feat(codex): add encrypted native main profiles

.github/workflows/ci.yml

@@ -432,6 +432,70 @@ jobs:
       - name: CLI help smoke
         run: bun run src/cli/index.ts help
 
+  # Keep every OS credential-store check on a disposable GitHub-hosted machine.
+  # A force-cancelled process cannot run its in-process finally cleanup, so no
+  # keyring matrix leg may use the persistent self-hosted Windows runner.
+  keyring-smoke:
+    name: keyring ${{ matrix.name }}
+    runs-on: ${{ matrix.runner }}
+    timeout-minutes: 8
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: ubuntu
+            runner: ubuntu-latest
+          - name: windows
+            runner: windows-latest
+          - name: macos
+            runner: macos-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - name: Setup Bun
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+        with:
+          bun-version: 1.3.14
+
+      - name: Install dependencies
+        run: bun install --frozen-lockfile
+
+      # Linux hosted runners do not provide an unlocked desktop keyring session.
+      # Run Secret Service with temporary state instead of skipping Linux.
+      - name: Install Secret Service dependencies (Linux)
+        if: matrix.name == 'ubuntu'
+        shell: bash
+        run: |
+          set -euo pipefail
+          sudo apt-get update
+          sudo apt-get install --yes --no-install-recommends dbus-x11 gnome-keyring
+
+      - name: OS keyring create/read/delete smoke
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [ "$RUNNER_OS" != "Linux" ]; then
+            bun run scripts/keyring-smoke.ts
+            exit 0
+          fi
+
+          keyring_home="$(mktemp -d)"
+          runtime_dir="$(mktemp -d)"
+          cleanup() { rm -rf -- "$keyring_home" "$runtime_dir"; }
+          trap cleanup EXIT
+          chmod 700 "$keyring_home" "$runtime_dir"
+          HOME="$keyring_home" XDG_RUNTIME_DIR="$runtime_dir" dbus-run-session -- bash -euo pipefail -c '
+            # Create and unlock the isolated login keyring without putting its
+            # ephemeral password in argv, the environment, or the job log.
+            od -An -N32 -tx1 /dev/urandom |
+              tr -d "[:space:]" |
+              gnome-keyring-daemon --unlock --components=secrets >/dev/null
+            bun run scripts/keyring-smoke.ts
+          '
+
   npm-global-smoke:
     name: npm-global ${{ matrix.os }}
     needs: changes
@@ -507,7 +571,7 @@ jobs:
     # direct dependencies only, so a failing `select-windows-runner` would
     # otherwise reach this gate as nothing at all while its dependents report
     # `skipped` — which the gate is required to read as a deliberate skip.
-    needs: [changes, select-windows-runner, test, gates, platform-macos, platform-windows, npm-global-smoke]
+    needs: [changes, select-windows-runner, test, gates, platform-macos, platform-windows, keyring-smoke, npm-global-smoke]
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:

.github/workflows/release.yml

@@ -60,7 +60,7 @@ jobs:
             exit 1
           fi
 
-      # opencodex is bun-native (the prepublishOnly GUI build + typecheck run under bun).
+      # opencodex is bun-native (the prepublishOnly audit, GUI build, and typecheck run under bun).
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
@@ -92,6 +92,9 @@ jobs:
       - name: Install dependencies
         run: bun install --frozen-lockfile
 
+      - name: Dependency audit (high severity)
+        run: bun run audit:high
+
       - name: Verify version matches package.json
         env:
           RELEASE_VERSION: ${{ inputs.version }}
@@ -103,6 +106,8 @@ jobs:
             exit 1;
           }
 
+      # The exact-SHA CI gate includes the hosted Linux, Windows, and macOS
+      # keyring smoke matrix. Do not duplicate its Linux bootstrap here.
       - name: Require successful Cross-platform CI for this commit
         env:
           GH_TOKEN: ${{ github.token }}
@@ -138,17 +143,15 @@ jobs:
           fi
 
           ci_url="$(
-            # shellcheck disable=SC2016
-            # `$branch` is a jq variable bound by --arg, not a shell variable, so
-            # the filter must stay single-quoted.
             gh run list \
               --workflow ci.yml \
+              --branch "${GITHUB_REF#refs/heads/}" \
               --commit "$GITHUB_SHA" \
+              --event push \
               --status success \
               --limit 10 \
-              --json conclusion,headSha,url,workflowName,event,headBranch \
-              --jq --arg branch "${GITHUB_REF#refs/heads/}" \
-                'map(select(.event == "push" and .headBranch == $branch)) | .[0].url // ""'
+              --json url \
+              --jq '.[0].url // ""'
           )"
 
           if [ -z "$ci_url" ]; then