v0.3.0 — OAuth2, 14 tools, security & CI

Added

• OAuth2 auth type — browser flow with local callback server, automatic token refresh, CSRF protection
• 7 new tool manifests — Twilio, Jira, Resend, Vercel, Cloudflare, OpenAI, Google (14 tools total)
• Security test suite — 19 tests: token storage, injection prevention, HTTPS enforcement
• CI/CD pipeline — GitHub Actions: lint, typecheck, test (Node 20+22), build, dependency audit
• Smoke test workflow — post-publish validation on Ubuntu + macOS
• OSS hygiene — LICENSE, SECURITY.md, CODE_OF_CONDUCT.md, CHANGELOG, PR template

Fixed

• Command injection in openBrowser() — exec() → execFile()
• Token leak via redirects — disabled HTTP redirects for authenticated requests
• Token write race condition — withTokenLock() mutex for concurrent operations
• Stale build artifacts — prebuild script cleans dist/

Install / Update

npm install -g @nico0891/stackrun

151 tests passing. 43.6 KB tarball.