OnlineChefGroep · OnlineChef · Jul 22, 2026 · Jul 22, 2026 · Jul 23, 2026 · Jul 23, 2026
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -0,0 +1,52 @@
+# Dependabot configuration
+# See: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "Europe/Amsterdam"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "automated"
+    versioning-strategy: increase
+    groups:
+      minor-patch:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "npm"
+    directory: "/gui"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "Europe/Amsterdam"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "automated"
+      - "gui"
+    versioning-strategy: increase
+    groups:
+      minor-patch:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "dependencies"
+      - "automated"
+      - "ci"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -18,6 +18,7 @@ on:
       - ".github/workflows/release.yml"
       - ".github/workflows/enforce-pr-target.yml"
       - ".github/workflows/stale-needs-info.yml"
+      - ".github/workflows/issue-triage.yml"
   push:
     branches: [main, preview, dev]
     paths:
@@ -35,6 +36,7 @@ on:
       - ".github/workflows/release.yml"
       - ".github/workflows/enforce-pr-target.yml"
       - ".github/workflows/stale-needs-info.yml"
+      - ".github/workflows/issue-triage.yml"
   workflow_dispatch:
 
 permissions:
@@ -171,3 +173,88 @@ jobs:
 
       - name: ocx help via bundled bun
         run: ocx help
+
+  security:
+    name: Security audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Install GUI dependencies
+        working-directory: gui
+        run: bun install --frozen-lockfile
+
+      - name: Generate Bun audit report
+        id: bun-audit
+        continue-on-error: true
+        shell: bash
+        run: |
+          set +e
+          # Full JSON evidence: `bun audit --json` ignores --audit-level, so this
+          # captures findings at every severity for the uploaded artifact.
+          bun audit --json > bun-audit.json
+          # Gate decision: bun audit only honors --audit-level in non-JSON mode,
+          # so derive the pass/fail from the human-readable run (high/critical only).
+          bun audit --audit-level=high
+          status=$?
+          echo "exit_code=$status" >> "$GITHUB_OUTPUT"
+          exit 0
+
+      - name: Generate GUI Bun audit report
+        id: gui-bun-audit
+        continue-on-error: true
+        working-directory: gui
+        shell: bash
+        run: |
+          set +e
+          bun audit --json > bun-audit.json
+          bun audit --audit-level=high
+          status=$?
+          echo "exit_code=$status" >> "$GITHUB_OUTPUT"
+          exit 0
+
+      - name: Upload Bun audit report
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: bun-audit
+          path: bun-audit.json
+          retention-days: 7
+
+      - name: Upload GUI Bun audit report
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: gui-bun-audit
+          path: gui/bun-audit.json
+          retention-days: 7
+
+      - name: Enforce Bun audit
+        if: steps.bun-audit.outputs.exit_code != '0' || steps.gui-bun-audit.outputs.exit_code != '0'
+        run: |
+          echo "== root bun-audit.json =="
+          cat bun-audit.json || true
+          echo "== gui/bun-audit.json =="
+          cat gui/bun-audit.json || true
+          exit 1
+
+  lint-github-actions:
+    name: Lint GitHub Actions
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Lint workflows
+        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -0,0 +1,78 @@
+# Changelog
+
+All notable changes to the OnlineChefGroep fork of **opencodex** are documented here.
+
+**Repository:** [OnlineChefGroep/opencodex](https://github.com/OnlineChefGroep/opencodex)  
+**Package:** `@bitkyc08/opencodex`
+
+> This fork uses **independent semantic versioning** starting at `v1.0.0-alpha.1`.  
+> See [VERSIONING.md](./VERSIONING.md) for details.
+
+---
+
+## [1.0.0-alpha.1] — Planned inaugural fork pre-release
+
+Prepared as the first independent fork release, fully detached from upstream release numbering.
+
+### Added
+
+- **Claude Desktop integration** — full Claude Desktop profile management via GUI and CLI
+- **Combo rename & public aliases** — rename combos and expose public aliases
+- **Output defaults & web-search replay markers** — custom output defaults
+- **Response item ID repair** — opt-in repair for unstable passthrough IDs
+- **Cursor context usage** — accurate context usage reporting across tool turns
+- **Cursor cache telemetry** — clarify missing cache telemetry with GUI indicators
+- **Native effort clamp** — gate native effort clamp by route identity
+- **Dutch GUI localization** — full Dutch translation for the dashboard
+- **Provider workspace shell** — dedicated dashboard panel for per-provider workspace
+- **Quota bars** — visual quota display in the dashboard
+
+### Changed
+
+- **Independent versioning** — detached from upstream version numbers with the fork's own semver scheme
+- **CI pipeline** — enhanced with CodeQL, Dependabot, security audit, workflow linting, and cross-platform package smoke tests
+- **Canonical fork references** — active project, release, documentation, and support URLs point to OnlineChefGroep; historical upstream links remain where attribution or tracking requires them
+- **Release workflow** — adapted for the fork's main-branch release model and prerelease tags
+
+### Fixed
+
+- Theme state: properly read `ocx-theme` from localStorage
+- Stale theme button: React state now updates on theme selection
+- Legacy hash links: restore `#combos`, `#subagents`, `#debug`, `#usage` routing
+- Merge conflict markers removed from Claude Desktop i18n files
+
+### Integrated since fork
+
+- **Claude Desktop integration** — full Claude Desktop profile management via GUI and CLI, family
+  editor, health monitoring, auto-apply, and effort transparency.
+- **Combo rename & public aliases** — rename combos and expose public aliases for model routing.
+- **Output defaults & web-search replay markers** — custom output defaults and hide web-search
+  replay markers.
+- **Response item ID repair** — opt-in repair for unstable passthrough IDs.
+- **Cursor context usage** — accurate context usage reporting across tool turns.
+- **Cursor cache telemetry** — clarify missing cache telemetry with GUI indicators.
+- **Native effort clamp** — gate native effort clamp by route identity.
+- **Native OpenAI slugs in combo resolution** — include native OpenAI slugs in combo member
+  resolution.
+- **Adaptive thinking headroom** — preserve adaptive thinking output headroom for Anthropic.
+- **Sidecar auth fixes** — verify direct helper auth origin, explicit ChatGPT auth intent.
+- **Dutch GUI localization** — full Dutch translation for the dashboard.
+- **Provider workspace shell** — dedicated dashboard panel for per-provider workspace.
+- **Quota bars** — visual quota display in the dashboard.
+- **Theme state fix** — properly read `ocx-theme` from localStorage.
+- **Stale theme button fix** — update React state on theme selection.
+- **Legacy hash link targets** — restore `#combos`, `#subagents`, `#debug`, `#usage` routing.
+
+### Infrastructure
+
+- **Independent versioning** — fully detached from upstream release numbering.
+- **Enhanced CI** — added security audit, CodeQL analysis, GitHub Actions linting, and package-install smoke coverage.
+- **Dependabot** — automated weekly dependency updates.
+- **Release documentation** — `VERSIONING.md` and `RELEASE_PROCESS.md` for repeatable releases.
+
+---
+
+## Earlier versions (upstream tracking)
+
+Versions `v2.7.26` through `v2.7.39` (and earlier) track the upstream
+[lidge-jun/opencodex](https://github.com/lidge-jun/opencodex) releases.
diff --git a/RELEASE_PROCESS.md b/RELEASE_PROCESS.md
@@ -0,0 +1,50 @@
+# Release Process
+
+## Quick start
+
+```bash
+# 1. Bump version in package.json
+npm version patch  # or minor / major
+
+# 2. Update CHANGELOG.md with the new version + notes
+
+# 3. Create a release commit + tag
+git commit -m "chore(release): v$(node -p 'require("./package.json").version')"
+git tag -a "v$(node -p 'require("./package.json").version')" -m "v$(node -p 'require("./package.json").version')"
+
+# 4. Push
+git push origin main --follow-tags
+
+# 5. Dispatch the Release workflow from GitHub Actions
+#    → https://github.com/OnlineChefGroep/opencodex/actions/workflows/release.yml
+#    Enter version, dist-tag (latest/preview), dry-run (set false to publish)
+```
+
+## Automated release
+
+The [Release workflow](.github/workflows/release.yml) uses Trusted Publishing (OIDC) to authenticate
+with npmjs.org — no tokens or secrets needed. It:
+
+1. Verifies `package.json` version matches the workflow input.
+2. Builds the GUI bundle.
+3. Runs `npm publish` with provenance attestation.
+4. Creates a GitHub Release with release notes.
+5. Pushes the version tag back to the repository.
+
+## Manual release (local)
+
+```bash
+npm run build:gui
+npm pack                       # verify the tarball contents
+npm publish --dry-run          # one last check
+npm publish                    # actual publish
+git tag -a v$(node -p 'require("./package.json").version') -m "v$(node -p 'require("./package.json").version')"
+git push origin --tags
+```
+
+## Important notes
+
+- Always run `bun test --isolate tests/` before releasing.
+- Update `CHANGELOG.md` before the release commit.
+- The `latest` dist-tag is for stable releases; use `preview` for beta/experimental builds.
+- Never release from a working branch — always from `main`.
diff --git a/VERSIONING.md b/VERSIONING.md
@@ -0,0 +1,43 @@
+# Versioning Policy
+
+**Package:** `@bitkyc08/opencodex`  
+**Repository:** `OnlineChefGroep/opencodex`  
+**License:** MIT
+
+This fork of [lidge-jun/opencodex](https://github.com/lidge-jun/opencodex) follows **independent
+semantic versioning** — we are **fully detached** from upstream releases.
+
+Starting with the first fork release, our versioning is:
+
+```
+v<major>.<minor>.<patch>
+```
+
+## Rules
+
+| Change | Rule |
+|---|---|
+| **Breaking change** (incompatible API, config, or CLI) | Bump **major** |
+| **New feature** (backward-compatible) | Bump **minor** |
+| **Bug fix** (backward-compatible) | Bump **patch** |
+
+## Current version
+
+Current: **`2.7.33`** (inherited from upstream; transition starts here)
+
+Next release: **`1.0.0`** — our first independent release, signifying the fork's new identity.
+
+## Version transition
+
+Because this fork initially tracked upstream releases, the existing tags (`v2.7.26` … `v2.7.39`)
+are kept for history. All **new** releases use our own scheme starting at `v1.0.0`.
+
+## Release process
+
+1. Update `CHANGELOG.md` with the new version and notes.
+2. Bump version in `package.json`.
+3. Commit and tag: `git tag -a v<version> -m "v<version>"`
+4. Push tag: `git push origin v<version>`
+5. The [Release workflow](.github/workflows/release.yml) handles npm publish + GitHub Release.
+
+See [RELEASE_PROCESS.md](./RELEASE_PROCESS.md) for the full step-by-step guide.
diff --git a/docs-site/public/robots.txt b/docs-site/public/robots.txt
@@ -1,4 +1,4 @@
 User-agent: *
 Allow: /
 
-Sitemap: https://opencodex.me/sitemap-index.xml
+# Sitemap: docs not currently deployed
diff --git a/docs-site/src/content/docs/contributing.md b/docs-site/src/content/docs/contributing.md
@@ -48,7 +48,7 @@ cd docs-site && bun install && bun dev
 
 ## Docs publishing
 
-The public docs publish to GitHub Pages at <https://opencodex.me/>. The
+The public docs publish to GitHub Pages at <https://github.com/OnlineChefGroep/opencodex/>. The
 `.github/workflows/deploy-docs.yml` workflow runs on `main` pushes that touch `docs-site/**` or the
 workflow itself, builds `docs-site`, and deploys the generated site. Before pushing docs changes,
 run:
@@ -71,10 +71,6 @@ GitHub Actions intentionally stay small:
 - **Release** (`.github/workflows/release.yml`) is manual. It does not act as a second full CI
   pipeline; before dry-run or publish it requires the exact release commit (`GITHUB_SHA`) to already
   have a successful Cross-platform CI run.
-- **Stale needs-info** (`.github/workflows/stale-needs-info.yml`) runs daily on the default branch.
-  Open issues labeled `needs-info` with no activity for 14 days get a warning; after 7 more idle
-  days they close as not planned. Any update clears the stale warning. To keep long-lived work open,
-  remove `needs-info` (for example when promoting an issue to `roadmap`).
 
 Use the helper for releases:
 
@@ -179,7 +175,7 @@ preset it cannot stand behind. Promote the row to the registry once the evidence
 
 ## Adding an adapter
 
-Implement `ProviderAdapter` (see [Adapters](/reference/adapters/)) in `src/adapters/`,
+Implement `ProviderAdapter` (see [Adapters](/opencodex/reference/adapters/)) in `src/adapters/`,
 register its name in `src/server/adapter-resolve.ts`, and bridge its output to internal
 `AdapterEvent`s. Reuse `image.ts` for image handling and follow `openai-chat.ts` for ordinary
 streaming/tool calls; use `fetchResponse` only when the adapter owns transport retries, or `runTurn`

diff --git a/gui/.env.example b/gui/.env.example
@@ -0,0 +1,8 @@
+# PostHog EU analytics (optional). Leave unset to disable.
+# Project API key from https://eu.posthog.com — never commit real keys.
+VITE_POSTHOG_KEY=
+# Defaults to https://eu.i.posthog.com when unset.
+# VITE_POSTHOG_HOST=https://eu.i.posthog.com
+
+# Optional API base for the proxy health check (default: same origin).
+# VITE_API_BASE=
diff --git a/gui/AGENTS.md b/gui/AGENTS.md
@@ -14,7 +14,7 @@ This file applies to `gui/` and inherits the repository-wide rules in `/AGENTS.m
 - **No hardcoded visible UI text** in `src/pages`, `src/components`, `src/App.tsx`, or `src/ui.tsx`.
 - Every new user-facing string goes into **all** locale files:
   - `src/i18n/en.ts` — source of truth / `TKey`
-  - plus every other `src/i18n/{locale}.ts` module (discovered automatically by `bun run lint:i18n`; when adding a language, add `{locale}.ts` and wire it in `src/i18n/shared.ts`)
+  - plus every other `src/i18n/{locale}.ts` module (discovered automatically by `bun run lint:i18n`; when adding a language, add `{locale}.ts`, register it in the `DICTS` map in `src/i18n/dicts.ts`, and list it in `LOCALES` in `src/i18n/shared.ts`)
 - Render copy with `useT()` / `t("key")` or `<Trans k="key" cmd="..." />` for `{cmd}` chips.
 - **Allowed literals without i18n keys** (see `.eslint/i18n-allowlist.ts`):
   - **Company / product names** (e.g. OpenAI, Anthropic, GitHub, Codex).