docs: align documentation before v0.13

Author: JacobOptimiza

CHANGELOG.md

@@ -10,6 +10,11 @@ Versioning.
 - Render the F3 custom-command manager as a centered modal consistent with the
   navigator and F1 help panel.
 
+### Security
+
+- Add GitHub Private Vulnerability Reporting, CodeQL analysis, and OpenSSF
+  Scorecard supply-chain checks.
+
 ## [0.12.0] - 2026-08-14
 
 ### Added

CONTRIBUTING.md

@@ -1,12 +1,23 @@
 # Contributing
 
-DevNav is a public, read-only project for inspection, cloning and downloading.
-The maintainer keeps the canonical repository changes internal; external Issues
-and Pull Requests are not part of the current contribution model. Security
+DevNav is a public project. Use the repository's Issue and pull-request
+templates for non-sensitive reports and focused changes. Security
 vulnerabilities must always use private reporting through [SECURITY.md](SECURITY.md).
 
-You may inspect, clone, download, and fork the project under the terms of the MIT
-license. Please keep changes small, focused, and documented.
+You may inspect, clone, download, and fork the project under the terms of the
+MIT license. Keep changes small, focused, documented, and scoped to one
+purpose.
+
+## Development prerequisites
+
+- Windows on x64 or ARM64 and PowerShell 7 or newer.
+- Rust 1.97 or newer (the CI toolchain is pinned to 1.97.1) with MSVC Build
+  Tools for native builds.
+- Node.js only for the npm bootstrap tests. The package declares Node `>=22`;
+  CI tests 22, 24, and 26, with Node 24 as the release baseline.
+
+For new Node.js environments, prefer a currently supported release line. Node
+is never required to run the installed native DevNav application.
 
 Before maintaining a fork or preparing an internal change, run the same quality gates as CI:
 
@@ -21,13 +32,17 @@ Invoke-Pester -Path ./tests/powershell
 node --test "tests/npm/**/*.test.mjs"
 ```
 
+Use a focused branch and pull request, wait for CI, and squash merge only after
+the applicable checks pass. New Actions references must use full commit SHAs.
+
 Do not disclose security vulnerabilities publicly. Report them privately as
 described in [SECURITY.md](SECURITY.md).
 
 ## Releasing
 
 Every channel ships the exact bytes built once by the release workflow: the
-GitHub release is canonical and npm, Scoop and WinGet derive from it. One
+GitHub release is canonical, npm and Scoop derive from it, and the workflow
+also generates the versioned WinGet submission asset. One
 version is shared by `Cargo.toml`, the Git tag, the GitHub release,
 `powershell/DevNav.psd1`, `packaging/npm/package.json` and
 `packaging/scoop/devnav.template.json`; CI and the release workflow abort on any
@@ -40,8 +55,8 @@ multichannel release; the release workflow enforces the floor.
 
 ### npm trusted publishing
 
-Future publishing uses OIDC trusted publishing with staged publishing; no
-`NPM_TOKEN` exists anywhere. The trusted publisher is restricted to repository
+Publishing uses OIDC trusted publishing with staged publishing; no `NPM_TOKEN`
+exists anywhere. The trusted publisher is restricted to repository
 `JacobOptimiza/dev-nav`, workflow `release.yml`, environment `npm-production`,
 and the `npm stage publish` action. The initial v0.10.0 package was published
 manually to establish the package; later releases stage the exact tested

README.es.md

@@ -73,6 +73,11 @@ No tienen script `postinstall` ni dependencias en runtime: el bootstrap elige el
 instalador oficial x64 o ARM64, verifica su SHA-256 con
 `release-manifest.json`, lo instala y valida la versión final.
 
+Para npm, pnpm y Yarn, el paquete de bootstrap declara Node.js `>=22`. CI lo
+valida con Node 22, 24 y 26; Node 24 es la base de release y Node 26 la vía de
+compatibilidad futura. Bun ejecuta este bootstrap con su propio runtime. Ninguno
+de estos runtimes es necesario después de instalar DevNav.
+
 Después, DevNav se actualiza con `dev update`, no con npm, Bun, pnpm o Yarn. El
 gestor sirve para descubrir e instalar la aplicación; no pasa a ser propietario
 de la instalación.
@@ -240,14 +245,14 @@ pulsar `f` para eliminarla de favoritos. `a` permite mostrarla como
 La ruta de inicio, los favoritos y los alias son locales y se guardan fuera del repositorio en
 `%LOCALAPPDATA%\DevNav\config.tsv`.
 
-## Shortcuts
+## Atajos
 
-Los shortcuts están agrupados por flujo de trabajo. Las acciones más frecuentes
+Los atajos están agrupados por flujo de trabajo. Las acciones más frecuentes
 aparecen primero para que sean fáciles de descubrir y recordar.
 
 ### Navegación y selección
 
-| Shortcut | Acción |
+| Atajo | Acción |
 |---|---|
 | `↑` / `↓` o `j` / `k` | mover la selección |
 | `Enter` | seleccionar la carpeta y volver a PowerShell |
@@ -264,7 +269,7 @@ aparecen primero para que sean fáciles de descubrir y recordar.
 
 ### Agentes
 
-| Shortcut | Acción |
+| Atajo | Acción |
 |---|---|
 | `c` | Codex: abrir una sesión nueva (`codex`) en la carpeta resaltada |
 | `r` | Codex: reanudar la última sesión del repositorio (`codex resume --last`) |
@@ -277,7 +282,7 @@ aparecen primero para que sean fáciles de descubrir y recordar.
 
 ### Organización, búsqueda y acciones
 
-| Shortcut | Acción |
+| Atajo | Acción |
 |---|---|
 | `/` | activar el filtro fuzzy incremental |
 | `f` | añadir o quitar un favorito global |
@@ -394,12 +399,12 @@ Set-DevUpdateCheck $false  # desactivar
 - La configuración local está separada de los archivos reemplazados al actualizar.
 - Binarios de release con checksum SHA-256.
 - Workflows con permisos mínimos y acciones fijadas a commits concretos.
-- Las futuras releases npm usan Trusted Publishing mediante OIDC; no se guarda
+- Las releases npm usan Trusted Publishing mediante OIDC; no se guarda
   ningún `NPM_TOKEN`.
 - Dependabot revisa Cargo y GitHub Actions.
-- `main` está protegida y únicamente los administradores pueden actualizarla.
-- El repositorio público es de solo lectura: permite consultar, clonar y descargar,
-  pero no acepta Issues ni Pull Requests externos.
+- Las vulnerabilidades se notifican mediante GitHub Private Vulnerability
+  Reporting; para trabajo no sensible se usan las plantillas de Issues y Pull
+  Requests.
 
 Consulta [SECURITY.md](SECURITY.md) para informar vulnerabilidades de forma
 privada y [CONTRIBUTING.md](CONTRIBUTING.md) para conocer la política del
@@ -417,7 +422,7 @@ cargo deny check
 Invoke-Pester -Path ./tests/powershell
 ```
 
-El repositorio fija Rust 1.97.1 con `rustfmt` y `clippy`. Los controles de
+El MSRV es Rust 1.97; CI fija Rust 1.97.1 con `rustfmt` y `clippy`. Los controles de
 PowerShell usan el parser nativo, PSScriptAnalyzer 1.25.0 y Pester 6.1.0. Las
 licencias, advisories, registros y versiones duplicadas de dependencias se
 comprueban con `cargo-deny` mediante [deny.toml](deny.toml). CI ejecuta todos

README.md

@@ -72,6 +72,11 @@ They have no `postinstall` script or runtime dependencies: the bootstrap selects
 the official x64 or ARM64 installer, verifies its SHA-256 against
 `release-manifest.json`, installs it, and validates the installed version.
 
+For npm, pnpm, and Yarn, the bootstrap package declares Node.js `>=22`. CI
+validates that package on Node 22, 24, and 26; Node 24 is the release baseline
+and Node 26 is the forward-compatibility lane. Bun runs this bootstrap with its
+own runtime. None of these runtimes is required after DevNav is installed.
+
 After installation, update DevNav with `dev update`—not with npm, Bun, pnpm, or
 Yarn. The package runner is a discovery and bootstrap channel; it does not own
 the installed application.
@@ -159,6 +164,7 @@ the folder DevNav opens by default.
 
 Published binaries do not require Rust or Visual Studio. A package runner is
 required only when you choose its bootstrap command.
+Windows PowerShell 5.1, 32-bit Windows, Linux, and macOS are not supported.
 
 ## Why DevNav?
 
@@ -188,6 +194,10 @@ Set-DevRoot $HOME
 Get-DevRoot
 ```
 
+For existing setups, `DEV_HOME` remains a fallback until a saved startup
+directory exists; a directory saved with `Ctrl+S` or `Set-DevRoot` takes
+precedence.
+
 ## Global favorites
 
 Press `f` on a directory to add or remove it from global favorites. Every saved
@@ -262,6 +272,17 @@ Use `Set-DevShortcut` for scripts, overwrite a slot by using the same index, or
 remove one with `Remove-DevShortcut -Index 1` (or `dev shortcut 1`). Bindings
 persist locally and appear in the `F1` help panel.
 
+You can also select a repository and pass an optional agent or shell command
+from PowerShell:
+
+```powershell
+dev codex
+dev "git status"
+```
+
+The agent CLIs are optional. DevNav returns the command to PowerShell, so the
+CLI you choose must be installed and available on `PATH`.
+
 ### Language
 
 On the first interactive launch, DevNav detects the first supported language in
@@ -327,8 +348,9 @@ Set-DevUpdateCheck $false  # disable
 - Release binaries and the PowerShell module are verified with SHA-256.
 - Local configuration is excluded from the repository and preserved on updates.
 - GitHub Actions use minimal permissions and commit-pinned actions.
-- Future npm releases use OIDC Trusted Publishing; no `NPM_TOKEN` is stored.
-- The public repository is read-only for external contributors.
+- npm releases use OIDC Trusted Publishing; no `NPM_TOKEN` is stored.
+- Security reports use GitHub Private Vulnerability Reporting; use the issue or
+  pull-request templates for non-sensitive work.
 
 See [SECURITY.md](SECURITY.md), [CONTRIBUTING.md](CONTRIBUTING.md), and the
 [troubleshooting guide](TROUBLESHOOTING.md).
@@ -355,9 +377,9 @@ cargo deny check
 Invoke-Pester -Path ./tests/powershell
 ```
 
-The repository pins Rust 1.97.1 with `rustfmt` and `clippy`. PowerShell quality
-gates use the native parser, PSScriptAnalyzer 1.25.0 and Pester 6.1.0. Dependency
-licenses, advisories, registries and duplicate versions are checked by
+The MSRV is Rust 1.97; CI pins Rust 1.97.1 with `rustfmt` and `clippy`.
+PowerShell quality gates use the native parser, PSScriptAnalyzer 1.25.0 and
+Pester 6.1.0. Dependency licenses, advisories, registries and duplicate versions are checked by
 `cargo-deny` using [deny.toml](deny.toml). CI runs all of these checks.
 
 See the public [roadmap](ROADMAP.md) for planned distribution work.

SECURITY.md

@@ -17,3 +17,10 @@ Include the affected version, operating system and architecture, reproduction
 steps or a proof of concept, impact, and any relevant logs or configuration
 details (with secrets removed). We will acknowledge a report within seven days
 and keep the reporter informed as we investigate.
+
+## Security controls
+
+CodeQL analyzes Rust and GitHub Actions on pushes to `main` and pull requests.
+OpenSSF Scorecard runs on `main` and publishes its current result through the
+repository badge. These controls complement, but do not replace, private
+vulnerability reporting.

TROUBLESHOOTING.md

@@ -12,6 +12,12 @@ Run in PowerShell 7:
 ```powershell
 $PSVersionTable.PSVersion
 Get-Command dev -ErrorAction SilentlyContinue
+Test-Path (Join-Path $env:LOCALAPPDATA 'Programs\DevNav\DevNav.psm1')
+```
+
+If `dev` is available, also check the configured root:
+
+```powershell
 Get-DevRoot
 Test-Path -LiteralPath (Get-DevRoot)
 ```

packaging/npm/README.md

@@ -67,7 +67,9 @@ DevNav remains a standalone native application under
 
 - Windows 10/11 on x64 or ARM64.
 - PowerShell 7 (`pwsh`) available on `PATH`.
-- Any of Bun, Node.js (via npm), pnpm, or Yarn to run the bootstrap.
+- Bun, or Node.js `>=22` for npm, pnpm, or Yarn. CI validates the bootstrap on
+  Node 22, 24, and 26; Node 24 is the release baseline. Node is not a DevNav
+  runtime dependency, and Bun uses its own runtime.
 
 ## Links
 

packaging/scoop/README.md

@@ -65,10 +65,10 @@ Update with:
 scoop update devnav
 ```
 
-The bucket is protected by pull requests and required CI. GitHub Actions are
-pinned to commits and Dependabot reviews those pins weekly. Excavator exists as
-a `workflow_dispatch` workflow only; there is no scheduled write automation.
-Future manifest changes must be reviewed and pass CI before they are merged.
+The bucket is maintained separately from this repository. Consult its current
+repository policy and automation before changing a manifest; this repository's
+release workflow remains the source for the generated release manifest and
+SHA-256 values.
 
 ## Setting up the bucket (historical bootstrap)