Pin npx-launched packages to fixed versions

agent-compatibility/README.md

@@ -49,31 +49,31 @@ The plugin does not bundle the scanner. It runs the published npm package when n
 Default scan (compact terminal dashboard):
 
 ```bash
-npx -y agent-compatibility@latest .
+npx -y agent-compatibility@0.1.7 .
 ```
 
 JSON output:
 
 ```bash
-npx -y agent-compatibility@latest --json .
+npx -y agent-compatibility@0.1.7 --json .
 ```
 
 Markdown output:
 
 ```bash
-npx -y agent-compatibility@latest --md .
+npx -y agent-compatibility@0.1.7 --md .
 ```
 
 Plain text output:
 
 ```bash
-npx -y agent-compatibility@latest --text .
+npx -y agent-compatibility@0.1.7 --text .
 ```
 
 Config override for ignored paths or weight overrides:
 
 ```bash
-npx -y agent-compatibility@latest . --config ./agent-compatibility.config.json
+npx -y agent-compatibility@0.1.7 . --config ./agent-compatibility.config.json
 ```
 
 The scanner is heuristic. It scores repo signals and surfaces likely friction, but it is not a full quality verdict on the codebase.

agent-compatibility/agents/compatibility-scan-review.md

@@ -15,7 +15,7 @@ Use when the task is specifically to run the published `agent-compatibility` sca
 
 ## Workflow
 
-1. Try the published scanner first with `npx -y agent-compatibility@latest --json "<path>"`.
+1. Try the published scanner first with `npx -y agent-compatibility@0.1.7 --json "<path>"`.
 2. If you are clearly working inside the scanner source repo and the published package path fails for an environment reason, fall back to the local scanner entrypoint.
 3. Only say the scanner is unavailable after you have actually tried the published package, and the local fallback when it is clearly available.
 4. Prefer JSON when you need structured reasoning. Prefer Markdown when the user wants a direct report.

pstack/skills/statechart/scripts/statechart.mjs

@@ -103,7 +103,7 @@ const COMMON = `Both commands
                      finished last. The command does not use an output folder that has files that
                      it did not write. On a filesystem that cannot rename, the command copies the
                      files into place, and overlapping runs can mix their files.
-  --png              Also render each chart to PNG with npx @mermaid-js/mermaid-cli.
+  --png              Also render each chart to PNG with npx @mermaid-js/mermaid-cli@12.0.0.
   -h, --help         Print this help, and exit 0.
 
 Output
@@ -634,7 +634,7 @@ function render(charts, shown) {
     const png = chart.replace(/\.mmd$/, ".png");
     const r = spawnSync(
       "npx",
-      ["-y", "@mermaid-js/mermaid-cli", "-i", chart, "-o", png, "-s", "2"],
+      ["-y", "@mermaid-js/mermaid-cli@12.0.0", "-i", chart, "-o", png, "-s", "2"],
       {
         encoding: "utf8",
       },

third_party/playwright/README.md

@@ -14,7 +14,7 @@ Or run `/add-plugin playwright` in chat.
 
 ## Requirements
 
-This is a **local stdio** MCP server. Cursor launches it with `npx -y @playwright/mcp@latest`, so the machine running Cursor needs **Node.js** installed and on `PATH`. The `-y` flag skips `npx`'s install confirmation so the first launch cannot hang waiting for interactive input over stdio.
+This is a **local stdio** MCP server. Cursor launches it with `npx -y @playwright/mcp@0.0.83`, so the machine running Cursor needs **Node.js** installed and on `PATH`. The `-y` flag skips `npx`'s install confirmation so the first launch cannot hang waiting for interactive input over stdio.
 
 The first run downloads Playwright's browser binaries. That can take a minute and needs network access; later runs reuse the cached browsers.
 
@@ -25,7 +25,7 @@ The first run downloads Playwright's browser binaries. That can take a minute an
   "mcpServers": {
     "playwright": {
       "command": "npx",
-      "args": ["-y", "@playwright/mcp@latest"]
+      "args": ["-y", "@playwright/mcp@0.0.83"]
     }
   }
 }

third_party/playwright/mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "playwright": {
       "command": "npx",
-      "args": ["-y", "@playwright/mcp@latest"]
+      "args": ["-y", "@playwright/mcp@0.0.83"]
     }
   }
 }

third_party/xero/README.md

@@ -22,7 +22,7 @@ Or run `/add-plugin xero` in chat.
       "command": "npx",
       "args": [
         "-y",
-        "@xeroapi/xero-mcp-server@latest"
+        "@xeroapi/xero-mcp-server@0.0.17"
       ],
       "env": {
         "XERO_CLIENT_ID": "${XERO_CLIENT_ID}",

third_party/xero/mcp.json

@@ -5,7 +5,7 @@
       "command": "npx",
       "args": [
         "-y",
-        "@xeroapi/xero-mcp-server@latest"
+        "@xeroapi/xero-mcp-server@0.0.17"
       ],
       "env": {
         "XERO_CLIENT_ID": "${XERO_CLIENT_ID}",