[ManningWorks]

Repairs the published 1.6.0 CLI: since 1.5.0 the CLI runtime dependencies (chalk, commander, ts-morph, and the @InQuirer prompt packages) were declared as optional peerDependencies, which npm/npx does not install — so the published 1.6.0 CLI could not start. They are now hard dependencies (fixes #42; restores pre-1.5.0 install behavior, public API unchanged). This release also lands the two non-TTY prompt fixes (#41 init, #49 add: non-interactive sessions refuse to overwrite, and prompt cancellation exits cleanly as "Cancelled"), and clears the dependabot advisory set from the fixes cycle (40 advisories via lockfile refresh + overrides, PR 38). No API changes.

Note: npm publish follows separately (Luke).

Note on security state at PR creation: 4 dependabot alerts are currently open on the default branch and are NOT addressed by this PR (which changes only the version and the changelog): alert 57, source-map-js in pnpm-lock.yaml (new advisory; alert created 2026-10-13, after the PR 38 refresh; lockfile resolves 1.2.1, fix available in 1.2.2) and alerts 1-3 (toml x2, uuid) in .opencode/package-lock.json (open since 2026-09-08, outside the pnpm workspace). A follow-up card is being created for those dependency bumps.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
projex-docs	Ready	Preview	Oct 14, 2026 11:21am UTC

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 7fd713af-08f2-4914-8621-20f612bfdcc7

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ManningWorks]

Review verdict: APPROVE

Reviewed PR 54 on ManningWorks/Projex against the strict two-file scope for the 1.6.1 release cut.

Scope guard — PASS. git diff --name-status over base..head shows exactly two files, no scope creep:

1. packages/core/package.json — single line: "version": "1.6.0" → "1.6.1". No other manifest touched; root workspace package.json (1.3.0, private) and packages/docs (0.0.0) unchanged.
2. CHANGELOG.md — the ## [Unreleased] section is now an empty section at the top, followed by the new ## [1.6.1] - 2026-10-14 section, followed by the existing ## [1.6.0] section unchanged (single diff hunk ending at the --- separator above 1.6.0).

Verbatim check — PASS. The 1.6.1 section was extracted byte-for-byte from the head commit and diffed against the Luke-approved draft: diff is empty. Date reads 2026-10-14 (actual cut date), the skills bullet carries the _(carried over from [Unreleased])_ suffix, all Fixed/Security/Internal/Documentation entries present as approved.

Base — PASS. PR base main == origin/main == 9f264e1; main has not moved since the assessment. Head is a single commit, d3c246b ("chore(release): v1.6.1").

CI on head — GREEN. Type Check, Build, Lint, Test all pass on d3c246b (plus Vercel preview). Consistent with the authoring card's full local gate (64 test files, 1051 tests).

Security note — correctly carried. The PR body retains the note on the 4 dependabot alerts open on the default branch at creation (source-map-js, alert 57; toml x2 + uuid, alerts 1-3) as out of scope for this PR, with the follow-up card for the dependency bumps. Per the assessment, these are not a defect of this PR.

Standards + Spec axes — both pass. Zero findings (no CRITICAL/HIGH/MEDIUM/LOW).

Approving per house practice (verdict comment; formal self-approve not possible on GitHub). Ready for merge + tag by the release-tail card.