chore: integrate OSS-readiness into main

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,35 @@
+name: Bug report
+description: Report a problem so we can fix it
+labels: [bug]
+body:
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear description of the bug.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: How can we reproduce it?
+      placeholder: |
+        1. ...
+        2. ...
+        3. ...
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: false
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: OS, runtime version, package versions.
+    validations:
+      required: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,23 @@
+name: Feature request
+description: Suggest an idea or improvement
+labels: [enhancement]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / motivation
+      description: What problem would this feature solve?
+    validations:
+      required: true
+  - type: textarea
+    id: solution
+    attributes:
+      label: Proposed solution
+    validations:
+      required: false
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+    validations:
+      required: false

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,24 @@
+# Pull Request
+
+## Summary
+
+<!-- What does this PR change and why? -->
+
+## Type of change
+
+- [ ] feat (new feature)
+- [ ] fix (bug fix)
+- [ ] docs
+- [ ] refactor / chore / ci
+
+## Checklist
+
+- [ ] Targets the `dev` branch (not `main`).
+- [ ] Builds locally.
+- [ ] Tests pass (if applicable).
+- [ ] No secrets / credentials / `.env` values committed.
+- [ ] Linked the related issue (if any).
+
+## Notes for reviewers
+
+<!-- Anything reviewers should pay special attention to. -->

.github/dependabot.yml

@@ -0,0 +1,22 @@
+version: 2
+updates:
+  # Keep GitHub Actions pinned versions fresh.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  # npm — active only when a manifest exists (Dependabot ignores otherwise).
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5
+
+  # pip / uv — active only when a Python manifest exists.
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 5

.github/workflows/gitleaks.yml

@@ -0,0 +1,24 @@
+# Secret scanning on every push and PR.
+name: Secret Scan
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  gitleaks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@v2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # GITLEAKS_LICENSE is only required for GitHub organizations.
+          GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}

.github/workflows/openhands-resolver.yml

@@ -0,0 +1,48 @@
+# OpenHands autonomous issue resolver.
+# Label an issue `fix-me` (or comment `@openhands-agent`) and OpenHands
+# opens a pull request with a proposed fix.
+#
+# SETUP (repo secrets/variables) — until configured the job no-ops, so it
+# never turns CI red:
+#   secrets.LLM_API_KEY   : your model API key (e.g. Anthropic)
+#   secrets.PAT_TOKEN     : a GitHub PAT with repo + workflow scope
+#   vars.LLM_MODEL        : e.g. anthropic/claude-sonnet-4-5
+# Docs: https://docs.openhands.dev/usage/how-to/github-action
+name: OpenHands Resolver
+
+on:
+  issues:
+    types: [labeled]
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+
+permissions:
+  contents: write
+  pull-requests: write
+  issues: write
+
+jobs:
+  resolve:
+    if: |
+      github.event.label.name == 'fix-me' ||
+      contains(github.event.comment.body, '@openhands-agent')
+    runs-on: ubuntu-latest
+    steps:
+      - name: Guard — require LLM_API_KEY before running
+        id: guard
+        run: |
+          if [ -z "${{ secrets.LLM_API_KEY }}" ]; then
+            echo "LLM_API_KEY not set; skipping OpenHands run." >&2
+            echo "ready=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "ready=true" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Run OpenHands resolver
+        if: steps.guard.outputs.ready == 'true'
+        uses: OpenHands/OpenHands@main
+        with:
+          github-token: ${{ secrets.PAT_TOKEN }}
+          llm-api-key: ${{ secrets.LLM_API_KEY }}
+          llm-model: ${{ vars.LLM_MODEL }}

.gitignore

@@ -32,4 +32,6 @@ output
 .gemini
 .next
 images
-build_output.txt
+build_output.txt
+# private internal spec — not for OSS
+要件定義書.md

CODE_OF_CONDUCT.md

@@ -0,0 +1,49 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic
+status, nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+
+Examples of unacceptable behavior:
+
+- The use of sexualized language or imagery, and unwelcome advances
+- Trolling, insulting or derogatory comments, personal or political attacks
+- Public or private harassment
+- Publishing others' private information without explicit permission
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards
+and will take appropriate and fair corrective action in response to any
+behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies
+when an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the maintainers at satomaru.fac.0505@gmail.com. All complaints will be
+reviewed and investigated promptly and fairly.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1.
+
+[homepage]: https://www.contributor-covenant.org

CONTRIBUTING.md

@@ -0,0 +1,49 @@
+# Contributing to image_translation_tool
+
+Thanks for your interest in contributing! This guide keeps changes safe,
+reviewable, and consistent.
+
+## Getting started
+
+1. Fork the repository and clone your fork.
+2. Install dependencies (see the README for the exact commands).
+3. Create a branch from `dev`:
+   `git switch -c feature/<topic> dev`
+
+## Branching model
+
+We use a three-tier flow: `main` -> `dev` -> `feature/*`.
+
+- `main` is always releasable. Do not commit to it directly.
+- `dev` is the integration branch where features are validated.
+- `feature/<topic>` is where you do the actual work.
+
+Open pull requests against `dev` (not `main`).
+
+## Commit style
+
+Use [Conventional Commits](https://www.conventionalcommits.org/):
+
+- `feat:` a new feature
+- `fix:` a bug fix
+- `docs:`, `test:`, `refactor:`, `chore:`, `perf:`, `ci:`
+
+Keep one logical change per commit, written in the imperative mood
+(`add`, not `added`).
+
+## Before you open a PR
+
+- [ ] Code builds locally.
+- [ ] Tests pass (if the project has tests).
+- [ ] No secrets, credentials, or `.env` values are committed.
+- [ ] The PR description explains the what and the why.
+
+## Reporting bugs and requesting features
+
+Open an issue using the provided templates. Include reproduction steps,
+expected vs. actual behavior, and environment details.
+
+## Code of Conduct
+
+By participating you agree to uphold our
+[Code of Conduct](./CODE_OF_CONDUCT.md).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 stewroux
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -190,3 +190,5 @@ Verification is currently performed via:
 - **Developer**: Ryoma Sato
 - **AI-Powered Development**: This project was developed with the assistance of **Google AI Studio** and **Google Antigravity**.
 - **License**: [MIT License](LICENSE)
+
+> **Security Notice**: `NEXT_PUBLIC_*` variables are embedded in the client-side JavaScript bundle and are visible to anyone who inspects the page source. Treat your Gemini API key as a low-privilege, quota-limited key and set usage quotas in Google AI Studio.

README_ja.md

@@ -192,3 +192,5 @@ npm run dev
 - **開発者**: Ryoma Sato
 - **生成AIによる開発**: このプロジェクトは **Google AI Studio** および **Google Antigravity** の支援を受けて開発されました。
 - **ライセンス**: [MIT License](LICENSE)
+
+> **Security Notice**: `NEXT_PUBLIC_*` variables are embedded in the client-side JavaScript bundle and are visible to anyone who inspects the page source. Treat your Gemini API key as a low-privilege, quota-limited key and set usage quotas in Google AI Studio.

SECURITY.md

@@ -0,0 +1,24 @@
+# Security Policy
+
+## Reporting a Vulnerability
+
+Please **do not** open a public issue for security vulnerabilities.
+
+Instead, report them privately:
+
+- Use GitHub's "Report a vulnerability" (Security advisories), or
+- Email the maintainers at satomaru.fac.0505@gmail.com.
+
+Include a description, reproduction steps, and the potential impact.
+We aim to acknowledge reports within a few days and will keep you informed
+as we work on a fix.
+
+## Supported Versions
+
+Security fixes are applied to the latest released version on the default
+branch. Older versions are supported on a best-effort basis.
+
+## Disclosure
+
+We follow a coordinated disclosure process: we will work with you on a
+timeline to release a fix before any public disclosure.

app/globals.css

@@ -64,4 +64,21 @@ body {
 
 .animate-fade-in {
    animation: fade-in 0.4s ease-out forwards;
+}
+
+/* モバイル タッチターゲット最小44px確保 */
+@media (pointer: coarse) {
+   button,
+   [role="button"],
+   input[type="file"] + label {
+      min-width: 44px;
+      min-height: 44px;
+   }
+}
+
+/* フォーカスインジケータ（キーボードナビゲーション用） */
+:focus-visible {
+   outline: 2px solid var(--color-primary);
+   outline-offset: 2px;
+   border-radius: 4px;
 }