Chore rebrand to shell security

[St0rmz1]

Summary

Completes the rename of the plugin from @kilocode/openclaw-security-advisor to @kilocode/shell-security. Restores the audit logic that the 0.1.5 stub release removed, applies the new name across code and docs, adds a new /shell-security slash command alongside the existing /security-checkup (kept as a legacy alias), and bumps package.json to 0.2.0 ready for the one time manual bootstrap publish under the new npm slug.

Changes

• npm package name, GitHub repo URL, OpenClaw plugin id (shell-security), display name (ShellSecurity), and tool name (kilocode_shell_security).
• PLUGIN_ID and PROVIDER_ID constants in src/auth/token-store.ts. Install directory moves to ~/.openclaw/extensions/shell-security/ and the secret file to ~/.openclaw/secrets/shell-security-auth-token.
• Two slash commands registered, both routed to the same handler: /shell-security (canonical, matches the plugin id) and /security-checkup (legacy alias for users migrating from the old plugin).
• Tool description expanded with trigger phrases so capable models match natural language requests reliably, plus an explicit instruction not to open a terminal when the user says "shell".
• GitHub Actions publish.yml repo guard, registry probe, and recovery copy updated to the new repo slug. script/publish.ts and script/version.ts updated to the new npm package name.
• README, AGENTS, CHANGELOG, and RELEASING updated. README has a new migration section including a note about updating tools.alsoAllow if the old tool was pinned there. RELEASING has a new section documenting the one time OIDC bootstrap required for the first publish of a freshly named npm package.
• Server API route URL is intentionally unchanged so this release does not require a coordinated server change.

Test plan

• bun run typecheck passes
• bun test passes (49 tests)
• bun run format:check passes
• Built tarball with bun pm pack, installed in local docker openclaw gateway
• Both slash commands run end to end, return full reports
• Device auth flow completes, token lands at ~/.openclaw/secrets/shell-security-auth-token
• Natural language invocation via kilocode_shell_security succeeds on capable models; documented small model failure mode in README

Post merge

1. Manual bootstrap publish of @kilocode/shell-security@0.2.0 using a classic npm automation token (OIDC cannot be configured until the package slug exists).
2. Create v0.2.0 git tag and GitHub release by hand.
3. Configure npm Trusted Publishers on npmjs.com pointing at Kilo-Org/shell-security + publish.yml.
4. Subsequent releases go through the normal workflow dispatch.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• CHANGELOG.md
• src/auth/device-auth.ts

---

_{Reviewed by gpt-5.4-2026-03-05 · 1,015,388 tokens}