chore: harden repo security controls

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @jcarlosrodicio

.github/workflows/check.yml

@@ -0,0 +1,37 @@
+name: Check
+
+on:
+  pull_request:
+  push:
+    branches:
+      - master
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Repository check
+        run: npm run check
+
+      - name: Install OpenCode tool dependencies
+        working-directory: opencode
+        run: npm ci
+
+      - name: Audit OpenCode tool dependencies
+        working-directory: opencode
+        run: npm audit --omit=dev --audit-level=moderate
+
+      - name: Smoke import OpenCode plugin
+        working-directory: opencode
+        run: node --input-type=module -e "import('@opencode-ai/plugin').then(() => console.log('plugin import ok'))"

docker/open-design/Dockerfile

@@ -7,13 +7,18 @@ RUN apt-get update \
 RUN useradd -m -s /bin/bash opencode
 WORKDIR /app
 
-RUN git clone https://github.com/nexu-io/open-design.git /app/open-design
+ARG OPEN_DESIGN_REF=1592beb96134f9d49b8a90dc6a359b94a69af57e
+ARG OPENCODE_AI_VERSION=1.14.31
+
+RUN git clone https://github.com/nexu-io/open-design.git /app/open-design \
+  && cd /app/open-design \
+  && git checkout "$OPEN_DESIGN_REF"
 WORKDIR /app/open-design
 
 RUN corepack enable \
   && corepack prepare pnpm@10.33.2 --activate \
   && pnpm install --frozen-lockfile=false \
-  && npm install -g opencode-ai@latest
+  && npm install -g "opencode-ai@$OPENCODE_AI_VERSION"
 
 # Make the daemon listen on OD_HOST when upstream exposes host/port constants.
 # This is intentionally best-effort because upstream may change file layout.
@@ -29,7 +34,8 @@ for (const file of candidates) {
 }
 NODE
 
-RUN pnpm build || pnpm -r build
+RUN pnpm --filter @open-design/daemon build \
+  && (pnpm build || pnpm -r build)
 
 ENV OD_HOST=0.0.0.0
 ENV OD_PORT=7456
@@ -41,4 +47,4 @@ RUN mkdir -p /home/opencode/.config/opencode /home/opencode/.local/share/opencod
 USER opencode
 EXPOSE 7456
 
-CMD ["sh", "-lc", "node apps/daemon/cli.js --host ${OD_HOST:-0.0.0.0} --port ${OD_PORT:-7456} --no-open || node daemon/cli.js --host ${OD_HOST:-0.0.0.0} --port ${OD_PORT:-7456} --no-open"]
+CMD ["sh", "-lc", "node apps/daemon/dist/cli.js --port ${OD_PORT:-7456} --no-open"]

docs/docker-open-design.md

@@ -6,6 +6,20 @@ cp .env.example .env
 docker compose up -d --build
 ```
 
+The Docker image pins upstream build inputs by default:
+
+- `OPEN_DESIGN_REF=1592beb96134f9d49b8a90dc6a359b94a69af57e`
+- `OPENCODE_AI_VERSION=1.14.31`
+
+Update them intentionally when you want a newer Open Design or OpenCode CLI build:
+
+```bash
+docker compose build \
+  --build-arg OPEN_DESIGN_REF=<commit-sha> \
+  --build-arg OPENCODE_AI_VERSION=<version>
+docker compose up -d
+```
+
 Authenticate OpenCode inside the container:
 
 ```bash

docs/synology.md

@@ -10,6 +10,16 @@ Recommended setup:
 4. Configure Synology reverse proxy with HTTPS if exposing beyond localhost.
 5. Protect public access with VPN, Tailscale, WireGuard, or authentication.
 
+The Dockerfile pins Open Design and OpenCode CLI build inputs. To update them,
+build with explicit args instead of editing to a floating branch or `latest`:
+
+```bash
+docker compose build \
+  --build-arg OPEN_DESIGN_REF=<commit-sha> \
+  --build-arg OPENCODE_AI_VERSION=<version>
+docker compose up -d
+```
+
 Useful operations:
 
 ```bash

opencode/.gitignore

@@ -0,0 +1,2 @@
+node_modules/
+.DS_Store