fix: route security reports to GitHub Private Vulnerability Reporting (v0.5.1)

elad-reznikov · elad-reznikov · commit 8a01f449da5e · 2026-06-25T15:50:57.000+03:00
diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
@@ -1,8 +1,8 @@
 {
   "$schema": "https://json.schemastore.org/claude-code-marketplace.json",
   "name": "deepfusionlabs-deep-init",
-  "owner": { "name": "Deep Fusion Labs" },
-  "description": "Deep Fusion Labs — DeepInit plugin marketplace.",
+  "owner": { "name": "DeepFusion Labs" },
+  "description": "DeepFusion Labs — DeepInit plugin marketplace.",
   "plugins": [
     {
       "name": "deep-init",
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
@@ -1,9 +1,9 @@
 {
   "name": "deep-init",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Generates a grounded, verified, two-tier agent context layer (lean CLAUDE.md + deep .ai/docs) for any codebase, plus report-only issue detection. 100% local, read-only.",
   "author": {
-    "name": "Deep Fusion Labs",
+    "name": "DeepFusion Labs",
     "url": "https://deepfusionlabs.ai"
   },
   "homepage": "https://github.com/deepfusionlabs/deep-init",
diff --git a/.oss-kit/config.json b/.oss-kit/config.json
@@ -1,10 +1,10 @@
 {
   "schemaVersion": 1,
   "identity": {
-    "copyrightHolder": "Deep Fusion Labs",
+    "copyrightHolder": "DeepFusion Labs",
     "brand": "DeepInit",
-    "author": "Deep Fusion Labs",
-    "maintainerName": "Deep Fusion Labs",
+    "author": "DeepFusion Labs",
+    "maintainerName": "DeepFusion Labs",
     "securityEmail": "elad@deepfusionlabs.ai",
     "license": "MIT"
   },
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,13 +4,19 @@ All notable changes to DeepInit are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this project uses **manual** `0.x`
 versioning (no release tooling derives this file).
 
+## [0.5.1] — Security reporting + output copy
+
+- **Security** — vulnerability reports can now be filed through GitHub Private Vulnerability
+  Reporting (the repo's **Security → Report a vulnerability** tab), alongside email.
+- Clearer `version` and `plugin-update` command output.
+
 ## [0.5.0] — Initial public release
 
 The first public release of **DeepInit** — a Claude Code skill that reads a codebase and emits a
 grounded, verified, two-tier agent context layer (a lean `CLAUDE.md` + a deep `.ai/docs/` layer),
 every claim tied to a `file:line`, plus a report-only issue layer. 100% local, read-only, MIT.
 
-Developed and dogfooded internally at Deep Fusion Labs before this first public release.
+Developed and dogfooded internally at DeepFusion Labs before this first public release.
 
 - **Two-tier context** — a lean, always-loaded `CLAUDE.md` + an on-demand `.ai/docs/` deep layer
   (per-component analysis, whole-system docs, decisions/ADRs, live DB/ORM drift).
diff --git a/LICENSE b/LICENSE
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Deep Fusion Labs
+Copyright (c) 2026 DeepFusion Labs
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
diff --git a/Makefile b/Makefile
@@ -32,9 +32,9 @@ golden: ## Regenerate the canonical e2e golden snapshot (deliberate)
 	$(PYTHON) tools/build_golden_snapshot.py validation/end-to-end/kemal --write
 
 report-preview: ## Build the report against a fixture WITH a populated graph + docs (open it to eyeball the Map view)
-	$(PYTHON) tools/build_report.py validation/dogfooding/oss-kit
-	@echo "open validation/dogfooding/oss-kit/.ai/report.html in a browser — click the Map tab (pan/zoom, click a node -> its docs)"
+	$(PYTHON) tools/build_report.py validation/end-to-end/kemal
+	@echo "open validation/end-to-end/kemal/.ai/report.html in a browser — click the Map tab (pan/zoom, click a node -> its docs)"
 
 report-smoke: ## Headless jsdom render test of the report (Docs/Insights/Map + node-navigation + honest-degrade)
-	$(PYTHON) tools/build_report.py validation/dogfooding/oss-kit
-	node tools/smoke_report.mjs validation/dogfooding/oss-kit/.ai/report.html
+	$(PYTHON) tools/build_report.py validation/end-to-end/kemal
+	node tools/smoke_report.mjs validation/end-to-end/kemal/.ai/report.html
diff --git a/README.md b/README.md
@@ -207,4 +207,4 @@ docs/                     # the design corpus (spec, requirements, design, test
 
 ## License
 
-MIT © Deep Fusion Labs. See [`LICENSE`](LICENSE) and [`AI_POLICY.md`](AI_POLICY.md).
+MIT © DeepFusion Labs. See [`LICENSE`](LICENSE) and [`AI_POLICY.md`](AI_POLICY.md).
diff --git a/SECURITY.md b/SECURITY.md
@@ -10,7 +10,7 @@ Please report privately — **do not** open a public issue for a security report
 
 Include: a description, affected file(s)/stage, reproduction steps, and impact. We aim to acknowledge within a few business days and will coordinate a fix and disclosure timeline with you.
 
-(This repository is currently private; GitHub Private Vulnerability Reporting — a public-repo feature — will be enabled if/when the project goes public. Until then, use the email above.)
+Prefer not to email? Use GitHub's **[Private Vulnerability Reporting](https://github.com/deepfusionlabs/deep-init/security/advisories/new)** — open the repository's **Security → Report a vulnerability** tab and your report stays private to the maintainers.
 
 ## Supported versions
 
diff --git a/commands/plugin-update.md b/commands/plugin-update.md
@@ -6,7 +6,7 @@ Bring the running DeepInit up to date. Claude Code has no first-party "pull the
 
 1. **Detect the install kind:**
    - **Marketplace install** (the plugin loads from `~/.claude/plugins/`) → go to step 2.
-   - **Local dogfood** (you're running this repo's `skills/deep-init/` directly) → there is nothing to fetch; skip to step 4 (a reload just picks up your local edits).
+   - **Local clone** (you're running this repo's `skills/deep-init/` directly) → there is nothing to fetch; skip to step 4 (a reload just picks up your local edits).
 
 2. **Detect your host first — it changes BOTH how you update and how you activate.** Read your runtime host from your system context (e.g. a note that you're "running inside a VSCode native extension environment"), then follow **only** the matching block. Resolve the target `deep-init@<marketplace>` — read the marketplace alias from the installed plugin state under `~/.claude/plugins/`, else fall back to the `name` in `.claude-plugin/marketplace.json`.
 
diff --git a/commands/version.md b/commands/version.md
@@ -6,14 +6,14 @@ Report the running DeepInit version — fast, no analysis. Do exactly this, then
 
 1. State the **loaded** version verbatim. This line ships inside the plugin markdown that is actually loaded in your session, so it is the source of truth for "what is running right now":
 
-   **DeepInit v0.5.0** <!-- deepinit:loaded-version -->
+   **DeepInit v0.5.1** <!-- deepinit:loaded-version -->
 
 2. Read the **on-disk** version (best-effort — skip gracefully if a path isn't present):
-   - dogfooding this repo → `.claude-plugin/plugin.json` (the `"version"` field)
+   - a local clone of this repo → `.claude-plugin/plugin.json` (the `"version"` field)
    - the marketplace-installed copy → the newest `plugin.json` under `~/.claude/plugins/` (the active pin is recorded in `~/.claude/plugins/installed_plugins.json`; a newer copy in the cache that the pin hasn't moved to means the update was fetched but not yet applied)
 
 3. Compare and advise:
-   - **loaded == on-disk** → "You're running the latest — go ahead and dogfood."
+   - **loaded == on-disk** → "You're running the latest version — you're all set."
    - **loaded is behind on-disk** → "The running plugin is STALE: a newer version is on disk but not live. Claude Code loads plugin markdown **ONCE per session** and does not re-read it mid-session, so one activation step remains — and it depends on your host. **Detect your host first** (from your system context), then do only the matching one:
      - **Plain terminal / CLI** → run `/reload-plugins`, or (more reliable for a version/command flip) start a **new session**. A reload picks up skills and hooks but doesn't rebuild the slash-command index, so this canary may not flip from `/reload-plugins` alone — a new session is the sure path.
      - **VS Code / JetBrains extension** → **restart the IDE itself** (a full quit + reopen). `Developer: Reload Window` **does not reload the plugin host**, so the loaded number won't flip from a window reload (or a new chat in the same window).
diff --git a/package.json b/package.json
@@ -1,10 +1,10 @@
 {
   "name": "deep-init",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "private": true,
   "description": "DeepInit — a Claude Code skill that generates a grounded, verified, two-tier agent context layer (lean CLAUDE.md + deep .ai/docs) for any codebase, plus report-only issue detection. 100% local, read-only, MIT.",
   "license": "MIT",
-  "author": "Deep Fusion Labs",
+  "author": "DeepFusion Labs",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/deepfusionlabs/deep-init.git"
diff --git a/skills/deep-init/assets/report-template.html b/skills/deep-init/assets/report-template.html
@@ -19,7 +19,7 @@
   SEPARATE artifact from the issue dashboard.
 -->
 <style>
-/* ---- Deep Fusion Labs brand system (navy + lime). Light: white/navy text,
+/* ---- DeepFusion Labs brand system (navy + lime). Light: white/navy text,
    readable blue links, lime accents/fills. Dark: navy #070E1B hero + lime #C4E934.
    System fonts only (no embedded/CDN font — license-clean, offline). ---- */
 :root{
@@ -233,7 +233,7 @@
 @media (max-width:720px){.shell{grid-template-columns:1fr}nav.rail{display:none}.searchwrap{width:auto;flex:1}}
 @media (prefers-reduced-motion:reduce){*{transition:none!important;scroll-behavior:auto!important;animation:none!important}}
 
-/* ===== Co-branded masthead (Deep Fusion Labs) ===== */
+/* ===== Co-branded masthead (DeepFusion Labs) ===== */
 .brand{display:flex;align-items:center;gap:.6rem;text-decoration:none;white-space:nowrap;color:var(--fg)}
 .brand:hover{text-decoration:none}
 .brand .logo{width:1.85rem;height:1.85rem;flex:0 0 auto;border-radius:8px;box-shadow:0 1px 3px rgba(15,34,64,.22)}
@@ -409,15 +409,15 @@
 <a class="skip" href="#maincontent">Skip to content</a>
 
 <header class="top">
-  <a class="brand" href="#overview" aria-label="DeepInit — by Deep Fusion Labs">
+  <a class="brand" href="#overview" aria-label="DeepInit — by DeepFusion Labs">
     <svg class="logo" viewBox="0 0 32 32" role="img" aria-hidden="true">
       <rect width="32" height="32" rx="8.5" fill="#c4e934"/>
       <path d="M4 22L16 28L28 22L16 16Z" fill="#0b1a30" opacity=".30"/>
       <path d="M4 16L16 22L28 16L16 10Z" fill="#0b1a30" opacity=".55"/>
       <path d="M4 10L16 16L28 10L16 4Z" fill="#0b1a30" opacity=".85"/>
       <circle cx="16" cy="4.4" r="2.5" fill="#0b1a30"/>
     </svg>
-    <span class="brandtext"><span class="bn">DeepInit</span><span class="bsub">by Deep Fusion Labs</span></span>
+    <span class="brandtext"><span class="bn">DeepInit</span><span class="bsub">by DeepFusion Labs</span></span>
   </a>
   <span class="topdiv" aria-hidden="true"></span>
   <nav class="viewswitch" role="tablist" aria-label="Switch view">
@@ -1274,7 +1274,7 @@ <h3>Keyboard shortcuts</h3>
   if(pj.name){ var rp=$("#reporepo"); rp.hidden=false; rp.textContent=pj.name+(pj.repo_sha?(" @ "+pj.repo_sha.slice(0,10)):""); }
   $("#genbanner").textContent="Generated artifact — regenerated on each DeepInit run; edits here are not preserved. "+(pj.generated?("Generated "+pj.generated+". "):"")+"Report-only · 100% local · self-contained (no network).";
   var fwrap=el("div","footwrap"); fwrap.appendChild(appIcon(24));
-  var ftx=el("div"); ftx.appendChild(el("div","f1","DeepInit — by Deep Fusion Labs"));
+  var ftx=el("div"); ftx.appendChild(el("div","f1","DeepInit — by DeepFusion Labs"));
   ftx.appendChild(el("div","f2","Grounded, verified context · every claim cites a file:line"+(pj.deepinit_version?(" · engine "+pj.deepinit_version):"")+(pj.run_id?(" · run "+pj.run_id):"")+" · deepfusionlabs.ai"));
   fwrap.appendChild(ftx); $("#footer").appendChild(fwrap);
   if(window.matchMedia && matchMedia("(prefers-reduced-motion:reduce)").matches) document.body.classList.add("reduced");
diff --git a/skills/deep-init/references/generation.md b/skills/deep-init/references/generation.md
@@ -175,7 +175,7 @@ Emit exactly this shape (the **machine-readable** contract GitHub code scanning
 
 **`.ai/docs-viewer.html` — the docs-navigation viewer (C-VIEW). [DEPRECATED → superseded by `.ai/report.html` (C-REPORT, ADR-019).]** A single self-contained vanilla-JS / inline-CSS **READER** over the *generated documentation* — the lean `AGENTS.md` + the component-doc tree + the ADR/KL decisions narrative + the issue ledger — with search, a component tree, jump-to-`file:line`, an architecture overview, a decisions timeline, and cross-reference linking. The docs are for the coding agent to consume; this is the **human-facing first impression**. Built by `tools/build_docs_viewer.py` from `skills/deep-init/assets/docs-viewer-template.html`; the corpus is embedded as one escaped inline JSON island (`<`/`>` escaped so an analyzed-repo `</script>` can't break the page) and rendered safely (createElement + textContent, element + URL-scheme allow-lists — no `innerHTML`/`eval`). A **docs reader, NOT a graph explorer** (DeepMap, S-8); a **separate artifact** from the issue dashboard. Generated (R3 provenance), regenerated not hand-edited; **redaction runs over the corpus before embed.** Full spec in `viewer.md`; default-on is gated on zero off-host refs (harness §43). **Deprecation (one-minor-version window):** same as C-DASH — superseded by the unified report; emitted as a redirect stub (`legacy-stub-template.html` → `report.html`) during the window (full template still ships; §43 still gates it), removed in a later release. The `--viewer` flag is preserved.
 
-**`.ai/report.html` — the unified Docs + Insights report (C-REPORT) — the canonical human artifact.** The self-contained, co-branded artifact ("DeepInit, by Deep Fusion Labs") that **MERGES** the docs reader (**Docs** view) + the issue/metrics dashboard (**Insights** view) into one file with a top-level view switch + a ⌘K command palette; built deterministically by `tools/build_report.py` (reuses the `build_docs_viewer` parsers) from `skills/deep-init/assets/report-template.html`. Vendored libraries (markdown-it / DOMPurify / highlight.js) are **inlined at build time, never CDN** — the constraint is no view-time network, NOT zero-dependency. **Supersedes C-VIEW + C-DASH**, which are now DEPRECATED: for one minor version their paths emit a redirect stub to `report.html` (`skills/deep-init/assets/legacy-stub-template.html`), then they are removed (the full templates + §16/§43 stay until then — expand-only). Full spec in `report.md` (ADR-019); verified by `tools/smoke_report.mjs`.
+**`.ai/report.html` — the unified Docs + Insights report (C-REPORT) — the canonical human artifact.** The self-contained, co-branded artifact ("DeepInit, by DeepFusion Labs") that **MERGES** the docs reader (**Docs** view) + the issue/metrics dashboard (**Insights** view) into one file with a top-level view switch + a ⌘K command palette; built deterministically by `tools/build_report.py` (reuses the `build_docs_viewer` parsers) from `skills/deep-init/assets/report-template.html`. Vendored libraries (markdown-it / DOMPurify / highlight.js) are **inlined at build time, never CDN** — the constraint is no view-time network, NOT zero-dependency. **Supersedes C-VIEW + C-DASH**, which are now DEPRECATED: for one minor version their paths emit a redirect stub to `report.html` (`skills/deep-init/assets/legacy-stub-template.html`), then they are removed (the full templates + §16/§43 stay until then — expand-only). Full spec in `report.md` (ADR-019); verified by `tools/smoke_report.mjs`.
 
 **`.ai/docs-viewer.html` / `.ai/dashboard.html` redirect stub (deprecation window).** `skills/deep-init/assets/legacy-stub-template.html` — a tiny self-contained page (strict CSP `default-src 'none'`, 0 off-host refs, no JS sink) with a `<meta http-equiv="refresh">` + a visible **relative** `report.html` link. Emitted verbatim at both legacy paths during the deprecation window so old links/bookmarks land on the unified report; removed once the window closes. (Harness §70 gates the stub's self-containment + the deprecation being stated, not silent.)
 
diff --git a/skills/deep-init/references/i18n.md b/skills/deep-init/references/i18n.md
@@ -49,7 +49,7 @@ Translate ONLY human prose; never the grounding. Before the LLM sees a string, `
 protected span for an `⟦N⟧` sentinel; `restore()` puts the exact span back; `verify()` asserts every
 token survives **verbatim** in the result. Protected: **code** (fenced + inline), **`file:line`
 citations**, **record IDs** (`BR-/WF-/IP-/ADR-/KL-/ISS-/IF-`), and **product nouns**
-(`DeepInit`, `DeepMap`, `Deep Fusion Labs`, `CLAUDE.md`, `AGENTS.md`, `.ai/`). A glossary keeps
+(`DeepInit`, `DeepMap`, `DeepFusion Labs`, `CLAUDE.md`, `AGENTS.md`, `.ai/`). A glossary keeps
 domain terms consistent. **A miss or a corrupted token → the field HONEST-DEGRADES to English
 (never blank, never fabricated — R1 / KL-learning:001).**
 
diff --git a/skills/deep-init/references/report.md b/skills/deep-init/references/report.md
@@ -1,7 +1,7 @@
 # report.md — C-REPORT (unified, co-branded Docs + Insights report)
 
 Emits ONE **`.ai/report.html`** — a self-contained, offline, co-branded report
-("DeepInit, by Deep Fusion Labs") that **MERGES** the docs reader and the
+("DeepInit, by DeepFusion Labs") that **MERGES** the docs reader and the
 metrics/issue dashboard into a single artifact with a top-level **Docs** (default)
 · **Insights** · **Map** view switch. It supersedes the two separate artifacts (`viewer.md`
 C-VIEW + `dashboard.md` C-DASH), which remain legacy until the harness/STATS
@@ -79,9 +79,9 @@ parser now handles those shapes, pinned by harness §43 G6).
   `prefers-reduced-motion`-aware.
 
 ## Brand
-Deep Fusion Labs: lime `#C4E934` + navy `#070E1B`, the layered-diamond app-icon logo
+DeepFusion Labs: lime `#C4E934` + navy `#070E1B`, the layered-diamond app-icon logo
 (inline SVG), co-branded masthead + footer (product-forward: **DeepInit** hero +
-"by Deep Fusion Labs"). System fonts (no embedded font — keeps the self-contained,
+"by DeepFusion Labs"). System fonts (no embedded font — keeps the self-contained,
 nothing-bundled-but-the-pinned-libs story).
 
 ## Template & verification
@@ -95,4 +95,4 @@ self-containment checks (zero off-host refs). The Python harness pins the report
 `viewMap`, the navigable enriched graph schema, the vendored-inlined + license-clean +
 self-contained graph lib, byte-stable determinism), each with a load-bearing mutation. Build
 a populated preview with `make report-preview` (or `python tools/build_report.py
-validation/dogfooding/oss-kit`) and smoke it with `make report-smoke`.
+validation/end-to-end/kemal`) and smoke it with `make report-smoke`.
diff --git a/skills/deep-init/references/update.md b/skills/deep-init/references/update.md
diff --git a/tools/build_report.py b/tools/build_report.py
diff --git a/tools/i18n_tokens.py b/tools/i18n_tokens.py

Original file line number	Diff line number	Diff line change
`@@ -1,8 +1,8 @@`
`1`	`1`	`{`
`2`	`2`	`"$schema": "https://json.schemastore.org/claude-code-marketplace.json",`
`3`	`3`	`"name": "deepfusionlabs-deep-init",`
`4`		`- "owner": { "name": "Deep Fusion Labs" },`
`5`		`- "description": "Deep Fusion Labs — DeepInit plugin marketplace.",`
	`4`	`+ "owner": { "name": "DeepFusion Labs" },`
	`5`	`+ "description": "DeepFusion Labs — DeepInit plugin marketplace.",`
`6`	`6`	`"plugins": [`
`7`	`7`	`{`
`8`	`8`	`"name": "deep-init",`
Original file line number	Diff line number	Diff line change
`@@ -207,4 +207,4 @@ docs/ # the design corpus (spec, requirements, design, test`
`207`	`207`
`208`	`208`	`## License`
`209`	`209`
`210`		-MIT © Deep Fusion Labs. See [`LICENSE`](LICENSE) and [`AI_POLICY.md`](AI_POLICY.md).
	`210`	+MIT © DeepFusion Labs. See [`LICENSE`](LICENSE) and [`AI_POLICY.md`](AI_POLICY.md).