Public-release hygiene: LICENSE, community health files, CI

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,28 @@
+---
+name: Bug report
+about: Something isn't working as expected
+title: "[bug] "
+labels: bug
+---
+
+**Describe the bug**
+A clear description of what went wrong.
+
+**To reproduce**
+Steps or the exact command you ran:
+
+```bash
+npx @oriro/orirocli ...
+```
+
+**Expected behavior**
+What you expected to happen.
+
+**Environment**
+- ORIRO version: (`oriro --version`)
+- OS:
+- Node version: (`node --version`)
+- Install method: `npx` / `npm i -g` / from source
+
+**Logs / output**
+Paste any relevant terminal output. **Redact any keys or personal data first.**

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Security vulnerability (private)
+    url: https://github.com/oriro-ai/cli/security/advisories/new
+    about: Please report security issues privately — do not open a public issue.
+  - name: ORIRO on the web
+    url: https://oriro.ai
+    about: Learn more about ORIRO.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,25 @@
+---
+name: Feature request
+about: Suggest an idea, skill, connector, or language
+title: "[feat] "
+labels: enhancement
+---
+
+**What would you like ORIRO to do?**
+A clear description of the feature or improvement.
+
+**Why is it useful?**
+The problem it solves or the workflow it improves.
+
+**Category**
+- [ ] Router / Mux
+- [ ] Skill
+- [ ] MCP connector
+- [ ] Language / translation
+- [ ] Guardian (security)
+- [ ] Channels (Telegram/Discord/WhatsApp)
+- [ ] Avatar / voice
+- [ ] Other
+
+**Additional context**
+Anything else — examples, references, mockups.

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,16 @@
+## What this changes
+
+Briefly describe the change and why.
+
+## Checklist
+
+- [ ] `npm run typecheck` is clean
+- [ ] `npm run test:unit` passes
+- [ ] `npm run smoke` passes (builds and exercises the real `dist/cli.js`)
+- [ ] Guardian changes include a deterministic test (`scripts/test-guardian.ts`)
+- [ ] Any external code/pattern is recorded in `ATTRIBUTION.md` (MIT/Apache-2.0 only)
+- [ ] Docs updated if the command surface, counts, or install path changed
+
+## Notes for reviewers
+
+Anything specific to look at, trade-offs, or follow-ups.

.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: CI
+
+on:
+  push:
+    branches: [pi-greenfield, main]
+  pull_request:
+    branches: [pi-greenfield, main]
+
+jobs:
+  build-and-test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        # undici 8.5 (via pi-coding-agent) needs Node's markAsUncloneable — Node 22+.
+        node-version: ["22.12.0", "24"]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Typecheck
+        run: npm run typecheck
+
+      - name: Build
+        run: npm run build
+
+      - name: Unit tests
+        run: npm run test:unit
+
+      - name: Smoke (built binary)
+        run: node scripts/smoke.mjs

ATTRIBUTION.md

@@ -38,6 +38,14 @@ lands in the tree (validated, zero-OpenClaw). Until then it sits under "To fold"
 - **goose** (`github.com/aaif-goose/goose`, Block) — **Apache-2.0** — *pattern reference only* (Rust): the battle-scars hardening — per-server isolation, stderr-on-init-failure, env denylist, 3-state OAuth, OSV check, Windows Job Objects, `_meta` owner stamping.
 - Connector catalog (59 entries) generated from ORIRO's own `connectors_pass.jsonl` (validated set), scrubbed.
 
+## Skill library — skills folded into `skills/` (2026-07-01 batch: +4, 327 total)
+- **graphify** — public/community skill (knowledge-graph builder); Pi variant (`skill-pi.md`) promoted to SKILL.md; license as embedded in dir.
+- **impeccable** — public/community frontend-quality skill; license as embedded in dir.
+- **uipm-ui-styling** — from the public UIPM / ui-ux-pro-max skill pack.
+- **21stdev** — ORIRO-authored (© 2026 ORIRO.ai) 21st.dev Magic-MCP usage skill, privacy-scrubbed for bundling.
+- Evaluated, already bundled (nested in the Step-5 pack — not re-added): focus, marketing, design, zero-to-live, gh, gh-skill, grill-me, playwright-cli, remotion-best-practices, supabase-postgres-best-practices, uipm-* (6), web-design-guidelines, doc-coauthoring, idea-to-deploy, app-builder-guide, debug-and-build-methodology, become-an-ai-engineer-26, image-generation-engineer, oriro-ui-2026, vercel-optimize.
+- Evaluated and EXCLUDED as private/unshippable: tranzguard-1, triro-trading, Training-Steps-Modal, ai-engineering, oriro-agentic, godmode, master-architect, google-ai-latest, remotion-narvo, scribe (local-path-bound), dev, codex-cli-runtime, codex-result-handling, gpt-5-4-prompting, last30days (16MB + vendored scrapers).
+
 ## Evaluated — NOT used (recorded for honesty)
 - **github/copilot-cli** — proprietary / no-derivatives, no source in repo. Blocked.
 - **manaflow-ai/cmux** — GPL-3.0 (copyleft) + Swift/macOS. Blocked.

CHANGELOG.md

@@ -0,0 +1,52 @@
+# Changelog
+
+All notable changes to `@oriro/orirocli` are documented here.
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project aims to follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.8] — 2026-07-01
+### Added
+- `routers add --url` — register ANY custom free or BYOK endpoint into the keyless router pool.
+
+## [0.1.7] — 2026-06
+### Fixed
+- `npx @oriro/orirocli` now resolves everywhere — added the `npx` bin alias.
+
+## [0.1.6] — 2026-06
+### Added
+- `scribe` CLI verbs (on/off/status/digest/timeline/recall/capture/health) — the consent-gated local work journal.
+- Claude Code transcript adapter for Scribe capture.
+
+## [0.1.5] — 2026-06
+### Fixed
+- Security hardening: Guardian V3 Lite (closed 39 bypasses + 4 over-blocks) and Scriber (5 redaction leaks).
+- Multi-round adversarial re-QA (rounds 2–5): secret-directory boundary parity, IOC `.ssh` boundary, and residual regressions all closed.
+- Functional bugs across onboarding, commands, routers, and the Mux.
+
+## [0.1.4] — 2026-06
+### Fixed
+- 6 QA bugs: language-by-name, `/help`, false-removes, category handling, env-exfil detection.
+
+## [0.1.3] — 2026-06
+### Fixed
+- Sanitize keyless-floor tool names to prevent token leakage.
+
+## [0.1.2] — 2026-06
+### Added
+- Wired `oriro language` and `oriro avatar`.
+### Fixed
+- Corrected documented skill/connector counts.
+
+## [0.1.1] — 2026-06
+### Added
+- First publishable, reproducible build. `dist/cli.js` committed; clean `npx` / `npm i -g` install path.
+- Prepublish gate (`scripts/prepublish-check.mjs`) and built-binary smoke tests.
+
+[0.1.8]: https://github.com/oriro-ai/cli/releases/tag/v0.1.8
+[0.1.7]: https://github.com/oriro-ai/cli/releases/tag/v0.1.7
+[0.1.6]: https://github.com/oriro-ai/cli/releases/tag/v0.1.6
+[0.1.5]: https://github.com/oriro-ai/cli/releases/tag/v0.1.5
+[0.1.4]: https://github.com/oriro-ai/cli/releases/tag/v0.1.4
+[0.1.3]: https://github.com/oriro-ai/cli/releases/tag/v0.1.3
+[0.1.2]: https://github.com/oriro-ai/cli/releases/tag/v0.1.2
+[0.1.1]: https://github.com/oriro-ai/cli/releases/tag/v0.1.1

CODE_OF_CONDUCT.md

@@ -0,0 +1,59 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment:
+
+- Demonstrating empathy and kindness toward other people
+- Being respectful of differing opinions, viewpoints, and experiences
+- Giving and gracefully accepting constructive feedback
+- Accepting responsibility and apologizing to those affected by our mistakes
+- Focusing on what is best for the overall community
+
+Examples of unacceptable behavior:
+
+- The use of sexualized language or imagery, and sexual attention or advances
+- Trolling, insulting or derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards and
+will take appropriate and fair corrective action in response to any behavior
+that they deem inappropriate, threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+**conduct@oriro.ai**. All complaints will be reviewed and investigated promptly
+and fairly. All community leaders are obligated to respect the privacy and
+security of the reporter of any incident.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.1, available at
+<https://www.contributor-covenant.org/version/2/1/code_of_conduct.html>.
+
+[homepage]: https://www.contributor-covenant.org

CONTRIBUTING.md

@@ -0,0 +1,57 @@
+# Contributing to ORIRO CLI
+
+Thanks for your interest in ORIRO — a free, keyless, on-device-friendly terminal AI coder.
+Contributions of all kinds are welcome: bug reports, docs, skills, connectors, and code.
+
+## Ground rules
+
+- **Be respectful.** See [`CODE_OF_CONDUCT.md`](./CODE_OF_CONDUCT.md).
+- **Security issues are private.** Do not file them as public issues — see [`SECURITY.md`](./SECURITY.md).
+- **Provenance matters.** Any external code or pattern you fold in must be MIT/Apache-2.0
+  (or compatible), TypeScript-friendly, and recorded in [`ATTRIBUTION.md`](./ATTRIBUTION.md)
+  with its upstream URL, license, and authors. We honor upstream authors; we never ship
+  copyleft or license-key-gated code.
+
+## Local setup
+
+Requires **Node ≥ 20**.
+
+```bash
+git clone https://github.com/oriro-ai/cli && cd cli
+npm install
+npm run build        # tsup → dist/cli.js
+node dist/cli.js     # run the built CLI
+```
+
+Useful scripts:
+
+| Script | What it does |
+|--------|--------------|
+| `npm run dev` | run from TypeScript source (`tsx src/cli.ts`) |
+| `npm run build` | bundle to `dist/cli.js` (tsup) |
+| `npm run typecheck` | `tsc --noEmit` |
+| `npm run test:unit` | tool-sanitize + Guardian + Scribe unit tests |
+| `npm run smoke` | build, then run the built-binary smoke suite |
+
+## Before you open a PR
+
+1. `npm run typecheck` is clean.
+2. `npm run test:unit` passes.
+3. `npm run smoke` passes (this builds and exercises the real `dist/cli.js`).
+4. If you touched Guardian, add/extend a case in `scripts/test-guardian.ts` — security
+   changes must be covered by a deterministic test.
+5. If you changed the command surface, docs (README), skill count, or bin, run
+   `node scripts/prepublish-check.mjs` so the publish gate still passes.
+6. Keep commits focused; use clear, conventional-style messages (e.g. `fix:`, `feat:`, `docs:`).
+
+## What we especially welcome
+
+- New **skills** (`skills/<category>/<name>/SKILL.md`) and **MCP connectors**.
+- Additional **languages** and translation quality fixes.
+- Guardian detections for new abuse patterns (with tests).
+- Bug reports with a reproduction and your OS + Node version.
+
+## License
+
+By contributing, you agree that your contributions are licensed under the
+[MIT License](./LICENSE).

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Vinay Sharma / ORIRO (Greenri Solutions LLC)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

PUBLISHING.md

@@ -19,7 +19,7 @@ npm pkg set private=true      # re-arm the gate immediately
 npm deprecate "@oriro/cli@<=2026.6.10" "Moved to @oriro/orirocli — install that for the clean rebuild."
 
 # Verify from a clean shell (new user path):
-npx -y @oriro/orirocli@latest --version    # → 0.1.0
+npx -y @oriro/orirocli@latest --version    # → 0.1.8
 ```
 
 ## What a user gets after this