@bobfrankston/npmglobalize 1.0.222 → 1.0.224

package/README.md

@@ -200,6 +200,24 @@ node_modules check:
   **name-only** (`--no-allow-scripts-pin`): a version pin would re-open the
   question on every bump. Without a terminal (piped stdin) nothing is asked;
   the pending packages are listed with the command to approve them.
+- **Each answer is remembered for every project.** A decision about `sharp`'s
+  install script is about sharp, not about the project that asked first, so
+  `y`/`n`/`a` answers are stored once per user in your userconfig `npm.json5` (the file `@bobfrankston/userconfig` names as `configPath`; the prompt prints its location):
+
+  ```json5
+  allowScripts: {
+      sharp: true,
+      koffi: true,
+      'some-pkg': false,
+  },
+  ```
+
+  The next project that meets a remembered package gets its `package.json`
+  entry written silently (`· install-script decisions applied from …npm.json5:
+  sharp allowed`). A project's own `allowScripts` entry wins over the
+  remembered one, so a per-project exception is just an edit to that
+  `package.json`. Edit or delete an entry in `npm.json5` to change your mind
+  everywhere.
 - The field is written by npm itself, so a linked dep gets the key npm wants
   for it — the `file:` spec, e.g. `"file:../../../../projects/com/com-wrapper": true`
   (relative to the link's parent directory, not the project).
@@ -207,8 +225,8 @@ node_modules check:
 The **global** install then allowlists your own packages — it just built and
 published them from your source, so they're trusted — plus whatever the
 project's `allowScripts` approved (a `file:` key is mapped to that dep's
-published name) and your user `.npmrc` `allow-scripts` list, minus anything
-the project denied. Third-party packages you never approved stay gated:
+published name), your remembered `npm.json5` approvals, and your user `.npmrc`
+`allow-scripts` list, minus anything denied. Third-party packages you never approved stay gated:
 
 ```
 > npm install -g @bobfrankston/winpos@2.0.51 --allow-scripts @bobfrankston/winpos,@bobfrankston/msger,@bobfrankston/msgcommon,sharp
@@ -884,7 +902,9 @@ This is useful for:
 deprecation note; it was renamed (2026-09-07) because "local" read as "local mode" rather
 than "install from the local directory".
 
-`-local-install` is persisted to `.globalize.json5` (`"local": true`), so a bare
+`-local-install` is persisted to `.globalize.json5` (`"localInstall": true`; the older
+`"local"` key is still read and is rewritten to the new name the next time the file is
+saved), so a bare
 `npmglobalize` keeps doing local installs until you run `-global` (or edit the
 file). Nothing is committed, bumped, or published, but a `.commitmsg` is still
 consumed: it is appended to `npmchanges.md` under a

package/cli.js

@@ -235,14 +235,15 @@ function parseArgs(args) {
             // from the local directory". Renamed to -local-install (-localinstall also
             // accepted). -local still works but says so, so muscle memory isn't broken
             // and the old spelling is phased out rather than silently kept alive.
-            // The .globalize.json5 key stays "local" so existing configs keep working.
+            // The .globalize.json5 key was renamed "local" → "localInstall" the same day;
+            // readConfig accepts the old name and the next persist rewrites it.
             case '-local':
-                console.log(colors.yellow('!  -local is deprecated — use -local-install (same meaning: npm install -g . from the local directory, no publish)'));
+                console.log(colors.yellow('!  -local is deprecated — use -local-install (or -localinstall). Same meaning: npm install -g . from the local directory, no publish.'));
             // falls through
             case '-local-install':
             case '-localinstall':
-                options.local = true;
-                options.explicitKeys.add('local');
+                options.localInstall = true;
+                options.explicitKeys.add('localInstall');
                 break;
             // 2026-09-01 16:30 EDT — Claude Code (Opus 5), at Bob's direction. -local-install
             // persists to .globalize.json5 but had no counterpart, so leaving local-only
@@ -250,8 +251,8 @@ function parseArgs(args) {
             // 2026-09-01 15:00 EDT — Bob: "-global makes more sense, -nolocal is confusing";
             // -nolocal dropped, -global is the only spelling.
             case '-global':
-                options.local = false;
-                options.explicitKeys.add('local');
+                options.localInstall = false;
+                options.explicitKeys.add('localInstall');
                 break;
             case '-install':
             case '-i':
@@ -663,7 +664,7 @@ export async function main() {
         console.log(`Updated ${path.join(cwd, 'package.json')} scripts:`);
         changes.forEach(c => console.log(`  ${c}`));
         // If no other flags need processing, exit; otherwise fall through
-        if (!cliOptions.install && !cliOptions.link && !cliOptions.local) {
+        if (!cliOptions.install && !cliOptions.link && !cliOptions.localInstall) {
             process.exit(0);
         }
     }

package/lib.d.ts

@@ -132,8 +132,9 @@ export interface GlobalizeOptions {
      *  are absent. Currently declarative (recorded in config and displayed);
      *  the actual conversion path is TODO. */
     usePaths?: boolean;
-    /** Local install only — skip transform/publish, just npm install -g . */
-    local?: boolean;
+    /** Local install only (-local-install) — skip transform/publish, just npm install -g .
+     *  Config key renamed from "local" 2026-09-07; readConfig still accepts the old name. */
+    localInstall?: boolean;
     /** Build every file: dep even when outputs look up to date (skips the freshness check) */
     forceBuild?: boolean;
     /** Freeze node_modules: replace symlinks/junctions with real copies for network share use */
@@ -570,6 +571,18 @@ export declare function projectAllowScripts(dir: string): {
     allowed: string[];
     denied: string[];
 };
+/** The user's remembered install-script decisions, by package name.
+ *  `true` = approve, `false` = deny. Read from npm.json5 via userconfig. */
+export declare function globalAllowScripts(): Record<string, boolean>;
+/** Merge new decisions into the remembered set and persist it. */
+export declare function rememberAllowScripts(decisions: Record<string, boolean>): void;
+/** Project policy layered over the remembered user policy: a name the
+ *  project decided keeps the project's answer; every other remembered
+ *  name contributes its own. */
+export declare function effectiveAllowScripts(dir: string): {
+    allowed: string[];
+    denied: string[];
+};
 /** Bring the project's package.json `allowScripts` up to date with what is
  *  installed, so `npm install` stops warning and — once npm starts enforcing
  *  the policy — keeps running the scripts this project depends on.

package/lib.js

@@ -14,7 +14,7 @@ import os from 'os';
 import path from 'path';
 import { execSync, spawn, spawnSync } from 'child_process';
 import { builtinModules } from 'module';
-import { readConfig as readUserConfig, writeConfig as writeUserConfig, configDir } from '@bobfrankston/userconfig';
+import { readConfig as readUserConfig, writeConfig as writeUserConfig, configDir, configPath as userConfigPath } from '@bobfrankston/userconfig';
 import { freezeDependencies } from '@bobfrankston/freezepak';
 import { importgen as runImportgen } from '@bobfrankston/importgen';
 /** Wrapper for spawnSync that avoids DEP0190 (args + shell: true).
@@ -312,7 +312,18 @@ export function readConfig(dir) {
     }
     try {
         const content = fs.readFileSync(configPath, 'utf-8');
-        return JSON5.parse(content);
+        const config = JSON5.parse(content);
+        // 2026-09-07 — Claude Code (Fable 5.1), at Bob's direction: the "local" key
+        // was renamed "localInstall" along with the -local → -local-install flag.
+        // Old files keep working: the value is carried over here, and since
+        // writeConfig reads the existing config through this same function, the
+        // next persist writes the new name and drops the old one.
+        if ('local' in config && !('localInstall' in config)) {
+            config.localInstall = config.local;
+            console.log(colors.dim(`  (.globalize.json5: "local" is now "localInstall" — rewritten on the next persist)`));
+        }
+        delete config.local;
+        return config;
     }
     catch (error) {
         console.warn(`Warning: Could not parse .globalize.json5 config: ${error.message}`);
@@ -332,7 +343,7 @@ const BOOL_COMMENTS = {
     quiet: { on: 'Suppress npm warnings', off: 'Show npm warnings' },
     verbose: { on: 'Show detailed output', off: 'Normal output detail' },
     fix: { on: 'Auto-run npm audit fix (default)', off: 'Do NOT run npm audit fix (audit report still runs)' },
-    local: { on: 'Local install only via -local-install (skip transform/publish)', off: 'Normal transform/publish flow' },
+    localInstall: { on: 'Local install only via -local-install (skip transform/publish)', off: 'Normal transform/publish flow' },
     noPublish: { on: 'Transform but don\'t publish', off: 'Publish normally' },
     freeze: { on: 'Freeze node_modules (replace symlinks with real copies)', off: 'Leave node_modules symlinks as-is' },
     usePaths: { on: 'Resolve file: deps from sibling checkouts', off: 'Resolve file: deps from npm, not siblings (standalone package)' },
@@ -444,7 +455,7 @@ export function writeConfig(dir, config, explicitKeys) {
         ['"gitVisibility": "private"', 'Git repo: private or public'],
         ['"npmVisibility": "private"', 'npm package: private or public'],
         ['"fix": true', 'true = auto-run npm audit fix (never --force); false = report only'],
-        ['"local": false', 'true = install from the local directory only, set by -local-install (skip transform/publish); clear with -global'],
+        ['"localInstall": false', 'true = install from the local directory only, set by -local-install (skip transform/publish); clear with -global'],
         ['"noPublish": false', 'true = transform but don\'t publish'],
         ['"freeze": false', 'true = freeze node_modules (replace symlinks with real copies)'],
         ['"usePaths": true', 'true = resolve file: deps from siblings; false = use latest npm version (standalone)'],
@@ -4361,18 +4372,55 @@ function npmrcAllowScripts() {
         return [];
     return r.output.split(/[,\s]+/).map(s => s.trim()).filter(Boolean);
 }
+// 2026-09-07 — Claude Code (Fable 5.1), at Bob's direction ("why not save the
+// accept scripts globally rather than asking me each time"). A yes/no about a
+// third-party package's install scripts is a decision about that PACKAGE, not
+// about the project that happened to ask first — sharp is sharp in whts and in
+// label-core. So every answer is remembered once, per user, in npm.json5
+// (`allowScripts: { sharp: true, "evil-pkg": false }`), and a project that
+// meets a remembered package gets its package.json field written without a
+// question. package.json stays the record npm itself reads; npm.json5 is the
+// memory that pre-answers it.
+/** The user's remembered install-script decisions, by package name.
+ *  `true` = approve, `false` = deny. Read from npm.json5 via userconfig. */
+export function globalAllowScripts() {
+    const policy = readUserNpmConfig().allowScripts;
+    return policy && typeof policy === 'object' ? { ...policy } : {};
+}
+/** Merge new decisions into the remembered set and persist it. */
+export function rememberAllowScripts(decisions) {
+    if (!Object.keys(decisions).length)
+        return;
+    writeUserNpmConfig({ allowScripts: { ...globalAllowScripts(), ...decisions } });
+}
 /** npm args allowing install scripts on a GLOBAL install: our own packages,
- *  whatever the project's package.json `allowScripts` approves, and the
- *  user's .npmrc list — minus anything the project denies. Empty when npm
- *  predates the policy (it runs the scripts anyway) or nothing is allowed. */
+ *  whatever the project's package.json `allowScripts` approves, the user's
+ *  remembered approvals (npm.json5), and the user's .npmrc list — minus
+ *  anything denied. A project's explicit decision wins over the remembered
+ *  one. Empty when npm predates the policy (it runs the scripts anyway) or
+ *  nothing is allowed. */
 function allowScriptsArgs(dir) {
     if (!npmSupportsAllowScripts())
         return [];
-    const project = projectAllowScripts(dir);
-    const names = [...new Set([...ownScopePackages(dir), ...project.allowed, ...npmrcAllowScripts()])]
-        .filter(n => !project.denied.includes(n));
+    const { allowed, denied } = effectiveAllowScripts(dir);
+    const names = [...new Set([...ownScopePackages(dir), ...allowed, ...npmrcAllowScripts()])]
+        .filter(n => !denied.includes(n));
     return names.length ? ['--allow-scripts', names.join(',')] : [];
 }
+/** Project policy layered over the remembered user policy: a name the
+ *  project decided keeps the project's answer; every other remembered
+ *  name contributes its own. */
+export function effectiveAllowScripts(dir) {
+    const project = projectAllowScripts(dir);
+    const allowed = new Set(project.allowed);
+    const denied = new Set(project.denied);
+    for (const [name, ok] of Object.entries(globalAllowScripts())) {
+        if (allowed.has(name) || denied.has(name))
+            continue;
+        (ok ? allowed : denied).add(name);
+    }
+    return { allowed: [...allowed], denied: [...denied] };
+}
 /** Parse the text listing of `npm approve-scripts --allow-scripts-pending`:
  *  one indented `name@version (event: cmd; event: cmd)` line per node,
  *  the same package repeated when several versions are installed. */
@@ -4424,16 +4472,23 @@ export async function ensureAllowScripts(dir, opts = {}) {
     if (!pending.length)
         return;
     const trusted = new Set([...ownScopePackages(dir), ...localDepDisplayNames(dir)]);
-    const auto = pending.filter(p => trusted.has(p.name));
-    const ask = pending.filter(p => !trusted.has(p.name));
     const label = (p) => p.versions.length ? `${p.name}@${p.versions.join('|')}` : p.name;
+    const auto = pending.filter(p => trusted.has(p.name));
+    // 2026-09-07 — Claude Code (Fable 5.1), at Bob's direction: a package already
+    // decided in npm.json5 is applied here without asking; only never-seen
+    // third-party packages reach the prompt, and their answers are remembered.
+    const remembered = globalAllowScripts();
+    const rememberedYes = pending.filter(p => !trusted.has(p.name) && remembered[p.name] === true);
+    const rememberedNo = pending.filter(p => !trusted.has(p.name) && remembered[p.name] === false);
+    const ask = pending.filter(p => !trusted.has(p.name) && !(p.name in remembered));
     if (opts.dryRun) {
-        console.log(colors.dim(`  [dry-run] allowScripts in ${pkgName}: would approve ${auto.map(label).join(', ') || '(none)'}; would ask about ${ask.map(label).join(', ') || '(none)'}`));
+        console.log(colors.dim(`  [dry-run] allowScripts in ${pkgName}: would approve ${[...auto, ...rememberedYes].map(label).join(', ') || '(none)'}; would deny ${rememberedNo.map(label).join(', ') || '(none)'}; would ask about ${ask.map(label).join(', ') || '(none)'}`));
         return;
     }
-    const approve = auto.map(p => p.name);
-    const deny = [];
+    const approve = [...auto, ...rememberedYes].map(p => p.name);
+    const deny = rememberedNo.map(p => p.name);
     const skipped = [];
+    const decisions = {};
     if (ask.length) {
         if (!process.stdin.isTTY) {
             console.log(colors.yellow(`  ⚠ ${ask.length} third-party package(s) in ${pkgName} have install scripts not yet covered by allowScripts (no terminal to ask): ${ask.map(label).join(', ')}`));
@@ -4441,40 +4496,56 @@ export async function ensureAllowScripts(dir, opts = {}) {
             skipped.push(...ask.map(label));
         }
         else {
-            console.log(colors.cyan(`npm gates install scripts for ${ask.length} third-party package(s) in ${pkgName}. Approvals are recorded in package.json "allowScripts" (name-only) and honored on the global install too.`));
+            console.log(colors.cyan(`npm gates install scripts for ${ask.length} third-party package(s) in ${pkgName}. Each answer is recorded in package.json "allowScripts" (name-only), honored on the global install, and remembered for every project in ${userConfigPath}.`));
             let allRemaining = false;
             for (const p of ask) {
                 const prebuilt = PREBUILT_SCRIPT_RUNNERS.test(p.scripts) ? ' — prebuilt-binary fetcher, the package ships binaries' : '';
                 if (allRemaining) {
                     approve.push(p.name);
+                    decisions[p.name] = true;
                     continue;
                 }
                 const answer = await promptChoice(`  Allow install scripts for ${label(p)} (${p.scripts})${prebuilt}?  [y]es / [n]o, deny / [a]ll remaining / [s]kip for now:`, ['y', 'n', 'a', 's']);
                 switch (answer) {
                     case 'y':
                         approve.push(p.name);
+                        decisions[p.name] = true;
                         break;
                     case 'a':
                         approve.push(p.name);
+                        decisions[p.name] = true;
                         allRemaining = true;
                         break;
                     case 'n':
                         deny.push(p.name);
+                        decisions[p.name] = false;
                         break;
                     default:
                         skipped.push(label(p));
                         break; // 's', or EOF ('' from promptChoice)
                 }
             }
+            try {
+                rememberAllowScripts(decisions);
+            }
+            catch (error) {
+                // Not swallowed: the project's package.json still gets the answer below;
+                // only the cross-project memory is lost, and the user is told so.
+                console.log(colors.yellow(`  ⚠ could not remember install-script decisions in ${userConfigPath}: ${error.message}`));
+            }
         }
     }
+    if (rememberedYes.length || rememberedNo.length) {
+        console.log(colors.dim(`  · install-script decisions applied from ${userConfigPath}: ${[...rememberedYes.map(p => `${p.name} allowed`), ...rememberedNo.map(p => `${p.name} denied`)].join(', ')}`));
+    }
     // `npm approve-scripts <name>` matches installed nodes by the same display
     // name the pending listing used, and writes the right key for each kind
     // (registry name, or the file: path for a linked dep).
     if (approve.length) {
         const r = await runCommandAsync('npm', ['approve-scripts', '--no-allow-scripts-pin', ...approve], { cwd: dir, silent: true });
+        const autoNote = [auto.length ? `${auto.length} own/local` : '', rememberedYes.length ? `${rememberedYes.length} remembered` : ''].filter(Boolean).join(', ');
         if (r.success)
-            console.log(colors.green(`  ✓ allowScripts: approved ${approve.join(', ')}${auto.length ? ` (${auto.length} own/local approved automatically)` : ''}`));
+            console.log(colors.green(`  ✓ allowScripts: approved ${approve.join(', ')}${autoNote ? ` (${autoNote} approved automatically)` : ''}`));
         else
             console.log(colors.red(`  ✗ npm approve-scripts failed: ${(r.stderr || r.output).trim().split('\n').find(l => /npm error/.test(l)) ?? 'see output'}`));
     }
@@ -4888,8 +4959,9 @@ export async function installInWsl(wslArgs, opts = {}) {
     // list is left out — WSL's npm has its own .npmrc. Probed against WSL's
     // npm, which is a separate install from the Windows one.
     if (opts.cwd && wslArgs.includes('install') && await wslNpmSupportsAllowScripts()) {
-        const project = projectAllowScripts(opts.cwd);
-        const names = [...new Set([...ownScopePackages(opts.cwd), ...project.allowed])].filter(n => !project.denied.includes(n));
+        // 2026-09-07 — Claude Code (Fable 5.1): remembered npm.json5 decisions apply in WSL too.
+        const policy = effectiveAllowScripts(opts.cwd);
+        const names = [...new Set([...ownScopePackages(opts.cwd), ...policy.allowed])].filter(n => !policy.denied.includes(n));
         if (names.length)
             wslArgs = [...wslArgs, '--allow-scripts', names.join(',')];
     }
@@ -6669,7 +6741,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     const { bump = 'patch', noPublish = false, cleanup = false, install = false, link = false, wsl = false, force = false, files = true, dryRun = false, quiet = true, verbose = false, init = false, gitVisibility = 'private', npmVisibility = 'private', message, conform = false, asis = false, updateDeps = false, updateMajor = false, publishDeps = true, // Default to publishing deps for safety
     publishDepsYes = false, // -pd: auto-yes to dep-cascade prompts (private only)
     publicDeps = false, // -public-deps: cascade public visibility to all deps
-    noPrescan = false, forcePublish = false, fix = true, fixTags = false, rebase = false, show = false, local = false, freeze = false, usePaths = true, allowTs, adopt = false, importCheck = false } = options;
+    noPrescan = false, forcePublish = false, fix = true, fixTags = false, rebase = false, show = false, localInstall = false, freeze = false, usePaths = true, allowTs, adopt = false, importCheck = false } = options;
     // 2026-09-06 — Claude Code (Fable 5.1), at Bob's direction: a directory marked
     // `.stale` is retired. Refuse to build, publish or install it — and because the
     // dep cascade reaches deps through this same function, refuse to cascade into
@@ -6733,7 +6805,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             settings.push('--force-publish');
         if (configOptions.show)
             settings.push('--show');
-        if (configOptions.local)
+        if (configOptions.localInstall)
             settings.push('-local-install');
         if (configOptions.freeze)
             settings.push('-freeze');
@@ -6758,7 +6830,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
     // 2026-09-01 16:30 EDT — Claude Code (Opus 5): this was a verbatim copy of
     // doLocalInstall (the 10:55 output-capture note lives there now). One path,
     // so the .commitmsg recording added today lands in both entry points.
-    if (local) {
+    if (localInstall) {
         return doLocalInstall(cwd, options);
     }
     // Prescan the file: dep graph up front — surface all problems before
@@ -6988,7 +7060,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                     + '  5) Abort\nChoice [1]:', ['1', '2', '3', '4', '5', '']);
                 if (choice === '4') {
                     console.log(colors.dim('Switching to local-only mode...'));
-                    writeConfig(cwd, { ...configOptions, local: true }, new Set(['local']));
+                    writeConfig(cwd, { ...configOptions, localInstall: true }, new Set(['localInstall']));
                     return doLocalInstall(cwd, options);
                 }
                 if (choice === '5') {
@@ -7017,7 +7089,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                     + '  4) Abort\nChoice [1]:', ['1', '2', '3', '4', '']);
                 if (choice === '3') {
                     console.log(colors.dim('Switching to local-only mode...'));
-                    writeConfig(cwd, { ...configOptions, local: true }, new Set(['local']));
+                    writeConfig(cwd, { ...configOptions, localInstall: true }, new Set(['localInstall']));
                     return doLocalInstall(cwd, options);
                 }
                 if (choice === '4') {
@@ -7060,7 +7132,7 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
                 + '  4) Abort\nChoice [1]:', ['1', '2', '3', '4', '']);
             if (choice === '3') {
                 console.log(colors.dim('Switching to local-only mode...'));
-                writeConfig(cwd, { ...configOptions, local: true }, new Set(['local']));
+                writeConfig(cwd, { ...configOptions, localInstall: true }, new Set(['localInstall']));
                 return doLocalInstall(cwd, options);
             }
             if (choice === '4') {
@@ -7875,8 +7947,8 @@ export async function globalize(cwd, options = {}, configOptions = {}) {
             surprises.push(`usePaths=false${fromConfig('usePaths')} — file: deps resolved from npm, not siblings`);
         if (configOptions.freeze || freeze)
             surprises.push(`freeze=true${fromConfig('freeze')}`);
-        if (configOptions.local || local)
-            surprises.push(`local=true${fromConfig('local')}`);
+        if (configOptions.localInstall || localInstall)
+            surprises.push(`localInstall=true${fromConfig('localInstall')}`);
         if (configOptions.files === false || files === false)
             surprises.push(`files=false${fromConfig('files')} — npm versions left in package.json`);
         if (configOptions.allowTs === true || allowTs === true)
@@ -9064,8 +9136,8 @@ export async function globalizeWorkspace(rootDir, options = {}, configOptions =
     // user up front avoids the surprise of "I asked for install but most
     // packages didn't install."
     const installSources = [];
-    if (options.local || configOptions.local) {
-        const src = configOptions.local && !options.local ? '.globalize.json5' : 'CLI';
+    if (options.localInstall || configOptions.localInstall) {
+        const src = configOptions.localInstall && !options.localInstall ? '.globalize.json5' : 'CLI';
         installSources.push(`-local-install (${src})`);
     }
     if (options.install || configOptions.install) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/npmglobalize",
-  "version": "1.0.222",
+  "version": "1.0.224",
   "description": "Transform file: dependencies to npm versions for publishing",
   "main": "index.js",
   "type": "module",
@@ -33,7 +33,7 @@
   "dependencies": {
     "@bobfrankston/freezepak": "^0.1.9",
     "@bobfrankston/importgen": "^0.1.43",
-    "@bobfrankston/themecolors": "^0.1.9",
+    "@bobfrankston/themecolors": "^0.1.10",
     "@bobfrankston/userconfig": "^1.0.11",
     "@npmcli/package-json": "^7.0.4",
     "json5": "^2.2.3",
@@ -61,7 +61,7 @@
     "dependencies": {
       "@bobfrankston/freezepak": "^0.1.9",
       "@bobfrankston/importgen": "^0.1.43",
-      "@bobfrankston/themecolors": "^0.1.9",
+      "@bobfrankston/themecolors": "^0.1.10",
       "@bobfrankston/userconfig": "^1.0.11",
       "@npmcli/package-json": "^7.0.4",
       "json5": "^2.2.3",