@devenius/junamis-skills 1.0.0-placeholder.0 → 1.1.0

package/CHANGELOG.md

@@ -2,7 +2,47 @@
 
 All notable changes to this project are documented here. Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
-## [1.0.0-placeholder.0] - 2026-11-10
+## [Unreleased]
+
+### Added
+
+### Changed
+
+### Fixed
+
+## [1.1.0] - 2026-11-13
+
+### Added
+- `.github/workflows/publish.yml` is renamed to `Publish` and runs two jobs: `publish-github` mirrors to GitHub Packages with `GITHUB_TOKEN` and `packages: write`, and `publish-npm` stages to npmjs with OIDC (`id-token: write`), the `npm-publish` environment, and `npm stage publish`. The npm job sets no `NODE_AUTH_TOKEN`; a maintainer approves the staged version on npmjs.com. Top-level permissions are `contents: read` and each job adds only what it needs.
+- `pnpm publish:npm` (`scripts/publish-npm.mjs` over `src/scripts/publish-npm.ts`) is a read-only publish checklist. It validates the package name, `publishConfig.access`, and the absence of `publishConfig.registry`, then prints the exact `npm stage publish` command. It never runs a registry mutation.
+- `src/color.ts` is a dependency-free ANSI helper (`paint`, `createColors`, `stripAnsi`, `colorsEnabled`). The `init` and `status` CLI output and the release gate use it: cyan headers, green success, yellow warnings, red errors, and gray details. Color disables itself for a non-TTY stream, `NO_COLOR`, or `TERM=dumb`, so captured output stays plain.
+- Every orchestrator prompt starts with `git branch --show-current`. On `main` or a detached HEAD it runs `git fetch origin` and `git switch -c task/<task-slug> origin/main` (or `git switch -c task/<task-slug> main` when there is no remote) and continues on that branch. On a task branch it continues; it never works on `main`. The orchestrator commits on `task/<task-slug>` in the project checkout, where the state root (`<project>/.orchestrator/`) and the design registry (`<project>/docs/design/`) live.
+- The orchestrator plans the delegation in `<state-root>/delegation.md` with one row per task: owner, depends on, worktree, branch, allowed files, and done proof. Every file has exactly one owner, and dependency order is explicit.
+- Each delegated task runs in `<project>/.worktrees/<task-slug>-<subtask>` on `task/<task-slug>-<subtask>`, cut from the task branch. The brief names the absolute path, the branch, and the allowed files. The sub-agent edits only its allocated files, asks the orchestrator for any file outside the allocation, never creates a pull request, and may commit only its allocated files on its assigned sub-branch.
+- When a sub-agent finishes, the orchestrator verifies the diff is a subset of the allowed files, runs the task checks, merges with `git merge --no-ff`, removes the worktree with `git worktree remove`, and deletes the merged sub-branch with `git branch -d`. On conflict it runs `git merge --abort`, stops, and asks the user.
+- One pull request per approved batch, and orchestrator prompt version 2.0.0. After every task is merged and the full gate passes, the orchestrator asks the user to approve, pushes `task/<task-slug>`, opens the pull request with `gh pr create`, reports the URL, and stops. The user reviews and merges; the agent's authority still ends at `gh pr create`.
+- Worktree limit is 8. Before creating one the orchestrator counts `git worktree list` entries under `<project-root>/.worktrees/` and prunes only a worktree that is merged into the task branch and clean, with `git worktree remove` (never `rm -rf`); if none qualifies it asks the user.
+- `opencode.json` allows external directories under `/tmp/**`, `/var/tmp/**`, `.worktrees/**`, and `**/.worktrees/**`, and allows the worktree shell workflow (`git status`, `git diff`, `git fetch`, `git branch --show-current`, `git switch -c task/*`, `git checkout -b task/*`, `git merge --no-ff task/*`, `git merge task/*`, `git merge --abort`, `git worktree add|list|remove`, `git add`, `git commit`, `git push origin task/*`, `pnpm install|test|build|typecheck|lint`, `pnpm run check:*`, `node --test`, `npx tsc`, the `npx --package` fallbacks for `junamis-orchestrator`, `junamis-design-registry`, and `junamis-reconcile`, and the GitHub pull-request commands `gh pr create|view|list|checks|edit` plus `gh run list|view|watch`).
+- The design registry bootstrap now always writes the project-wide map at `docs/design/other/project.md` (`surface_id: other/project`, kind `other`, `code_paths: []`, draft, owner `library/document`). It names the project, lists every discovered target as workspace, kind, surface_id, and code_paths, and is included in the bootstrap result and the regenerated `INDEX.md`. An existing map is never rewritten.
+- `## Environment setup` in the orchestrator prompt. Before `boot`, `route`, or any dispatch the orchestrator resolves the project root as the user's cwd, checks the four installed library files, ensures the state CLI, checks the four required design registry files (`_schema.md`, `INDEX.md`, `_registry.json`, `other/project.md`), and bootstraps a missing registry only after asking once. A declined bootstrap continues with `design_context: none` and records the missing registry.
+- `docs/RECONCILE.md` is installed as a shared doc next to `RESUME.md` and is published in the package file set.
+- The orchestrator's authority now ends at `gh pr create` (prompt version 1.5.0). After pushing `task/<task-slug>` it opens the pull request, reports the URL, and stops. It never merges, never uses `--admin`, never pushes `main`, never force-pushes, never tags, and never rebases or resets `main`; every action that touches `main` belongs to the user, who reviews and merges.
+- Approvals are single-use, stated in the orchestrator prompt, `AGENTS.md`, and `CONTRIBUTING.md`: one command in one prompt exactly once, ended when that command finishes or fails, never reused for a retry, a second command, a later step, another task, another pull request, or another session, and asked again every time.
+- `.github/pull_request_template.md` checklist items record that the pull request was created by the agent and not merged by it, that `main` was not pushed, and that every approval used in the task was single-use.
+- `test/orchestrator-policy.test.js` locks the PR-only authority and the single-use approval wording across the orchestrator prompt, `AGENTS.md`, `CONTRIBUTING.md`, and the pull request template.
+
+### Changed
+- Hard-deny policies now also deny `shell:gh pr merge` (bare), `shell:git push origin main *`, `shell:git push origin HEAD:main`, and `shell:git push --force-with-lease *`. `git push origin task/*`, `git push -u origin task/*`, and `gh pr create *` stay allowed, and `HARD_DENY_POLICIES` in the config check mirrors the new denies.
+- Hard-deny policies now also deny `shell:git switch main`, `shell:git checkout main`, `shell:git branch -d main`, and `shell:git branch -D main`, so the orchestrator cannot leave a task branch for `main`. `HARD_DENY_POLICIES` in the config check mirrors them, and `git switch -c task/*` and `git checkout -b task/*` stay allowed.
+- Hard-deny policies replace the blanket `shell:git push *` with targeted denies: `shell:git push origin main`, `shell:git push --force *`, `shell:git push -f *`, `shell:git commit --no-verify *`, and `shell:gh pr merge *`. Pushing a `task/*` branch and opening or checking a pull request are allowed; every other hard deny is unchanged.
+- The orchestrator never skips a state or design step because a bin is missing. It prefers `junamis-orchestrator` and `junamis-design-registry` on `PATH` and falls back to `npx --yes --package github:devenius/junamis-skills#main ...`; the package `prepare` script builds `dist/` for that fallback.
+- The orchestrator must call `start` before every dispatch, `end` after it, and close every session with `checkpoint` plus `finish` or `lease release`. A task with no `start`/`end` is not a completed run.
+- `RESUME.md` reference implementation documents the `npx --package` fallback for the state CLI; the normative contract is unchanged.
+
+### Fixed
+- Git installs (`npx github:...`) now build `dist/` through the `prepare` script, so the bin can load the CLI.
+
+## [1.0.0] - 2026-11-10
 
 ### Added
 - `library/RESUME.md` as the normative persistence and resume contract. It is installed as a shared doc next to `HANDOFF.md`, `SAFETY.md`, `EXTERNAL.md`, and `SECURITY.md`.

package/README.md

@@ -1 +1,232 @@
-"Placeholder release — not usable; install 1.1.0 or later."
+# junamis-skills
+
+An orchestrated set of Agent Skills and agents for AI coding tools. The package ships:
+
+- **The library** (`library/`): the orchestrator, eight specialist agents, and the skills they use.
+- **The manifest** (`skills-lock.json`): external skill sources, immutable commits, per-skill tree SHAs, and licenses.
+- **A scan record** (`SECURITY.md`): per-skill kind, source, license, scan status, and last scan month.
+- **An installer** (`junamis-skills`): one `init` command installs the library and every external skill, and writes a setup guide into your project.
+
+## Quick start
+
+Run these in the project that will use the skills. Use `--dry-run` first to see what will change. Requires Node.js 26+; external installs also require Git.
+
+The package name is `@devenius/junamis-skills`. The command-line binary it installs is `junamis-skills`. `npx @devenius/junamis-skills ...` runs the binary without a separate install.
+
+### Option A: Install from npmjs (primary)
+
+```bash
+# 1. Preview the whole install, then apply it.
+npx @devenius/junamis-skills@latest init --dry-run
+npx @devenius/junamis-skills@latest init
+
+# Or install the CLI globally and use the junamis-skills binary.
+npm install -g @devenius/junamis-skills@latest
+
+# 2. Check state.
+npx @devenius/junamis-skills@latest status
+```
+
+### npmjs status
+
+npmjs is the primary public registry. **Until `1.1.0` is published and approved on npmjs.com, `latest` still points at the `0.0.0-stage` placeholder**, so the commands above resolve to an empty placeholder, not a working installer. The first usable npm release is **`1.1.0`**.
+
+- **Until `1.1.0` is live on npmjs**, use the GitHub direct install in Option B. It is the safe path today.
+- **After `1.1.0` is live on npmjs**, the npmjs commands in Option A are primary and `latest` is `1.1.0`.
+
+The placeholder was staged from a separate release branch; it is not a banner on `main`.
+
+### Option B: Run directly from GitHub (no setup, safe today)
+
+```bash
+# 1. Preview the whole install, then apply it.
+npx github:devenius/junamis-skills init --dry-run
+npx github:devenius/junamis-skills init
+
+# For Claude Code instead of OpenCode:
+npx github:devenius/junamis-skills init --agent claude
+
+# Install into the project instead of globally:
+npx github:devenius/junamis-skills init --scope project
+
+# 2. Check state.
+npx github:devenius/junamis-skills status
+```
+
+`init` writes the setup guide, writes `opencode.json` when it is missing (OpenCode only), installs the library, and installs every pinned external skill. Use `--force` to overwrite a guide, config, or library file you edited.
+
+### Option C: Install from GitHub Packages (mirror)
+
+GitHub Packages is the mirror of npmjs. Configure `~/.npmrc` once (see [Installing from GitHub Packages](#installing-from-github-packages)), then use the normal npx form:
+
+```bash
+npx @devenius/junamis-skills init --dry-run
+npx @devenius/junamis-skills init
+npx @devenius/junamis-skills status
+```
+
+Then open the project in your agent and send your first request to `orchestrator`.
+
+## Commands
+
+The CLI has two working commands and `help`.
+
+| Command | What it does |
+|---|---|
+| `init [--agent opencode\|claude] [--scope global\|project] [--dir <path>] [--force] [--dry-run]` | In order: writes `junamis-skills-guide.md` and its marker; writes/refreshes `opencode.json` for OpenCode (only when missing, or with `--force`); installs the library; installs every pinned external skill non-interactively. Exits 1 only when an external install fails. |
+| `status [--dir <path>] [--scope global\|project\|all]` | Reports the guide, marker, per-target internal/external skill counts, canonical agents and link state, legacy leftovers (informational), library manifest validity, `opencode.json` validity, external skill coverage, and the `SECURITY.md` scan record. Exits 1 only when a detected target's manifest or config is invalid, or project JSON is malformed. Default scope: `global` (matching `init`). |
+| `help` | Prints usage. |
+
+## Supported agents
+
+| Agent (`--agent`) | External skills directory | Internal (library) skills directory | Agent definitions (canonical → link) | External install support |
+|---|---|---|---|---|
+| `opencode` | `~/.agents/skills` | `~/.config/junamis/skills/skills` | `~/.config/junamis/skills/agents` → `~/.config/opencode/agents` | `skillsio` |
+| `claude` | `~/.claude/skills` | `~/.claude/skills` | `~/.config/junamis/skills/agents` → `~/.claude/agents` | `skillsio` |
+| `cursor` | `~/.cursor/skills` | `~/.cursor/skills` | `~/.config/junamis/skills/agents` → `~/.cursor/agents` | Library only |
+| `windsurf` | `~/.codeium/windsurf/skills` | `~/.codeium/windsurf/skills` | `~/.config/junamis/skills/agents` → `~/.config/devin/agents` | Library only |
+| `cline` | `~/.cline/skills` | `~/.cline/skills` | `~/.config/junamis/skills/agents` → `~/.cline/agents` | Library only |
+
+Agent definitions are written once to the canonical directory and symlinked into the target's agents directory. If a link cannot be created (for example Windows without developer mode), the file is copied instead and a warning is printed.
+
+For OpenCode, the shipped `opencode.json` registers both skill roots, so internal and external skills resolve side by side. Other targets keep a single skills directory shared by both kinds.
+
+The shipped `opencode.json` uses OpenCode V2 keys. It enables the built-in file tools and local skills, keeps shell and network fetches behind `ask`, denies secret paths and `external_directory`, hard-denies destructive shell verbs, and ships no MCP servers or third-party plugins. Add MCP servers or plugins only after a reviewed decision.
+
+Library installation supports all five targets. Scanned external installation (`init`) currently accepts only OpenCode and Claude Code.
+The Windsurf target keeps project skills in the legacy `.windsurf/skills` directory and installs subagents using Devin's current `.devin/agents` format and locations.
+
+Other agents are added on request, one target file each under `src/targets/`.
+
+## Where things go
+
+- External skills: `<external skills directory>/<name>/SKILL.md`
+- Internal (library) skills: `<internal skills directory>/<name>/SKILL.md`
+- Canonical agents: `~/.config/junamis/skills/agents/<name>.md`
+- Agent links: `<target agents directory>/<name>.md` → the canonical file
+- Shared rules the agents read: `~/.config/junamis/skills/` (`HANDOFF.md`, `SAFETY.md`, `EXTERNAL.md`, `SECURITY.md`, `RESUME.md`, `RECONCILE.md`)
+- Installed manifest for the state engine: `~/.config/junamis/skills/skills-lock.json`
+- Install record: `~/.config/junamis/skills/installed/library-<agent>.json`
+- Project scope: `<project>/.config/junamis/skills/{skills,agents,*.md,installed}` mirrors the internal side. External skills stay at the target's project skills directory, and project agent links stay at its project agents directory.
+- Session state and the guide marker stay in `.junamis/` (`handoff.md`, `junamis-skills.json`).
+
+For OpenCode the split is: internal skills in `~/.config/junamis/skills/skills`, canonical agents in `~/.config/junamis/skills/agents`, shared docs in `~/.config/junamis/skills/*.md`, the install manifest in `~/.config/junamis/skills/installed/library-opencode.json`, links in `~/.config/opencode/agents`, and external skills in `~/.agents/skills`. Other targets keep one skills directory for both kinds.
+
+`init` writes only the nested layout. There is no automatic migration: older flat files under `~/.config/junamis/` and flat skill folders directly under `~/.config/junamis/skills/` are reported by `status` as legacy leftovers and are never deleted. Move or remove them yourself once the new install is verified.
+
+## Persistence and resume
+
+The orchestrator is resumable. Every session starts by rehydrating execution state from disk, before `route` or any skill dispatch:
+
+```bash
+junamis-orchestrator boot --project <cwd> --session <new id>
+```
+
+The `junamis-orchestrator` bin also exposes `plan set`, `plan show`, `start`, `end`, `resolve`, `status`, `checkpoint`, `lease acquire|heartbeat|release|status`, and `finish`.
+
+- **State root.** The default is `<project>/.orchestrator/` (gitignored). It holds `journal.ndjson` (the source of truth), `state.json`, `plan.json`, `tasks/<task_id>/`, `checkpoints/`, `locks/`, `resume-report.md`, and the generated `STATE.md` view. `ORCH_STATE_ROOT` overrides the location. The root must be persistent and host-local, never inside the operating system temp directory.
+- **Report first.** `boot` writes `resume-report.md`. Read it in full. Its status is `NEW_RUN`, `RESUMING`, `COMPLETE`, `BLOCKED_DRIFT`, or `HALT_CORRUPT`. Exit codes are `0` success, `1` usage or I/O, `2` lease held or lost, `3` drift, `4` corrupt state, and `5` invalid transition or handoff. On a non-zero exit, stop and report the halt line and report path; dispatch nothing.
+- **Single writer.** A lease under `locks/` prevents two sessions from writing one state root. A stale lease is taken over; a live lease halts the second session.
+- **Drift gate.** `skills-lock.json` and the library override map are fingerprinted at plan time. A manifest or `library/` change makes boot report `BLOCKED_DRIFT` and refuse to dispatch.
+- **Idempotent or escalate.** Every library skill declares `idempotent: true | false` in its frontmatter. An interrupted `true` step is retried; an interrupted `false` step becomes `needs_review` and waits for a user decision. An external skill records the value in its adapter and defaults to `false` when upstream does not declare one.
+- **Contract.** `RESUME.md` is installed with `HANDOFF.md`, `SAFETY.md`, `EXTERNAL.md`, `SECURITY.md`, and `RECONCILE.md` at the config root and is the normative persistence contract. `RECONCILE.md` is the work-queue contract that decides what runs next.
+
+The state engine lives under `src/orchestrator/`, uses only Node 26 built-in modules, and adds no runtime dependency.
+
+## External skills (manifest)
+
+These are installed from `skills-lock.json` into the agent's global skills directory.
+
+| Skill | Source | License |
+|---|---|---|
+| `agent-browser` | [vercel-labs/agent-browser](https://github.com/vercel-labs/agent-browser) | Apache-2.0 |
+| `agent-rules` | [netresearch/agent-rules-skill](https://github.com/netresearch/agent-rules-skill) | MIT OR CC-BY-SA-4.0 |
+| `architect` | [JavaScript-Mastery-Pro/skills](https://github.com/JavaScript-Mastery-Pro/skills) | MIT |
+| `check` | [JavaScript-Mastery-Pro/skills](https://github.com/JavaScript-Mastery-Pro/skills) | MIT |
+| `debug` | [JavaScript-Mastery-Pro/skills](https://github.com/JavaScript-Mastery-Pro/skills) | MIT |
+| `develop` | [JavaScript-Mastery-Pro/skills](https://github.com/JavaScript-Mastery-Pro/skills) | MIT |
+| `doc-coauthoring` | [anthropics/skills](https://github.com/anthropics/skills) | Apache-2.0 |
+| `document` | [JavaScript-Mastery-Pro/skills](https://github.com/JavaScript-Mastery-Pro/skills) | MIT |
+| `driftlock` | [KairosSignal/driftlock-agent-docs](https://github.com/KairosSignal/driftlock-agent-docs) | MIT |
+| `find-skills` | [vercel-labs/skills](https://github.com/vercel-labs/skills) | MIT |
+| `frontend-design` | [anthropics/skills](https://github.com/anthropics/skills) | Apache-2.0 |
+| `grill-me` | [mattpocock/skills](https://github.com/mattpocock/skills) | MIT |
+| `grill-with-docs` | [mattpocock/skills](https://github.com/mattpocock/skills) | MIT |
+| `mcp-builder` | [anthropics/skills](https://github.com/anthropics/skills) | Apache-2.0 |
+| `nestjs-best-practices` | [Kadajett/agent-nestjs-skills](https://github.com/Kadajett/agent-nestjs-skills) | MIT |
+| `scope` | [JavaScript-Mastery-Pro/skills](https://github.com/JavaScript-Mastery-Pro/skills) | MIT |
+| `shadcn` | [shadcn-ui/ui](https://github.com/shadcn-ui/ui) | MIT |
+| `shadcn-component-discovery` | [mattbx/shadcn-skills](https://github.com/mattbx/shadcn-skills) | MIT |
+| `shadcn-component-review` | [mattbx/shadcn-skills](https://github.com/mattbx/shadcn-skills) | MIT |
+| `skill-creator` | [anthropics/skills](https://github.com/anthropics/skills) | Apache-2.0 |
+| `tdd` | [mattpocock/skills](https://github.com/mattpocock/skills) | MIT |
+| `test` | [JavaScript-Mastery-Pro/skills](https://github.com/JavaScript-Mastery-Pro/skills) | MIT |
+| `theme-factory` | [anthropics/skills](https://github.com/anthropics/skills) | Apache-2.0 |
+| `webapp-testing` | [anthropics/skills](https://github.com/anthropics/skills) | Apache-2.0 |
+
+Each lock entry pins an upstream commit and skill tree SHA. Maintainers should follow the [external skill review and pinning procedure](docs/external-skills-maintenance.md) when changing this manifest.
+
+## Security record (`SECURITY.md`)
+
+[`SECURITY.md`](SECURITY.md) is the recorded vetting record for every skill the package installs. It lists each internal skill and each locked external skill with its source, license, scan status (`first-party`, `pass`, or `flagged`), and the month it was last reviewed. Install-time scanning is skipped by design (`--skip-scan`); `SECURITY.md` plus `library/SAFETY.md` is the vetting record. `Last external scan` records when the pinned `skillsio 1.1.3` scan (Trust Hub, Socket, Snyk) was last recorded. `scripts/check-security.mjs` fails CI when a skill is added and not recorded, or when that line is missing. `pnpm run check:pins` re-fetches every locked source and confirms its tree SHA.
+
+## Installing from GitHub Packages
+
+This package is also published to GitHub Packages as `@devenius/junamis-skills`; it is the mirror of the npmjs release, not the primary registry.
+
+1. Create or edit `~/.npmrc` (or project `.npmrc`):
+
+```ini
+@devenius:registry=https://npm.pkg.github.com
+//npm.pkg.github.com/:_authToken=YOUR_GITHUB_TOKEN
+```
+
+2. Install or run:
+
+```bash
+npm install -g @devenius/junamis-skills
+# or run without installing:
+npx github:devenius/junamis-skills init
+```
+
+A GitHub personal access token with `read:packages` (and `write:packages` for publishing) is required.
+
+## Maintainers: publishing
+
+npmjs (`@devenius/junamis-skills`) is the primary public registry and GitHub Packages is the mirror. The release mechanics, trusted publisher setup, staged approval, and deprecation policy live in [`docs/publishing/npm.md`](docs/publishing/npm.md).
+
+**The user runs every publish and deprecate command.** The agent prepares the exact command and the release metadata and stops there. It never runs `npm publish`, `npm stage publish`, `npm deprecate`, `npm unpublish`, `npm dist-tag`, `npm owner`, or `npm access`; those are user actions gated by `library/SAFETY.md` and single-use approvals.
+
+## Safety
+
+- The installer never runs a command through a shell. Every value is checked against a strict pattern before use.
+- The scanner is pinned to `skillsio@1.1.3` with a verified registry, tarball URL, and SHA-512 integrity. Each locked commit, tree SHA, and checkout HEAD is verified before it runs.
+- A skill folder must be a Git tree. An in-tree symlink such as `CLAUDE.md -> AGENTS.md` is allowed; an absolute or escaping symlink is rejected, as is a gitlink.
+- `init` passes `-y` and `--skip-scan` so it can install every skill non-interactively. `-y` cannot bypass the scanner's high/critical prompt, so install-time scanning is skipped by design; the recorded scan is the gate. After each group it verifies that every expected `<name>/SKILL.md` exists and counts only verified installs.
+- Flagged findings are vetted in `SECURITY.md` and gated in `library/SAFETY.md`.
+- Destructive or external actions in the library need your explicit approval. See `library/SAFETY.md`.
+
+## Development
+
+The runtime code is TypeScript under `src/`. The built package ships `dist/` and its declarations; `src/` is not part of the published package.
+
+```bash
+pnpm install    # dev dependencies only; there is no runtime dependency
+pnpm build      # tsc -> dist/ (JavaScript, declarations, source maps)
+pnpm typecheck  # source check, then the compiled consumer contract
+pnpm test       # build, typecheck, then the full Node test suite
+```
+
+Consumers import the package root (`@devenius/junamis-skills`) or the `./types` subpath; both resolve to `dist/`. `dist/` is generated and gitignored, so contributors never commit it. See [`docs/typescript.md`](docs/typescript.md) for the build outputs, strict compiler settings, and the `unknown`-at-the-boundary rules.
+
+`main` is protected and read-only. Work on a task branch in its own worktree, run the gate above, push the branch, and open a pull request; never push directly to `main` and never self-merge. See [`CONTRIBUTING.md`](CONTRIBUTING.md) and [`.github/pull_request_template.md`](.github/pull_request_template.md) for the checklist.
+
+## Reporting issues
+
+If an external skill is missing or an install fails, open an issue at
+https://github.com/devenius/junamis-skills/issues with these details:
+version, Node version, agent, installer, failing skill, and the command output.
+
+## License
+
+MIT. The external skills keep their own licenses, listed in `skills-lock.json`.

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAIA,OAAO,EAAyC,UAAU,EAAE,MAAM,YAAY,CAAC;AAE/E,OAAO,EAAE,eAAe,EAAoC,MAAM,eAAe,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAgB,MAAM,sBAAsB,CAAC;AAG7F,OAAO,KAAK,EACV,qBAAqB,EAGrB,YAAY,EAGZ,cAAc,EACd,cAAc,EACf,MAAM,kBAAkB,CAAC;AAkC1B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAmGD,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,CAAC;AAE9F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAID,wBAAsB,mBAAmB,CAAC,EACxC,GAAmB,EACnB,KAAgB,EAChB,KAAa,EACb,MAAc,EACd,WAA0B,GAC3B,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA6B5D;AAmDD,iEAAiE;AACjE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,UAAU,CAAC;IACxC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IACxD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,eAAe,CAAC;IAClD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAmFtF;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,cAAsB,EAC7B,UAAU,GAAE,MAAsB,GACjC,cAAc,EAAE,CAkBlB;AAuND,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC,CAkB3F"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAKA,OAAO,EAAyC,UAAU,EAAE,MAAM,YAAY,CAAC;AAE/E,OAAO,EAAE,eAAe,EAAoC,MAAM,eAAe,CAAC;AAClF,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAgB,MAAM,sBAAsB,CAAC;AAG7F,OAAO,KAAK,EACV,qBAAqB,EAGrB,YAAY,EAGZ,cAAc,EACd,cAAc,EACf,MAAM,kBAAkB,CAAC;AAkC1B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAmGD,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,WAAW,GAAG,MAAM,GAAG,aAAa,GAAG,eAAe,CAAC;AAE9F,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAID,wBAAsB,mBAAmB,CAAC,EACxC,GAAmB,EACnB,KAAgB,EAChB,KAAa,EACb,MAAc,EACd,WAA0B,GAC3B,GAAE,qBAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA6B5D;AA0DD,iEAAiE;AACjE,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,UAAU,CAAC;IACxC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1D,QAAQ,CAAC,kBAAkB,CAAC,EAAE,OAAO,kBAAkB,CAAC;IACxD,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IAC1D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,eAAe,CAAC;IAClD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,yDAAyD;AACzD,MAAM,WAAW,mBAAoB,SAAQ,qBAAqB;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAsB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAE,QAAa,GAAG,OAAO,CAAC,UAAU,CAAC,CAoFtF;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,cAAsB,EAC7B,UAAU,GAAE,MAAsB,GACjC,cAAc,EAAE,CAkBlB;AAwND,wBAAsB,GAAG,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAAC,CAkB3F"}

package/dist/cli.js

@@ -2,6 +2,7 @@ import { existsSync, lstatSync, readlinkSync } from "node:fs";
 import { mkdir, readdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
+import { createColors, colorsEnabled } from "./color.js";
 import { PACKAGE_ROOT, GUIDE_NAME, MARKER_PATH, writeGuide } from "./guide.js";
 import { getTarget, targets } from "./targets/index.js";
 import { installExternal, validateAgent, validateInstaller } from "./external.js";
@@ -161,63 +162,69 @@ export async function writeOpencodeConfig({ dir = process.cwd(), scope = "global
     await writeFile(targetPath, content, "utf8");
     return { status: "written", path: targetPath };
 }
+function palette() {
+    return createColors({ enabled: colorsEnabled() });
+}
 function reportGuide(result, projectDir) {
+    const c = palette();
     if (result.status === "created") {
-        console.log(`guide: wrote ${result.path}`);
-        console.log(`marker: ${join(projectDir, MARKER_PATH)}`);
+        console.log(`${c.cyan("guide:")} wrote ${c.gray(result.path)}`);
+        console.log(`${c.cyan("marker:")} ${c.gray(join(projectDir, MARKER_PATH))}`);
     }
     else if (result.status === "exists") {
-        console.log(`guide: ${GUIDE_NAME} already written by junamis-skills ${result.version}; nothing to do.`);
-        console.log("guide: use --force to rewrite it.");
+        console.log(`${c.cyan("guide:")} ${GUIDE_NAME} already written by junamis-skills ${result.version}; nothing to do.`);
+        console.log(c.yellow("guide: use --force to rewrite it."));
     }
     else if (result.status === "kept-user-file") {
-        console.log(`guide: ${result.path} exists and was not written by junamis-skills; left unchanged.`);
-        console.log("guide: use --force to replace it.");
+        console.log(`${c.cyan("guide:")} ${c.gray(result.path)} exists and was not written by junamis-skills; left unchanged.`);
+        console.log(c.yellow("guide: use --force to replace it."));
     }
     else {
-        console.log(`guide: ${String(result.status)} (${result.path})`);
+        console.log(`${c.cyan("guide:")} ${String(result.status)} (${c.gray(result.path)})`);
     }
 }
 function reportConfig(result) {
+    const c = palette();
     if (result.status === "written")
-        console.log(`config: wrote ${result.path}`);
+        console.log(`${c.cyan("config:")} wrote ${c.gray(result.path)}`);
     else if (result.status === "unchanged")
-        console.log(`config: unchanged (${result.path})`);
+        console.log(`${c.cyan("config:")} unchanged (${c.gray(result.path)})`);
     else if (result.status === "kept")
-        console.log(`config: left unchanged; use --force (${result.path})`);
+        console.log(`${c.yellow("config:")} left unchanged; use --force (${c.gray(result.path)})`);
     else if (result.status === "would-write")
-        console.log(`config: would write ${result.path}`);
+        console.log(`${c.cyan("config:")} would write ${c.gray(result.path)}`);
     else if (result.status === "would-replace")
-        console.log(`config: would replace ${result.path} (--force)`);
+        console.log(`${c.cyan("config:")} would replace ${c.gray(result.path)} (--force)`);
     else
-        console.log(`config: ${String(result.status)} (${result.path})`);
+        console.log(`${c.cyan("config:")} ${String(result.status)} (${c.gray(result.path)})`);
 }
 function reportLibrary(args, scope, result, version) {
+    const c = palette();
     const counts = {};
     for (const a of [...result.actions, ...(result.linkActions ?? [])]) {
         counts[a.action] = (counts[a.action] ?? 0) + 1;
     }
     const summary = Object.entries(counts).map(([k, v]) => `${v} ${k}`).join(", ") || "nothing";
-    console.log(`library for ${args.agent} (junamis-skills ${version}, ${scope}): ${summary}`);
+    console.log(`${c.cyan("library")} for ${args.agent} (junamis-skills ${version}, ${scope}): ${c.gray(summary)}`);
     if (args.dryRun) {
         for (const a of result.actions)
-            console.log(`  ${a.action.padEnd(24)} ${a.path}`);
+            console.log(`  ${a.action.padEnd(24)} ${c.gray(a.path)}`);
         for (const a of result.linkActions ?? [])
-            console.log(`  ${a.action.padEnd(24)} ${a.path} -> ${a.target}`);
+            console.log(`  ${a.action.padEnd(24)} ${c.gray(a.path)} -> ${c.gray(String(a.target))}`);
     }
     for (const p of result.stale)
-        console.log(`  ${args.dryRun ? "would remove" : "removed"} stale ${p}`);
+        console.log(`  ${args.dryRun ? "would remove" : "removed"} stale ${c.gray(p)}`);
     for (const warning of result.warnings ?? [])
-        console.warn(`  warning: ${warning}`);
+        console.warn(c.yellow(`  warning: ${warning}`));
     if (!result.ok) {
-        console.error(`\n${result.conflicts.length} library file(s) were edited by you and are not managed by junamis-skills:`);
+        console.error(c.red(`\n${result.conflicts.length} library file(s) were edited by you and are not managed by junamis-skills:`));
         for (const p of result.conflicts)
-            console.error(`  ${p}`);
-        console.error("Review them. Run again with --force to overwrite, or move your copy elsewhere.");
+            console.error(c.red(`  ${p}`));
+        console.error(c.yellow("Review them. Run again with --force to overwrite, or move your copy elsewhere."));
         return 1;
     }
     if (args.dryRun)
-        console.log("library: dry run, nothing was written.");
+        console.log(c.green("library: dry run, nothing was written."));
     return 0;
 }
 /**
@@ -239,19 +246,20 @@ export async function runInit(args, deps = {}) {
         throw new Error(`unknown agent "${agent}"; expected opencode or claude`);
     }
     const scope = resolvedScope(args.scope, "global");
+    const c = palette();
     let exitCode = 0;
     // 1. Guide.
     if (args.dryRun) {
         const guidePath = join(args.dir, GUIDE_NAME);
         const exists = existsSync(guidePath);
-        console.log(`guide: ${exists && !args.force ? "present, would not rewrite without --force" : `would write ${guidePath}`}`);
+        console.log(`${c.cyan("guide:")} ${exists && !args.force ? "present, would not rewrite without --force" : `would write ${c.gray(guidePath)}`}`);
     }
     else {
         reportGuide(await d.writeGuide({ projectDir: args.dir, force: args.force }), args.dir);
     }
     // 2. opencode.json for OpenCode only.
     if (agent !== "opencode") {
-        console.log("config: skipped (opencode.json is OpenCode only)");
+        console.log(`${c.cyan("config:")} skipped (opencode.json is OpenCode only)`);
     }
     else {
         reportConfig(await d.writeOpencodeConfig({
@@ -284,7 +292,7 @@ export async function runInit(args, deps = {}) {
     if (args.dryRun) {
         const names = await lockSkillNames();
         external = { ...external, planned: names.length };
-        console.log(`external: ${names.length} pinned skills would be installed with skillsio`);
+        console.log(`${c.cyan("external:")} ${names.length} pinned skills would be installed with skillsio`);
     }
     else {
         validateInstaller("skillsio");
@@ -294,17 +302,17 @@ export async function runInit(args, deps = {}) {
             agent,
             installer: "skillsio",
         });
-        console.log(`external: ${external.installed} installed, ${external.skipped} skipped, ${external.failed} failed`);
+        console.log(`${c.cyan("external:")} ${external.installed} installed, ${external.skipped} skipped, ${external.failed} failed`);
         if (external.failed > 0)
             exitCode = 1;
     }
     // 5. Summary.
-    console.log("\nsummary:");
-    console.log(`  guide:    ${args.dryRun ? "planned" : "done"}`);
-    console.log(`  config:   ${agent === "opencode" ? (args.dryRun ? "planned" : "done") : "skipped"}`);
-    console.log(`  library:  ${args.dryRun ? "planned" : "done"} (${scope})`);
-    console.log(`  external: ${args.dryRun ? `planned (${String(external.planned)})` : `${external.installed} installed, ${external.skipped} skipped, ${external.failed} failed`}`);
-    console.log(`  exit:     ${exitCode === 0 ? "ok" : "needs attention"}`);
+    console.log(`\n${c.cyan("summary:")}`);
+    console.log(`  ${c.gray("guide:")}    ${args.dryRun ? c.yellow("planned") : c.green("done")}`);
+    console.log(`  ${c.gray("config:")}   ${agent === "opencode" ? (args.dryRun ? c.yellow("planned") : c.green("done")) : "skipped"}`);
+    console.log(`  ${c.gray("library:")}  ${args.dryRun ? c.yellow("planned") : c.green("done")} (${scope})`);
+    console.log(`  ${c.gray("external:")} ${args.dryRun ? c.yellow(`planned (${String(external.planned)})`) : `${external.installed} installed, ${external.skipped} skipped, ${external.failed} failed`}`);
+    console.log(`  ${c.gray("exit:")}     ${exitCode === 0 ? c.green("ok") : c.yellow("needs attention")}`);
     return { exitCode, scope, external };
 }
 export function statusLocations(agentId, scope = "all", projectDir = process.cwd()) {
@@ -379,6 +387,7 @@ async function legacyLeftovers(scope, projectDir) {
     return found;
 }
 async function status(args) {
+    const c = palette();
     const scope = args.scope ?? "global";
     if (!isOneOf(scope, ALL_SCOPES)) {
         throw new Error(`unknown scope "${scope}"; expected global, project, or all`);
@@ -386,7 +395,7 @@ async function status(args) {
     const scopes = scope === "all" ? ["global", "project"] : [scope];
     const failures = [];
     const check = (label, pass, detail = "") => {
-        console.log(`${pass ? "✔" : "✖"} ${label}${detail ? `: ${detail}` : ""}`);
+        console.log(`${pass ? c.green("✔") : c.red("✖")} ${label}${detail ? `: ${c.gray(detail)}` : ""}`);
         if (!pass)
             failures.push(label);
         return pass;
@@ -395,9 +404,9 @@ async function status(args) {
     // only a present but malformed marker is a real problem.
     const guidePath = join(args.dir, GUIDE_NAME);
     const guideExists = existsSync(guidePath);
-    console.log(`project:  ${args.dir}`);
-    console.log(`package:  ${PACKAGE_ROOT}`);
-    console.log(`guide:    ${guideExists ? "present" : "missing"} (${GUIDE_NAME})`);
+    console.log(`${c.cyan("project:")}  ${c.gray(args.dir)}`);
+    console.log(`${c.cyan("package:")}  ${c.gray(PACKAGE_ROOT)}`);
+    console.log(`${c.cyan("guide:")}    ${guideExists ? c.green("present") : "missing"} (${GUIDE_NAME})`);
     const markerPath = join(args.dir, MARKER_PATH);
     let marker = null;
     let markerProblem = null;
@@ -418,18 +427,18 @@ async function status(args) {
             }
         }
     }
-    console.log(`marker:   ${marker ? `written ${marker.writtenAt} by ${marker.version}` : "none"}`);
+    console.log(`${c.cyan("marker:")}   ${marker ? `written ${marker.writtenAt} by ${marker.version}` : "none"}`);
     if (markerProblem) {
-        console.error(`✖ invalid marker ${markerPath}: ${markerProblem}`);
+        console.error(c.red(`✖ invalid marker ${markerPath}: ${markerProblem}`));
         failures.push("marker");
     }
     // Per-target counts and library manifests. Missing directories and manifests
     // are informational: a target can be detected without this package being
     // installed for it. A present manifest is always validated.
-    console.log("agents:");
+    console.log(c.cyan("agents:"));
     for (const t of targets) {
         const detected = t.detect();
-        console.log(`  ${t.label.padEnd(12)} ${detected ? "detected" : "not found"}`);
+        console.log(`  ${t.label.padEnd(12)} ${detected ? c.green("detected") : c.gray("not found")}`);
         for (const location of statusLocations(t.id, scope, args.dir)) {
             const libraryCount = await countSkills(location.librarySkillsDir);
             const externalCount = await countSkills(location.skillsDir);
@@ -453,13 +462,13 @@ async function status(args) {
             }
             const parsed = await readJsonObject(location.manifestPath);
             if (!parsed.ok) {
-                console.error(`✖ library manifest invalid (${location.manifestPath}): ${parsed.error}`);
+                console.error(c.red(`✖ library manifest invalid (${location.manifestPath}): ${parsed.error}`));
                 failures.push("library manifest");
                 continue;
             }
             const problem = describeLibraryManifest(parsed.value);
             if (problem) {
-                console.error(`✖ library manifest invalid (${location.manifestPath}): ${problem}`);
+                console.error(c.red(`✖ library manifest invalid (${location.manifestPath}): ${problem}`));
                 failures.push("library manifest");
                 continue;
             }
@@ -516,7 +525,7 @@ async function status(args) {
     const missing = lockNames.filter((name) => !existsSync(join(externalDir, name)));
     const coverage = `${lockNames.length - missing.length}/${lockNames.length}`;
     const coverageDetail = missing.length === 0 ? `${coverage} in ${externalDir}` : `${coverage}; missing ${missing.join(", ")}`;
-    console.log(`external coverage: ${coverageDetail}`);
+    console.log(`${c.cyan("external coverage:")} ${missing.length === 0 ? c.green(coverageDetail) : c.yellow(coverageDetail)}`);
     // SECURITY.md is the recorded scan vetted at install time. Report its status
     // without failing; the scan record is part of the package, not the install.
     const securityPath = join(PACKAGE_ROOT, "SECURITY.md");
@@ -525,9 +534,9 @@ async function status(args) {
         const text = await readFile(securityPath, "utf8");
         securityMonth = text.match(/^Last external scan:\s*(\d{4}-\d{2})/m)?.[1] ?? null;
     }
-    console.log(`SECURITY.md scan record: ${securityMonth ? `${securityPath} (last external scan ${securityMonth})` : `${securityPath} is missing or has no Last external scan line`}`);
+    console.log(`${c.cyan("SECURITY.md scan record:")} ${securityMonth ? `${c.gray(securityPath)} (last external scan ${securityMonth})` : c.yellow(`${securityPath} is missing or has no Last external scan line`)}`);
     const passed = failures.length === 0;
-    console.log(`\nstatus: ${passed ? "ok" : `${failures.length} required check(s) failed`}`);
+    console.log(`\n${c.cyan("status:")} ${passed ? c.green("ok") : c.yellow(`${failures.length} required check(s) failed`)}`);
     if (!passed)
         process.exitCode = 1;
     return passed ? 0 : 1;