ci: gate release and harden npm install

Author: DeliciousBuding

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -5,7 +5,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for taking the time to file a bug. Please fill in as much as you can — the more reproducible, the faster it gets fixed.
+        Thanks for taking the time to file a bug. Keep public issues free of screenshots, DOM snapshots, tab titles, full URLs from private pages, tokens, account IDs, and logged-in page content. Use GitHub private vulnerability reporting for sensitive repros.
 
   - type: textarea
     id: what-happened
@@ -71,6 +71,7 @@ body:
     id: discover-output
     attributes:
       label: Output of `codex-browser-bridge -mode discover`
+      description: Redact private pipe names or local identifiers before posting.
       render: text
     validations:
       required: false
@@ -79,7 +80,7 @@ body:
     id: logs
     attributes:
       label: Bridge logs
-      description: Stderr from the bridge (`[codex-bridge] ...` lines), if any.
+      description: Stderr from the bridge (`[codex-bridge] ...` lines), with tokens, URLs, tab titles, DOM text, and account identifiers removed.
       render: text
     validations:
       required: false

.github/workflows/ci.yml

@@ -32,6 +32,11 @@ jobs:
       - name: Build
         shell: bash
         run: go build -trimpath -ldflags "-s -w" -o bin/codex-browser-bridge.exe ./cmd/bridge
+      - name: Test npm installer helpers
+        shell: bash
+        run: |
+          cd npm
+          npm test
       - name: Check npm package contents
         shell: bash
         run: |

.github/workflows/release.yml

@@ -13,7 +13,59 @@ permissions:
   contents: write
 
 jobs:
+  test:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+      - name: Vet
+        shell: bash
+        run: go vet ./...
+      - name: Test with coverage
+        shell: bash
+        run: go test -race -coverprofile=coverage.out -covermode=atomic ./...
+      - name: Build
+        shell: bash
+        run: go build -trimpath -ldflags "-s -w" -o bin/codex-browser-bridge.exe ./cmd/bridge
+      - name: Test npm installer helpers
+        shell: bash
+        run: |
+          cd npm
+          npm test
+      - name: Check npm package contents
+        shell: bash
+        run: |
+          cd npm
+          npm pack --dry-run --json > pack.json
+          node - <<'NODE'
+          const fs = require("fs");
+          const pack = JSON.parse(fs.readFileSync("pack.json", "utf8"))[0];
+          const files = new Set(pack.files.map((f) => f.path));
+          for (const required of ["package.json", "scripts/install.js", "bin/codex-browser-bridge.js"]) {
+            if (!files.has(required)) {
+              throw new Error(`npm package is missing ${required}`);
+            }
+          }
+          NODE
+
+  lint:
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: go.mod
+      - uses: golangci/golangci-lint-action@v9
+        with:
+          version: latest
+
   release:
+    needs: [test, lint]
     runs-on: windows-latest
     steps:
       - uses: actions/checkout@v6

.gitignore

@@ -10,8 +10,11 @@ npm/bin/codex-browser-bridge
 # Test artifacts
 test_*.txt
 cover.out
+coverage.out
 coverage
 *.coverprofile
+npm/pack.json
+npm/*.tgz
 
 # IDE
 .idea/

CHANGELOG.md

@@ -2,6 +2,17 @@
 
 All notable changes to this project will be documented in this file.
 
+## [1.5.2] - 2026-06-09
+
+### Fixed
+
+- Release tags now run test and lint jobs before GitHub Release assets are created.
+- CI now runs Node tests for installer checksum parsing.
+- Public issue and contributing docs now ask reporters to redact browser-local data before posting.
+- Ignore rules now cover generated coverage files, npm pack output, and package archives.
+- npm installer downloads from the project release for the package version by default. Development download overrides require `CODEX_BRIDGE_ALLOW_DEV_DOWNLOADS=1`.
+- README wording now states project relationships and browser-session permissions directly.
+
 ## [1.5.1] - 2026-06-09
 
 ### Fixed

CONTRIBUTING.md

@@ -7,10 +7,12 @@ Thanks for taking the time to contribute. This is a small project, and issues an
 Please open an issue using the bug report template. Include:
 
 - The output of `codex-browser-bridge --version`
-- The output of `codex-browser-bridge -mode discover`
+- The output of `codex-browser-bridge -mode discover`, with local identifiers redacted
 - Codex Desktop version, Chrome version, Windows version
 - A minimal reproduction (which tool you called, what arguments, what response)
 
+Public issues must not include screenshots, DOM snapshots, tab titles, full private URLs, logged-in page content, tokens, account IDs, or production admin pages. Use GitHub private vulnerability reporting for sensitive repros.
+
 ## Reporting security issues
 
 See [SECURITY.md](SECURITY.md). Please don't file these as public issues.

README.md

@@ -54,7 +54,7 @@ Useful when an agent needs to work with pages that require a real browser sessio
 
 ## Status
 
-Version 1.5.1 is a local Windows tool for Codex Desktop and the Codex Chrome Extension. It supports both known Codex browser pipe name formats:
+Version 1.5.2 is a local Windows tool for Codex Desktop and the Codex Chrome Extension. It supports both known Codex browser pipe name formats:
 
 - `codex-browser-use-<uuid>`
 - `codex-browser-use\<uuid>`
@@ -391,9 +391,9 @@ Planned or open work:
 
 MIT License.
 
-## Disclaimer
+## Project Relationship
 
-This is an independent third-party project. It is not affiliated with, endorsed by, or connected to OpenAI, Codex Desktop, Anthropic, Claude Code, Google, or Chrome.
+Maintained independently from OpenAI, Codex Desktop, Anthropic, Claude Code, Google, and Chrome.
 
 ## Acknowledgments
 

README.zh-CN.md

@@ -40,7 +40,7 @@ Codex Desktop 通过本地 named pipe 与其 Chrome 扩展通信。其他 Agent
 
 本项目复用你机器上已经存在的浏览器桥接能力，并将其包装为 MCP 服务器。
 
-Agent 因此可以：
+Agent 可以：
 
 - 查看你当前的浏览器标签页
 - 接管（claim）现有标签页
@@ -54,7 +54,7 @@ Agent 因此可以：
 
 ## 状态
 
-v1.5.1 是面向本地 Windows 的工具，需要 Codex Desktop 和 Codex Chrome 扩展已安装并运行。当前版本支持两种已知的 Codex 浏览器 pipe 名称格式：
+v1.5.2 是面向本地 Windows 的工具，需要 Codex Desktop 和 Codex Chrome 扩展已安装并运行。当前版本支持两种已知的 Codex 浏览器 pipe 名称格式：
 
 - `codex-browser-use-<uuid>`
 - `codex-browser-use\<uuid>`
@@ -300,10 +300,10 @@ Chrome 标签页
 
 本工具赋予 Agent 访问你活跃浏览器会话的能力。
 
-请像使用其他浏览器自动化工具一样谨慎使用：
+按本地浏览器自动化工具处理它的权限：
 
-- 不要将桥接器暴露到网络端口
-- 不要为不受信任的 MCP 客户端运行
+- 只在本机 stdio MCP 连接中运行
+- 只连接可信 MCP 客户端
 - 在允许敏感操作前检查 Agent 的行为
 - 避免在包含密码、支付信息、私有令牌或生产管理后台的页面上使用
 - 被接管的标签页可能已经登录，请按已登录会话处理
@@ -360,9 +360,9 @@ make build
 
 MIT License
 
-## 免责声明
+## 项目关系
 
-本项目为独立第三方项目，与 OpenAI、Codex Desktop、Anthropic、Claude Code、Google 或 Chrome 无关联、无认可、无从属关系。
+本项目独立维护，与 OpenAI、Codex Desktop、Anthropic、Claude Code、Google 和 Chrome 分属不同项目。
 
 ## 致谢
 

npm/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@delicious233/codex-browser-bridge",
-  "version": "1.5.1",
+  "version": "1.5.2",
   "private": false,
   "description": "MCP server that exposes Codex Desktop's Chrome browser bridge for Claude Code and other agents.",
   "bin": {
     "codex-browser-bridge": "bin/codex-browser-bridge.js"
   },
   "scripts": {
+    "test": "node scripts/install.test.js",
     "postinstall": "node scripts/install.js"
   },
   "files": [

npm/scripts/install.js

@@ -1,12 +1,11 @@
 #!/usr/bin/env node
 
 const fs = require("fs");
-const os = require("os");
 const path = require("path");
 const crypto = require("crypto");
 const https = require("https");
 
-const repo = process.env.CODEX_BRIDGE_REPO || "DeliciousBuding/codex-browser-bridge";
+const defaultRepo = "DeliciousBuding/codex-browser-bridge";
 const binDir = path.join(__dirname, "..", "bin");
 const packageJson = require("../package.json");
 
@@ -61,7 +60,9 @@ async function main() {
       process.exit(1);
   }
 
-  const tag = process.env.CODEX_BRIDGE_TAG || `v${packageJson.version}`;
+  const devDownloads = process.env.CODEX_BRIDGE_ALLOW_DEV_DOWNLOADS === "1";
+  const repo = devDownloads && process.env.CODEX_BRIDGE_REPO ? process.env.CODEX_BRIDGE_REPO : defaultRepo;
+  const tag = devDownloads && process.env.CODEX_BRIDGE_TAG ? process.env.CODEX_BRIDGE_TAG : `v${packageJson.version}`;
   const exeName = "codex-browser-bridge.exe";
   const asset = arch === "arm64" ? "codex-browser-bridge-arm64.exe" : "codex-browser-bridge.exe";
 
@@ -93,7 +94,14 @@ async function main() {
   console.log(`Installed: ${target}`);
 }
 
-main().catch((err) => {
-  console.error(`install failed: ${err.message}`);
-  process.exit(1);
-});
+if (require.main === module) {
+  main().catch((err) => {
+    console.error(`install failed: ${err.message}`);
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  parseChecksumLine,
+  sha256,
+};