Add OPC desktop hardening and audit docs

.claude-plugin/marketplace.json

@@ -1,12 +1,13 @@
 {
-  "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
   "name": "claude-code-plugins",
-  "version": "1.0.0",
-  "description": "Bundled plugins for Claude Code including Agent SDK development tools, PR review toolkit, and commit workflows",
   "owner": {
     "name": "Anthropic",
     "email": "support@anthropic.com"
   },
+  "metadata": {
+    "version": "1.0.0",
+    "description": "Bundled plugins for Claude Code including Agent SDK development tools, PR review toolkit, and commit workflows"
+  },
   "plugins": [
     {
       "name": "agent-sdk-dev",
@@ -80,6 +81,16 @@
       "source": "./plugins/frontend-design",
       "category": "development"
     },
+    {
+      "name": "gstack-workflows",
+      "description": "Lightweight gstack-inspired engineering workflows for investigation, review, security, QA reporting, and documentation release checks",
+      "version": "0.1.0",
+      "author": {
+        "name": "OPC Contributors"
+      },
+      "source": "./plugins/gstack-workflows",
+      "category": "productivity"
+    },
     {
       "name": "hookify",
       "description": "Easily create custom hooks to prevent unwanted behaviors by analyzing conversation patterns or from explicit instructions. Define rules via simple markdown files.",

.codex/environments/environment.toml

@@ -0,0 +1,3 @@
+[actions.Run]
+command = "./script/build_and_run.sh --verify"
+description = "Build, install, and launch OPC.app"

.github/workflows/desktop-verify.yml

@@ -0,0 +1,38 @@
+name: Desktop Verify
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - master
+
+jobs:
+  desktop:
+    name: Audit and test desktop
+    runs-on: macos-latest
+    defaults:
+      run:
+        working-directory: desktop
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: desktop/package-lock.json
+
+      - name: Install
+        run: npm ci
+
+      - name: Desktop verification
+        run: npm run verify:ci
+
+      - name: Desktop UI smoke
+        run: npm run test:ui
+
+      - name: Desktop visual smoke
+        run: npm run test:visual

.gitignore

@@ -10,6 +10,8 @@ pnpm-debug.log*
 # Build output
 dist/
 build/
+!desktop/build/
+!desktop/build/**
 *.tsbuildinfo
 
 # Runtime data

.mcp.json

@@ -0,0 +1,7 @@
+{
+  "mcpServers": {
+    "forge_extension": {
+      "url": "http://localhost:49453/mcp"
+    }
+  }
+}