fix: code review — remove self-dependency, stale proxy refs, doc accuracy

- Remove robinhood-for-agents self-dependency from package.json
- Remove unused msw devDependency
- Update integration test comments from proxy to TokenStore auth
- Fix SECURITY.md: session.enc → tokens.enc
- Migrate biome.json schema to 2.4.10

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: kevin1chun

SECURITY.md

@@ -23,7 +23,7 @@ You will receive an acknowledgment within 48 hours and a detailed response withi
 
 **In scope:**
 - Token or credential leakage
-- Encryption weaknesses in session storage (`~/.robinhood-for-agents/session.enc`)
+- Encryption weaknesses in token storage (`~/.robinhood-for-agents/tokens.enc`)
 - Unauthorized order execution or account access
 - Bypassing safety controls (blocked operations, parameter validation)
 

python/tests/integration/test_client.py

@@ -1,8 +1,7 @@
-"""Integration tests — hit the real Robinhood API via the auth proxy.
+"""Integration tests — hit the real Robinhood API via TokenStore auth.
 
 Prerequisites:
-    1. Login: robinhood-for-agents login
-    2. Proxy: robinhood-for-agents proxy
+    1. Login: robinhood-for-agents onboard
 
 Run: uv run pytest -m integration
 """

typescript/__tests__/integration/client.test.ts

@@ -1,15 +1,14 @@
 /**
- * Integration tests — hit the real Robinhood API via the auth proxy.
+ * Integration tests — hit the real Robinhood API via TokenStore auth.
  *
  * Prerequisites:
- *   1. Login: robinhood-for-agents login
- *   2. Proxy: robinhood-for-agents proxy
+ *   1. Login: robinhood-for-agents onboard
  *
  * Run: bun run test:integration
  *
  * Uses Bun's test runner (not Vitest) because Bun.secrets is needed
- * to load the proxy token from the OS keychain. Vitest runs in Node
- * where Bun.secrets is unavailable.
+ * to load tokens from the OS keychain. Vitest runs in Node where
+ * Bun.secrets is unavailable.
  */
 
 import { beforeAll, describe, expect, it } from "bun:test";
@@ -22,7 +21,7 @@ describe("integration: RobinhoodClient", () => {
     await client.restoreSession();
   });
 
-  it("authenticates via proxy", () => {
+  it("authenticates via TokenStore", () => {
     expect(client.isLoggedIn).toBe(true);
   });
 

typescript/biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.4.8/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.4.10/schema.json",
   "linter": {
     "enabled": true,
     "rules": {

typescript/package.json

@@ -43,13 +43,11 @@
     "@clack/prompts": "^1.1.0",
     "@modelcontextprotocol/sdk": "^1.12.0",
     "playwright-core": "^1.50.0",
-    "robinhood-for-agents": "^0.6.2",
     "zod": "^4.3.6"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.0.0",
     "@types/bun": "latest",
-    "msw": "^2.7.0",
     "typescript": "^5.8.0",
     "vitest": "^4.0.18"
   },