🌐 Add Korean README and improve onboarding

[nbsp1221]

Summary

• Add a Korean README alongside the canonical English README and include both in the published npm package.
• Rework the README as a user-facing landing page: explain the project briefly, keep the quick start complete, show the core workflow, and leave implementation and lifecycle details to the existing architecture and security docs.
• Keep practical CLI, configuration, security, and troubleshooting notes without duplicating internal design details.

Verification

• pnpm check — passed from a clean Node.js 24 environment, including format, lint, typecheck, 72 unit/integration tests, and build.
• pnpm test:e2e — not run because this change only updates documentation and package file inclusion; it does not change sandbox runtime behavior.
• pnpm pack — verified that both README.md and README.ko.md are included in the package tarball.
• git diff --check — passed.

Notes

• README.md remains the canonical English documentation; README.ko.md mirrors the same user-facing structure in Korean.
• No new documentation site or getting-started document is added. Detailed runtime behavior remains in docs/architecture.md and security policy remains in SECURITY.md.
• No runtime code or sandbox behavior changes are included.
• README links to repository-only documentation remain relative by design; those maintainer docs are not added to the npm tarball solely for local node_modules browsing.

[leverframe]

Leverframe review

🟡 Incremental review completed in 366s

• 0 new findings
• 2 existing findings remain unresolved
• 2 of 2 changed files reviewed
• Verification: 5 passed

Changes e4eb6db..4de1176 · Commit 4de1176 · View check run

[leverframe]

Leverframe review

One low-severity packaging defect found. Review used the CI-aligned Node.js 24.20.0 environment and exact declared pnpm 11.23.0. Repository checks otherwise passed apart from two IPv6 tests that fail identically at the base SHA.

Findings

1 finding was published inline.

Checks

6 passed · 3 failed · 0 not run

Show 9 checks

Status	Check	Evidence
🟢 passed	node --version && pnpm --version	Node.js v24.20.0 and pnpm 11.23.0; these match CI's Node 24 and exact pnpm declaration.
🟢 passed	pnpm install --frozen-lockfile	Lockfile installation and supply-chain policy verification succeeded.
🟢 passed	git diff --check 2cc958a7df1535022702c349fd06765dd655b793...0fcfa16d9e26c8eeabf9544c8934f755869e363d	No whitespace errors.
🔴 failed	pnpm check	Formatting, linting, and typechecking passed; 70 tests passed and two IPv6 ::1 integration tests failed before the chained build stage.
🔴 failed	focused base-SHA run of test/integration/status.test.ts and test/integration/cli.test.ts	The identical two IPv6 failures reproduce at base SHA 2cc958a, so they were not introduced by this PR.
🟢 passed	pnpm build	tsdown 0.22.14 successfully produced the Node 24 bundle.
🟢 passed	pnpm pack --dry-run --json	Confirmed README.ko.md is included in the published package.
🔴 failed	pack, extract, and resolve README.ko.md relative links	Five linked targets were absent from the generated package: CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md, docs/architecture.md, and test/README.md.
🟢 passed	fetch current Secure MCP Tunnel and Docker Sandboxes documentation	Authoritative documentation confirmed the tunnel variables, key source, connector workflow, permission model, and referenced sbx diagnostic commands.

Limitations

• The sbx executable and Docker Sandbox service were unavailable, so real E2E tests were not run; the PR changes no sandbox runtime code.

• Authenticated ChatGPT and OpenAI Platform screens were not available. Their onboarding contracts were checked against current official OpenAI documentation and the linked tunnel-client guide instead.

[leverframe]

🔵 [LOW] Packaged Korean README links to files absent from the package

The PR exposes README.ko.md from the English README and explicitly adds it to the npm package. After installation, this Architecture link resolves to node_modules/chat2sbx/docs/architecture.md, which is absent. The same problem affects its Security, Contributing, Tests, and Code of Conduct links, making substantial parts of the packaged Korean documentation unreachable.

Evidence: Packing and extracting chat2sbx-0.2.0 confirmed README.ko.md is present while docs/architecture.md, SECURITY.md, CONTRIBUTING.md, test/README.md, and CODE_OF_CONDUCT.md are missing.

Suggested action: Use absolute repository URLs for references not shipped in the npm package, or include all referenced documents in package.json#files.

Confidence: high

[nbsp1221]

Leaving this unchanged intentionally after checking current ecosystem behavior. GitHub recommends relative links for repository files because they keep working across branches, forks, and clones, and current npmjs.com rendering handles relative README links. The package keeps the user-facing READMEs but does not ship contributor, architecture, or test documentation solely to make local node_modules browsing self-contained. We can revisit this if the published npm page itself shows broken links.

[leverframe]

Leverframe review

Found one new medium-severity onboarding defect. Reviewed both changed READMEs using Node.js 24.20.0 and the repository-pinned pnpm 11.23.0, plus the current official sbx 0.42.1 CLI contract.

Findings

🟡 [MEDIUM] Initialize the network policy before running setup

README.md:42 · confidence: high

The fresh-install sequence runs chat2sbx setup before telling users to initialize Docker Sandboxes' network policy. When the template is absent, setup invokes sbx create; the current supported sbx CLI states that sbx policy init must run before starting the first sandbox. This prevents the documented sequence from completing on a fresh headless/non-interactive host, precisely where the following paragraph acknowledges initialization may be needed.

Evidence: README lines 39–43 order sbx login immediately followed by chat2sbx setup, while initialization is first mentioned on line 45. src/cli/setup.ts invokes sbx create to create a missing template. Official sbx 0.42.1 policy init --help says the command “must be run before ... starting a sandbox for the first time.”

Suggested action: Place sbx policy init balanced (or an explicit instruction to choose another policy) before chat2sbx setup in both English and Korean quick starts.

Checks

8 passed · 1 failed · 1 not run

Show 10 checks

Status	Check	Evidence
🟢 passed	node --version; pnpm --version; sbx version	Selected versions: Node.js v24.20.0, repository-pinned pnpm 11.23.0, and downloaded official sbx v0.42.1 for CLI-contract inspection.
🟢 passed	pnpm format:check	All 64 matched files passed formatting checks.
🟢 passed	pnpm test:unit	5 files and 14 tests passed.
🔴 failed	pnpm test:integration	Initial run had two IPv6-loopback failures because this environment set NODE_USE_ENV_PROXY=1; this was environmental and unrelated to the documentation diff.
🟢 passed	env -u HTTP_PROXY -u HTTPS_PROXY -u ALL_PROXY -u http_proxy -u https_proxy -u all_proxy NODE_USE_ENV_PROXY=0 pnpm test:integration	All 8 files and 58 integration tests passed with proxy handling disabled for loopback.
🟢 passed	pnpm lint; pnpm typecheck; pnpm build	Oxlint/ESLint and TypeScript completed successfully; tsdown produced the Node 24 bundle.
🟢 passed	pnpm pack --pack-destination <temporary-directory>	Built chat2sbx-0.2.0 package and inspected its exact file list.
🟢 passed	Repository-relative target scan and HTTP checks for README.md and README.ko.md	Every relative target exists in the checkout. Changed OpenAI and Docker documentation URLs returned HTTP 200; npmjs returned an automation-specific HTTP 403.
🟢 passed	sbx v0.42.1 policy init --help	Confirmed policy initialization is a one-time prerequisite before starting the first sandbox.
⚪ not run	pnpm test:e2e	The diff is documentation-only, and this host has no authenticated, KVM-ready Docker Sandboxes runtime.

Limitations

• An actual first-sandbox creation was unavailable because the environment lacked an authenticated Docker Sandboxes runtime; the command-order failure was verified against setup's implementation, current Docker documentation, and the official sbx 0.42.1 CLI contract.