opencode-codex-security 0.0.0-stage → 0.1.1

package/docs/MULTI-SCAN.md

@@ -0,0 +1,62 @@
+# Scan runs and session tools
+
+SDK-mode scans use immutable app `runId` values. `scanId` is the SDK identifier and is absent until the SDK supplies it. Every approved preview creates an independent client, cancellation signal, settings snapshot, result set, and SDK-managed output directory. Preparing another scan does not replace running inputs. At most two scans run concurrently per OpenCode project location; no hidden queue starts work later. Deep workers are separate from this two-run limit.
+
+The panel and tools report only observed feedback: phase, file/review counts, bounded activity, optional Deep progress, model-reported worker dispatch, and optional estimated cost. Counts are phase-local, may be unknown, and do not establish a wall-clock ETA. Findings become available at completion. Raw reasoning, command arguments, credential details and raw tool output are not streamed.
+
+Private per-run JSON records under the user's XDG state directory retain scan previews and terminal findings. The list shows the latest 50; files are not silently deleted. Start/terminal receipts, real SDK run IDs and phase changes persist; other live progress is checkpointed at most every 10 seconds. An unfinished record after another plugin instance ends is marked untracked, not completed or automatically resumed. Policy/validation operations currently remain memory-only. Reloading the plugin can cancel active work: finish or explicitly cancel runs before updating it.
+
+## Workspace versus target
+
+The plugin installation and SDK defaults are global. They do not select a repository, combine histories or start work across projects.
+
+- **Workspace** is the local OpenCode session location. RPC calls and scan/operation lists belong to this location. Two sessions in the same location share that workspace history; a different location has its own history.
+- **Target** is the exact repository saved in an immutable scan or operation preview. It defaults to the known current workspace, or can be explicitly set elsewhere. An override does not change global settings or the default for a later request. Same-named directories remain distinct by full path.
+- Scan scope and supporting files are relative to that target. Policy's optional component is also relative to its target. Validation launched from a finding keeps the finding's original repository, rather than silently switching to the current workspace.
+- If no valid local session anchor is known, use an explicit absolute repository path. The backend never substitutes the plugin process's working directory; home folders and parent directories remain prohibited targets. No Git-root guess expands the target.
+- Switching the displayed workspace remounts the view and its polling; it does not move, cancel or restart existing scans. Return to the launching workspace to see them. A workspace history can include explicitly chosen targets elsewhere; this is not a global all-repositories dashboard.
+
+In the TUI, `/security-target` selects an absolute target for the next scan and clears the previous target’s scope/context. `/security-mode` uses that exact prepared target. The TUI history workspace is pinned to its setup location; it does not claim to follow other session tabs automatically. Unknown setup context requires an explicit target. Desktop follows its mounted local session and remounts when that location changes.
+
+Policy and validation operations remain server-session-only. Scan receipts persist under their launching workspace's local history. Model configuration is global; per-scan targets and scope are not configuration overrides.
+
+## Model tools
+
+- `security_prepare_scan`: independent target/context preview; no inference.
+- `security_run_scan`: exact preview, host permission, immutable run ID.
+- `security_list_scans`: recent runs and available previews.
+- `security_scan_status`, `security_scan_activity`, `security_scan_results`: exact run ID; results only claim completion after the SDK completes.
+- `security_cancel_scan`: exact run ID and host permission; cannot cancel another run implicitly.
+- `security_finding_detail`: completed run plus finding ID; excludes raw source evidence.
+- `security_prepare_policy`: repository/component and documentation context.
+- `security_prepare_validation`: a finding from a completed run, without starting inference.
+- `security_start_operation`: exact policy/validation preview with separate native permission.
+- `security_list_operations`, `security_operation_status`: progress, questions and final result.
+- `security_answer_questions`: exact operation/question batch, verified user-authorized facts, native permission. Missing knowledge must be asked about, not invented.
+- `security_cancel_operation`: exact policy/validation operation.
+
+## Supported operations and limits
+
+Policy calls the installed SDK's `generatePolicy`, pauses for owner clarification through its `answerQuestions` callback, and returns an unapplied SECURITY.md draft. No file is automatically overwritten.
+
+Validation calls the installed SDK's `validate` against source and returns a disposition/report. It does not run builds/tests. SDK 0.9.1 provides no validation cost ceiling; the normal scan budget does not apply. The UI and model tool disclose this and require separate authorization.
+
+Patch generation/application and fix verification are not exposed. They need a separate isolated-workspace design.
+
+No scan or operation silently signs in. Dedicated Codex Security authentication must already be established. Configuration, previews and status reads do not create SDK clients or perform inference.
+
+## Run detail and uncertainty
+
+Each run retains structured SDK lifecycle, phase-local file/review counts, keyed activity, observed worker-session numbers, reconnect metadata and usage measurements. A review count of zero falls back to available file counts. Dispatch markers are best-effort signals; Deep maximum is a cap, not a percentage denominator.
+
+SDK core completion can precede the final `run()` result. During that interval the app stays running and says it is finalizing. No deduplication progress is inferred. The SDK does not provide a typed live findings callback; findings remain final-only.
+
+Activity IDs are hashed because some SDK IDs contain prose. Raw reasoning, commands, arguments and descriptions are never retained. Fixed categories and bounded repository-relative path mentions provide context; credential/runtime/outside paths are excluded. Running/completed updates share one keyed row and late running updates cannot reverse a terminal row. At most 100 activity entries and 128 observed worker numbers are retained.
+
+Measurements distinguish complete, partial and unavailable usage coverage, include observation time/missing-session counts, and preserve known estimate bounds. Partial values are measured subtotals; no price is a bill or account allowance. A missing upper bound stays unknown. Legacy saved costs have unknown coverage.
+
+Final results distinguish reportable, informational and unclassified returned findings. Repository matching describes returned historical records, never a count of new unique vulnerabilities. Summary lists are bounded and show omissions. Manifest coverage is a guarded, version-sensitive projection: SDK 0.9.1 can remove detailed review state during finalization, so unavailable coverage remains unavailable. Typed scope/review exclusions can still be shown. No extra artifact files are opened by this projection.
+
+New metadata is revalidated and sanitized when private history is loaded. Invalid optional metadata is discarded without losing the whole run.
+
+Older saved runs cannot reconstruct activity or coverage that the previous plugin discarded; their missing details remain unavailable.

package/docs/PUBLISHING.md

@@ -0,0 +1,71 @@
+# npm staging and human approval
+
+The source is public under Apache 2.0. Version `0.1.0` is live on npm under `latest`, verified November 10, 2026. The manifest retains `private: false`, public registry/access settings, a conservative `contentPolicy.class: dual-use` declaration and a root `DISCLOSURE`. Version `0.1.1` is prepared for staging; a version bump alone does not stage or publish it. GitHub previews remain available independently.
+
+## Security boundaries
+
+This utility uses Codex Security for source scans, policy drafting and static finding validation, not exploit execution or patch application. Its dual-use metadata and disclosure must persist across versions. npm forbids direct OIDC publication for dual-use packages. This repository automates **staging only**; each live version requires a maintainer's review and npm 2FA approval. Never add a direct publish command or a token fallback.
+
+`Checks` builds and tests without publishing permissions. It installs locked dependencies with lifecycle scripts disabled, audits runtime dependencies, checks source/build freshness and package allowlists, and tests the exact tarball in an isolated OpenCode host. Consumer dependencies are resolved afresh and audited too. The package has no install, prepare, pack or publish lifecycle hooks. Build explicitly before packing. These checks are not a comprehensive secret scan or a guarantee that transitive dependencies are safe.
+
+`npm-stage.yml` is manual, main-only and bound in code to `strantalis/opencode-codex-security`. It requires a successful current-main push run from `ci.yml` in the same repository. It requires the tested source commit to match both current main and the staging workflow commit (`GITHUB_SHA`, recorded by npm provenance). It checks public visibility, fixed filenames, dual-use manifest, SHA-256 checksums and artifact count. It promotes those exact bytes without rebuilding. The GitHub-hosted staging job has only read access and `id-token: write`, runs pinned Node/npm tooling, and never checks out or executes project code or installs project dependencies. The action is pinned to a commit. There are no npm secrets. The workflow verifies bundled npm 11.20.0 in Node 26.13.0 and fails if tooling differs.
+
+## One-time bootstrap: separate maintainer action
+
+Bootstrap is already complete for `opencode-codex-security`; use the later-version flow below for updates. The following steps document first-time setup only. Do not run them for another package until the maintainer approves the exact npm destination, public contents and account. Confirm name availability/ownership again. Review current npm policy, archive contents, license/dependency obligations and account eligibility. npm trust requires an **existing package**; do not try to grant trust to a nonexistent package.
+
+Use a workstation with Node 26.13.0/npm 11.20.0 (staging needs npm 11.15.0+). Enable npm 2FA. Download all three assets from a successful current-main CI run or matching GitHub preview, inspect `build-manifest.json` and verify `SHA256SUMS` before continuing. Use the actual archive filename:
+
+```sh
+# macOS; Linux: sha256sum -c SHA256SUMS
+shasum -a 256 -c SHA256SUMS
+npm login
+npm whoami
+npm stage publish ./opencode-codex-security-0.1.0.tgz --access public --tag latest --ignore-scripts
+npm stage list opencode-codex-security
+npm stage view STAGE_ID
+```
+
+Login and bootstrap staging are separate maintainer actions, not effects of changing repository files. A 401 from `npm whoami` means the CLI is not authenticated, not that no account exists. Do not share or commit passwords, tokens or OTPs. **Staging a new name creates a public `0.0.0-stage` placeholder**, even before the first real version is approved. The staged payload itself is not a live published version. Review the stage, download and compare its tarball with the tested SHA-256, and approve only the intended version/tag. Human approval is a separate action:
+
+```sh
+npm stage download STAGE_ID
+# Compare the downloaded tarball's SHA-256 with build-manifest.json.
+npm stage approve STAGE_ID
+```
+
+Approval requires 2FA and publishes that staged version. `npm stage reject STAGE_ID` also requires 2FA and discards it. Inspect any interrupted/uncertain operation with list/view before retrying; never blindly create another stage. Tags are immutable within a stage. Reject and restage if the tag was wrong. Check `npm view opencode-codex-security@0.1.0 version dist.integrity` and the intended dist-tag after approval. Do not treat a workflow success, stage ID or placeholder as a live release.
+
+## Configure stage-only trusted publishing: separate approval
+
+After the package exists, the maintainer must explicitly authorize and configure persistent npm trust for exactly:
+
+- Provider: GitHub Actions.
+- Owner: `strantalis`.
+- Repository: `opencode-codex-security`.
+- Workflow filename: `npm-stage.yml`.
+- Permission: **stage only**, never direct publishing.
+- Environment: none (this workflow does not claim an environment).
+
+Use npm package settings or the current `npm trust` documentation, not invented CLI flags. Do not configure a broader repository/workflow or create a long-lived token as a workaround. Newly configured trust must be used within two days or it expires. Once the staged flow is verified, select npm package protection **Require two-factor authentication and disallow tokens**. These settings require separate approval and are not made by this repository change.
+
+## Stage a later version
+
+1. Bump `version` in both package and lockfile in a reviewed PR. Use a patch bump for fixes (`0.1.1`); use a prerelease such as `0.1.1-rc.1` with `next` for testing. Never reuse a live version. Keep the dual-use metadata and disclosure.
+2. Merge only after checks pass. Wait for **Checks on the new main push** to finish successfully. Its verified artifact is retained for 14 days.
+3. Run **Actions → Stage npm release** on main with that run's numeric ID. Choose `next` for prereleases/testing or deliberately choose `latest` for a stable release. The default is `next`; prereleases with `latest` fail closed.
+4. Review the returned stage ID, version, tag, source and tarball hash using the human steps above. Approve with 2FA only when ready for public installation. There is no automated approval job.
+
+If main moves, the artifact expires, trust is absent/expired, or registry permissions fail, fix the specific prerequisite and use a fresh current-main successful run. Do not weaken checks or fall back to tokens. A failure after submitting to npm can have an uncertain outcome: inspect stage list/view before retrying. A version cannot be overwritten after publication; use a new version for corrections.
+
+## Limits and references
+
+Provenance is requested for public source/package with matching repository metadata. Review provenance after promotion: it identifies the staging workflow, while `build-manifest.json` links the bytes to the independently verified build commit/run. Native Desktop/platform testing and a complete real SDK assessment remain separate from mocked CI. Use only repositories and workplace devices authorized for scanning and data transfer.
+
+- [npm stage CLI](https://docs.npmjs.com/cli/v11/commands/npm-stage/)
+- [npm staged publishing and bootstrap](https://docs.npmjs.com/staged-publishing/)
+- [npm trusted publishers](https://docs.npmjs.com/trusted-publishers/)
+- [npm trust prerequisites](https://docs.npmjs.com/cli/v11/commands/npm-trust/)
+- [npm dual-use policy](https://docs.npmjs.com/policies/dual-use/)
+
+Verified November 10, 2026; recheck before setup. Installed metadata identifies Codex Security 0.9.1 as Apache-2.0, OpenCode plugin/Solid as MIT, and OpenTUI native binaries as MIT AND LGPL-2.1-or-later. Dependencies stay external; this is not comprehensive legal clearance.

package/docs/RELEASING.md

@@ -0,0 +1,53 @@
+# Tested builds and open-source release readiness
+
+## Build and promote a tested preview
+
+Repository visibility is an explicit maintainer choice. The manifest is public-release-ready, but GitHub previews do not stage or publish to npm. No npm account, package registry token or new persistent credential is required for the preview pipeline. The separate [npm staging guide](PUBLISHING.md) describes explicit bootstrap/trust setup and human approval.
+
+Every push and pull request runs locked installation with lifecycle scripts disabled, runtime dependency audit, lint, formatting, types, unit tests, build freshness, package allowlist and offline OpenCode integration. CI packs once, installs and tests that exact tarball, audits its newly resolved consumer dependencies, then saves `package-<full-commit>` for 14 days. The artifact contains the `.tgz`, `build-manifest.json` and `SHA256SUMS`. A PR artifact identifies its tested synthetic merge commit; prefer a push artifact when pinning a branch.
+
+After the branch is merged and **main's Checks run succeeds**, use **Actions → Preview release → Run workflow** on main and enter that successful push run's numeric ID and the intended repository visibility (`private` or `public`). A mismatch with the repository's actual visibility fails closed; public assets are accessible to anyone. The workflow never changes repository visibility. The workflow refuses failed, PR, foreign, expired, non-main or outdated-main builds. It creates `preview-<12-character-commit>` with three release assets. It never rebuilds, replaces a tag, publishes to npm or changes repository visibility. If a run expires, rerun Checks on the current main. A release failure can leave a tag/release created by GitHub; inspect it before retrying rather than overwriting assets blindly.
+
+Equivalent CLI using an already authorized GitHub login:
+
+```sh
+gh run list --repo strantalis/opencode-codex-security --workflow ci.yml --branch main --event push
+gh workflow run release.yml --repo strantalis/opencode-codex-security --ref main -f run_id=RUN_ID -f visibility=public
+gh run list --repo strantalis/opencode-codex-security --workflow release.yml
+```
+
+Only the existing GitHub Actions `GITHUB_TOKEN` is used. The workflow needs Actions enabled and repository policy allowing its scoped `contents: write` release job. Do not grant extra PAT/OAuth permissions to work around restrictions without approval.
+
+## Install a tested build at work
+
+Use only a workplace/device where this code and its data transfers are permitted. For a public repository/release, use the release page to download the three assets without GitHub sign-in. A private repository requires your existing authorized GitHub access; a private URL by itself does not grant access. Installing real SDK mode also needs the separate supported account/sign-in described in the README. The pipeline does not configure workplace access or copy sign-ins.
+
+Download the selected release's three assets from [Releases](https://github.com/strantalis/opencode-codex-security/releases). If you already use an authorized GitHub CLI login, the equivalent is:
+
+```sh
+mkdir security-preview && cd security-preview
+gh release download preview-COMMIT_PREFIX --repo strantalis/opencode-codex-security
+# macOS:
+shasum -a 256 -c SHA256SUMS
+# Linux: sha256sum -c SHA256SUMS
+cat build-manifest.json
+npm install --prefix ./consumer --ignore-scripts --no-audit --no-fund ./opencode-codex-security-0.1.1.tgz
+```
+
+The tarball version follows the package manifest; the release tag, full source commit and hash uniquely identify each build. Use the archive filename actually listed in `build-manifest.json`, which may differ from the example above. A GitHub preview does not make that version live on npm. Set your OpenCode plugin's `package` to the absolute path of `consumer/node_modules/opencode-codex-security` while preserving unrelated configuration. Select `engine: fixture` for offline testing or your explicitly configured SDK mode. Keep each preview in a separate directory; switch/reload only after active scans, approval dialogs and policy forms finish. Keep the previous directory to roll back. Nothing auto-updates the watched installation.
+
+The tarball does not bundle its dependency tree: npm still fetches dependencies. Artifact checksums authenticate only the downloaded bytes relative to the trusted repository; they are not independent signatures or a dependency safety guarantee.
+
+## Keep fixes moving
+
+Develop in a separate checkout/worktree, push fixes, inspect that commit's CI, merge reviewed changes and create a new preview. Report the full `sourceCommit`, OpenCode/OS versions and a minimal redacted reproduction with test feedback. Avoid attaching real scan payloads or credentials. GitHub's hosted checks continue when the development Mac is unavailable, but interactive assistant work still needs an available authorized checkout/computer.
+
+## npm distribution
+
+Public GitHub distribution under Apache 2.0 is approved. Version `0.1.0` is live on npm. The separate manual `npm-stage.yml` workflow stages later tested artifacts using maintainer-configured stage-only trust. No account, npm package or persistent trust is created by adding that workflow. Every live npm version still requires human 2FA approval. See [publishing and operating the staging flow](PUBLISHING.md).
+
+Keep development fixes in separate worktrees and PRs; do not overwrite the watched local installation. For npm fixes, bump the patch version and lockfile together. For prerelease testing use a full prerelease version with `next`; use `latest` only deliberately for stable releases. Pin the full installed version, keep the prior consumer for rollback and reload only after active operations finish.
+
+Before a public release, review source/history/assets for private data, preserve the license and disclosure, recheck dependency advisories, validate native Desktop/supported platforms, and complete any separately approved real SDK assessment. Mocked CI does not establish those claims. Branch rules and vulnerability-reporting settings are independent repository controls.
+
+Source references: [GitHub workflow permissions](https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#permissions), [GitHub Actions artifacts](https://docs.github.com/en/actions/using-workflows/storing-workflow-data-as-artifacts), [npm trusted publishing](https://docs.npmjs.com/trusted-publishers/).

package/docs/SDK.md

@@ -0,0 +1,36 @@
+# Codex Security SDK integration
+
+Pinned SDK: `@openai/codex-security@0.9.1`; OpenCode/plugin: 2.2.6.
+
+Current global configuration is documented in [GLOBAL-CONFIG.md](GLOBAL-CONFIG.md). No per-project SDK overrides are loaded. Session-supplied target/focus/context is distinct from global model, reasoning and Daybreak settings. Optional per-scan Standard/Deep mode overrides only the global mode fallback; no other SDK settings are overridden by session inputs.
+
+## Pipeline
+
+1. `security_prepare_scan` or the native review action resolves the current OpenCode location (or explicit repository), canonical scope paths, focused instructions and bounded documentation files. It reads and hashes the global settings file. No SDK client, login or inference is created.
+2. Preview includes target, added context, model/reasoning, Daybreak/access program and estimated cost threshold. The whole conversation is not copied.
+3. `security_run_scan` checks native OpenCode permissions. Applicable saved authorization can allow it without a redundant prompt. Native UI uses an explicit review action. Missing/mismatched/reused previews fail closed.
+4. Before starting, the plugin revalidates target/context and global config fingerprints. A change or expired preview requires a new review.
+5. The adapter creates an SDK client with the global model, reasoning and Daybreak constructor overrides and the fixed OpenAI provider. It invokes `run(repository, options)` with scope, prompt, documentation paths, configured scan settings, fixed ChatGPT auth and disabled owner suggestions.
+6. Progress and sanitized lifecycle events update the panel. Findings arrive at completion. Informational findings are counted but not relabeled in the four-severity display. Local SDK artifacts remain authoritative.
+
+## Safety and authorization boundaries
+
+- The global file never authorizes scans, saves credentials or changes accounts.
+- A model tool cannot inject arbitrary SDK constructor objects, credentials, executable paths, provider URLs or an approval boolean.
+- Native host permission rules are the authorization authority for the run tool. Direct RPC is intended only for the trusted UI, not a workaround for model authorization.
+- Repository scope is not a sandbox. Source beyond a scoped file can be relevant to SDK analysis. These settings do not guarantee process/filesystem isolation.
+- Named context is restricted to in-repository text documentation, excluding obvious credential/runtime paths. Context changes between review and execution are rejected. Hostile concurrent directory mutation is outside this prototype's scope.
+- Models and account entitlement are not checked while loading settings. Daybreak is a separate toggle, not a model; the toggle does not grant access.
+- Cost limits use estimates, not a hard billing cap. In-flight work can exceed the threshold.
+
+## Dedicated authentication
+
+Real operations require an existing private, owned, nonsymlink dedicated auth file and directory. A metadata-only guard runs before constructing the real SDK client. It does not read tokens, perform login or import credentials. The injected mock clients bypass this real-auth precondition.
+
+The SDK uses `$CODEX_SECURITY_STATE_DIR/codex-home`, otherwise `$CODEX_HOME/state/plugins/codex-security/codex-home`, with `~/.codex` as the default Codex home. Keep this outside the target repository.
+
+SDK 0.9.1 can import ambient credentials when its dedicated home is empty. The guard prevents ordinary missing-auth startup, but is not an atomic no-import policy: external deletion after the check can still race. Windows is deliberately rejected until a safe ACL verification path exists.
+
+## Verified behavior
+
+The actual OpenCode host was tested with injected mocks for scans, concurrent runs, cancellation, policy questions and static validation. One authorized real synthetic-file scan authenticated and reached discovery, then exceeded its USD 1 estimated budget guard. No completed assessment was returned. Direct native Desktop verification and full real-scan quality remain separate work.

package/fixtures/vulnerable/docs/ARCHITECTURE.md

@@ -0,0 +1,2 @@
+# Synthetic fixture architecture
+These four JavaScript files are intentionally vulnerable test inputs. They are never executed. Review request-input boundaries only. This document contains no real application source or credentials.

package/fixtures/vulnerable/src/accounts.js

@@ -0,0 +1,4 @@
+// Synthetic, intentionally vulnerable example. Never execute or deploy.
+export function findAccount(req, db) {
+  return db.query("SELECT * FROM accounts WHERE email = '" + req.query.email + "'");
+}

package/fixtures/vulnerable/src/diagnostics.js

@@ -0,0 +1,5 @@
+// Synthetic, intentionally vulnerable example. Never execute or deploy.
+import { exec } from 'node:child_process';
+export function ping(req) {
+  exec('ping -c 1 ' + req.query.host);
+}

package/fixtures/vulnerable/src/download.js

@@ -0,0 +1,5 @@
+// Synthetic, intentionally vulnerable example. Never execute or deploy.
+import { readFile } from 'node:fs/promises';
+export function download(req) {
+  return readFile('/srv/reports/' + req.query.file);
+}

package/fixtures/vulnerable/src/profile.js

@@ -0,0 +1,4 @@
+// Synthetic, intentionally vulnerable example. Never execute or deploy.
+export function profile(req, res) {
+  res.send('<h1>Hello ' + req.query.name + '</h1>');
+}

package/package.json

@@ -1,6 +1,81 @@
 {
   "name": "opencode-codex-security",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "private": false,
+  "type": "module",
+  "exports": {
+    ".": "./src/plugin.ts",
+    "./tui": "./src/tui.tsx",
+    "./gui-experimental": "./dist/gui-experimental.cjs",
+    "./rpc": "./src/rpc.ts"
+  },
+  "scripts": {
+    "test": "node --test tests/*.test.mjs",
+    "typecheck": "tsc --noEmit",
+    "build": "vite build",
+    "demo": "node scripts/demo.mjs",
+    "preview": "node scripts/preview-server.mjs",
+    "check": "npm run lint && npm run format:check && npm run typecheck && npm test && npm run build",
+    "setup:local": "node scripts/setup-local.mjs",
+    "test:host": "node scripts/host-test.mjs && node scripts/host-test.mjs --codex-gate",
+    "test:plan-host": "node scripts/host-plan-test.mjs",
+    "lint": "eslint . --max-warnings=0",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "pack:check": "npm run build && node scripts/check-package.mjs",
+    "test:package": "npm run build && node scripts/packed-host-test.mjs",
+    "test:tui": "bun --preload @opentui/solid/preload scripts/tui-preview-smoke.tsx",
+    "audit:runtime": "npm audit --omit=dev --audit-level=high",
+    "release:artifact": "npm run build && node scripts/release-artifact.mjs"
+  },
+  "dependencies": {
+    "@openai/codex-security": "0.9.1",
+    "@opencode/plugin": "2.2.6",
+    "solid-js": "^1.9.0"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@opencode/cli": "2.2.6",
+    "@opentui/core": "0.8.3",
+    "@opentui/solid": "0.8.3",
+    "@types/node": "^26.6.6",
+    "eslint": "^10.14.0",
+    "globals": "^17.14.0",
+    "prettier": "^3.9.10",
+    "typescript": "^5.9.0",
+    "typescript-eslint": "^8.72.2",
+    "vite": "^8.3.6",
+    "vite-plugin-solid": "^2.11.15"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "description": "Codex Security scans, policy drafts and finding validation inside OpenCode V2.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/strantalis/opencode-codex-security.git"
+  },
+  "files": [
+    "src/",
+    "dist/gui-experimental.cjs",
+    "fixtures/vulnerable/",
+    "LICENSE",
+    "DISCLOSURE",
+    "README.md",
+    "CONTRIBUTING.md",
+    "SECURITY.md",
+    "docs/GLOBAL-CONFIG.md",
+    "docs/MULTI-SCAN.md",
+    "docs/SDK.md",
+    "docs/PUBLISHING.md",
+    "docs/RELEASING.md"
+  ],
+  "contentPolicy": {
+    "class": "dual-use"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  }
+}