OpenCode Extension Stack v0.1.1

Security Hardening

All 12 findings from the initial security review have been addressed:

• SEC-001: Request body size limits (1MB cap on bridge JSON parsing)
• SEC-002: Per-key rate limiting (100 req/min per IP:method:path)
• SEC-003: SSE connection cap (50 max) and 1-minute hard timeout per session
• SEC-004: Path traversal guard in memory evidence resolution
• SEC-005: Security headers on all bridge responses
• SEC-006: Server timeout (30s) and headers timeout (35s)
• SEC-007: Telegram webhook rate limiting (30 req/min per IP)
• SEC-008-012: Positive security patterns verified

Full report: security_best_practices_report.md

Other Changes

• Add MIT License (Elliott Schmechel 2026)
• Add README badges (CI, Node.js, pnpm, license, issues)
• Add docs/publishing-strategy.md

Verification

• pnpm test (96 tests pass)
• pnpm run smoke (all packages pass)