opencode-codex-security 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +4 -4
- package/docs/PUBLISHING.md +3 -3
- package/docs/RELEASING.md +3 -3
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
Security scans, policy drafts and finding validation inside **OpenCode V2**, with a native terminal view, an experimental Desktop panel and tools for your session's model.
|
|
4
4
|
|
|
5
|
-
This is an early project, not an official OpenCode or OpenAI product.
|
|
5
|
+
This is an early project, not an official OpenCode or OpenAI product. Version `0.1.0` is available on npm under [Apache 2.0](LICENSE). Later releases use stage-only npm publishing, with human 2FA approval required before each version goes live. Tested GitHub release tarballs are also available. See [npm staging](docs/PUBLISHING.md).
|
|
6
6
|
|
|
7
7
|
## What works
|
|
8
8
|
|
|
@@ -27,7 +27,7 @@ SDK mode uses `@openai/codex-security` 0.9.1. Repository source and selected con
|
|
|
27
27
|
|
|
28
28
|
## Install a released version
|
|
29
29
|
|
|
30
|
-
|
|
30
|
+
Install an exact live npm version into a dedicated local consumer, or use [tested GitHub tarballs](docs/RELEASING.md):
|
|
31
31
|
|
|
32
32
|
```sh
|
|
33
33
|
mkdir security-plugin && cd security-plugin
|
|
@@ -35,7 +35,7 @@ npm install --save-exact --ignore-scripts opencode-codex-security@0.1.0
|
|
|
35
35
|
npm audit --omit=dev --audit-level=high
|
|
36
36
|
```
|
|
37
37
|
|
|
38
|
-
`0.1.0` is the
|
|
38
|
+
`0.1.0` is the current live version. The source version `0.1.1` is prepared for staging and is not available until separately approved. A staged version or `0.0.0-stage` placeholder is not installable functionality. Point the plugin configuration below at the absolute path of `security-plugin/node_modules/opencode-codex-security`. This uses the tested local-path plugin route; no special OpenCode install command is required. Keep the lockfile and use `npm ci --ignore-scripts` for repeat installs. Use only a workplace/device authorized for the plugin and its source-data transfers.
|
|
39
39
|
|
|
40
40
|
For updates, select an exact approved version, install into a new directory, audit, and switch the configured path only when scans, approval dialogs and policy forms have finished. Keep the previous directory for rollback. Nothing updates automatically. Test prereleases explicitly by their full version rather than following a moving tag.
|
|
41
41
|
|
|
@@ -95,7 +95,7 @@ These launchers isolate configuration under `.runtime/`. The plan-host tests inj
|
|
|
95
95
|
|
|
96
96
|
## Tested builds and releases
|
|
97
97
|
|
|
98
|
-
CI produces an exact tested tarball with its source commit and SHA-256 checksums. A manual workflow can promote a successful main build to a GitHub prerelease at the explicitly selected repository visibility without npm tokens. See [testing and release readiness](docs/RELEASING.md) and [security reporting](SECURITY.md). The maintainer approved public GitHub distribution under Apache 2.0. npm registry publication remains a separate step.
|
|
98
|
+
CI produces an exact tested tarball with its source commit and SHA-256 checksums. A manual workflow can promote a successful main build to a GitHub prerelease at the explicitly selected repository visibility without npm tokens. See [testing and release readiness](docs/RELEASING.md) and [security reporting](SECURITY.md). The maintainer approved public GitHub distribution under Apache 2.0. npm registry publication remains a separate, human-approved step for every version.
|
|
99
99
|
|
|
100
100
|
## Verification limits
|
|
101
101
|
|
package/docs/PUBLISHING.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# npm staging and human approval
|
|
2
2
|
|
|
3
|
-
The source is public under Apache 2.0.
|
|
3
|
+
The source is public under Apache 2.0. Version `0.1.0` is live on npm under `latest`, verified November 10, 2026. The manifest retains `private: false`, public registry/access settings, a conservative `contentPolicy.class: dual-use` declaration and a root `DISCLOSURE`. Version `0.1.1` is prepared for staging; a version bump alone does not stage or publish it. GitHub previews remain available independently.
|
|
4
4
|
|
|
5
5
|
## Security boundaries
|
|
6
6
|
|
|
@@ -12,7 +12,7 @@ This utility uses Codex Security for source scans, policy drafting and static fi
|
|
|
12
12
|
|
|
13
13
|
## One-time bootstrap: separate maintainer action
|
|
14
14
|
|
|
15
|
-
Do not run
|
|
15
|
+
Bootstrap is already complete for `opencode-codex-security`; use the later-version flow below for updates. The following steps document first-time setup only. Do not run them for another package until the maintainer approves the exact npm destination, public contents and account. Confirm name availability/ownership again. Review current npm policy, archive contents, license/dependency obligations and account eligibility. npm trust requires an **existing package**; do not try to grant trust to a nonexistent package.
|
|
16
16
|
|
|
17
17
|
Use a workstation with Node 26.13.0/npm 11.20.0 (staging needs npm 11.15.0+). Enable npm 2FA. Download all three assets from a successful current-main CI run or matching GitHub preview, inspect `build-manifest.json` and verify `SHA256SUMS` before continuing. Use the actual archive filename:
|
|
18
18
|
|
|
@@ -26,7 +26,7 @@ npm stage list opencode-codex-security
|
|
|
26
26
|
npm stage view STAGE_ID
|
|
27
27
|
```
|
|
28
28
|
|
|
29
|
-
Login and staging are
|
|
29
|
+
Login and bootstrap staging are separate maintainer actions, not effects of changing repository files. A 401 from `npm whoami` means the CLI is not authenticated, not that no account exists. Do not share or commit passwords, tokens or OTPs. **Staging a new name creates a public `0.0.0-stage` placeholder**, even before the first real version is approved. The staged payload itself is not a live published version. Review the stage, download and compare its tarball with the tested SHA-256, and approve only the intended version/tag. Human approval is a separate action:
|
|
30
30
|
|
|
31
31
|
```sh
|
|
32
32
|
npm stage download STAGE_ID
|
package/docs/RELEASING.md
CHANGED
|
@@ -31,10 +31,10 @@ gh release download preview-COMMIT_PREFIX --repo strantalis/opencode-codex-secur
|
|
|
31
31
|
shasum -a 256 -c SHA256SUMS
|
|
32
32
|
# Linux: sha256sum -c SHA256SUMS
|
|
33
33
|
cat build-manifest.json
|
|
34
|
-
npm install --prefix ./consumer --ignore-scripts --no-audit --no-fund ./opencode-codex-security-0.1.
|
|
34
|
+
npm install --prefix ./consumer --ignore-scripts --no-audit --no-fund ./opencode-codex-security-0.1.1.tgz
|
|
35
35
|
```
|
|
36
36
|
|
|
37
|
-
The tarball version
|
|
37
|
+
The tarball version follows the package manifest; the release tag, full source commit and hash uniquely identify each build. Use the archive filename actually listed in `build-manifest.json`, which may differ from the example above. A GitHub preview does not make that version live on npm. Set your OpenCode plugin's `package` to the absolute path of `consumer/node_modules/opencode-codex-security` while preserving unrelated configuration. Select `engine: fixture` for offline testing or your explicitly configured SDK mode. Keep each preview in a separate directory; switch/reload only after active scans, approval dialogs and policy forms finish. Keep the previous directory to roll back. Nothing auto-updates the watched installation.
|
|
38
38
|
|
|
39
39
|
The tarball does not bundle its dependency tree: npm still fetches dependencies. Artifact checksums authenticate only the downloaded bytes relative to the trusted repository; they are not independent signatures or a dependency safety guarantee.
|
|
40
40
|
|
|
@@ -44,7 +44,7 @@ Develop in a separate checkout/worktree, push fixes, inspect that commit's CI, m
|
|
|
44
44
|
|
|
45
45
|
## npm distribution
|
|
46
46
|
|
|
47
|
-
Public GitHub distribution under Apache 2.0 is approved. The separate manual `npm-stage.yml` workflow
|
|
47
|
+
Public GitHub distribution under Apache 2.0 is approved. Version `0.1.0` is live on npm. The separate manual `npm-stage.yml` workflow stages later tested artifacts using maintainer-configured stage-only trust. No account, npm package or persistent trust is created by adding that workflow. Every live npm version still requires human 2FA approval. See [publishing and operating the staging flow](PUBLISHING.md).
|
|
48
48
|
|
|
49
49
|
Keep development fixes in separate worktrees and PRs; do not overwrite the watched local installation. For npm fixes, bump the patch version and lockfile together. For prerelease testing use a full prerelease version with `next`; use `latest` only deliberately for stable releases. Pin the full installed version, keep the prior consumer for rollback and reload only after active operations finish.
|
|
50
50
|
|