docs: add contributing, security, and code of conduct guides

CODE_OF_CONDUCT.md

@@ -0,0 +1,26 @@
+# Code of Conduct / 行为准则
+
+## Our pledge / 我们的承诺
+
+We are committed to providing a friendly, safe, and welcoming environment for all, regardless of level of experience, gender identity and expression, sexual orientation, disability, personal appearance, body size, race, ethnicity, age, religion, or nationality. / 我们致力于为所有人提供友好、安全、受欢迎的环境，无论经验水平、性别认同与表达、性取向、残障、外貌、体型、种族、民族、年龄、宗教或国籍。
+
+## Our standards / 我们的标准
+
+Examples of behavior that contributes to a positive environment: / 有助于营造积极环境的行为包括：
+
+- Using welcoming and inclusive language / 使用友善和包容的语言
+- Being respectful of differing viewpoints and experiences / 尊重不同的观点和经验
+- Gracefully accepting constructive criticism / 优雅地接受建设性批评
+- Focusing on what is best for the community / 以社区利益为重
+
+Examples of unacceptable behavior: / 不可接受的行为包括：
+
+- Harassment, trolling, or discriminatory comments / 骚扰、挑衅或歧视性言论
+- Publishing others' private information without consent / 未经同意公开他人隐私信息
+- Other conduct reasonably considered inappropriate in a professional setting / 其他在专业场合被认为不当的行为
+
+## Enforcement / 执行
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the maintainer via GitHub ([@kittimzhe](https://github.com/kittimzhe)). All complaints will be reviewed and investigated. / 滥用、骚扰或其他不可接受的行为可通过 GitHub（[@kittimzhe](https://github.com/kittimzhe)）联系维护者举报。所有举报都会被审查与调查。
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org) version 2.1. / 本行为准则改编自 [Contributor Covenant](https://www.contributor-covenant.org) 2.1 版。

CONTRIBUTING.md

@@ -0,0 +1,31 @@
+# Contributing / 贡献指南
+
+Thanks for your interest in improving `dsh-session-export`! / 感谢你对 `dsh-session-export` 的贡献兴趣！
+
+## Reporting issues / 提交 issue
+
+1. Search existing issues first — avoid duplicates. / 先搜索已有 issue，避免重复。
+2. Include: plugin version (`npm ls dsh-session-export`), DSH version, Node version (20/22), and a minimal reproduction. / 请附上：插件版本、DSH 版本、Node 版本（20/22）与最小复现步骤。
+3. For security vulnerabilities, do **not** open a public issue — see [SECURITY.md](SECURITY.md). / 安全漏洞请勿开公开 issue，见 [SECURITY.md](SECURITY.md)。
+
+## Pull requests / PR 规范
+
+- One PR per concern; keep the diff reviewable. / 一个 PR 只做一件事，保持可审阅的 diff。
+- Conventional commit titles (`feat:` / `fix:` / `docs:` / `chore:` / `test:` / `ci:`). / 使用约定式提交前缀。
+- Behavior changes require tests; docs changes require no test but must update **both** `README.md` and `README.zh.md` in sync. / 行为变更必须带测试；文档变更无需测试，但 `README.md` 与 `README.zh.md` 必须同步修改。
+- CI (Node 20/22) must be green before review. / 合入前 CI（Node 20/22）必须全绿。
+
+## Development setup / 开发环境
+
+```bash
+npm ci
+npm run typecheck   # tsc --noEmit
+npm test            # vitest run
+npm run bundle      # tsdown -> lib/
+```
+
+Releases are cut by the maintainer (version bump + tag + GitHub Release + `npm publish`). / 版本发布由维护者执行（版本号 + tag + GitHub Release + `npm publish`）。
+
+## License / 许可
+
+By contributing, you agree your contributions are licensed under the [MIT License](LICENSE). / 提交贡献即表示你同意贡献内容以 [MIT 许可](LICENSE)发布。

README.md

@@ -184,3 +184,7 @@ ln -s ../dsh-session-recall/node_modules/@deepseek-ai/dsh-tools node_modules/@de
 ## License
 
 MIT
+
+## Community
+
+- [Contributing](CONTRIBUTING.md) · [Security policy](SECURITY.md) · [Code of Conduct](CODE_OF_CONDUCT.md)

README.zh.md

@@ -178,3 +178,7 @@ ln -s ../dsh-session-recall/node_modules/@deepseek-ai/dsh-tools node_modules/@de
 ## 许可
 
 MIT
+
+## 社区
+
+- [贡献指南](CONTRIBUTING.md) · [安全策略](SECURITY.md) · [行为准则](CODE_OF_CONDUCT.md)

SECURITY.md

@@ -0,0 +1,19 @@
+# Security Policy / 安全策略
+
+## Supported versions / 支持版本
+
+Only the latest published release is supported. / 仅支持最新发布版本。
+
+## Reporting a vulnerability / 报告漏洞
+
+**Do not open a public issue for security problems. / 请勿为安全问题创建公开 issue。**
+
+Please use GitHub's private vulnerability reporting: **Security tab → "Report a vulnerability"**. / 请使用 GitHub 私密漏洞报告：仓库 **Security 标签页 → "Report a vulnerability"**。
+
+- Include: affected version, impact, reproduction steps, and any mitigations. / 请包含：受影响版本、影响范围、复现步骤与缓解措施。
+- You will receive an acknowledgement within 72 hours. / 我们将在 72 小时内确认收到。
+- Please avoid public disclosure until a fix is released. / 在修复发布前请勿公开披露。
+
+## Scope / 范围
+
+Vulnerabilities in this plugin's code and configuration handling are in scope; vulnerabilities in DSH itself or in dependencies should be reported to their upstream projects. / 本插件代码与配置处理中的漏洞属于受理范围；DSH 本体或依赖库的漏洞请报告其上游项目。