chore(release): bump to v0.4.7

CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to `codeforerunner` are documented here.
 The format is loosely based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/);
 this project follows [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.4.7] — 2026-06-02
+
+### Fixed
+
+- **Agent detection silent failures** — `shellEscape` was missing its closing single quote, causing all `command:`-based detections (`claude`, `gemini`, `opencode`, `codex`, etc.) to produce a shell syntax error and return `not found`. Only agents with a `macapp:` fallback (e.g. Cursor) were detected. (`bin/install.js`)
+- **Global install installing locally** — `installViaSkills` never passed `-g` to `npx skills add`, so the global/local choice had no effect for non-Claude/Gemini agents; both modes installed to the current directory. (`bin/install.js`)
+- **Agent profile filter overridden by `--all`** — `npx skills add --all` expands to `--agent '*'`, silently overriding the per-provider `-a <profile>` argument. Replaced with explicit `--agent <profile> --skill '*'`. (`bin/install.js`)
+- **Bundled skills ignored on `npx` installs** — `fetchSkill` fell back to HTTPS even though `skills/` ships in the npm package, because `detectRepoRoot` requires `plugins/` which is not in the published files. Now checks `__dirname/../skills/` before the network. (`bin/install.js`)
+
+### Added
+
+- **Interactive agent selection** — when multiple agents are detected and stdin/stdout are TTYs, the installer prompts users to choose which agents to install to (numbered list, space-separated input, default: all). Skipped when `--only`, `--non-interactive`, or only one agent is detected. (`bin/install.js`)
+- 12 new installer tests: `shellEscape` correctness and shell round-trip, `buildSkillsAddArgs` unit tests for global `-g` flag and agent profile preservation, local install path targeting, `--only` validation, `--non-interactive` non-blocking. (`tests/install.test.js`)
+
 ## [0.4.6] — 2026-06-01
 
 ### Added

README.md

@@ -2,7 +2,7 @@
 
 # codeForerunner
 
-[![Socket Badge](https://badge.socket.dev/npm/package/codeforerunner/0.4.6)](https://socket.dev/npm/package/codeforerunner)
+[![Socket Badge](https://badge.socket.dev/npm/package/codeforerunner/0.4.7)](https://socket.dev/npm/package/codeforerunner)
 
 Model-agnostic repository documentation tooling. Ships a prompt pack for codebase analysis and doc generation, a thin Python CLI, an MCP server, drift-detection rules that keep docs honest — and native slash-command skills for Claude Code, Codex, Gemini CLI, and other agent CLIs.
 
@@ -122,7 +122,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6.0.2
-      - uses: derek-palmer/codeforerunner@v0.4.6
+      - uses: derek-palmer/codeforerunner@v0.4.7
         with:
           fail-on-drift: "true"   # set "false" to warn-only
 ```

install.ps1

@@ -13,9 +13,9 @@ param([Parameter(ValueFromRemainingArguments=$true)][string[]]$Args)
 $ErrorActionPreference = "Stop"
 
 # Security: pinned to a specific version so one-liners don't execute unreviewed code.
-$NpmPkg  = "codeforerunner@0.4.6"
+$NpmPkg  = "codeforerunner@0.4.7"
 $Repo    = "derek-palmer/codeforerunner"
-$RepoTag = "v0.4.6"
+$RepoTag = "v0.4.7"
 $ScriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
 $LocalJs = Join-Path $ScriptDir "bin\install.js"
 

install.sh

@@ -16,9 +16,9 @@ set -euo pipefail
 
 # Security: pinned to a specific version so curl|bash one-liners don't silently
 # execute whatever the npm registry or GitHub currently serves as "latest".
-NPM_PKG="codeforerunner@0.4.6"
+NPM_PKG="codeforerunner@0.4.7"
 REPO="derek-palmer/codeforerunner"
-REPO_TAG="v0.4.6"
+REPO_TAG="v0.4.7"
 
 # Locate bin/install.js relative to this script (works even when piped through bash)
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]:-install.sh}")" 2>/dev/null && pwd || echo "")"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeforerunner",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "description": "Model-agnostic repository documentation tooling — installs /forerunner-* slash commands into 30+ agent CLIs",
   "main": "./bin/install.js",
   "bin": {

plugins/codex/marketplace.json

@@ -4,14 +4,14 @@
     "id": "codeforerunner",
     "name": "codeforerunner",
     "description": "Model-agnostic repo documentation prompts as an installable Codex plugin.",
-    "version": "0.4.6",
+    "version": "0.4.7",
     "homepage": "https://github.com/derek-palmer/codeforerunner"
   },
   "plugins": [
     {
       "id": "codeforerunner",
       "name": "codeforerunner",
-      "version": "0.4.6",
+      "version": "0.4.7",
       "description": "Prompt-first repository documentation skill.",
       "source": {
         "kind": "git",

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "codeforerunner"
-version = "0.4.6"
+version = "0.4.7"
 description = "Model-agnostic repository documentation tooling (prompt-first; thin CLI)."
 readme = "README.md"
 requires-python = ">=3.11"