openqodex 0.6.0 → 0.6.1

package/README.md

@@ -1,4 +1,7 @@
-<!-- banner: added before launch -->
+<picture>
+  <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/openqodex/openqodex/main/.github/assets/readme-banner-dark.png">
+  <img alt="OpenQodex" src="https://raw.githubusercontent.com/openqodex/openqodex/main/.github/assets/readme-banner-light.png" width="1280">
+</picture>
 
 # OpenQodex
 
@@ -6,7 +9,7 @@
 [![licence](https://img.shields.io/badge/licence-Apache--2.0-blue)](LICENSE)
 [![CI](https://github.com/openqodex/openqodex/actions/workflows/ci.yml/badge.svg)](https://github.com/openqodex/openqodex/actions/workflows/ci.yml)
 
-OpenQodex is open source code review that runs before you push, from your coding agent or your terminal. One command, `openqodex review`, works out your change: the commits not yet pushed plus everything uncommitted. It runs the scanners that fit the changed files and keeps only findings on the lines you changed. Then it starts its own reviewer, a separate Claude Code or Codex process that reads a frozen copy of the change. The reviewer checks every scanner finding and is given every changed line. OpenQodex checks its answer with scripts and prints one report. It needs Claude Code or Codex installed and logged in, and no other key, account or server.
+OpenQodex is open source AI code review for Claude Code and Codex. It runs before you push, from your coding agent or your terminal. One command, `openqodex review`, works out your change: the commits not yet pushed plus everything uncommitted. It runs the scanners that fit the changed files and keeps only findings on the lines you changed. Then it starts its own reviewer, a separate Claude Code or Codex process that reads a frozen copy of the change. The reviewer checks every scanner finding and is given every changed line. OpenQodex checks its answer with scripts and prints one report. It needs Claude Code or Codex installed and logged in, and no other key, account or server.
 
 ## Install
 
@@ -163,11 +166,12 @@ The docs ship inside the package. `npx openqodex guide <topic>` prints a page of
 - [Agents](docs/agents.md)
 - [GitHub Action](docs/github-action.md)
 - [Security](docs/security.md)
+- [Privacy](docs/privacy.md)
 - [FAQ](docs/faq.md)
 
 ## Telemetry
 
-None. OpenQodex sends no usage data. semgrep runs with its own metrics switched off. See [docs/telemetry.md](docs/telemetry.md).
+None. OpenQodex sends no usage data. semgrep runs with its own metrics switched off. See [docs/telemetry.md](docs/telemetry.md) and the privacy policy, [docs/privacy.md](docs/privacy.md).
 
 ## Security
 
@@ -179,6 +183,8 @@ OpenQodex is new and on the way to 1.0. Commands, flags and the config file can
 
 ## Made by Qodex
 
+[![Made by Qodex](https://raw.githubusercontent.com/openqodex/openqodex/main/.github/assets/made-by-qodex.svg)](https://qodex.ai?utm_source=openqodex&utm_medium=readme)
+
 OpenQodex is made by [Qodex](https://qodex.ai?utm_source=openqodex&utm_medium=readme), which also runs a hosted review on every pull request.
 
 Licensed under [Apache 2.0](LICENSE). See [NOTICE](NOTICE) for the scanners' licences.

package/dist/bin.js

@@ -39813,7 +39813,7 @@ function launcherStarted(env = process.env, entry = process.argv[1]) {
   return named !== void 0 && named !== "" && entry !== void 0 && resolve6(named) === resolve6(entry);
 }
 function directRunner(entry = process.argv[1]) {
-  const npx = `npx -y openqodex@${"0.6.0"}`;
+  const npx = `npx -y openqodex@${"0.6.1"}`;
   if (entry === void 0) return npx;
   let file2;
   let own2;
@@ -40223,7 +40223,7 @@ function composeIssue(problem, command, args2) {
     `Scanners: ${scanners}`,
     `Environment: ${osName()}, ${process.arch}, Node ${process.versions.node.split(".")[0]}`
   ].join("\n");
-  return { title: `OpenQodex ${"0.6.0"}: ${problem.code}`, body: body2 };
+  return { title: `OpenQodex ${"0.6.1"}: ${problem.code}`, body: body2 };
 }
 function issueText(issue2) {
   return [
@@ -41505,7 +41505,7 @@ Nothing was written.
     const record3 = loadRecord(home);
     const recordBefore = serialize(record3);
     try {
-      const runtime2 = planRuntime(record3, "0.6.0", home);
+      const runtime2 = planRuntime(record3, "0.6.1", home);
       const refused = runtime2.find((a2) => a2.failed);
       if (refused) return fail2(`openqodex hook install: ${refused.path}: ${refused.note}`);
       await applyAll(runtime2);
@@ -41618,7 +41618,7 @@ var init_hook = __esm({
     BRANCH = /^[A-Za-z0-9._][A-Za-z0-9._/-]*$/;
     CANNOT_TELL = "OpenQodex could not tell what this push sends; run openqodex review and push with plain git push";
     ZERO_SHA = /^0+$/;
-    MANAGED_LINE = (manager) => hookLine(`npx -y openqodex@${"0.6.0"}`, manager.args);
+    MANAGED_LINE = (manager) => hookLine(`npx -y openqodex@${"0.6.1"}`, manager.args);
   }
 });
 
@@ -50102,7 +50102,7 @@ async function runReview(o2) {
       created_at: (/* @__PURE__ */ new Date()).toISOString(),
       lenses: lenses.map((l2) => ({ name: l2.name, confidenceFloor: l2.confidenceFloor })),
       instructions_hash: instructions.hash,
-      runtime_version: "0.6.0",
+      runtime_version: "0.6.1",
       ...prep.target ? { target: prep.target } : {}
     };
     writeReportFiles(
@@ -53582,7 +53582,7 @@ ${USAGE2}
     home,
     oqHome: openqodexHomeDir(),
     repoRoot,
-    version: "0.6.0",
+    version: "0.6.1",
     written: [],
     before: /* @__PURE__ */ new Map()
   };
@@ -53675,7 +53675,7 @@ function maybeStartUpdate(home, state) {
   child.unref();
 }
 function notices(home, state) {
-  if (state.notice === null || state.notice.version !== "0.6.0") return;
+  if (state.notice === null || state.notice.version !== "0.6.1") return;
   process.stderr.write(`${state.notice.text}
 `);
   updateState(home, { notice: null });
@@ -53687,7 +53687,7 @@ function afterCommand(name2, args2) {
     const state = readState(home);
     const sub = name2 === "hook" ? args2[0] : void 0;
     if (!launcherStarted()) {
-      const note3 = name2 === "review" || name2 === "scan" ? pinnedNote(state, "0.6.0") : null;
+      const note3 = name2 === "review" || name2 === "scan" ? pinnedNote(state, "0.6.1") : null;
       if (note3 !== null) process.stderr.write(`openqodex: ${note3}
 `);
       return;
@@ -53890,7 +53890,7 @@ async function writeBrief(p3, flags2, noGraph, scope, target) {
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     lenses: lenses.map((l2) => ({ name: l2.name, confidenceFloor: l2.confidenceFloor })),
     instructions_hash: instructions.hash,
-    runtime_version: "0.6.0",
+    runtime_version: "0.6.1",
     ...target ? { target, run_id: runId } : {}
   };
   const impact = await buildImpact(p3, flags2, noGraph);
@@ -54026,7 +54026,7 @@ async function runAll(flags2, only, skip, noGraph) {
     created_at: (/* @__PURE__ */ new Date()).toISOString(),
     lenses: lenses.map((l2) => ({ name: l2.name, confidenceFloor: l2.confidenceFloor })),
     instructions_hash: instructions.hash,
-    runtime_version: "0.6.0"
+    runtime_version: "0.6.1"
   });
   writeScan(repoRoot, dir, p3.scan);
   const { impact, hot, note: note3 } = await buildHotSpots(p3, flags2, noGraph);
@@ -54174,7 +54174,7 @@ async function runFinalize(flags2, path11, all, args2, handedOff, runId) {
   if (target !== void 0 && runId === void 0) {
     throw new OpenQodexError(`this run reviewed ${target.spec}; finalize it with review --finalize --run ${basename11(dir)}`);
   }
-  if (manifest !== null && manifest.runtime_version !== void 0 && manifest.runtime_version !== "0.6.0") {
+  if (manifest !== null && manifest.runtime_version !== void 0 && manifest.runtime_version !== "0.6.1") {
     if (target !== void 0) {
       throw new OpenQodexError(`this brief was written by openqodex ${manifest.runtime_version}; run the review of ${target.spec} again`);
     }
@@ -54481,7 +54481,7 @@ var init_fetch = __esm({
     DEADLINE_MS2 = 12e4;
     MB = 1024 * 1024;
     LIMITS = { metadata: 20 * MB, attestations: 5 * MB, tarball: 50 * MB };
-    VERSION = true ? "0.6.0" : "dev";
+    VERSION = true ? "0.6.1" : "dev";
     UpdateFetchError = class extends Error {
       constructor(message5) {
         super(message5);
@@ -59817,7 +59817,7 @@ async function runUpdateWorker(opts) {
 async function work(home, env, anyAge, wait) {
   const now = Date.now();
   const test = seam(env);
-  const running = test.as ?? "0.6.0";
+  const running = test.as ?? "0.6.1";
   const from = activeVersion(home);
   if (from === null || !existsSync15(launcherPath(home))) return { outcome: "failed", lines: ["No launcher install here; run npx openqodex init."] };
   for (const tmp of tempRuntimes(home, false)) rmSync15(tmp, { recursive: true, force: true });
@@ -59946,14 +59946,14 @@ function statusLines(home) {
   const launched = launcherStarted();
   const allowed = updatesAllowed(home, process.env);
   const lines3 = [
-    `running      ${"0.6.0"}${launched ? " (through the launcher)" : " (pinned: not started through the launcher, never updates)"}`,
+    `running      ${"0.6.1"}${launched ? " (through the launcher)" : " (pinned: not started through the launcher, never updates)"}`,
     `latest seen  ${state.latestSeen ?? "not checked yet"}`,
     `last check   ${ago(state.checkedAt)}`,
     `updates      ${allowed.why}`,
     `last error   ${state.lastError ?? "none"}`
   ];
   if (!launched) {
-    const note3 = pinnedNote(state, "0.6.0");
+    const note3 = pinnedNote(state, "0.6.1");
     if (note3 !== null) lines3.push(`note         ${note3}`);
   }
   return lines3;
@@ -60245,7 +60245,7 @@ async function run12(args2) {
   const { positionals } = parseFlags(args2, { positionals: 1 });
   const topic = positionals[0];
   if (topic === void 0 || topic === "skill") {
-    const runner = launcherStarted() ? launcherRunner(launcherPath(openqodexHomeDir())) : `npx -y openqodex@${"0.6.0"}`;
+    const runner = launcherStarted() ? launcherRunner(launcherPath(openqodexHomeDir())) : `npx -y openqodex@${"0.6.1"}`;
     process.stdout.write(renderSkill(runner));
     return EXIT_OK;
   }
@@ -60446,7 +60446,7 @@ function reportError(error62, command, args2) {
   return EXIT_TOOL_FAILED;
 }
 async function main(argv) {
-  const program2 = new Command("openqodex").description("Open source code review that runs inside your coding agent, before you push.").version("0.6.0", "-v, --version", "Print the version").exitOverride();
+  const program2 = new Command("openqodex").description("Open source code review that runs inside your coding agent, before you push.").version("0.6.1", "-v, --version", "Print the version").exitOverride();
   for (const [name2, entry] of Object.entries(commands)) {
     const command = program2.command(name2, { hidden: entry.hidden === true });
     if (entry.usage !== void 0) command.usage(entry.usage);

package/docs/agents.md

@@ -168,6 +168,8 @@ Before each push it runs `openqodex hook pre-push` through the launcher. For eac
 
 - The skill alone: `npx skills add openqodex/openqodex`. This writes the skill but no hook.
 - Claude Code plugin: the repository holds a plugin marketplace with an `openqodex` plugin. The plugin carries the skill and the push gate hook. Its hook calls `npx -y openqodex@<version>`.
+- Codex plugin: `plugins/codex/` packages the skill alone for the OpenAI plugin directory. It writes no hook and no instruction file.
+- Cursor plugin: `.cursor-plugin/plugin.json` at the repository root makes the repository a Cursor plugin that carries the skill alone. It holds no rule. The rule that asks Cursor to review before every push comes from `init`, which writes `.cursor/rules/openqodex.mdc` in your repository. A rule shipped inside the plugin would go in a `rules/` folder at the repository root.
 
 ## Inside a sandbox
 

package/docs/github-action.md

@@ -85,7 +85,7 @@ The repository also ships a pre-commit hook for the pre-push stage. Add this to
 ```yaml
 repos:
   - repo: https://github.com/openqodex/openqodex
-    rev: v0.6.0
+    rev: v0.6.1
     hooks:
       - id: openqodex-scan
 ```

package/docs/index.md

@@ -26,4 +26,5 @@ These pages ship inside the npm package. `npx openqodex guide <topic>` prints on
 - `github-action`: run the scan on pull requests.
 - `security`: what runs, what is sent where, and where files go.
 - `telemetry`: there is none.
+- `privacy`: the privacy policy: what OpenQodex collects (nothing) and every network call it makes.
 - `faq`: short answers.

package/docs/llms.txt

@@ -9,6 +9,7 @@
 - [OpenQodex docs](index.md)
 - [Reviewer drivers](internal-reviewer-drivers.md)
 - [Plumbing commands](plumbing.md)
+- [Privacy](privacy.md)
 - [Quickstart](quickstart.md)
 - [Scanners](scanners.md)
 - [Security](security.md)

package/docs/privacy.md

@@ -0,0 +1,43 @@
+# Privacy
+
+This page is the privacy policy for OpenQodex: the `openqodex` package on npm, its skill, its plugins for Claude Code, Codex and Cursor, its GitHub Action and its pre-commit hook. `security` and `telemetry` give the details behind each line.
+
+## What OpenQodex collects
+
+Nothing. OpenQodex collects no usage data, no crash reports and no identifiers. It has no server and no account, and it sends no telemetry. semgrep runs with its own metrics switched off.
+
+## Who reviews your code
+
+The review runs in a reviewer process OpenQodex starts on your machine: Claude Code or Codex, on your own login. That process sends the brief and what the reviewer reads to the model your login uses. OpenQodex adds no other model and needs no other key. By default the reviewer can also search the web, and Claude Code can open web pages; `reviewer_web: off` in `~/.openqodex/config.yaml` removes that.
+
+When neither Claude Code nor Codex can be the reviewer, the coding agent you are in reviews the change itself, on the model that agent already uses.
+
+## Every network use
+
+OpenQodex and the built-in scanners send no code anywhere. They use the network for these things only:
+
+- Scanner downloads on first use, into `~/.openqodex/tools/`. GitHub release files are checked against sha256 sums pinned in the package. semgrep and bandit come from PyPI through uv, with a Python 3.11 that uv downloads. oxlint comes from npm. brakeman and rubocop come from RubyGems. These package installs are pinned by version.
+- Semgrep rule packs. semgrep fetches `p/default`, `p/security-audit` and `p/secrets` from the Semgrep registry on each run.
+- The dependency check. When the change holds a lockfile, osv-scanner sends the names and versions of the dependencies in it to osv.dev. It never sends code.
+- Custom scanners. `openqodex trust` reads the scanner's release from the GitHub API and downloads the asset.
+- The problem report, only when you choose it. When OpenQodex fails, a scanner breaks, or you run `openqodex report`, it prints the GitHub issue it would create and two choices. Nothing is sent unless you press 1 or run `openqodex report --send-last`. The issue holds the OpenQodex version, the command and its arguments with paths and secrets taken out, the part that failed, a scrubbed error line, the scanner statuses and your platform. It never holds code, file names, paths, repository names, config or secrets.
+- The daily version check, for an install made with `init`. It sends GET requests to `registry.npmjs.org` only, with nothing about you, your code or your repository. `security` describes what it checks before it installs a release.
+- A review of a branch or a pull request. git fetches it from your own remote with git's own credentials, and the GitHub CLI, when it is installed and signed in, is asked for the pull request's base. OpenQodex reads no token.
+
+`--offline` skips osv-scanner and semgrep and turns scanner downloads and the version check off.
+
+The plugins, the GitHub Action and the pre-commit hook fetch the `openqodex` package from npm to run it.
+
+The GitHub Action uploads its findings to code scanning in your own repository on GitHub: each finding's message, file path and line numbers, as a SARIF file. Set `upload-sarif: false` in the workflow to turn that off.
+
+## Custom scanners
+
+A custom scanner named in `.openqodex.yaml` is a command that runs on your machine with your permissions. It never runs until you approve that exact entry with `openqodex trust`, and an edited entry needs a new approval. After approval, a custom scanner does whatever its own command does, including any network use. OpenQodex does not control it.
+
+## What stays on your machine
+
+Scanners, caches and your approvals stay under `~/.openqodex/`. Each review writes its brief, findings and reports under `.openqodex/` in your repository. When gitleaks finds a secret in the change, OpenQodex removes it from the brief, every report file and the terminal.
+
+## Contact
+
+Questions about this page: siddhant@qodex.ai. Report a vulnerability through GitHub's private vulnerability reporting on the openqodex/openqodex repository, never in a public issue.

package/package.json

@@ -1,10 +1,10 @@
 {
   "name": "openqodex",
-  "version": "0.6.0",
-  "description": "Open source code review that runs inside your coding agent, before you push.",
+  "version": "0.6.1",
+  "description": "Open source AI code review for Claude Code and Codex, before you push: scanners on your changed lines, then a separate reviewer that checks every scanner finding and is given every changed line.",
   "type": "module",
   "license": "Apache-2.0",
-  "homepage": "https://github.com/openqodex/openqodex#readme",
+  "homepage": "https://qodex.ai/openqodex",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/openqodex/openqodex.git",
@@ -15,12 +15,28 @@
   },
   "keywords": [
     "code-review",
+    "ai-code-review",
+    "code-review-tool",
     "static-analysis",
+    "sast",
+    "security",
+    "secret-scanning",
+    "linter",
+    "code-quality",
+    "pre-commit",
+    "pre-push",
+    "git-hooks",
     "claude-code",
+    "claude-code-plugin",
+    "agent-skills",
     "cursor",
     "codex",
     "cline",
-    "pre-commit"
+    "coding-agent",
+    "semgrep",
+    "gitleaks",
+    "osv-scanner",
+    "cli"
   ],
   "engines": {
     "node": ">=22"

package/skills/openqodex/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: openqodex
-description: Review the current code change before it is pushed. One command runs the security and lint scanners that fit the changed files, a separate reviewer that checks every scanner finding and is given every changed line, and prints the report. Use before every git push, when asked to review changes, and when a push was blocked or warned by OpenQodex.
+description: Code review for the current change, before it is pushed. One command runs the security, secret, dependency and lint scanners that fit the changed files, a separate reviewer that checks every scanner finding and is given every changed line, and prints the report. Use before every git push, when asked for a code review, a security scan, or to review changes, a diff or a pull request, and when a push was blocked or warned by OpenQodex.
 ---
 
 # OpenQodex: review the change before it is pushed
@@ -27,13 +27,13 @@ When the file `~/.openqodex/bin/openqodex` exists, run it in place of `npx -y op
 1. From the repository, run:
 
    ```
-   npx -y openqodex@0.6.0 review
+   npx -y openqodex@0.6.1 review
    ```
 
    It reviews the change: the commits not yet pushed plus everything uncommitted, untracked files included. To review the whole repository instead, run:
 
    ```
-   npx -y openqodex@0.6.0 review --all
+   npx -y openqodex@0.6.1 review --all
    ```
 
 2. Wait for it. A review takes one to three minutes. Many agents stop a command after two minutes, so give it up to ten minutes, or run it in the background and wait until it exits. While the reviewer works, it prints a progress line every 15 seconds on stderr. Do not start it a second time while one runs.
@@ -50,8 +50,8 @@ When the file `~/.openqodex/bin/openqodex` exists, run it in place of `npx -y op
 When the developer asks you to review a branch or a pull request that is not their current work, name it:
 
 ```
-npx -y openqodex@0.6.0 review feature/login
-npx -y openqodex@0.6.0 review '#42'
+npx -y openqodex@0.6.1 review feature/login
+npx -y openqodex@0.6.1 review '#42'
 ```
 
 Quote `#42`: in a shell `#` starts a comment. A pull request link works too. OpenQodex fetches the target, checks it out in a temporary folder and reviews what it added since it left its base. This is someone else's code: never run its tests, scripts, builds or services, and never edit it.
@@ -62,7 +62,7 @@ Quote `#42`: in a shell `#` starts a comment. A pull request link works too. Ope
 - Never run `openqodex trust` without asking the developer first. It approves a custom scanner, which is a command that runs on their machine.
 - Never set `OPENQODEX_SKIP`. It is the developer's switch, not yours.
 - When the verdict is `blocked`, do not push unless the developer says so after seeing the findings.
-- When OpenQodex prints "OpenQodex had a problem. Nothing has been sent." with `1 create a GitHub issue` and `2 ignore`, tell the developer in one line what went wrong and give them the two choices. Never choose 1 yourself. If they say 1, run `npx -y openqodex@0.6.0 report --send-last` from the same folder. Anything else means 2: do nothing.
+- When OpenQodex prints "OpenQodex had a problem. Nothing has been sent." with `1 create a GitHub issue` and `2 ignore`, tell the developer in one line what went wrong and give them the two choices. Never choose 1 yourself. If they say 1, run `npx -y openqodex@0.6.1 report --send-last` from the same folder. Anything else means 2: do nothing.
 
 ## Reading the report
 
@@ -74,7 +74,7 @@ Quote `#42`: in a shell `#` starts a comment. A pull request link works too. Ope
   - `installing`: it is being downloaded for the first time; it is included from the next run. Say so to the developer rather than waiting.
   - `not installed`: it could not be installed here; the reason says why.
   - `needs Ruby 2.7+` or `needs Go`: brakeman and rubocop need Ruby, golangci-lint needs Go. OpenQodex does not install language runtimes. If the developer wants those scanners, they install Ruby or Go the usual way for their system (for example `brew install ruby go` on a Mac) and run the review again.
-  - `untrusted`: a custom scanner from the repo's config that the developer has not approved. Tell the developer; approving it is their decision (`npx -y openqodex@0.6.0 trust`).
+  - `untrusted`: a custom scanner from the repo's config that the developer has not approved. Tell the developer; approving it is their decision (`npx -y openqodex@0.6.1 trust`).
   - `failed`: the scanner ran and broke; the reason has its error. A scanner problem never changes the exit code.
 
 ## Inside a sandbox
@@ -82,11 +82,11 @@ Quote `#42`: in a shell `#` starts a comment. A pull request link works too. Ope
 Some agents run commands in a sandbox that cannot reach the network or write outside the project. There the first run cannot download the scanners, and the reviewer may not reach its model. Tell the developer to run this once in their own terminal, outside the agent:
 
 ```
-npx -y openqodex@0.6.0 doctor --install
+npx -y openqodex@0.6.1 doctor --install
 ```
 
-It downloads every scanner that fits the machine into `~/.openqodex/tools/`. If the review still says "Full review unavailable" inside the sandbox, the developer runs `npx -y openqodex@0.6.0 review` in their own terminal.
+It downloads every scanner that fits the machine into `~/.openqodex/tools/`. If the review still says "Full review unavailable" inside the sandbox, the developer runs `npx -y openqodex@0.6.1 review` in their own terminal.
 
 ## More
 
-`npx -y openqodex@0.6.0 guide` prints this guide. `npx -y openqodex@0.6.0 guide <topic>` prints a page of the docs, offline: `quickstart`, `config`, `scanners`, `custom-scanners`, `security`, `agents`, `cli`.
+`npx -y openqodex@0.6.1 guide` prints this guide. `npx -y openqodex@0.6.1 guide <topic>` prints a page of the docs, offline: `quickstart`, `config`, `scanners`, `custom-scanners`, `security`, `agents`, `cli`.