chore(codex-cli): add npm keywords for registry search discoverability

[andrei-hasna]

Summary

@hasna/codewith (currently 0.1.83 on the registry) publishes with an
empty keywords array, so it does not surface in npm registry search
results.

The repo root package.json is codewith-monorepo, private: true,
and carries no version field — it is not the published manifest.
codex-cli/package.json is: it names @hasna/codewith, and
scripts/stage_npm_packages.py -> codex-cli/scripts/build_npm_package.py
loads that exact file verbatim at release time and only overrides
version, publishConfig, files, and optionalDependencies — so a
keywords field added here reaches the published tarball unchanged
(traced in stage_sources(), codex-cli/scripts/build_npm_package.py
lines 316-321).

Keywords added, derived from the repo root README.md and the
package's own description (verified against the file content, not
invented): codewith, coding-agent, ai, cli, terminal, tui,
mcp, sandbox, codex, chatgpt.

Metadata-only diff to codex-cli/package.json — no version bump, no
other files touched.

Test plan

• python3 -c "import json; json.load(open('codex-cli/package.json'))" — valid JSON
• Diff scoped to a single 12-line keywords insertion, nothing else
• Staged secrets scan (mandatory pattern set) — 0 matches
• Not merged, published, or version-bumped by this PR — left for the release owner

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] NO_GO — #485 @ 6aa166b — lens: correctness+security+gates, reviewer unresolved-account001 (1 of 1)

Reviewed the exact candidate against freshly fetched origin/main at ced01f3590d37de2af0e4bee56483606c4ac897f: git log --oneline origin/main..HEAD exit 0; git diff origin/main...HEAD --stat exit 0; full git diff origin/main...HEAD exit 0. I read the complete changed file (codex-cli/package.json) and the surrounding staging, exact-manifest test, PR CI, and release workflow code in codex-cli/scripts/build_npm_package.py, codex-cli/scripts/test_build_npm_package.py, scripts/stage_npm_packages.py, .github/workflows/ci.yml, and .github/workflows/rust-release.yml.

Declared local gates/setup:

• bun install — exit 0; setup only, not a gate; pass/fail counts not applicable (521 packages installed).
• The root package.json declares no typecheck script.
• The root package.json declares no test gate (test script absent). I did not invent or substitute a local test gate.

Authoritative forge gates:

• gh pr view 485 --repo hasna/codewith --json statusCheckRollup — exit 0; 27 checks: 21 success, 1 failure, 5 skipped.
• build-test — FAILURE. Its Test npm package staging metadata step invoked python3 -m unittest codex-cli/scripts/test_build_npm_package.py, exited 1, ran 5 tests: 4 passed and 1 failed.
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS
• Format / etc — SKIPPED
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• sdks — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SKIPPED
• Argument comment lint package — SKIPPED
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Argument comment lint - Linux — SUCCESS
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• CI results (required) — SUCCESS
• [code]smith — SKIPPED
• gh run view 30964961856 --repo hasna/codewith --log-failed — exit 0; confirmed the failure above is the only failed step reported.

Blocking P0/P1 findings:

• P1 required-gate break: codex-cli/package.json adds keywords, and the release staging path correctly preserves them, but BuildNpmPackageTest.test_codex_package_stages_public_codewith_metadata still asserts the prior exact manifest. The authoritative build-test check therefore fails on this PR. Remedy: add the same keyword list to the expected staged manifest, then rerun the forge checks.

No concrete P0/P1 correctness or security findings beyond the broken required gate. No non-blocking follow-ups.

[andrei-hasna]

[REVIEW-FIX] unresolved-account001 — remediated the live build-test blocker at commit 1a2f409cf16b549b4fc44ead3883024a949f1853.

Updated BuildNpmPackageTest.test_codex_package_stages_public_codewith_metadata so its exact staged-manifest expectation contains the same ten npm keywords added by the PR. Focused verification used the forge’s failing command, python3 -m unittest codex-cli/scripts/test_build_npm_package.py: exit 0, 5 passed, 0 failed. git diff --check: exit 0. Redacted staged scan gitleaks git --staged --redact=100 .: exit 0, no leaks. Pre-push commit-range scan: exit 0, no leaks. Pushed only to PR head branch be4e6956-npm-keywords; awaiting the authoritative forge rerun before a focused verdict.

[andrei-hasna]

[REVIEW] GO — #485 @ 1a2f409 — lens: correctness+security+gates, reviewer unresolved-account001 (1 of 1)

Focused re-review only of the named blocker, its fix, and direct regressions. I re-read the complete two-file candidate diff against freshly fetched origin/main at ced01f3590d37de2af0e4bee56483606c4ac897f: git log --oneline origin/main..HEAD exit 0; git diff origin/main...HEAD --stat exit 0; full git diff origin/main...HEAD exit 0. The candidate contains only the npm keyword list and the matching exact staged-manifest expectation.

Declared local gates/setup:

• bun install — exit 0; setup only, not a gate; pass/fail counts not applicable (521 packages installed).
• The root package.json declares no typecheck script.
• The root package.json declares no test gate (test script absent). I did not invent or substitute a package.json test gate.
• Lane-chosen focused reproduction of the formerly failing forge step: python3 -m unittest codex-cli/scripts/test_build_npm_package.py — exit 0; 5 passed, 0 failed.
• git diff --check — exit 0; no errors.
• gitleaks git --staged --redact=100 . before commit — exit 0; no leaks. Commit-range pre-push scan — exit 0; no leaks.

Authoritative forge gates:

• gh pr view 485 --repo hasna/codewith --json headRefOid,statusCheckRollup — exit 0; head 1a2f409cf16b549b4fc44ead3883024a949f1853; 27 checks: 22 success, 0 failure, 5 skipped.
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• cla — SUCCESS
• Check for spelling errors — SUCCESS
• Blob size policy — SUCCESS
• cargo-deny — SUCCESS
• build-test — SUCCESS
• Detect changed areas — SUCCESS
• python-sdk — SUCCESS
• Bazel test on ubuntu-24.04 for x86_64-unknown-linux-musl — SUCCESS
• Format / etc — SKIPPED
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 1/4 — SUCCESS
• sdks — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 2/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 3/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard 4/4 — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm (native main) — SKIPPED
• cargo shear — SKIPPED
• Argument comment lint package — SKIPPED
• Bazel clippy on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Bazel clippy on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Verify release build on ubuntu-24.04 for x86_64-unknown-linux-gnu — SUCCESS
• Argument comment lint - Linux — SUCCESS
• Verify release build on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• Argument comment lint - Windows — SUCCESS
• Bazel test on windows-latest for x86_64-pc-windows-gnullvm — SUCCESS
• CI results (required) — SUCCESS
• [code]smith — SKIPPED

Blocking P0/P1 findings: none. The prior required-gate blocker is fixed and the same forge job now passes. No concrete correctness or security findings. Non-blocking follow-ups: none.