[WRONG BRANCH] feat(provider-security): ChefVault client + in-memory slots (PSP-008)

.github/dependabot.yml

@@ -0,0 +1,52 @@
+# Dependabot configuration
+# See: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "Europe/Amsterdam"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "automated"
+    versioning-strategy: increase
+    groups:
+      minor-patch:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "npm"
+    directory: "/gui"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "09:00"
+      timezone: "Europe/Amsterdam"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "automated"
+      - "gui"
+    versioning-strategy: increase
+    groups:
+      minor-patch:
+        applies-to: version-updates
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    labels:
+      - "dependencies"
+      - "automated"
+      - "ci"

.github/scripts/issue-quality.test.cjs

@@ -742,7 +742,7 @@ describe("validateIssue - documentation", () => {
       "### Documentation problem type",
       "Incorrect documentation",
       "### Documentation location",
-      "https://lidge-jun.github.io/opencodex/providers/",
+      "https://github.com/OnlineChefGroep/opencodex",
       "### What is wrong or missing?",
       "The page says kimi uses /v1/chat/completions but it actually uses /v1/responses.",
       "### What should the documentation explain instead?",
@@ -893,7 +893,7 @@ describe("shouldReopen", () => {
       state: "closed",
       closed_at: "2026-07-20T10:00:00Z",
       state_reason: "not_planned",
-      closed_by: "lidge-jun",
+      closed_by: "OnlineChefGroep",
     };
     assert.equal(shouldReopen(baseBotState, issue, false), false);
   });

.github/workflows/ci.yml

@@ -136,3 +136,60 @@ jobs:
 
       - name: ocx help via bundled bun
         run: ocx help
+
+  security:
+    name: Security audit
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      - name: Generate Bun audit report
+        id: bun-audit
+        continue-on-error: true
+        shell: bash
+        run: |
+          set +e
+          # Full JSON evidence: `bun audit --json` ignores --audit-level, so this
+          # captures findings at every severity for the uploaded artifact.
+          bun audit --json > bun-audit.json
+          # Gate decision: bun audit only honors --audit-level in non-JSON mode,
+          # so derive the pass/fail from the human-readable run (high/critical only).
+          bun audit --audit-level=high
+          status=$?
+          echo "exit_code=$status" >> "$GITHUB_OUTPUT"
+          exit 0
+
+      - name: Upload Bun audit report
+        if: always()
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: bun-audit
+          path: bun-audit.json
+          retention-days: 7
+
+      - name: Enforce Bun audit
+        if: steps.bun-audit.outputs.exit_code != '0'
+        run: |
+          cat bun-audit.json
+          exit 1
+
+  lint-github-actions:
+    name: Lint GitHub Actions
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+
+      - name: Lint workflows
+        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0

.github/workflows/enforce-issue-quality.yml

@@ -1040,7 +1040,7 @@ jobs:
               "",
               guidanceList,
               "",
-              "See the [Contributing guide](https://lidge-jun.github.io/opencodex/contributing/) for details.",
+              "See the [README](https://github.com/OnlineChefGroep/opencodex) for details.",
               "",
               "Once the report passes the automated checks, it will be reopened automatically unless a maintainer has changed its state.",
             ].join("\n"));

.github/workflows/release.yml

@@ -110,32 +110,30 @@ jobs:
         run: |
           set -euo pipefail
 
+          # All releases run from main. Stable versions (no pre-release suffix) get dist-tag "latest".
+          # Pre-release versions (e.g. 1.0.0-alpha.1) get dist-tag "preview".
           case "$GITHUB_REF" in
             refs/heads/main)
-              expected_tag="latest"
               if [[ "$RELEASE_VERSION" == *-* ]]; then
-                echo "::error::main releases must use a stable semver version; got ${RELEASE_VERSION}"
-                exit 1
-              fi
-              ;;
-            refs/heads/preview)
-              expected_tag="preview"
-              if [[ "$RELEASE_VERSION" != *-preview.* ]]; then
-                echo "::error::preview releases must use a preview prerelease version; got ${RELEASE_VERSION}"
-                exit 1
+                # Pre-release version — must use "preview" dist-tag
+                if [ "$NPM_DIST_TAG" != "preview" ]; then
+                  echo "::error::Pre-release versions (${RELEASE_VERSION}) must use dist-tag 'preview', got '${NPM_DIST_TAG}'"
+                  exit 1
+                fi
+              else
+                # Stable version — must use "latest" dist-tag
+                if [ "$NPM_DIST_TAG" != "latest" ]; then
+                  echo "::error::Stable releases (${RELEASE_VERSION}) must use dist-tag 'latest', got '${NPM_DIST_TAG}'"
+                  exit 1
+                fi
               fi
               ;;
             *)
-              echo "::error::Release must run from main or preview; got ${GITHUB_REF}"
+              echo "::error::Release must run from main; got ${GITHUB_REF}"
               exit 1
               ;;
           esac
 
-          if [ "$NPM_DIST_TAG" != "$expected_tag" ]; then
-            echo "::error::${GITHUB_REF#refs/heads/} releases must publish with npm dist-tag '${expected_tag}', got '${NPM_DIST_TAG}'"
-            exit 1
-          fi
-
           ci_url="$(
             gh run list \
               --workflow ci.yml \
@@ -320,7 +318,7 @@ jobs:
           # Preview builds must be marked prerelease so GitHub "latest" keeps pointing at the
           # stable channel (matching npm dist-tags); see issue #64.
           prerelease_flag=""
-          if [[ "$RELEASE_VERSION" == *-preview.* ]]; then
+          if [[ "$RELEASE_VERSION" == *-* ]]; then
             prerelease_flag="--prerelease"
           fi
 

CHANGELOG.md

@@ -0,0 +1,78 @@
+# Changelog
+
+All notable changes to the OnlineChefGroep fork of **opencodex** are documented here.
+
+**Repository:** [OnlineChefGroep/opencodex](https://github.com/OnlineChefGroep/opencodex)  
+**Package:** `@bitkyc08/opencodex`
+
+> This fork uses **independent semantic versioning** starting at `v1.0.0-alpha.1`.  
+> See [VERSIONING.md](./VERSIONING.md) for details.
+
+---
+
+## [1.0.0-alpha.1] — Planned inaugural fork pre-release
+
+Prepared as the first independent fork release, fully detached from upstream release numbering.
+
+### Added
+
+- **Claude Desktop integration** — full Claude Desktop profile management via GUI and CLI
+- **Combo rename & public aliases** — rename combos and expose public aliases
+- **Output defaults & web-search replay markers** — custom output defaults
+- **Response item ID repair** — opt-in repair for unstable passthrough IDs
+- **Cursor context usage** — accurate context usage reporting across tool turns
+- **Cursor cache telemetry** — clarify missing cache telemetry with GUI indicators
+- **Native effort clamp** — gate native effort clamp by route identity
+- **Dutch GUI localization** — full Dutch translation for the dashboard
+- **Provider workspace shell** — dedicated dashboard panel for per-provider workspace
+- **Quota bars** — visual quota display in the dashboard
+
+### Changed
+
+- **Independent versioning** — detached from upstream version numbers with the fork's own semver scheme
+- **CI pipeline** — enhanced with CodeQL, Dependabot, security audit, workflow linting, and cross-platform package smoke tests
+- **Canonical fork references** — active project, release, documentation, and support URLs point to OnlineChefGroep; historical upstream links remain where attribution or tracking requires them
+- **Release workflow** — adapted for the fork's main-branch release model and prerelease tags
+
+### Fixed
+
+- Theme state: properly read `ocx-theme` from localStorage
+- Stale theme button: React state now updates on theme selection
+- Legacy hash links: restore `#combos`, `#subagents`, `#debug`, `#usage` routing
+- Merge conflict markers removed from Claude Desktop i18n files
+
+### Integrated since fork
+
+- **Claude Desktop integration** — full Claude Desktop profile management via GUI and CLI, family
+  editor, health monitoring, auto-apply, and effort transparency.
+- **Combo rename & public aliases** — rename combos and expose public aliases for model routing.
+- **Output defaults & web-search replay markers** — custom output defaults and hide web-search
+  replay markers.
+- **Response item ID repair** — opt-in repair for unstable passthrough IDs.
+- **Cursor context usage** — accurate context usage reporting across tool turns.
+- **Cursor cache telemetry** — clarify missing cache telemetry with GUI indicators.
+- **Native effort clamp** — gate native effort clamp by route identity.
+- **Native OpenAI slugs in combo resolution** — include native OpenAI slugs in combo member
+  resolution.
+- **Adaptive thinking headroom** — preserve adaptive thinking output headroom for Anthropic.
+- **Sidecar auth fixes** — verify direct helper auth origin, explicit ChatGPT auth intent.
+- **Dutch GUI localization** — full Dutch translation for the dashboard.
+- **Provider workspace shell** — dedicated dashboard panel for per-provider workspace.
+- **Quota bars** — visual quota display in the dashboard.
+- **Theme state fix** — properly read `ocx-theme` from localStorage.
+- **Stale theme button fix** — update React state on theme selection.
+- **Legacy hash link targets** — restore `#combos`, `#subagents`, `#debug`, `#usage` routing.
+
+### Infrastructure
+
+- **Independent versioning** — fully detached from upstream release numbering.
+- **Enhanced CI** — added security audit, CodeQL analysis, GitHub Actions linting, and package-install smoke coverage.
+- **Dependabot** — automated weekly dependency updates.
+- **Release documentation** — `VERSIONING.md` and `RELEASE_PROCESS.md` for repeatable releases.
+
+---
+
+## Earlier versions (upstream tracking)
+
+Versions `v2.7.26` through `v2.7.39` (and earlier) track the upstream
+[lidge-jun/opencodex](https://github.com/lidge-jun/opencodex) releases.

RELEASE_PROCESS.md

@@ -0,0 +1,50 @@
+# Release Process
+
+## Quick start
+
+```bash
+# 1. Bump version in package.json
+npm version patch  # or minor / major
+
+# 2. Update CHANGELOG.md with the new version + notes
+
+# 3. Create a release commit + tag
+git commit -m "chore(release): v$(node -p 'require("./package.json").version')"
+git tag -a "v$(node -p 'require("./package.json").version')" -m "v$(node -p 'require("./package.json").version')"
+
+# 4. Push
+git push origin main --follow-tags
+
+# 5. Dispatch the Release workflow from GitHub Actions
+#    → https://github.com/OnlineChefGroep/opencodex/actions/workflows/release.yml
+#    Enter version, dist-tag (latest/preview), dry-run (set false to publish)
+```
+
+## Automated release
+
+The [Release workflow](.github/workflows/release.yml) uses Trusted Publishing (OIDC) to authenticate
+with npmjs.org — no tokens or secrets needed. It:
+
+1. Verifies `package.json` version matches the workflow input.
+2. Builds the GUI bundle.
+3. Runs `npm publish` with provenance attestation.
+4. Creates a GitHub Release with release notes.
+5. Pushes the version tag back to the repository.
+
+## Manual release (local)
+
+```bash
+npm run build:gui
+npm pack                       # verify the tarball contents
+npm publish --dry-run          # one last check
+npm publish                    # actual publish
+git tag -a v$(node -p 'require("./package.json").version') -m "v$(node -p 'require("./package.json").version')"
+git push origin --tags
+```
+
+## Important notes
+
+- Always run `bun test --isolate tests/` before releasing.
+- Update `CHANGELOG.md` before the release commit.
+- The `latest` dist-tag is for stable releases; use `preview` for beta/experimental builds.
+- Never release from a working branch — always from `main`.

ROADMAP.md

@@ -0,0 +1,41 @@
+# Roadmap
+
+**Independent OnlineChefGroep fork** of [opencodex](https://github.com/lidge-jun/opencodex)
+
+## Vision
+
+A fully self-sufficient fork with our own release cadence, feature set, and quality bar —
+not dependent on upstream decisions or timelines, while retaining a deliberate intake path for
+relevant security and compatibility fixes.
+
+## Short term (done)
+
+- [x] **Independent versioning** — fully detached from upstream version numbers, with our own semver scheme
+- [x] **Integrated inherited branch work** — Dutch GUI, Claude Desktop, combo/alias, Cursor fixes, and related stacked work reconciled into `main`
+- [x] **Enhanced CI** — CodeQL, Dependabot, security audit, workflow linting, and cross-platform package smoke tests
+- [x] **Release process** — `VERSIONING.md`, `RELEASE_PROCESS.md`, and `CHANGELOG.md`
+- [x] **Fork identity documentation** — canonical repository links and translated README fork notices updated
+
+## Near term (next)
+
+- [ ] **Publish first fork release (`v1.0.0-alpha.1`)** — tag, run the guarded release workflow, verify npm install, and record release evidence
+- [ ] **Canonical npm ownership** — migrate the package to an OnlineChefGroep-controlled npm scope and retain a compatibility path for `@bitkyc08/opencodex`
+- [ ] **Clean up old tags** — remove or archive stale upstream tags that do not identify fork releases
+- [ ] **Dependency audit hardening** — review root and GUI dependencies, then make high-severity audit failures enforceable instead of informational
+- [ ] **TypeScript strict mode** — enable `strict` in `tsconfig` and fix all violations
+- [ ] **Upstream intake policy** — document how security, protocol, and client-compatibility fixes are evaluated and imported without restoring release dependence
+
+## Medium term
+
+- [ ] **Custom provider: OnlineChef AI gateway** — first-party provider integration
+- [ ] **Performance benchmarks** — proxy latency regression tests in CI
+- [ ] **Improved documentation** — deploy docs to GitHub Pages for the fork
+- [ ] **Automated dependency upgrades** — Dependabot auto-merge for verified non-breaking updates
+- [ ] **Smoke test suite** — end-to-end tests that start the proxy and exercise real provider-compatible requests
+
+## Long term
+
+- [ ] **Own GUI theme** — custom branding for the dashboard
+- [ ] **Plugin system** — third-party provider adapters
+- [ ] **Service mode improvements** — better systemd/launchd integration
+- [ ] **Multi-host fleet management** — centralized config across machines