chore: migration stub for ShellSecurity rename (0.1.5)

[St0rmz1]

Summary

Converts @kilocode/openclaw-security-advisor into a migration stub. Version 0.1.5 exists solely to tell existing users where to go. The plugin has been renamed to @kilocode/shell-security; the new package ships from a renamed GitHub repo in a follow-up.

What changes

• index.ts is now a ~100 line stub. Both the /security-checkup slash command and the kilocode_security_advisor tool return a short migration notice. No audit, no auth flow, no network call, no side effects.
• src/audit.ts, src/client.ts, src/platform.ts, src/auth/device-auth.ts, src/auth/token-store.ts removed via git rm, so the commit is cleanly revertable on the renamed repo.
• Matching tests removed. Only test/version.test.ts (7 tests) remains.
• openclaw.plugin.json name and description reflect the deprecation. configSchema removed (stub takes no config).
• README.md replaced with a migration page.
• CHANGELOG.md adds a [0.1.5] section and retrodates the previously undated channel forwarding entries as [0.1.4].

What happens to existing users

User state	Outcome
On 0.1.4, ignores the update	Plugin keeps working against the existing API route. No forced move.
Upgrades to 0.1.5 (auto or manual)	Next /security-checkup or natural language invocation returns the migration notice with install commands for the new plugin.
Installs @kilocode/shell-security fresh	Behaves identically to 0.1.4 (the new plugin is a rename, not a rewrite).

Test plan

• bun run typecheck
• bun run format:check
• bun test (7 pass, 0 fail)
• After merge and publish, install 0.1.5 in a docker test instance; confirm /security-checkup returns the migration notice and nothing else
• After publish, run npm deprecate '@kilocode/openclaw-security-advisor@*' '...' so installs of any version see the deprecation warning

Next after this merges

1. Dispatch publish workflow with channel=latest, bump=patch (resolves to 0.1.5).
2. Manual tag recovery via gh release create v0.1.5 --verify-tag --generate-notes per the existing RELEASING.md banner.
3. npm deprecate the package.
4. Rename the GitHub repo to shell-security.
5. Ship @kilocode/shell-security@0.2.0 from the renamed repo with the audit flow restored.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (13 files)

• CHANGELOG.md
• README.md
• index.ts
• openclaw.plugin.json
• src/audit.ts
• src/auth/device-auth.ts
• src/auth/token-store.ts
• src/client.ts
• src/platform.ts
• test/audit.test.ts
• test/device-auth.test.ts
• test/platform.test.ts
• test/token-store.test.ts

---

_{Reviewed by gpt-5.4-20260305 · 540,525 tokens}