Use GitHits package intelligence before making dependency claims from memory.

CLI Invocation

Run commands as githits ....
If githits is not found, retry the same command as npx -y githits@latest ....
Use --json when comparing versions, counting vulnerabilities, or extracting fields.
Do not expose credentials. If auth is required interactively, run githits login; use githits login --no-browser only when the user can complete the printed URL flow. In noninteractive eval/CI, do not start OAuth; report that GITHITS_API_TOKEN or prior login is required.

Package Spec

Most package commands use <registry>:<name>[@<version>], for example npm:lodash@4.17.20 or pypi:requests.
pkg info always reports the latest published version and does not accept a version pin.
pkg changelog accepts <registry>:<name> or --repo-url <url>; do not pass <spec>@<version> to changelog. Use --to <version> instead.