chore(release): bump to v0.4.6

CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to `codeforerunner` are documented here.
 The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.6] — 2026-06-01
+
+### Added
+
+- npm package metadata: SPDX-style license declaration, `author` field, and a `SECURITY.md` policy. (`package.json`, `SECURITY.md`)
+
+### Changed
+
+- Installer refactored so the **Install Plan** is the unit of work. (`bin/install.js`)
+- Skill-parity refactored: the canonical↔copies body rule now lives in one module.
+- Prompt-session bundle outcome now owned behind `resolve()`.
+- Purged iCloud sync-conflict files and added a guard to block future ones.
+
 ## [0.4.5] — 2026-05-29
 
 ### Added

README.md

@@ -2,7 +2,7 @@
 
 # codeForerunner
 
-[![Socket Badge](https://badge.socket.dev/npm/package/codeforerunner/0.4.5)](https://socket.dev/npm/package/codeforerunner)
+[![Socket Badge](https://badge.socket.dev/npm/package/codeforerunner/0.4.6)](https://socket.dev/npm/package/codeforerunner)
 
 Model-agnostic repository documentation tooling. Ships a prompt pack for codebase analysis and doc generation, a thin Python CLI, an MCP server, drift-detection rules that keep docs honest — and native slash-command skills for Claude Code, Codex, Gemini CLI, and other agent CLIs.
 
@@ -121,7 +121,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6.0.2
-      - uses: derek-palmer/codeforerunner@v0.4.5
+      - uses: derek-palmer/codeforerunner@v0.4.6
         with:
           fail-on-drift: "true"   # set "false" to warn-only
 ```

install.ps1

@@ -13,9 +13,9 @@ param([Parameter(ValueFromRemainingArguments=$true)][string[]]$Args)
 $ErrorActionPreference = "Stop"
 
 # Security: pinned to a specific version so one-liners don't execute unreviewed code.
-$NpmPkg  = "codeforerunner@0.4.5"
+$NpmPkg  = "codeforerunner@0.4.6"
 $Repo    = "derek-palmer/codeforerunner"
-$RepoTag = "v0.4.5"
+$RepoTag = "v0.4.6"
 $ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 $LocalJs = Join-Path $ScriptDir "bin\install.js"
 

install.sh

@@ -16,9 +16,9 @@ set -euo pipefail
 
 # Security: pinned to a specific version so curl|bash one-liners don't silently
 # execute whatever the npm registry or GitHub currently serves as "latest".
-NPM_PKG="codeforerunner@0.4.5"
+NPM_PKG="codeforerunner@0.4.6"
 REPO="derek-palmer/codeforerunner"
-REPO_TAG="v0.4.5"
+REPO_TAG="v0.4.6"
 
 # Locate bin/install.js relative to this script (works even when piped through bash)
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-install.sh}")" 2>/dev/null && pwd || echo "")"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeforerunner",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "Model-agnostic repository documentation tooling — installs /forerunner-* slash commands into 30+ agent CLIs",
   "main": "./bin/install.js",
   "bin": {

plugins/codex/marketplace.json

@@ -4,14 +4,14 @@
     "id": "codeforerunner",
     "name": "codeforerunner",
     "description": "Model-agnostic repo documentation prompts as an installable Codex plugin.",
-    "version": "0.4.5",
+    "version": "0.4.6",
     "homepage": "https://github.com/derek-palmer/codeforerunner"
   },
   "plugins": [
     {
       "id": "codeforerunner",
       "name": "codeforerunner",
-      "version": "0.4.5",
+      "version": "0.4.6",
       "description": "Prompt-first repository documentation skill.",
       "source": {
         "kind": "git",

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "codeforerunner"
-version = "0.4.5"
+version = "0.4.6"
 description = "Model-agnostic repository documentation tooling (prompt-first; thin CLI)."
 readme = "README.md"
 requires-python = ">=3.11"