# Pre-release security review

## Scope

Manual source review of the project installer, JSONC configuration edits, CLI,
and packaged content before the first release. The review focused on path
containment, symlink handling, file ownership, preserving user changes, and
partial failures. This is not an independent audit, a guarantee against local
filesystem attackers, or a review of provider/model behavior.

## Result

No release-blocking issue was identified for the documented project-local use
on a trusted filesystem. The installer resolves the project root, restricts
manifest paths to toolkit asset locations, rejects symlinked install paths and
non-regular files, refuses unmanaged collisions, and verifies hashes before
replacing or removing managed content. Configuration changes use JSONC edits
and preserve unrelated entries. Deterministic tests cover collisions, modified
files, symlinked install directories, and a tampered manifest.

## Limitations and operational guidance

- The installer does not defend against a concurrent process replacing a path
  after it has been checked (a filesystem time-of-check/time-of-use race). Run it
  only where another actor cannot concurrently manipulate the project tree.
- The ownership manifest is ordinary project-local JSON, not an authenticated
  record. It protects against accidental overwrite/removal, not a malicious
  project owner who can edit both the manifest and files.
- Uninstall removes managed files incrementally. If an I/O failure interrupts
  it, the manifest is retained for recovery in normal mid-operation failures;
  resolve the filesystem problem and rerun uninstall. Transactional rollback
  for uninstall remains future work.
- Provider-backed agent delegation and skill invocation have not been reviewed
  or verified. The runtime smoke test only covered plugin activation and the
  read-only status tool with a local mock provider.

## Checks run

- `npm run typecheck` — passed.
- `npm test` — passed, 16 tests.
- `npm run test:coverage` — passed; 87.4% lines, 95.23% functions, and 81.86%
  branches.
- `npm pack --dry-run` — passed; included runtime files, selected content,
  licenses, notice, and README.