Fix HTTPS capture uploads and document token setup

CHANGELOG.md

@@ -22,7 +22,22 @@ Changelog
 [Github master](https://github.com/bjones1/CodeChat_Editor)
 -----------------------------------------------------------
 
-* No changes.
+* Fix capture token validation and event upload against HTTPS capture service
+  endpoints by enabling platform certificate verification and proxy support in
+  the Rust HTTP client.
+* Add a capture transport regression test that fails if the Rust HTTP client is
+  built without HTTPS support.
+* Remove the insecure dev portal URL, public class code, token-shape hint, and
+  internal database schema detail from the student capture setup guide, and
+  align the documented capture statuses and log casing with the extension.
+* Resolve cargo-audit failures from vulnerable `webbrowser` and `rkyv`
+  dependency paths, and document the temporary `h2` advisory ignore required
+  until `actix-http` exposes an `h2` 0.4.16+ dependency path.
+* Harden the long-doc-block browser regression test by waiting for the visible
+  TinyMCE editor to become interactable before typing.
+* Add a student-facing CodeChat Capture token setup guide.
+* Document the capture token storage, upload spool, AWS service path, and
+  CaptureWebService-only database boundary.
 
 Version 0.2.1 -- 2026-Jul-26
 ----------------------------

README.md

@@ -33,6 +33,9 @@ Capture** or **CodeChat Editor: Enter Capture Token** from the command palette,
 paste the token, then turn on consent and recording from the same capture
 manager.
 
+For detailed student/tester setup steps, see the
+[CodeChat Capture Token Setup Guide](docs/capture-token-setup-guide.html).
+
 The token is imported through the VS Code UI and persisted only in VS Code
 SecretStorage. It is never written to workspace settings, repository files, or a
 JSON configuration file. The extension asks CaptureWebService for token status;
@@ -60,6 +63,12 @@ again. The capture service endpoint can be changed in the user-level
 for this token-bearing endpoint. Token-bearing requests require HTTPS except for
 localhost development endpoints.
 
+Developer builds must keep the Rust `minreq` dependency compiled with
+`https-rustls-probe` and `proxy` support. Capture HTTPS requests validate with
+the host platform certificate store and honor standard proxy environment
+variables. Without HTTPS support, token validation and event upload to the AWS
+capture service report as unavailable even when the service itself is healthy.
+
 Structure
 ---------
 

builder/src/main.rs

@@ -484,6 +484,9 @@ fn run_format_and_lint(check_only: bool) -> io::Result<()> {
     } else {
         ("", "", "--fix")
     };
+    // RUSTSEC-2026-0258 is h2 0.3.x via actix-http; remove this ignore once
+    // actix-http publishes a compatible release on h2 0.4.16 or newer.
+    let h2_advisory_ignore = "RUSTSEC-2026-0258";
     run_cmd!(
         info "cargo clippy and fmt";
         cargo clippy --all-targets --all-features -- $clippy_check_only;
@@ -502,15 +505,15 @@ fn run_format_and_lint(check_only: bool) -> io::Result<()> {
         cargo fmt --all $check --manifest-path=$TEST_UTILS_PATH/Cargo.toml;
 
         info "cargo audit";
-        cargo audit;
+        cargo audit --ignore $h2_advisory_ignore;
         info "Builder: cargo audit";
-        cargo audit --file=$BUILDER_PATH/Cargo.lock --no-fetch;
+        cargo audit --file=$BUILDER_PATH/Cargo.lock --no-fetch --ignore $h2_advisory_ignore;
         info "VSCode extension: cargo audit";
-        cargo audit --file=$VSCODE_PATH/Cargo.lock --no-fetch;
+        cargo audit --file=$VSCODE_PATH/Cargo.lock --no-fetch --ignore $h2_advisory_ignore;
         info "Standalone: cargo audit";
-        cargo audit --file=$STANDALONE_PATH/Cargo.lock --no-fetch;
+        cargo audit --file=$STANDALONE_PATH/Cargo.lock --no-fetch --ignore $h2_advisory_ignore;
         info "test_utils: cargo audit";
-        cargo audit --file=$TEST_UTILS_PATH/Cargo.lock --no-fetch;
+        cargo audit --file=$TEST_UTILS_PATH/Cargo.lock --no-fetch --ignore $h2_advisory_ignore;
 
         info "cargo sort";
         cargo sort $check;