@jacebenson/jsn 3.1.4 → 3.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jacebenson/jsn",
-  "version": "3.1.4",
+  "version": "3.2.0",
   "description": "A command-line interface for ServiceNow that follows the Unix philosophy: simple, composable, and scriptable.",
   "type": "module",
   "bin": {

package/src/app.js

@@ -3,7 +3,7 @@
 import { AuthManager } from './auth.js';
 import { SDKClient } from './sdk.js';
 import { OutputWriter, FormatAuto, FormatJSON, FormatMarkdown, FormatQuiet, FormatStyled } from './output.js';
-import { getEffectiveInstance } from './config.js';
+import { getEffectiveInstance, normalizeInstanceURL } from './config.js';
 import { extractProfileName } from './helpers.js';
 import { getCurrentUser, getCurrentApplication, getCurrentUpdateSet } from './context.js';
 import { errUsage, errAuth } from './errors.js';
@@ -55,6 +55,8 @@ export class App {
   }
 
   getEffectiveInstance() {
+    // Command-line override (--instance, --profile) takes precedence
+    if (this._overrideInstance) return this._overrideInstance;
     return getEffectiveInstance(this.config);
   }
 
@@ -191,6 +193,18 @@ export class App {
       throw errAuth('Not authenticated');
     }
   }
+
+  /**
+   * Override the effective instance for this command run.
+   * Rebuilds the SDK client for the new instance.
+   */
+  setEffectiveInstance(url) {
+    const normalizedUrl = normalizeInstanceURL(url);
+    if (normalizedUrl) {
+      this._overrideInstance = normalizedUrl;
+      this.sdk = new SDKClient(normalizedUrl, this.auth);
+    }
+  }
 }
 
 function resolveFormat(fmt) {

package/src/auth.js

@@ -7,8 +7,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
-import readline from 'node:readline';
 import { execSync } from 'node:child_process';
+import { password as passwordPrompt } from '@inquirer/prompts';
 import { globalConfigDir, normalizeInstanceURL } from './config.js';
 import { errAuth } from './errors.js';
 
@@ -58,6 +58,24 @@ function removePKCEState(instance) {
 const DEFAULT_OAUTH_CLIENT_ID = '543e5655f77746a28228c6009a599dfb';
 const REDIRECT_URI = '/sdk-oauth.do';
 
+// ─── WSL detection ───
+
+/**
+ * Detect if running under Windows Subsystem for Linux.
+ * Reads /proc/version which contains "Microsoft" or "WSL" on WSL.
+ */
+let _cachedIsWSL = null;
+async function isWSLEnv() {
+  if (_cachedIsWSL !== null) return _cachedIsWSL;
+  try {
+    const data = fs.readFileSync('/proc/version', 'utf-8');
+    _cachedIsWSL = /microsoft|wsl/i.test(data);
+  } catch {
+    _cachedIsWSL = false;
+  }
+  return _cachedIsWSL;
+}
+
 // ─── Basic auth from environment variables ───
 // SN_USERNAME / SN_PASSWORD — global credentials
 // SN_<INSTANCE>_USERNAME / SN_<INSTANCE>_PASSWORD — instance-specific (e.g. SN_DEV328604_USERNAME)
@@ -248,52 +266,7 @@ function deleteCredentials(instance, username) {
 }
 
 function askHidden(promptText) {
-  return new Promise((resolve) => {
-    const rl = readline.createInterface({
-      input: process.stdin,
-      output: process.stdout,
-    });
-
-    const stdin = process.stdin;
-    const stdout = process.stdout;
-
-    if (!stdin.isTTY) {
-    rl.question(promptText, (answer) => {
-      rl.close();
-      resolve(answer.trim());
-    });
-    return;
-  }
-
-    stdout.write(promptText);
-
-    stdin.setRawMode(true);
-    stdin.resume();
-    stdin.setEncoding('utf-8');
-
-    let input = '';
-    const onData = (key) => {
-      if (key === '\r' || key === '\n') {
-        stdin.removeListener('data', onData);
-        stdin.setRawMode(false);
-        stdin.pause();
-        stdout.write('\n');
-        rl.close();
-        resolve(input);
-      } else if (key === '\u0003') {
-        process.exit();
-      } else if (key === '\u007f') {
-        if (input.length > 0) {
-          input = input.slice(0, -1);
-          stdout.write('\b \b');
-        }
-      } else {
-        input += key;
-        stdout.write('*');
-      }
-    };
-    stdin.on('data', onData);
-  });
+  return passwordPrompt({ message: promptText });
 }
 
 export class AuthManager {
@@ -431,10 +404,23 @@ export class AuthManager {
       args = [authURL];
     } else if (platform === 'win32') {
       cmd = 'cmd';
-      args = ['/c', 'start', authURL];
+      // Windows: cmd.exe interprets & as a command separator, which truncates
+      // the URL after the first parameter. Passing an empty string as the first
+      // arg to `start` serves as the window title, and spawn auto-quotes the
+      // URL arg, protecting & and other special chars from cmd.exe's parser.
+      args = ['/c', 'start', '', authURL];
     } else {
-      cmd = 'xdg-open';
-      args = [authURL];
+      // WSL detection: check if we're running under Windows Subsystem for Linux
+      // On WSL, xdg-open delegates to cmd.exe /C start <url>, which truncates
+      // on &. We call cmd.exe directly with proper quoting instead.
+      const isWSL = platform === 'linux' && (await isWSLEnv());
+      if (isWSL) {
+        cmd = 'cmd.exe';
+        args = ['/c', 'start', '', authURL];
+      } else {
+        cmd = 'xdg-open';
+        args = [authURL];
+      }
     }
     const child = open(cmd, args, { detached: true, stdio: 'ignore' });
     child.on('error', () => {

package/src/cli.js

@@ -3,7 +3,9 @@
 import yargs from 'yargs';
 import { hideBin } from 'yargs/helpers';
 import process from 'node:process';
-import { loadConfig, getEffectiveInstance } from './config.js';
+import path from 'node:path';
+import fs from 'node:fs';
+import { loadConfig, getEffectiveInstance, globalConfigDir } from './config.js';
 import { App } from './app.js';
 import { renderHelp } from './help.js';
 import { isMutationCommand } from './mutations.js';
@@ -25,7 +27,8 @@ import { groupRolesCmd } from './commands/grouproles.js';
 import { ticketsCmd } from './commands/tickets.js';
 import { versionCmd } from './commands/version.js';
 import { devCmd } from './commands/dev.js';
-import { skillCmd, checkSkill } from './commands/skill.js';
+import { skillCmd } from './commands/skill.js';
+import { getVersion, checkLatest } from './commands/version.js';
 
 // Dev subcommands promoted to root level for progressive disclosure
 import {
@@ -35,8 +38,9 @@ import {
   spPagesCmd, spWidgetsCmd, uiPagesCmd, appMenuCmd,
   aclsCmd, rolesCmd, propertiesCmd,
   relationshipsCmd, appmodulesCmd, listcontrolsCmd, viewsCmd,
-  privilegesCmd, securitytypesCmd, uxscriptsCmd, aliasesCmd,
+  privilegesCmd, uxscriptsCmd, aliasesCmd,
   catalogscriptsCmd, cataloguipoliciesCmd,
+  uipoliciesCmd,
   scriptactionsCmd, scheduledjobsCmd, asyncrulesCmd, triggersCmd,
   decisiontablesCmd, assignmentsCmd,
   emailCmd,
@@ -152,8 +156,23 @@ export function buildCLI() {
         if (argv.format) {
           app.output.setFormat(argv.format);
         }
+        // --profile: resolve profile name to its instance URL
+        // --instance wins if both are specified (explicit URL > profile reference)
+        if (argv.profile) {
+          const profile = (cfg.profiles || {})[argv.profile];
+          if (!profile) {
+            process.stderr.write(`Error: Unknown profile "${argv.profile}"\n`);
+            process.exit(1);
+          }
+          const url = profile.instance_url;
+          app._overrideInstance = url;
+          argv._overrideInstance = url;
+          // Temporarily switch active profile so auth picks up the right user
+          cfg.activeProfile = argv.profile;
+        }
         if (argv.instance) {
           app._overrideInstance = argv.instance;
+          argv._overrideInstance = argv.instance;
         }
       },
       // Guard mutation commands when no instance configured
@@ -165,6 +184,7 @@ export function buildCLI() {
         // Check for --instance override
         if (argv.instance) {
           app._overrideInstance = argv.instance;
+          argv._overrideInstance = argv.instance;
         }
         // Determine if this is a mutation
         const subcommand = (argv._[1] || '').toString();
@@ -182,18 +202,40 @@ export function buildCLI() {
 
       const cmd = (argv._[0] || '').toString();
 
-      // Auto-check skill on every command (fire-and-forget, non-blocking)
-      const skipSkillCheck = ['help', 'version', 'completion', 'skill'].includes(cmd)
-        || process.env.JSN_NO_SKILL_CHECK === '1'
-        || argv['no-skill-check']
+      // Daily npm version check (fire-and-forget, non-blocking)
+      // Checks npm for newer jsn releases, at most once per 24 hours.
+      const skipNpmCheck = ['help', 'version', 'completion', 'skill'].includes(cmd)
+        || process.env.JSN_NO_VERSION_CHECK === '1'
         || argv.json
         || argv.quiet;
-      if (!skipSkillCheck) {
-        checkSkill().then(result => {
-          if (result && !result.current && result.error) {
-            process.stderr.write(`\n⚠ ${result.error}\n\n`);
+      if (!skipNpmCheck) {
+        const cacheFile = path.join(globalConfigDir(), '.last-npm-check');
+        let shouldCheck = true;
+        try {
+          const mtime = fs.statSync(cacheFile).mtimeMs;
+          const elapsed = Date.now() - mtime;
+          // Only check if >= 24 hours since last check
+          if (elapsed < 86400000) shouldCheck = false;
+        } catch {
+          // File doesn't exist — check
+        }
+
+        if (shouldCheck) {
+          const version = getVersion();
+          checkLatest().then(latest => {
+            if (latest && version !== latest) {
+              process.stderr.write(`\n⚠ jsn ${latest} available (you have ${version}) — run "npm install -g @jacebenson/jsn" to update\n\n`);
+            }
+          }).catch(() => {});
+
+          // Stamp the cache file (write async, don't block)
+          try {
+            fs.mkdirSync(globalConfigDir(), { recursive: true });
+            fs.writeFileSync(cacheFile, String(Date.now()), 'utf-8');
+          } catch {
+            // Non-fatal
           }
-        }).catch(() => {});
+        }
       }
 
       // Print context header for interactive terminals
@@ -235,7 +277,6 @@ export function buildCLI() {
     .command(b4rulesCmd(wrap))
     .command(rolesCmd(wrap))
     .command(privilegesCmd(wrap))
-    .command(securitytypesCmd(wrap))
     .command(aliasesCmd(wrap))
     .command(groupsCmd(wrap))
     .command(groupMembersCmd(wrap))
@@ -249,6 +290,7 @@ export function buildCLI() {
     .command(uiActionsCmd(wrap))
     .command(viewsCmd(wrap))
     .command(catalogscriptsCmd(wrap))
+    .command(uipoliciesCmd(wrap))
     .command(cataloguipoliciesCmd(wrap))
     // USER EXPERIENCE — Core UI
     .command(uiPagesCmd(wrap))

package/src/commands/dev/_simple.js

@@ -73,10 +73,10 @@ export const tablesCmd = (wrap) => buildDevCmd('tables', 'sys_db_object', ['tabl
   },
 });
 
-export const columnsCmd = (wrap) => buildDevCmd('columns', 'sys_dictionary', ['column', 'col'], ['element', 'column_label', 'internal_type', 'mandatory', 'max_length', 'active'], wrap, { singular: 'column', scopeValidation: true });
+export { columnsCmd } from './columns.js';
 
 // Read-only commands (Go only has list/show)
-export const importCmd = (wrap) => buildDevCmd('import', 'sys_import_set', ['imports', 'imp'], ['sys_import_set', 'sys_import_row', 'sys_target_table', 'sys_target_sys_id'], wrap, { singular: 'import set', readOnly: true });
+export { importCmd } from './import.js';
 export const spPagesCmd = (wrap) => buildDevCmd('sppages', 'sp_page', ['sp-pages', 'pages'], ['id', 'title', 'sys_scope'], wrap, { singular: 'Service Portal page', readOnly: true });
 export const spWidgetsCmd = (wrap) => buildDevCmd('spwidgets', 'sp_widget', ['sp-widget', 'widgets'], ['id', 'name', 'sys_scope'], wrap, { singular: 'Service Portal widget', readOnly: true });
 export const uiPagesCmd = (wrap) => buildDevCmd('uipages', 'sys_ui_page', ['ui-page', 'pages'], ['name', 'sys_scope'], wrap, { singular: 'UI page', scopeValidation: true });
@@ -92,10 +92,9 @@ export const relationshipsCmd = (wrap) => buildDevCmd('relationships', 'sys_rela
 export const appmodulesCmd = (wrap) => buildDevCmd('appmodules', 'sys_app_module', ['appmodule', 'am'], ['name', 'active', 'sys_scope'], wrap, { singular: 'application module', scopeValidation: true });
 export const listcontrolsCmd = (wrap) => buildDevCmd('listcontrols', 'sys_ui_list_control', ['listcontrol', 'lc'], ['name', 'active', 'sys_scope'], wrap, { singular: 'list control', scopeValidation: true });
 export const viewsCmd = (wrap) => buildDevCmd('views', 'sys_ui_view', ['view', 'vw'], ['name', 'title', 'sys_scope'], wrap, { singular: 'view', scopeValidation: true });
-export const privilegesCmd = (wrap) => buildDevCmd('privileges', 'sys_scope_privilege', ['privilege', 'priv'], ['name', 'status', 'sys_scope'], wrap, { singular: 'privilege', scopeValidation: true });
-export const securitytypesCmd = (wrap) => buildDevCmd('securitytypes', 'sys_security_type', ['securitytype', 'st'], ['name', 'active', 'sys_scope'], wrap, { singular: 'security type', scopeValidation: true });
+export const privilegesCmd = (wrap) => buildDevCmd('privileges', 'sys_scope_privilege', ['privilege', 'priv'], ['source_scope', 'target_scope', 'target_name', 'operation', 'status'], wrap, { singular: 'privilege', scopeValidation: true });
 export const uxscriptsCmd = (wrap) => buildDevCmd('uxscripts', 'sys_ux_lib_source_script', ['uxscript', 'ux'], ['name', 'active', 'sys_scope'], wrap, { singular: 'UX script', scopeValidation: true });
-export const aliasesCmd = (wrap) => buildDevCmd('aliases', 'sys_alias', ['alias', 'als'], ['name', 'table', 'sys_scope'], wrap, { singular: 'alias', scopeValidation: true });
+export { aliasesCmd } from './aliases.js';
 export const catalogscriptsCmd = (wrap) => buildDevCmd('catalogscripts', 'catalog_script_client', ['catalogscript', 'cs'], ['name', 'table', 'active', 'sys_scope'], wrap, { singular: 'catalog script', scopeValidation: true });
 
 // ── Automation: Async ──
@@ -122,4 +121,5 @@ export const uimacrosCmd = (wrap) => buildDevCmd('uimacros', 'sys_ui_macro', ['u
 // ── UX: Workspaces ──
 export const uxlistsCmd = (wrap) => buildDevCmd('uxlists', 'sys_ux_list', ['uxlist'], ['name', 'active', 'sys_scope'], wrap, { singular: 'workspace list', scopeValidation: true, readOnly: true });
 export const uxapplicabilityCmd = (wrap) => buildDevCmd('uxapplicability', 'sys_ux_applicability_m2m', ['uxapp'], ['name', 'active', 'sys_scope'], wrap, { singular: 'workspace applicability', scopeValidation: true, readOnly: true });
-export const cataloguipoliciesCmd = (wrap) => buildDevCmd('cataloguipolicies', 'catalog_ui_policy', ['cataloguipolicy', 'cup'], ['short_description', 'table', 'active', 'sys_scope'], wrap, { singular: 'catalog UI policy', scopeValidation: true });
+export { uipoliciesCmd } from './uipolicies.js';
+export const cataloguipoliciesCmd = (wrap) => buildDevCmd('cataloguipolicies', 'catalog_ui_policy', ['cataloguipolicy', 'cup'], ['short_description', 'catalog_item', 'variable_set', 'active', 'sys_scope'], wrap, { singular: 'catalog UI policy', scopeValidation: true });

package/src/commands/dev/aliases.js

@@ -0,0 +1,30 @@
+import { buildDevCmd } from './_generic.js';
+import { getStringField } from '../../helpers.js';
+
+export const aliasesCmd = (wrap) => buildDevCmd('aliases', 'sys_alias', ['alias', 'als'],
+  ['name', 'table', 'sys_scope'], wrap, {
+    singular: 'alias',
+    scopeValidation: true,
+    onShow: async (record, app) => {
+      const sysID = getStringField(record, 'sys_id') || '';
+      if (!sysID) return;
+
+      const mp = new URLSearchParams();
+      mp.set('sysparm_query', `connection_alias=${sysID}^ORDERBYname`);
+      mp.set('sysparm_limit', '100');
+      mp.set('sysparm_display_value', 'all');
+      mp.set('sysparm_fields', 'name,active,credential,sys_id');
+      const conns = await app.sdk.list('sys_connection', mp);
+
+      if (conns.length > 0) {
+        console.log(`  Connections (${conns.length}):`);
+        for (const c of conns) {
+          const name = getStringField(c, 'name') || '';
+          const cred = getStringField(c, 'credential') || '';
+          const cid = getStringField(c, 'sys_id') || '';
+          console.log(`    ${name}${cred ? ` → ${cred}` : ''}`);
+          console.log(`      → jsn records get --table sys_connection --sys-id ${cid}`);
+        }
+      }
+    },
+  });

package/src/commands/dev/b4rules.js

@@ -2,4 +2,4 @@ import { buildDevCmd } from './_generic.js';
 
 // Before-query business rules — applies filters to GlideRecord queries before they execute.
 // These are sys_script records with order < 100.
-export const b4rulesCmd = (wrap) => buildDevCmd('b4rules', 'sys_script', ['b4rule'], ['name', 'collection', 'active', 'order', 'sys_scope'], wrap, { singular: 'before-query business rule', scopeValidation: true, extraQuery: 'order<100' });
+export const b4rulesCmd = (wrap) => buildDevCmd('b4rules', 'sys_script', ['b4rule'], ['name', 'collection', 'active', 'order', 'sys_scope'], wrap, { singular: 'before-query business rule', scopeValidation: true, extraQuery: 'when=before' });

package/src/commands/dev/columns.js

@@ -0,0 +1,27 @@
+import { buildDevCmd } from './_generic.js';
+
+export const columnsCmd = (wrap) => {
+  const base = buildDevCmd('columns', 'sys_dictionary', ['column', 'col'],
+    ['element', 'column_label', 'internal_type', 'mandatory', 'max_length', 'active'],
+    wrap, { singular: 'column', scopeValidation: true });
+
+  // Add --table filter
+  const origBuilder = base.builder;
+  base.builder = (yargs) => {
+    const built = origBuilder(yargs);
+    // Patch the 'list' subcommand builder to add --table
+    const listCmd = built._commands?.find(c => c.name === 'list' || c._aliases?.includes('ls'));
+    if (listCmd) {
+      const origListBuilder = listCmd.builder;
+      listCmd.builder = (y) => (origListBuilder ? origListBuilder(y).option('table', { type: 'string', describe: 'Filter by table (e.g. incident)' }) : y.option('table', { type: 'string' }));
+      const origHandler = listCmd.handler;
+      listCmd.handler = async (argv) => {
+        if (argv.table) argv.query = argv.query ? `${argv.query}^name=${argv.table}` : `name=${argv.table}`;
+        return origHandler(argv);
+      };
+    }
+    return built;
+  };
+
+  return base;
+};

package/src/commands/dev/import.js

@@ -0,0 +1,27 @@
+import { buildDevCmd } from './_generic.js';
+import { getStringField } from '../../helpers.js';
+
+export const importCmd = (wrap) => buildDevCmd('import', 'sys_import_set', ['imports', 'imp'],
+  ['name', 'sys_target_table', 'state', 'sys_created_on'], wrap, {
+    singular: 'import set',
+    readOnly: true,
+    formatLabel: (r) => {
+      const name = getStringField(r, 'name') || '';
+      const table = getStringField(r, 'sys_target_table') || '';
+      return table ? `${name} [${table}]` : name;
+    },
+    onShow: async (record, app) => {
+      const sysID = getStringField(record, 'sys_id') || '';
+      if (!sysID) return;
+      try {
+        const rp = new URLSearchParams();
+        rp.set('sysparm_query', `sys_import_set=${sysID}`);
+        rp.set('sysparm_limit', '0'); rp.set('sysparm_fields', 'sys_id');
+        const rows = await app.sdk.list('sys_import_set_row', rp);
+        console.log(`  Import rows: ${rows.length}`);
+        console.log(`    → jsn records list --table sys_import_set_row --query "sys_import_set=${sysID}" --limit 200`);
+      } catch (err) {
+        console.log(`  Import rows: (unavailable)`);
+      }
+    },
+  });

package/src/commands/dev/lists.js

@@ -1,99 +1,68 @@
-import chalk from 'chalk';
-import { getStringField } from '../../helpers.js';
-
-// ─── Helpers ───
-
-function getDisplayValue(record, key) {
-  if (!record || typeof record !== 'object') return '';
-  const val = record[key];
-  if (val == null) return '';
-  if (typeof val === 'string') return val;
-  if (typeof val === 'object') {
-    if (val.display_value != null && val.display_value !== '') return String(val.display_value);
-    if (val.value != null) return String(val.value);
-  }
-  return String(val);
-}
-
-function getIntValue(record, key) {
-  if (!record || typeof record !== 'object') return 0;
-  const val = record[key];
-  if (val == null) return 0;
-  if (typeof val === 'number') return Math.floor(val);
-  if (typeof val === 'string') {
-    const n = parseInt(val, 10);
-    return isNaN(n) ? 0 : n;
-  }
-  if (typeof val === 'object' && val.value != null) {
-    const n = parseInt(val.value, 10);
-    return isNaN(n) ? 0 : n;
-  }
-  return 0;
-}
-
-// ─── Commands ───
+import { getStringField, interactiveList } from '../../helpers.js';
 
 export function listsCmd(wrap) {
   return {
     command: 'lists [subcommand]',
     aliases: ['list-layout', 'l'],
-    describe: 'Manage UI List layouts',
+    describe: 'List views for a table',
     builder: (yargs) => {
       return yargs
         .command({
-          command: 'list <table>',
+          command: 'list [table]',
           aliases: ['ls'],
-          describe: 'List list views for a table',
+          describe: 'List views for a table (or pick from all tables)',
           builder: (y) => y
-            .positional('table', {
-              describe: 'Table name (e.g. incident, change_request)',
-              type: 'string',
-            })
-            .option('limit', { alias: 'l', type: 'number', default: 50, describe: 'Max records' }),
+            .positional('table', { type: 'string', describe: 'Table name (e.g. incident)' })
+            .option('limit', { alias: 'l', type: 'number', default: 50 }),
           handler: wrap(async (argv, app) => {
             app.requireInstance();
-            const table = argv.table;
-            const limit = argv.limit || 50;
-
-            const params = new URLSearchParams();
-            params.set('sysparm_limit', String(limit));
-            params.set('sysparm_fields', 'view');
-            params.set('sysparm_group_by', 'view');
-            params.set('sysparm_display_value', 'all');
-            const sysparmQuery = table ? `name=${table}^ORDERBYview` : 'ORDERBYview';
-            params.set('sysparm_query', sysparmQuery);
-
-            const records = await app.sdk.list('sys_ui_list', params);
-
-            const viewMap = new Map();
-            for (const record of records) {
-              const view = getDisplayValue(record, 'view');
-              if (view && !viewMap.has(view)) {
-                viewMap.set(view, true);
-              }
+            let table = argv.table;
+            let viewSysID = null;
+
+            // If no table, pick one interactively
+            if (!table) {
+              const tpicked = await interactiveList({
+                app, table: 'sys_ui_list', singular: 'table',
+                columns: ['name'],
+                limit: argv.limit,
+                labelField: 'name',
+                groupBy: 'name',
+              });
+              if (!tpicked) return;
+              table = getStringField(tpicked, 'name');
             }
 
-            const views = Array.from(viewMap.keys()).sort();
-            const defaultViews = views.filter(v => v === 'Default view');
-            const workspaceViews = views.filter(v => v.toLowerCase().includes('workspace'));
-            const otherViews = views.filter(v => !defaultViews.includes(v) && !workspaceViews.includes(v));
+            // Show list views for table
+            const picked = await interactiveList({
+              app, table: 'sys_ui_list', singular: 'list',
+              columns: ['name', 'view'],
+              limit: argv.limit,
+              query: table ? `name=${table}` : '',
+              labelField: 'view',
+              formatLabel: (r) => `${getStringField(r, 'view')}`,
+            });
 
-            const recordsOut = views.map(v => ({ view: v, table }));
+            if (picked) {
+              const sysID = getStringField(picked, 'sys_id') || '';
+              viewSysID = getStringField(picked, 'view') || '';
+              await showList(app, table, viewSysID, sysID);
+              return;
+            }
 
+            // Fallback non-TTY
+            const p = new URLSearchParams();
+            p.set('sysparm_limit', String(argv.limit));
+            p.set('sysparm_display_value', 'all');
+            p.set('sysparm_fields', 'name,view');
+            p.set('sysparm_query', table ? `name=${table}^ORDERBYview` : 'ORDERBYview');
+            const records = await app.sdk.list('sys_ui_list', p);
             app.ok({
-              table,
-              count: views.length,
-              default: defaultViews,
-              workspaces: workspaceViews,
-              other: otherViews,
-              records: recordsOut,
-              instance_url: app.getEffectiveInstance(),
-            }, {
-              summary: `${views.length} list views for ${table}`,
-              breadcrumbs: [
-                { action: 'show', cmd: `jsn lists show ${table} --view "Default view"`, description: 'Show Default view columns' },
-              ],
-            });
+              table: 'sys_ui_list',
+              count: records.length,
+              columns: ['name', 'view'],
+              records: records.map(r => ({ name: getStringField(r, 'name'), view: getStringField(r, 'view') })),
+              context: { instance_url: app.getEffectiveInstance() },
+            }, { summary: `${records.length} list view(s)${table ? ` for ${table}` : ''}` });
           }),
         })
         .command({
@@ -101,147 +70,61 @@ export function listsCmd(wrap) {
           aliases: ['get'],
           describe: 'Show list layout',
           builder: (y) => y
-            .option('view', { type: 'string', default: 'Default view', describe: 'View name' }),
+            .option('view', { type: 'string', default: 'Default view' }),
           handler: wrap(async (argv, app) => {
             app.requireInstance();
             const table = argv.table;
-            const viewName = argv.view;
 
-            // Look up view sys_id
+            // Resolve view sys_id
             let viewSysID = '';
-            const viewParams = new URLSearchParams();
-            viewParams.set('sysparm_limit', '1');
-            viewParams.set('sysparm_fields', 'sys_id');
-            viewParams.set('sysparm_query', `name=${viewName}`);
-            try {
-              const viewRecords = await app.sdk.list('sys_ui_view', viewParams);
-              if (viewRecords.length > 0) {
-                viewSysID = getStringField(viewRecords[0], 'sys_id');
-              }
-            } catch {
-              // ignore
-            }
-
-            if (!viewSysID) {
-              viewParams.set('sysparm_query', `title=${viewName}`);
-              try {
-                const viewRecords = await app.sdk.list('sys_ui_view', viewParams);
-                if (viewRecords.length > 0) {
-                  viewSysID = getStringField(viewRecords[0], 'sys_id');
-                }
-              } catch {
-                // ignore
-              }
-            }
-
-            if (!viewSysID) {
-              viewSysID = viewName;
-            }
-
-            // Fetch list layouts
-            const params = new URLSearchParams();
-            params.set('sysparm_limit', '10');
-            params.set('sysparm_fields', 'sys_id,name,view,parent,active,sys_created_on,sys_updated_on');
-            params.set('sysparm_display_value', 'all');
-
-            const parts = [];
-            if (table) parts.push(`name=${table}`);
-            if (viewSysID) parts.push(`view=${viewSysID}`);
-            const sysparmQuery = parts.length > 0 ? `${parts.join('^')}^ORDERBYsys_created_on` : 'ORDERBYsys_created_on';
-            params.set('sysparm_query', sysparmQuery);
-
-            const records = await app.sdk.list('sys_ui_list', params);
-            if (records.length === 0) {
-              throw new Error(`no list layout found for ${table} with view "${viewName}"`);
-            }
-
-            const mainLayout = records[0];
-            const layoutSysID = getStringField(mainLayout, 'sys_id');
-
-            // Fetch elements (columns) for the list
-            const elemParams = new URLSearchParams();
-            elemParams.set('sysparm_limit', '100');
-            elemParams.set('sysparm_fields', 'sys_id,list_id,element,position,type');
-            elemParams.set('sysparm_display_value', 'all');
-            elemParams.set('sysparm_query', `list_id=${layoutSysID}^ORDERBYposition`);
-
-            const elemRecords = await app.sdk.list('sys_ui_list_element', elemParams);
-
-            const elements = elemRecords.map(record => ({
-              sys_id: getStringField(record, 'sys_id'),
-              listID: getStringField(record, 'list_id'),
-              element: getDisplayValue(record, 'element'),
-              position: getIntValue(record, 'position'),
-              type: getDisplayValue(record, 'type'),
-            }));
-
-            elements.sort((a, b) => a.position - b.position);
-
-            // Build formatted output
-            const lines = [];
-            lines.push('');
-            lines.push(chalk.bold(chalk.hex('#e8a217')(`${table} (${viewName})`)));
-            lines.push('');
-
-            lines.push(chalk.bold(chalk.hex('#666666')('─ List Columns ─')));
-            if (elements.length === 0) {
-              lines.push(chalk.hex('#888888')('  (no columns defined)'));
-            } else {
-              for (let i = 0; i < elements.length; i++) {
-                const elem = elements[i];
-                lines.push(`  ${chalk.hex('#666666')(`${String(i + 1).padStart(2)}.`)}  ${chalk.hex('#cccccc')(elem.element)}`);
-              }
-            }
-            lines.push('');
-
-            lines.push('─────');
-            lines.push('');
-            lines.push(chalk.bold(chalk.hex('#e8a217')('Hints:')));
-            lines.push(`  ${`jsn lists list ${table}`.padEnd(50)}  ${chalk.hex('#888888')('List all views')}`);
-            lines.push(`  ${`jsn forms show ${table} --view "${viewName}"`.padEnd(50)}  ${chalk.hex('#888888')('Show form layout')}`);
-            lines.push('');
-
-            const formatted = lines.join('\n');
-
-            // Build structured data for JSON/quiet mode
-            const columnsData = elements.map(elem => {
-              const col = {
-                element: elem.element,
-                position: elem.position,
-              };
-              if (elem.type) {
-                col.type = elem.type;
-              }
-              return col;
-            });
-
-            app.ok({
-              table,
-              view: viewName,
-              columns: columnsData,
-              _formatted: formatted,
-              _context: {
-                instance_url: app.getEffectiveInstance(),
-                table: 'sys_ui_list',
-              },
-            }, {
-              summary: `List: ${table} (${viewName}) - ${elements.length} columns`,
-              breadcrumbs: [
-                { action: 'list', cmd: `jsn lists list ${table}`, description: 'List all views' },
-                { action: 'form', cmd: `jsn forms show ${table} --view "${viewName}"`, description: 'Show form layout' },
-              ],
-            });
+            const vp = new URLSearchParams();
+            vp.set('sysparm_limit', '1'); vp.set('sysparm_fields', 'sys_id');
+            vp.set('sysparm_query', `name=${argv.view}^name=${table}`);
+            const vr = await app.sdk.list('sys_ui_view', vp);
+            viewSysID = vr.length > 0 ? getStringField(vr[0], 'sys_id') : '';
+
+            // Find list layout
+            const lp = new URLSearchParams();
+            lp.set('sysparm_limit', '1'); lp.set('sysparm_display_value', 'all');
+            lp.set('sysparm_fields', 'sys_id,name,view');
+            lp.set('sysparm_query', `name=${table}^view=${viewSysID || argv.view}`);
+            const layouts = await app.sdk.list('sys_ui_list', lp);
+            if (layouts.length === 0) throw new Error(`No list layout for ${table} view "${argv.view}"`);
+            await showList(app, table, getStringField(layouts[0], 'view') || argv.view, getStringField(layouts[0], 'sys_id'));
           }),
         });
     },
     handler: () => {
-      console.log('Manage list layouts from the sys_ui_list table.');
-      console.log('');
-      console.log('Available subcommands:');
-      console.log('  list <table>         List list views for a table');
-      console.log('  show <table>         Show list layout for a table');
+      console.log('Manage list layouts.');
       console.log('');
-      console.log('Run "jsn lists <command> --help" for details.');
+      console.log('Commands:');
+      console.log('  list [table]      List views (pick table if omitted)');
+      console.log('  show <table>      Show list layout columns');
     },
   };
 }
+
+async function showList(app, table, viewName, layoutSysID) {
+  const ep = new URLSearchParams();
+  ep.set('sysparm_limit', '100'); ep.set('sysparm_display_value', 'all');
+  ep.set('sysparm_fields', 'element,position,type');
+  ep.set('sysparm_query', `list_id=${layoutSysID}^ORDERBYposition`);
+  const elements = await app.sdk.list('sys_ui_list_element', ep);
+
+  elements.sort((a, b) => {
+    const pa = parseInt(getStringField(a, 'position') || '0', 10) || 0;
+    const pb = parseInt(getStringField(b, 'position') || '0', 10) || 0;
+    return pa - pb;
+  });
+
+  app.ok({
+    table,
+    view: viewName,
+    columns: elements.map(e => ({
+      element: getStringField(e, 'element'),
+      position: parseInt(getStringField(e, 'position') || '0', 10) || 0,
+      type: getStringField(e, 'type') || undefined,
+    })),
+    _context: { instance_url: app.getEffectiveInstance(), table: 'sys_ui_list' },
+  }, { summary: `${table} (${viewName}) — ${elements.length} columns` });
+}

package/src/commands/dev/uipolicies.js

@@ -0,0 +1,28 @@
+import { buildDevCmd } from './_generic.js';
+import { getStringField } from '../../helpers.js';
+
+export const uipoliciesCmd = (wrap) => buildDevCmd('uipolicies', 'sys_ui_policy', ['uipolicy', 'up'],
+  ['short_description', 'table', 'sys_class_name', 'active'], wrap, {
+    singular: 'UI policy',
+    scopeValidation: true,
+    onShow: async (record, app) => {
+      const sysID = getStringField(record, 'sys_id') || '';
+      if (!sysID) return;
+      const mp = new URLSearchParams();
+      mp.set('sysparm_query', `ui_policy=${sysID}^ORDERBYorder`);
+      mp.set('sysparm_limit', '100'); mp.set('sysparm_display_value', 'all');
+      mp.set('sysparm_fields', 'name,table,field_name,read_only,mandatory,visible,sys_id');
+      const actions = await app.sdk.list('sys_ui_policy_action', mp);
+      if (actions.length > 0) {
+        console.log(`  Actions (${actions.length}):`);
+        for (const a of actions) {
+          const f = getStringField(a, 'field_name') || '(all fields)';
+          const flags = [];
+          if (getStringField(a, 'mandatory') === 'true') flags.push('mandatory');
+          if (getStringField(a, 'read_only') === 'true') flags.push('read-only');
+          if (getStringField(a, 'visible') === 'false') flags.push('hidden');
+          console.log(`    ${f}  ${flags.length ? `[${flags.join(', ')}]` : ''}`);
+        }
+      }
+    },
+  });

package/src/commands/dev.js

@@ -7,7 +7,7 @@ import {
   spPagesCmd, spWidgetsCmd, uiPagesCmd, appMenuCmd,
   aclsCmd, rolesCmd, propertiesCmd,
   relationshipsCmd, appmodulesCmd, listcontrolsCmd, viewsCmd,
-  privilegesCmd, securitytypesCmd, uxscriptsCmd, aliasesCmd,
+  privilegesCmd, uxscriptsCmd, aliasesCmd,
   catalogscriptsCmd, cataloguipoliciesCmd,
 } from './dev/_simple.js';
 import { flowsCmd } from './dev/flows.js';
@@ -53,7 +53,6 @@ export function devCmd(wrap) {
         .command(listcontrolsCmd(wrap))
         .command(viewsCmd(wrap))
         .command(privilegesCmd(wrap))
-        .command(securitytypesCmd(wrap))
         .command(uxscriptsCmd(wrap))
         .command(aliasesCmd(wrap))
         .command(catalogscriptsCmd(wrap))

package/src/commands/groups.js

@@ -24,8 +24,30 @@ export function groupsCmd(wrap) {
               formatLabel: r => `${getStringField(r, 'name')} ${getStringField(r, 'manager') ? '→ ' + getStringField(r, 'manager') : ''}`,
             });
             if (picked) {
+              const sysID = getStringField(picked, 'sys_id') || '';
+              // Fetch member + role counts for hints
+              let memberCount = 0, roleCount = 0;
+              try {
+                const cp = new URLSearchParams();
+                cp.set('sysparm_query', `group=${sysID}`); cp.set('sysparm_limit', '0'); cp.set('sysparm_fields', 'sys_id');
+                const members = await app.sdk.list('sys_user_grmember', cp);
+                memberCount = members.length;
+              } catch {}
+              try {
+                const rp = new URLSearchParams();
+                rp.set('sysparm_query', `group=${sysID}`); rp.set('sysparm_limit', '0'); rp.set('sysparm_fields', 'sys_id');
+                const roles = await app.sdk.list('sys_group_has_role', rp);
+                roleCount = roles.length;
+              } catch {}
+
               picked._context = { instance_url: app.getEffectiveInstance(), table: 'sys_user_group' };
-              return app.ok(picked, { summary: `Group: ${getStringField(picked, 'name')}` });
+              return app.ok(picked, {
+                summary: `Group: ${getStringField(picked, 'name')}`,
+                breadcrumbs: [
+                  memberCount > 0 ? { action: 'members', cmd: `jsn records list --table sys_user_grmember --query "group=${sysID}"`, description: `${memberCount} member(s)` } : null,
+                  roleCount > 0 ? { action: 'roles', cmd: `jsn records list --table sys_group_has_role --query "group=${sysID}"`, description: `${roleCount} role(s)` } : null,
+                ].filter(Boolean),
+              });
             }
 
             const params = new URLSearchParams();

package/src/commands/skill.js

@@ -4,32 +4,86 @@ import os from 'node:os';
 import process from 'node:process';
 import { fileURLToPath } from 'node:url';
 
+import { execSync } from 'node:child_process';
+
 const SKILL_NAME = 'servicenow';
 const SKILL_REPO_PATH = path.join(
   path.dirname(fileURLToPath(import.meta.url)),
   '..', '..', 'skills', SKILL_NAME, 'SKILL.md'
 );
 
-const HERMES_SKILL_PATH = path.join(os.homedir(), '.hermes', 'skills', SKILL_NAME, 'SKILL.md');
-
 const SKILL_RAW_URL = 'https://raw.githubusercontent.com/jacebenson/jsn/nodejs/skills/servicenow/SKILL.md';
 
+/**
+ * Resolve the user's real home directory, even when Hermes overrides $HOME.
+ */
+function realHomeDir() {
+  try {
+    const result = execSync('getent passwd ' + process.env.USER + ' 2>/dev/null', { encoding: 'utf-8', timeout: 3000 });
+    const home = result.trim().split(':')[5];
+    if (home) return home;
+  } catch {
+    // fall through
+  }
+  return os.homedir();
+}
+
+/**
+ * Resolve the Hermes profile skill directory.
+ * Checks HERMES_PROFILE env var, then scans ~/.hermes/profiles/ for the first
+ * profile directory, falling back to ~/.hermes/skills/ (legacy symlink path).
+ */
+function hermesSkillDir() {
+  const base = path.join(realHomeDir(), '.hermes');
+  const profileEnv = process.env.HERMES_PROFILE;
+  let profileName = profileEnv;
+
+  if (!profileName) {
+    try {
+      const profiles = fs.readdirSync(path.join(base, 'profiles'));
+      // Pick the first real profile directory (skip . and ..)
+      profileName = profiles.find(d => d !== '.' && d !== '..') || null;
+    } catch {
+      profileName = null;
+    }
+  }
+
+  if (profileName) {
+    return path.join(base, 'profiles', profileName, 'skills', SKILL_NAME);
+  }
+  return path.join(base, 'skills', SKILL_NAME);
+}
+
+/** Resolve the installed SKILL.md path for Hermes. */
+function hermesSkillPath() {
+  return path.join(hermesSkillDir(), 'SKILL.md');
+}
+
 // Known agent skill directories (personal/user-level)
 // Keyed by agent name for the --target flag
+// Each value is the directory for the <name>/SKILL.md file
 const AGENT_SKILL_DIRS = {
-  hermes: path.join(os.homedir(), '.hermes', 'skills', SKILL_NAME),
-  copilot: path.join(os.homedir(), '.copilot', 'skills', SKILL_NAME),
-  claude: path.join(os.homedir(), '.claude', 'skills', SKILL_NAME),
-  cursor: path.join(os.homedir(), '.cursor', 'rules'),
-  agents: path.join(os.homedir(), '.agents', 'skills', SKILL_NAME),
+  hermes: hermesSkillDir(),
+  copilot: path.join(realHomeDir(), '.copilot', 'skills', SKILL_NAME),
+  vscode: path.join(realHomeDir(), '.copilot', 'instructions', SKILL_NAME),
+  claude: path.join(realHomeDir(), '.claude', 'skills', SKILL_NAME),
+  cursor: path.join(realHomeDir(), '.cursor', 'rules'),
+  agents: path.join(realHomeDir(), '.agents', 'skills', SKILL_NAME),
+  opencode: path.join(realHomeDir(), '.config', 'opencode', 'skills', SKILL_NAME),
+  openclaw: path.join(realHomeDir(), '.openclaw', 'skills', SKILL_NAME),
+  codex: path.join(realHomeDir(), '.codex', 'skills', SKILL_NAME),
 };
 
 const TARGET_NAMES = {
   hermes: 'Hermes Agent',
   copilot: 'GitHub Copilot',
+  vscode: 'VS Code (Copilot Instructions)',
   claude: 'Claude Code',
   cursor: 'Cursor',
   agents: 'Agents (open standard)',
+  opencode: 'OpenCode',
+  openclaw: 'OpenClaw',
+  codex: 'Codex CLI',
 };
 
 function readBundledSkill() {
@@ -40,21 +94,32 @@ function readBundledSkill() {
   }
 }
 
-function readInstalledSkill() {
-  try {
-    return fs.readFileSync(HERMES_SKILL_PATH, 'utf-8');
-  } catch {
-    return null;
+export async function checkSkill() {
+  // Compare all installed skill copies against GitHub.
+  // Uses a single HTTP fetch and reads all harness paths that exist.
+  // Returns the first installed version found for comparison, plus a list
+  // of harnesses where the skill is current vs outdated (or missing).
+  const SKILL_NAME = 'servicenow';
+
+  // Collect all installed copies that actually exist on disk
+  const installedCopies = [];
+  for (const [key, dir] of Object.entries(AGENT_SKILL_DIRS)) {
+    const skillPath = key === 'cursor'
+      ? path.join(dir, `${SKILL_NAME}.mdc`)
+      : path.join(dir, 'SKILL.md');
+    try {
+      const content = fs.readFileSync(skillPath, 'utf-8');
+      installedCopies.push({ harness: key, label: TARGET_NAMES[key], content, path: skillPath });
+    } catch {
+      // Not installed to this harness — skip
+    }
   }
-}
 
-export async function checkSkill() {
-  // Compare the Hermes-installed copy's version against GitHub (not the npm-bundled copy).
-  // Uses the YAML frontmatter "version" field so publishing jsn doesn't flag it.
-  const installed = readInstalledSkill() || readBundledSkill();
-  if (!installed) return { current: false, error: 'Skill file not found' };
+  // Fall back to bundled skill if nothing installed yet
+  const primary = installedCopies[0] || { content: readBundledSkill() };
+  if (!primary.content) return { current: false, error: 'Skill file not found' };
 
-  const installedVersion = extractVersion(installed);
+  const installedVersion = extractVersion(primary.content);
   if (!installedVersion) return { current: false, error: 'No version field in installed skill' };
 
   try {
@@ -68,11 +133,30 @@ export async function checkSkill() {
     if (!upstreamVersion) return { current: false, error: 'No version field in upstream skill' };
 
     const current = installedVersion === upstreamVersion;
+
+    // Check each installed copy for version match
+    const outdated = [];
+    for (const copy of installedCopies) {
+      const v = extractVersion(copy.content);
+      if (v && v !== upstreamVersion) {
+        outdated.push(copy.label);
+      }
+    }
+
+    const outdatedMsg = outdated.length > 0
+      ? ` Skill outdated for ${outdated.join(', ')} (v${installedVersion} vs GitHub v${upstreamVersion}) — run "jsn skill install" to update`
+      : null;
+
     return {
       current,
       installed_version: installedVersion,
       upstream_version: upstreamVersion,
-      error: current ? null : `Skill version ${installedVersion} vs GitHub ${upstreamVersion} — run "jsn skill install" to update`,
+      checked: installedCopies.length,
+      harnesses: {
+        installed: installedCopies.map(c => c.label),
+        outdated,
+      },
+      error: current ? null : outdatedMsg,
     };
   } catch {
     return { current: false, error: 'Could not check — GitHub unreachable' };
@@ -85,6 +169,9 @@ function extractVersion(content) {
   return m ? m[1] : null;
 }
 
+// Exported for testing
+export { realHomeDir, hermesSkillDir, extractVersion, AGENT_SKILL_DIRS, TARGET_NAMES };
+
 export function skillCmd(wrap) {
   return {
     command: 'skill',
@@ -112,13 +199,28 @@ export function skillCmd(wrap) {
           describe: 'Check if the bundled skill file is up to date with GitHub',
           handler: wrap(async (_argv, app) => {
             const result = await checkSkill();
+            const h = result.harnesses || {};
+
+            // Build a summary that shows which harnesses are installed and current
+            let summary;
             if (result.error && !result.current) {
-              app.ok(result, { summary: result.error });
+              summary = result.error;
             } else if (result.current) {
-              app.ok(result, { summary: `✓ Skill is current (v${result.installed_version})` });
+              const parts = [`✓ Skill is current (v${result.installed_version})`];
+              if (h.installed && h.installed.length > 0) {
+                parts.push(` — installed for ${h.installed.join(', ')}`);
+              }
+              summary = parts.join('');
             } else {
-              app.ok(result, { summary: `⚠ Skill outdated: installed v${result.installed_version} vs GitHub v${result.upstream_version} — run "jsn skill install" to update` });
+              const parts = [`⚠ Skill outdated: installed v${result.installed_version} vs GitHub v${result.upstream_version}`];
+              if (h.outdated && h.outdated.length > 0) {
+                parts.push(` — outdated for ${h.outdated.join(', ')}`);
+              }
+              parts.push(` — run "jsn skill install" to update`);
+              summary = parts.join('');
             }
+
+            app.ok(result, { summary });
           }),
         })
         .command({
@@ -148,7 +250,7 @@ export function skillCmd(wrap) {
             }, {
               summary: 'Skill file locations and install targets',
               breadcrumbs: [
-                { action: 'install', cmd: 'jsn skill install', description: 'Install to Hermes (default)' },
+                { action: 'install', cmd: 'jsn skill install', description: 'Interactive picker for install targets' },
                 { action: 'install-all', cmd: 'jsn skill install --target all', description: 'Install to all supported agents' },
                 { action: 'install-copilot', cmd: 'jsn skill install --target copilot', description: 'Install for GitHub Copilot' },
                 { action: 'install-claude', cmd: 'jsn skill install --target claude', description: 'Install for Claude Code' },
@@ -166,8 +268,7 @@ export function skillCmd(wrap) {
             })
             .option('target', {
               type: 'string',
-              describe: 'Target agent(s): hermes, copilot, claude, cursor, agents, or "all" (comma-separated)',
-              default: 'hermes',
+              describe: 'Target agent(s): hermes, copilot, vscode, claude, cursor, agents, opencode, openclaw, codex, or "all" (comma-separated). Omit for interactive picker.',
             }),
           handler: wrap(async (argv, app) => {
             const res = await fetch(SKILL_RAW_URL);
@@ -184,7 +285,8 @@ export function skillCmd(wrap) {
               const targetPath = path.join(p, 'SKILL.md');
               fs.writeFileSync(targetPath, content, 'utf-8');
               targets.push({ name: path.basename(argv.dir), path: targetPath });
-            } else {
+            } else if (argv.target) {
+              // Explicit --target: install to specified agents
               const rawTargets = argv.target.split(',').map(t => t.trim().toLowerCase());
               const all = rawTargets.includes('all');
 
@@ -204,6 +306,80 @@ export function skillCmd(wrap) {
                   }
                 }
               }
+            } else if (process.stdin.isTTY) {
+              // Interactive: show multi-select picker
+              const fetchedVersion = extractVersion(content);
+              // Check if any existing installed copies are outdated
+              const outdated = [];
+              if (fetchedVersion) {
+                for (const [key, dir] of Object.entries(AGENT_SKILL_DIRS)) {
+                  const skillPath = key === 'cursor'
+                    ? path.join(dir, `${SKILL_NAME}.mdc`)
+                    : path.join(dir, 'SKILL.md');
+                  try {
+                    const existing = fs.readFileSync(skillPath, 'utf-8');
+                    const existingVersion = extractVersion(existing);
+                    if (existingVersion && existingVersion !== fetchedVersion) {
+                      outdated.push(TARGET_NAMES[key]);
+                    }
+                  } catch {
+                    // Not installed — skip
+                  }
+                }
+              }
+              const promptMsg = outdated.length > 0
+                ? `Where should the jsn skill be installed? (${outdated.length} outdated)`
+                : 'Where should the jsn skill be installed?';
+
+              const { default: checkbox } = await import('@inquirer/checkbox');
+              const choices = Object.entries(TARGET_NAMES).map(([key, label]) => {
+                const dir = AGENT_SKILL_DIRS[key];
+                const targetPath = key === 'cursor'
+                  ? path.join(dir, `${SKILL_NAME}.mdc`)
+                  : path.join(dir, 'SKILL.md');
+                // Show tildified path for readability
+                const home = realHomeDir();
+                const displayPath = targetPath.replace(home, '~');
+                return {
+                  name: label,
+                  value: key,
+                  description: displayPath,
+                  // Pre-check agents whose skill dirs already exist
+                  checked: fs.existsSync(AGENT_SKILL_DIRS[key]),
+                };
+              });
+              const selected = await checkbox({
+                message: promptMsg,
+                choices,
+                instructions: '(space to toggle, enter to confirm)',
+              });
+
+              if (selected.length === 0) {
+                // Fall back to Hermes if nothing selected
+                selected.push('hermes');
+              }
+
+              for (const key of selected) {
+                const dir = AGENT_SKILL_DIRS[key];
+                if (key === 'cursor') {
+                  fs.mkdirSync(dir, { recursive: true });
+                  const targetPath = path.join(dir, `${SKILL_NAME}.mdc`);
+                  fs.writeFileSync(targetPath, content, 'utf-8');
+                  targets.push({ name: TARGET_NAMES[key], path: targetPath });
+                } else {
+                  fs.mkdirSync(dir, { recursive: true });
+                  const targetPath = path.join(dir, 'SKILL.md');
+                  fs.writeFileSync(targetPath, content, 'utf-8');
+                  targets.push({ name: TARGET_NAMES[key], path: targetPath });
+                }
+              }
+            } else {
+              // Non-interactive, no --target: install to Hermes only (backward compat)
+              const dir = AGENT_SKILL_DIRS.hermes;
+              fs.mkdirSync(dir, { recursive: true });
+              const targetPath = path.join(dir, 'SKILL.md');
+              fs.writeFileSync(targetPath, content, 'utf-8');
+              targets.push({ name: TARGET_NAMES.hermes, path: targetPath });
             }
 
             if (targets.length === 0) {

package/src/commands/users.js

@@ -24,8 +24,15 @@ export function usersCmd(wrap) {
               formatLabel: r => `${getStringField(r, 'user_name')} (${getStringField(r, 'name') || '-'})`,
             });
             if (picked) {
+              const sysID = getStringField(picked, 'sys_id') || '';
               picked._context = { instance_url: app.getEffectiveInstance(), table: 'sys_user' };
-              return app.ok(picked, { summary: `User: ${getStringField(picked, 'user_name')}` });
+              return app.ok(picked, {
+                summary: `User: ${getStringField(picked, 'user_name')}`,
+                breadcrumbs: [
+                  { action: 'preferences', cmd: `jsn records list --table sys_user_preference --query "user=${sysID}"`, description: 'User preferences' },
+                  { action: 'groups', cmd: `jsn records list --table sys_user_grmember --query "user=${sysID}"`, description: 'Group memberships' },
+                ],
+              });
             }
 
             const params = new URLSearchParams();

package/src/commands/version.js

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'node:url';
 const NPM_PKG = '@jacebenson/jsn';
 const NPM_REGISTRY = `https://registry.npmjs.org/${NPM_PKG}/latest`;
 
-function getVersion() {
+export function getVersion() {
   try {
     const __dirname = path.dirname(fileURLToPath(import.meta.url));
     const pkgPath = path.join(__dirname, '..', '..', 'package.json');
@@ -16,7 +16,7 @@ function getVersion() {
   }
 }
 
-async function checkLatest() {
+export async function checkLatest() {
   try {
     const res = await fetch(NPM_REGISTRY);
     if (!res.ok) return null;

package/src/help.js

@@ -53,7 +53,6 @@ const ACCESS_COMMANDS = [
   { name: 'b4rules', alias: 'b4r', desc: 'Before-query business rules (see also Automation)' },
   { name: 'roles', alias: 'role', desc: 'Roles' },
   { name: 'privileges', alias: 'priv', desc: 'Scope privileges' },
-  { name: 'securitytypes', alias: 'st', desc: 'Custom security types' },
   { name: 'aliases', alias: 'als', desc: 'Connection & credential aliases' },
   { name: 'groups', alias: 'group', desc: 'Manage groups' },
   { name: 'groupmembers', alias: 'gm', desc: 'Group memberships' },

package/src/output.js

@@ -460,6 +460,9 @@ export function getTableURL(instance, table, sysID) {
     sysevent_email_action: `nav_to.do?uri=sysevent_email_action.do?sys_id=${sysID}`,
     sysevent_in_email_action: `nav_to.do?uri=sysevent_in_email_action.do?sys_id=${sysID}`,
     soap_message: `nav_to.do?uri=soap_message.do?sys_id=${sysID}`,
+    sys_security_acl: `nav_to.do?uri=sys_security_acl.do?sys_id=${sysID}`,
+    sys_user_role: `nav_to.do?uri=sys_user_role.do?sys_id=${sysID}`,
+    sys_db_object: `nav_to.do?uri=sys_db_object.do?sys_id=${sysID}`,
   };
   const path = mapped[table] || `${table}.do?sys_id=${sysID}`;
   return `${instance}/${path}`;