[mangeshraut712]

The installed skill could select a stale ~/.local/bin CLI ahead of the caller's PATH. Preserve PATH priority while retaining desktop fallback directories, with a regression that failed before the fix and passes afterward.

Document the published scoped npm commands and correct uninstall instructions. Keep plugin recovery/profile documentation, runtime prerequisites, and existing model-use authorization consistent.

Validation: npm run ci (115 tests, ESLint, syntax/types, documentation links, plugin validator, package dry run); 3 adoption tests. Fresh-cache npx @mangeshraut712/codex-insights@0.7.0 --version and --help passed, and the published CLI generated HTML/JSON from an empty synthetic legacy SQLite database without model calls. Skill scenarios were checked for local-only, already-authorized model use, and profile publication boundaries. No real session data was used.

The npm smoke test verifies published 0.7.0. The wrapper and guidance fixes in this PR are source updates; they are available through the GitHub plugin after merge and require a later npm release for registry consumers.

---

Note

Low Risk
Narrow behavioral change to CLI resolution order plus documentation and skill guidance; no auth, data handling, or core report pipeline logic changes.

Overview
Fixes the $insights wrapper so it searches the caller’s PATH before macOS fallback dirs (~/.local/bin, Homebrew, etc.), avoiding a stale global install winning over the CLI the user actually selected. A new plugin contract test reproduces that regression.

Docs and install guidance are aligned with the published scoped package @mangeshraut712/codex-insights (including npx, global install/uninstall, wrapper error text, and pinning 0.7.0), plus contributor notes on Node 22/24/26 CI and lockfile-pinned TypeScript. README adoption wording now points at npm run metrics for refreshed snapshots.

Skill/plugin copy clarifies profile export (account aggregates with local fallback, --source flags), model-assisted runs (estimate always; confirm only when provider/scope/budget isn’t already authorized), and that the wrapper still uses fallback paths when the desktop PATH is stripped.

^{Reviewed by Cursor Bugbot for commit 7ea5d54. Bugbot is set up for automated code reviews on this repo. Configure here.}

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-12T08:47:03.355429Z We couldn’t complete this review. Comment @codex review to try again.	3849d2c	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 809cdd14-314f-4b8c-bba9-dcc8b5b97fda)

[kilo-code-bot]

Code Review Roast 🔥

Verdict: No Issues Found | Recommendation: Merge

Oh wait, this PR is actually clean. I need to sit down. I had my flamethrower warmed up and everything — I was ready to roast some documentation drift, a busted PATH precedence, or a phantom npm package — but this diff is just coherent, tested fixes that all check out. I even cross-referenced package.json to make sure @mangeshraut712/codex-insights@0.7.0 isn't a fictional package the author hallucinated at 2am. It's real. The pin matches the published version, the scoped install command matches the name field, the engines field matches the CONTRIBUTING.md update, and the new test actually exercises the PATH precedence fix instead of just asserting it exists. I'm genuinely disappointed, but also mildly impressed.

📊 Overall: Like swapping the batteries in a smoke detector and remembering to also change the ones that work — tedious, correct, and mercifully uneventful.

Files Reviewed (8 files)

• README.md — 2 changed lines, both accurate
• docs/install.md — 4 changed lines, all accurate
• CONTRIBUTING.md — 2 changed lines, both accurate
• plugin/codex-insights/README.md — 2 changed lines, both accurate
• plugin/codex-insights/scripts/run-insights.mjs — 2 changed lines (PATH order fix + package name), both correct
• plugin/codex-insights/skills/insights/SKILL.md — 4 changed lines, all consistent with code
• plugin/codex-insights/skills/insights/references/report-modes.md — 1 changed line, consistent
• test/plugin-contract.test.js — 22 lines added (updated existing test + new PATH precedence test), well-designed

Previous Review Summary (commit 3849d2c)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 3849d2c)

Verdict: No Issues Found | Recommendation: Merge

Oh wait, this PR is actually clean. I need to sit down. I had my flamethrower warmed up and everything — I was ready to roast some documentation sins — but this diff is just four line swaps that all check out. I even cross-referenced package.json to make sure @mangeshraut712/codex-insights@0.7.0 isn't a fictional package the author hallucinated at 2am. It's real. The pin matches the published version, the scoped install command matches the name field, and the npm run metrics fallback maps to a script that actually exists. I'm genuinely disappointed, but also mildly impressed.

📊 Overall: Like swapping the batteries in a smoke detector and remembering to also change the ones that work — tedious, correct, and mercifully uneventful.

Files Reviewed (2 files)

• README.md — 2 changed lines, both accurate
• docs/install.md — 2 changed lines, both accurate
• package.json — read for context (name/version/bin verification)

---

_{Reviewed by free · Input: 65K · Output: 4.4K · Cached: 315.6K}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 19dab765-0a47-4016-86df-d834d19a8230)