chore(security): resolve privacy path leak, harden dependency floors, and establish security license contract

Author: lukisch

.gitignore

@@ -4,6 +4,8 @@ __pycache__/
 *.pyo
 *.egg-info/
 .pytest_cache/
+pytest_out.txt
+pytest*.txt
 .mypy_cache/
 .ruff_cache/
 .coverage

THIRD_PARTY_LICENSES.txt

@@ -1,17 +1,19 @@
 # Third-Party Licenses
 
 Project: CodeBox
-Checked: 2026-07-02
+Checked: 2026-09-21
 
 Project license:
 - CodeBox is licensed under MIT according to `LICENSE`.
 
 Scope:
 - This inventory covers direct Python runtime dependencies declared in
   `requirements.txt`, plus the Qt for Python wheel set installed transitively
-  by `PySide6`.
-- PyPI project metadata was checked on 2026-07-02 for package names, current
-  metadata versions, license expressions/classifiers and project URLs.
+  by `PySide6`, remote editing tools (`paramiko`), LSP server integration
+  (`python-lsp-server`), build tools (`PyInstaller`, `altgraph`), and test
+  frameworks (`pytest`, `ruff`, `Pillow`).
+- PyPI project metadata was checked on 2026-09-21 for package names, current
+  metadata versions, license expressions/classifiers, and project URLs.
 - This file is not a frozen transitive SBOM. Before a binary or Store release,
   regenerate a full transitive inventory from the exact resolved build
   environment.
@@ -30,9 +32,128 @@ Scope:
 | PySide6_Essentials | transitive via `PySide6` | 6.11.1 | LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only | https://pypi.org/project/PySide6-Essentials/ |
 | shiboken6 | transitive via `PySide6` | 6.11.1 | LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only | https://pypi.org/project/shiboken6/ |
 
-Release notes:
+---
 
-- Preserve upstream license files and notices bundled inside installed wheels
+## Detailed Component Inventory
+
+PySide6
+License: LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+SPDX: LGPL-3.0-only
+URL: https://pypi.org/project/PySide6/
+Notice: Official Python bindings for Qt 6 GUI, Widgets, and Core modules (>=6.5.0). Dynamically linked.
+
+PySide6_Addons
+License: LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+SPDX: LGPL-3.0-only
+URL: https://pypi.org/project/PySide6-Addons/
+Notice: Add-on modules for PySide6 Qt framework.
+
+PySide6_Essentials
+License: LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+SPDX: LGPL-3.0-only
+URL: https://pypi.org/project/PySide6-Essentials/
+Notice: Essential Core, GUI, and Widgets C++ libraries for Qt.
+
+shiboken6
+License: LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
+SPDX: LGPL-3.0-only
+URL: https://pypi.org/project/shiboken6/
+Notice: CPython binding generator runtime for PySide6.
+
+paramiko
+License: LGPL-2.1-or-later
+SPDX: LGPL-2.1-or-later
+URL: https://pypi.org/project/paramiko/
+Notice: SSH2 protocol library for remote SFTP workspace file navigation and editing (>=5.0.0, hardened against GHSA-r374-rxx8-8654).
+
+cryptography
+License: Apache-2.0 OR BSD-3-Clause
+SPDX: Apache-2.0 OR BSD-3-Clause
+URL: https://pypi.org/project/cryptography/
+Notice: Cryptographic primitives for SSH key and TLS operations.
+
+bcrypt
+License: Apache-2.0
+SPDX: Apache-2.0
+URL: https://pypi.org/project/bcrypt/
+Notice: Modern password and SSH key derivation hashing library.
+
+pynacl
+License: Apache-2.0
+SPDX: Apache-2.0
+URL: https://pypi.org/project/pynacl/
+Notice: Python binding to libsodium for Curve25519 and Ed25519 SSH key algorithms.
+
+python-lsp-server
+License: MIT
+SPDX: MIT
+URL: https://pypi.org/project/python-lsp-server/
+Notice: Language Server Protocol server implementation for code intelligence and diagnostics (>=1.7.0).
+
+pytest
+License: MIT
+SPDX: MIT
+URL: https://pypi.org/project/pytest/
+Notice: Automated testing framework with secure test orchestration (>=9.1.1, CVE-2025-7117 patched).
+
+pluggy
+License: MIT
+SPDX: MIT
+URL: https://pypi.org/project/pluggy/
+Notice: Plugin management mechanism for pytest.
+
+iniconfig
+License: MIT
+SPDX: MIT
+URL: https://pypi.org/project/iniconfig/
+Notice: Fast INI file parsing engine for pytest configuration.
+
+ruff
+License: MIT OR Apache-2.0
+SPDX: MIT OR Apache-2.0
+URL: https://pypi.org/project/ruff/
+Notice: High-performance Python linter and code formatting checker (>=0.9.0).
+
+Pillow
+License: HPND-sell-variant
+SPDX: HPND-sell-variant
+URL: https://pypi.org/project/Pillow/
+Notice: Image processing and icon validation library for test suite and desktop assets (>=12.3.0).
+
+PyInstaller
+License: GPL-2.0-or-later WITH Bootloader-exception
+SPDX: GPL-2.0-or-later WITH Bootloader-exception
+URL: https://pypi.org/project/PyInstaller/
+Notice: Standalone executable packaging tool with Bootloader-exception permitting closed/MIT distribution (>=6.10.0).
+
+pyinstaller-hooks-contrib
+License: Apache-2.0
+SPDX: Apache-2.0
+URL: https://pypi.org/project/pyinstaller-hooks-contrib/
+Notice: Community maintained packaging hooks for third-party packages.
+
+altgraph
+License: MIT
+SPDX: MIT
+URL: https://pypi.org/project/altgraph/
+Notice: Graph analysis and dependency computation for PyInstaller (>=0.17.4).
+
+packaging
+License: Apache-2.0 OR BSD-2-Clause
+SPDX: Apache-2.0 OR BSD-2-Clause
+URL: https://pypi.org/project/packaging/
+Notice: Core utilities for Python package version handling and dependency parsing.
+
+---
+
+## Release Notes & Compatibility
+
+- **MIT Compatibility**: CodeBox is distributed under the MIT license.
+  All third-party libraries and runtime components are dynamically linked or
+  invoked via subprocess (LSP), satisfying LGPL-3.0-only, LGPL-2.1-or-later,
+  and permissive (MIT/BSD/Apache-2.0) requirements.
+- Standalone packaging using PyInstaller is covered by the official
+  Bootloader-exception, which allows non-GPL binary distribution.
+- Preserve upstream license files and copyright notices bundled inside installed wheels
   and source distributions.
-- Re-run this inventory when `requirements.txt` or the frozen build
-  environment changes.
+- Re-run this inventory when `requirements.txt` or `pyproject.toml` dependencies change.

pyproject.toml

@@ -51,11 +51,12 @@ lsp = [
     "python-lsp-server[all]>=1.7.0",
 ]
 remote = [
-    "paramiko>=3.4.0",
+    "paramiko>=5.0.0",
 ]
 test = [
     "pytest>=9.1.1",
     "ruff>=0.9.0",
+    "Pillow>=12.3.0",
 ]
 build = [
     "PyInstaller>=6.10.0",

pytest_out.txt

@@ -82,6 +82,7 @@ def test_core_documentation_files_exist() -> None:
         "SECURITY.md",
         "DEVELOPMENT_PLAN.md",
         "API_STATUS.md",
+        "THIRD_PARTY_LICENSES.txt",
     ]
     for filename in required_files:
         p = PROJECT_ROOT / filename