fix: retire the OpenCode Console breach notice

A new install has no seen list, so every new OpenCode user was still warned about
an October incident that is long over. The mechanism stays for the next notice;
an empty list is now a valid file, and the validators keep running over whatever
it holds.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/releasing.md

@@ -59,4 +59,4 @@ A security notice is a sticky warning card about something outside Codeman that
 - `title` (optional) is the card's bold line; keep it short. `link.url` must be https. `i18n` is optional; a missing string falls back to the English one.
 - Run `npx prettier --write src/web/public/security-notices.json` and `npm test -- test/security-notices.test.ts`, which validates the file (unique ids, real dates, https links, every `cli` a stock registry id, a zh-CN title wherever there is an English one).
 
-**Retiring one**: let it expire, or delete the entry once it has. Removing it early stops it on the next release only; browsers already showing it keep the card until they close it or reload.
+**Retiring one**: let it expire, or delete the entry once it has. Removing it early stops it on the next release only; browsers already showing it keep the card until they close it or reload. Until then a fresh install gets it too, because a new browser has no seen list, so give an `expires` no later than the warning stays useful. An empty list (`{ "notices": [] }`) is a valid file.

src/web/public/security-notices.json

@@ -1,21 +1 @@
-{
-  "notices": [
-    {
-      "id": "opencode-console-breach-2026-10",
-      "severity": "warning",
-      "cli": "opencode",
-      "published": "2026-10-17",
-      "expires": "2026-12-31",
-      "title": "OpenCode Console breach: check your API keys",
-      "message": "OpenCode reported unauthorized access to a legacy system on 17 October. Provider API keys (OpenAI, Anthropic and others) saved in some OpenCode Console workspaces may have been exposed. If OpenCode emailed you about it, revoke and replace those keys and check their recent usage. If you got no email, OpenCode says you were not affected.",
-      "link": { "label": "Read OpenCode's notice", "url": "https://x.com/opencode/status/2111519637049319818" },
-      "i18n": {
-        "zh-CN": {
-          "title": "OpenCode Console 遭入侵：请检查你的 API 密钥",
-          "message": "OpenCode 于 10 月 17 日报告，其一个旧系统遭到未授权访问，部分用户保存在 OpenCode Console 工作区中的提供商 API 密钥（OpenAI、Anthropic 等）可能已泄露。如果你收到了 OpenCode 的相关邮件，请撤销并更换这些密钥，同时检查近期用量。OpenCode 表示，没有收到邮件的用户不受影响。",
-          "label": "查看 OpenCode 公告"
-        }
-      }
-    }
-  ]
-}
+{ "notices": [] }

test/security-notices.test.ts

@@ -333,8 +333,7 @@ describe('the shipped security-notices.json', () => {
   const nonBlank = (value: unknown) => typeof value === 'string' && value.trim().length > 0;
 
   it('is a list of notices with unique, stable ids', () => {
-    expect(Array.isArray(notices)).toBe(true);
-    expect(notices.length).toBeGreaterThan(0);
+    expect(Array.isArray(notices)).toBe(true); // empty is fine: every notice has been retired
     const all = notices.map((n) => n.id);
     expect(new Set(all).size).toBe(all.length);
     for (const id of all) expect(id).toMatch(/^[a-z0-9][a-z0-9-]*$/);
@@ -383,22 +382,10 @@ describe('the shipped security-notices.json', () => {
     }
   });
 
-  it('shows the OpenCode notice, with its title, only to OpenCode users', () => {
-    const breach = notices.find((n) => n.id === 'opencode-console-breach-2026-10');
-    expect(breach?.cli).toBe('opencode');
-    const [shown] = core.select(notices, { available: { opencode: true }, now: NOW });
-    expect(shown).toMatchObject({
-      id: 'opencode-console-breach-2026-10',
-      title: 'OpenCode Console breach: check your API keys',
-      label: "Read OpenCode's notice",
-      url: 'https://x.com/opencode/status/2111519637049319818',
-    });
-    expect(core.select(notices, { available: { opencode: true }, now: NOW, lang: 'zh-CN' })[0].title).toBe(
-      'OpenCode Console 遭入侵：请检查你的 API 密钥'
-    );
-    expect(core.select(notices, { available: { opencode: false, claude: true }, now: NOW })).toEqual([]);
-    expect(core.select(notices, { available: {}, now: NOW })).toEqual([]);
-    expect(core.select(notices, { available: { opencode: true }, now: at(2027, 1, 1) })).toEqual([]);
+  it('no longer ships the retired OpenCode Console notice, even to a fresh OpenCode install', () => {
+    // It stayed in the file past its use, and a new install has no seen list, so everyone got it.
+    expect(notices.map((n) => n.id)).not.toContain('opencode-console-breach-2026-10');
+    expect(core.select(notices, { available: { opencode: true }, seen: [], now: NOW })).toEqual([]);
   });
 
   it('is fetched by the page and never generated by the release script', () => {