ssh
+labels: [bug]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting. Please include enough detail that a maintainer can reproduce without asking follow-ups.
+
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: Output of `node -p "require('./package.json').version"` or `ssh-manager --version`
+      placeholder: 3.2.2
+    validations:
+      required: true
+
+  - type: dropdown
+    id: client
+    attributes:
+      label: MCP client
+      options:
+        - Claude Code
+        - OpenAI Codex
+        - Other (explain below)
+    validations:
+      required: true
+
+  - type: input
+    id: node
+    attributes:
+      label: Node version
+      placeholder: v20.11.0
+    validations:
+      required: true
+
+  - type: input
+    id: os
+    attributes:
+      label: Operating system
+      placeholder: macOS 15.2, Ubuntu 24.04, ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened
+      description: Describe the actual behavior. Include the tool name if you know it.
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected
+    attributes:
+      label: What should have happened
+    validations:
+      required: true
+
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: How to reproduce
+      description: Minimal steps. If a specific SSH host setup matters (proxy_jump, Windows platform, etc.), include that.
+      placeholder: |
+        1. Configure server with `SSH_SERVER_X_PROXYJUMP=bastion`
+        2. Ask Claude to `ssh_execute` with cwd `/tmp`
+        3. Tool returns error ...
+    validations:
+      required: true
+
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Paste output from `~/.ssh-manager.log` or MCP stderr. Run with `SSH_LOG_LEVEL=DEBUG` if you can.
+      render: shell
+
+  - type: checkboxes
+    id: checked
+    attributes:
+      label: Pre-flight
+      options:
+        - label: I searched existing issues and this is not a duplicate
+          required: true
+        - label: I redacted any credentials, hostnames, or paths from logs above
+          required: true

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/hunchom/claude-code-ssh/security/advisories/new
+    about: Report privately via GitHub Security Advisories. Do not open a public issue for security bugs.
+  - name: Question or discussion
+    url: https://github.com/hunchom/claude-code-ssh/discussions
+    about: Usage questions, setup help, design discussion.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,51 @@
+name: Feature request
+description: Something claude-code-ssh should do that it doesn't
+labels: [enhancement]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Good feature requests describe a real workflow that's painful today and the outcome you want, not a specific implementation.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: The problem
+      description: What's the workflow you're trying to do, and where does it break down?
+    validations:
+      required: true
+
+  - type: textarea
+    id: desired
+    attributes:
+      label: What you'd want Claude to be able to say
+      description: A concrete example of the interaction you'd want.
+      placeholder: |
+        "ssh into prod03, check redis memory, restart if > 8GB"
+    validations:
+      required: true
+
+  - type: textarea
+    id: existing
+    attributes:
+      label: Why existing tools don't cover it
+      description: Did you try a combination of ssh_execute, ssh_service_status, ssh_tail? What was missing?
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives you've considered
+      description: Other tools, workarounds, or designs you looked at.
+
+  - type: dropdown
+    id: scope
+    attributes:
+      label: Where does this belong
+      options:
+        - New tool in an existing group
+        - New tool group
+        - Change to an existing tool's schema/behavior
+        - Docs / examples
+        - Unsure
+    validations:
+      required: true

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,32 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      production:
+        dependency-type: production
+        update-types: [minor, patch]
+      development:
+        dependency-type: development
+        update-types: [minor, patch]
+    labels: [dependencies]
+    commit-message:
+      prefix: "deps"
+      include: scope
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 3
+    groups:
+      actions:
+        patterns: ["*"]
+    labels: [dependencies, ci]
+    commit-message:
+      prefix: "ci"

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,32 @@
+name: codeql
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: analyze
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript]
+    steps:
+      - uses: actions/checkout@v5
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended,security-and-quality
+      - uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"