@methiu/raigal 0.16.3 → 1.0.1

package/README.md

@@ -2,15 +2,14 @@
 
 **Catch the slop AI coding agents leave in your code.**
 
-[![npm version](https://img.shields.io/npm/v/raigal.svg)](https://www.npmjs.com/package/raigal) [![npm downloads](https://img.shields.io/npm/dm/raigal.svg)](https://www.npmjs.com/package/raigal) [![CI](https://github.com/meethiu/raigal/actions/workflows/ci.yml/badge.svg)](https://github.com/meethiu/raigal/actions/workflows/ci.yml) [![Node >= 20](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org) [![Discord](https://img.shields.io/badge/Discord-Join-5865F2?logo=discord&logoColor=white)](https://discord.gg/Mzz4A6mfj6)
-
+[![npm version](https://img.shields.io/npm/v/@methiu/raigal.svg)](https://www.npmjs.com/package/@methiu/raigal) [![npm downloads](https://img.shields.io/npm/dm/@methiu/raigal.svg)](https://www.npmjs.com/package/@methiu/raigal) [![CI](https://github.com/meethiu/raigal/actions/workflows/ci.yml/badge.svg)](https://github.com/meethiu/raigal/actions/workflows/ci.yml) [![Node >= 20](https://img.shields.io/badge/node-%3E%3D20-brightgreen.svg)](https://nodejs.org)
 The patterns Claude Code, Cursor, Codex, and OpenCode leave behind: narrative comments above self-explanatory code, swallowed exceptions, hidden fallbacks, `as any` casts, hallucinated imports, duplicated helpers, dead code, todo stubs, oversized functions. Tests pass. Lint passes. The code rots anyway.
 
 Raigal catches them. 50+ rules across 10 language targets (TypeScript, JavaScript, Expo / React Native, Python, Go, Rust, Ruby, PHP, C#, C/C++). Scores every change 0-100. Sub-second. Deterministic: no LLM in the runtime path, same code in, same score out.
 
 ## Quick start
 
-Raigal is proprietary software licensed to organizations on an admin-managed allowlist. Runs require authentication via organization credentials (`raigal login` or `RAIGAL_TOKEN`).
+Raigal is demo software licensed to organizations on an admin-managed allowlist. Runs require authentication via organization credentials (`raigal login` or `RAIGAL_TOKEN`).
 
 ```bash
 # 1. Sign in with your organization account
@@ -25,10 +24,11 @@ In CI and automated workflows, provide your organization API key via the `RAIGAL
 Also available on npm, Yarn, Bun, and Homebrew:
 
 ```bash
-npm install -g raigal                # npm
-yarn dlx raigal scan                 # Yarn
-bun add -g raigal                    # Bun
-brew install meethiu/tap/raigal      # Homebrew
+npm install -g @methiu/raigal
+
+or
+
+npm i @methiu/raigal
 ```
 
 See [Installation](#installation) for every option.
@@ -53,7 +53,7 @@ raigal hook install --claude # per-edit hook
 [![raigal](https://badges.raigal.dev/score/<owner>/<repo>.svg)](https://raigal.dev)
 ```
 
-Run `npx raigal@latest badge` to auto-generate. Free at [raigal.dev](https://raigal.dev).
+Run `npx @methiu/raigal@latest badge` to auto-generate. Free at [raigal.dev](https://raigal.dev).
 
 ## See it in action
 
@@ -71,22 +71,22 @@ The same CLI is published to npm and Homebrew. Pick whichever fits your stack.
 
 ```bash
 # Run without installing
-npx raigal@latest scan
+npx @methiu/raigal@latest scan
 
 # npm
-npm install --save-dev raigal
+npm install --save-dev @methiu/raigal
 
 # yarn
-yarn add --dev raigal
+yarn add --dev @methiu/raigal
 
 # pnpm
-pnpm add -D raigal
+pnpm add -D @methiu/raigal
 
 # bun
-bun add -d raigal
+bun add -d @methiu/raigal
 
 # Global
-npm install -g raigal
+npm install -g @methiu/raigal
 ```
 
 Package installation does not run dependency lifecycle scripts. After installing, run `raigal-tools` once if you want bundled Ruff and golangci-lint coverage; the core scanner works without it.
@@ -113,7 +113,7 @@ Full reference for every channel, optional bundled tooling, and external tools:
 
 ## Usage
 
-Examples below use the installed `raigal` binary. For a one-off latest run, prefix the command with `npx raigal@latest`, for example `npx raigal@latest scan`.
+Examples below use the installed `raigal` binary. For a one-off latest run, prefix the command with `npx @methiu/raigal@latest`, for example `npx @methiu/raigal@latest scan`.
 
 ### Command reference
 
@@ -272,7 +272,7 @@ raigal install claude cursor           # alias for hook install
 raigal install hooks --claude          # natural alias for hook install
 ```
 
-**Runtime adapters** (scan + feedback): `claude`, `cursor`, `gemini`, `pi`.  
+**Runtime adapters** (scan + feedback): `claude`, `cursor`, `gemini`, `pi`.
 **Rules-only** (agent reads rules): `codex`, `windsurf`, `cline`, `kilocode`, `antigravity`, `copilot`.
 
 Hook install flags: `--agent <names>`, `-g, --global`, `--project`, `--dry-run`, `--yes`, `--quality-gate`, plus per-agent shortcuts `--claude`, `--cursor`, `--gemini`, `--pi`, `--codex`, `--windsurf`, `--cline`, `--kilocode`, `--antigravity`, `--copilot`.
@@ -298,7 +298,7 @@ Expose Raigal as MCP tools for Claude Desktop, Cursor, Codex:
   "mcpServers": {
     "raigal": {
       "command": "npx",
-      "args": ["-y", "raigal-mcp"]
+      "args": ["-y", "@methiu/raigal-mcp"]
     }
   }
 }
@@ -389,7 +389,7 @@ jobs:
         with:
           node-version: 24
       - name: Raigal Quality Gate
-        run: npx --yes raigal@latest ci
+        run: npx --yes @methiu/raigal@latest ci
         env:
           RAIGAL_TOKEN: ${{ secrets.RAIGAL_TOKEN }}
 ```
@@ -397,7 +397,7 @@ jobs:
 **GitHub code scanning (SARIF)**: emit a SARIF 2.1.0 report and upload it so findings appear in the Security tab:
 
 ```yaml
-- run: npx raigal@latest scan . --sarif > raigal.sarif
+- run: npx @methiu/raigal@latest scan . --sarif > raigal.sarif
 - uses: github/codeql-action/upload-sarif@v3
   with:
     sarif_file: raigal.sarif
@@ -419,7 +419,7 @@ pipelines:
             depth: full   # branch diffs need history
           script:
             - git fetch origin "$BITBUCKET_PR_DESTINATION_BRANCH"
-            - npx --yes raigal@latest ci --changes --base FETCH_HEAD
+            - npx --yes @methiu/raigal@latest ci --changes --base FETCH_HEAD
 ```
 
 `ci` applies the score gate and exit code, so no JSON parsing or hand-rolled threshold is needed. More providers: [CI/CD](docs/ci.md).
@@ -488,7 +488,7 @@ Raigal rules are shaped by public scans and benchmark-derived failure modes, not
 
 ## Community
 
-[Discord](https://discord.gg/Mzz4A6mfj6) for community chat and support · [Discussions](https://github.com/meethiu/raigal/discussions) for questions, rule requests, and false-positive triage · [Issues](https://github.com/meethiu/raigal/issues) for bugs
+[Discussions](https://github.com/meethiu/raigal/discussions) for questions, rule requests, and false-positive triage · [Issues](https://github.com/meethiu/raigal/issues) for bugs
 
 ## Contributing
 
@@ -508,4 +508,4 @@ Auto-updated by `.github/workflows/contributors.yml`. [Link commit email](https:
 
 ## License
 
-Proprietary. All rights reserved. Use is permitted only under a written agreement with Raigal. See [LICENSE](LICENSE) and [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).
+Proprietary. All rights reserved. Use is permitted only under a written agreement with Raigal. See [LICENSE](LICENSE) and [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md).

package/dist/cli.js

@@ -863,7 +863,7 @@ const createLogger = (deps = {}) => {
 const log = createLogger();
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "0.16.3";
+const APP_VERSION = "1.0.1";
 //#endregion
 //#region src/commands/agent-connect.ts
 const commandText = (status) => [status.provider.loginCommand.command, ...status.provider.loginCommand.args].join(" ");
@@ -1132,7 +1132,7 @@ const AllowedOwner = z.object({
 	login: z.string().max(100)
 });
 const EntitlementClaims = z.object({
-	iss: z.literal("https://app.raigal.dev"),
+	iss: z.literal(process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev"),
 	sub: z.string(),
 	org_name: z.string(),
 	plan: z.enum(["trial", "active"]),
@@ -1345,7 +1345,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.16.3", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("1.0.1", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -23984,7 +23984,7 @@ const maybeNotifyUpdate = async (now = Date.now()) => {
 	if (!process.stderr.isTTY) return;
 	const cachePath = resolveUpdateCachePath();
 	const cache = readCache(cachePath);
-	if (cache && isOutdated("0.16.3", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
+	if (cache && isOutdated("1.0.1", cache.latest)) process.stderr.write(formatUpdateNotice(APP_VERSION, cache.latest));
 	if (!cache || now - cache.checkedAt > CHECK_INTERVAL_MS) {
 		const latest = await fetchLatestVersion$1();
 		if (latest) writeCache(cachePath, {
@@ -24504,7 +24504,7 @@ const renderCommandGroup = (group, commandWidth) => {
 	return lines;
 };
 const renderCommandReference = (input = {}) => {
-	const version = input.version ?? "0.16.3";
+	const version = input.version ?? "1.0.1";
 	const commandWidth = Math.max(...COMMAND_REFERENCE.map((item) => item.command.length));
 	const lines = [renderHeader({
 		version,
@@ -24727,7 +24727,7 @@ const renderHelpDetails = () => [
 ].map((line) => highlightRaigal(line, theme)).join("\n");
 const renderHome = (input = {}) => {
 	let out = renderHeader({
-		version: input.version ?? "0.16.3",
+		version: input.version ?? "1.0.1",
 		command: "--bare",
 		context: []
 	});
@@ -29390,7 +29390,16 @@ const shouldRenderPlainVersion = () => {
 		"version"
 	].includes(args[0] ?? "");
 };
-const program = new Command().name("raigal").description("The quality gate for agentic coding.").version(APP_VERSION, "-v, --version").argument("[directory]", "directory to scan when no command is passed", ".").option("--changes", "only scan changed files (git diff)").option("--staged", "only scan staged files").option("--base <ref>", "diff base for --changes, e.g. origin/main (default HEAD)").option("-d, --verbose", "show file details per rule").option("--json", "output JSON instead of terminal UI").option("--sarif", "output SARIF 2.1.0 (for GitHub code scanning)").option("--format <format>", "output format: json or sarif");
+const program = new Command().name("raigal").description("The quality gate for agentic coding.").version(APP_VERSION, "-v, --version").argument("[directory]", "directory to scan when no command is passed", ".");
+for (const [flag, description] of [
+	["--changes", "only scan changed files (git diff)"],
+	["--staged", "only scan staged files"],
+	["--base <ref>", "diff base for --changes, e.g. origin/main (default HEAD)"],
+	["-d, --verbose", "show file details per rule"],
+	["--json", "output JSON instead of terminal UI"],
+	["--sarif", "output SARIF 2.1.0 (for GitHub code scanning)"],
+	["--format <format>", "output format: json or sarif"]
+]) program.option(flag, description);
 addFilterAndFailOnOptions(program).showSuggestionAfterError().action(async (directory, flags) => {
 	if (hasNoUserArgs() && noFlagsPassed(flags) && process.stdin.isTTY) try {
 		await interactiveCommand(directory, loadConfig(directory));
@@ -29398,7 +29407,17 @@ addFilterAndFailOnOptions(program).showSuggestionAfterError().action(async (dire
 	} catch {}
 	await runScan(directory, flags);
 });
-addFilterAndFailOnOptions(program.command("scan [directory]").description("Score a project and print findings").option("--changes", "only scan changed files").option("--staged", "only scan staged files").option("--base <ref>", "diff base for --changes, e.g. origin/main (default HEAD)").option("-d, --verbose", "show file details per rule").option("--json", "output JSON").option("--sarif", "output SARIF 2.1.0 (for GitHub code scanning)").option("--format <format>", "output format: json or sarif")).action(async (directory = ".", _flags, command) => {
+const scanCmd = program.command("scan [directory]").description("Score a project and print findings");
+for (const [flag, description] of [
+	["--changes", "only scan changed files"],
+	["--staged", "only scan staged files"],
+	["--base <ref>", "diff base for --changes, e.g. origin/main (default HEAD)"],
+	["-d, --verbose", "show file details per rule"],
+	["--json", "output JSON"],
+	["--sarif", "output SARIF 2.1.0 (for GitHub code scanning)"],
+	["--format <format>", "output format: json or sarif"]
+]) scanCmd.option(flag, description);
+addFilterAndFailOnOptions(scanCmd).action(async (directory = ".", _flags, command) => {
 	await runScan(directory, command.optsWithGlobals());
 });
 const fixProgram = program.command("fix [directory]").description("Auto-fix findings or hand off to a coding agent").option("-d, --verbose", "show detailed fix progress").option("-f, --force", "run aggressive fixes (audit and framework dependency alignment)").option("--safe", "only apply reversible fixes (imports, comment removal, safe formatters); skip anything that deletes code, rewrites behaviour, or runs unsafe formatter configs").option("--dry-run", "print planned fix steps without writing files").addOption(new Option("--changes", "only fix changed files (git diff)").conflicts("staged")).addOption(new Option("--staged", "only fix staged files").conflicts("changes")).option("--base <ref>", "diff base for --changes, e.g. origin/main (default HEAD)").option("-p, --prompt", "print a prompt for your coding agent to fix remaining issues");

package/dist/index.js

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-w6rU3OgI.js";
+import { t as APP_VERSION } from "./version-om7oAIVO.js";
 import { a as getEngineLabel, i as ENGINE_INFO, r as scoreImpactForRule, t as summarizeFindingAssessments } from "./finding-assessment-M5fUTE-C.js";
 import { n as isSecretClassRule, r as maskSecrets, t as FIXED_SECRET_DIAGNOSTIC_MESSAGE } from "./mask-secrets-BXn-ZSEh.js";
 import { createRequire, isBuiltin } from "node:module";
@@ -15877,7 +15877,7 @@ const AllowedOwner = z.object({
 	login: z.string().max(100)
 });
 const EntitlementClaims = z.object({
-	iss: z.literal("https://app.raigal.dev"),
+	iss: z.literal(process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev"),
 	sub: z.string(),
 	org_name: z.string(),
 	plan: z.enum(["trial", "active"]),
@@ -16051,7 +16051,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.16.3", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("1.0.1", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {
@@ -19171,12 +19171,12 @@ const runScanBody = async (resolvedDir, config, options, projectInfo, scanScope,
 		scoreFileCount
 	});
 	if (options.sarif) {
-		const { buildSarifLog } = await import("./sarif-TxkW17qu.js");
+		const { buildSarifLog } = await import("./sarif-C9k9QYGi.js");
 		console.log(JSON.stringify(buildSarifLog(results), null, 2));
 		return completion;
 	}
 	if (options.json) {
-		const { buildJsonOutput } = await import("./json-CytVHOS7.js");
+		const { buildJsonOutput } = await import("./json-Be-AUuDb.js");
 		const jsonOut = buildJsonOutput(results, scoreResult, scoreFileCount, elapsedMs, scanCoverage);
 		console.log(JSON.stringify(jsonOut, null, 2));
 		return completion;

package/dist/{json-CytVHOS7.js → json-Be-AUuDb.js}

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-w6rU3OgI.js";
+import { t as APP_VERSION } from "./version-om7oAIVO.js";
 import { i as ENGINE_INFO, n as withFindingAssessments, t as summarizeFindingAssessments } from "./finding-assessment-M5fUTE-C.js";
 //#region src/output/json.ts
 const buildJsonOutput = (results, scoreResult, fileCount, elapsedMs, coverage) => {

package/dist/mcp.js

@@ -84,7 +84,7 @@ const getActiveToken = () => {
 };
 //#endregion
 //#region src/version.ts
-const APP_VERSION = "0.16.3";
+const APP_VERSION = "1.0.1";
 //#endregion
 //#region src/cloud/contract.ts
 const Severity = z.enum(["error", "warning"]);
@@ -168,7 +168,7 @@ const AllowedOwner = z.object({
 	login: z.string().max(100)
 });
 const EntitlementClaims = z.object({
-	iss: z.literal("https://app.raigal.dev"),
+	iss: z.literal(process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev"),
 	sub: z.string(),
 	org_name: z.string(),
 	plan: z.enum(["trial", "active"]),
@@ -342,7 +342,7 @@ const verifyEntitlementJwt = (jwt, options = {}) => {
 	const claims = parsed.data;
 	const expectedIssuer = process.env.RAIGAL_ISSUER?.trim() || "https://app.raigal.dev";
 	if (claims.iss !== expectedIssuer) throw new JwtVerificationError(`Untrusted issuer: ${claims.iss}`, "invalid_issuer");
-	if (!isVersionAtLeast("0.16.3", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
+	if (!isVersionAtLeast("1.0.1", claims.min_cli_version)) throw new JwtVerificationError(`CLI version ${APP_VERSION} is below required minimum ${claims.min_cli_version}. Run "raigal update" or "npm install -g @methiu/raigal@latest".`, "cli_version_unsupported");
 	const now = options.nowSeconds ?? Math.floor(Date.now() / 1e3);
 	const grace = options.allowGraceSeconds ?? 0;
 	if (now > claims.exp + grace) {

package/dist/{sarif-TxkW17qu.js → sarif-C9k9QYGi.js}

@@ -1,4 +1,4 @@
-import { t as APP_VERSION } from "./version-w6rU3OgI.js";
+import { t as APP_VERSION } from "./version-om7oAIVO.js";
 import { n as isSecretClassRule, t as FIXED_SECRET_DIAGNOSTIC_MESSAGE } from "./mask-secrets-BXn-ZSEh.js";
 import path from "node:path";
 //#region src/output/sarif.ts

package/dist/{version-w6rU3OgI.js → version-om7oAIVO.js}

@@ -1,6 +1,6 @@
 import "node:fs";
 import "node:url";
 //#region src/version.ts
-const APP_VERSION = "0.16.3";
+const APP_VERSION = "1.0.1";
 //#endregion
 export { APP_VERSION as t };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@methiu/raigal",
-	"version": "0.16.3",
+	"version": "1.0.1",
 	"publishConfig": {
 		"access": "public"
 	},

package/scripts/check-tarball-keys.mjs

@@ -96,11 +96,15 @@ try {
 	if (tarballPath && fs.existsSync(tarballPath)) {
 		try {
 			fs.rmSync(tarballPath, { force: true });
-		} catch {}
+		} catch {
+			// Best effort: cleanup failures must not mask the original error.
+		}
 	}
 	if (extractDir && fs.existsSync(extractDir)) {
 		try {
 			fs.rmSync(extractDir, { recursive: true, force: true });
-		} catch {}
+		} catch {
+			// Best effort: cleanup failures must not mask the original error.
+		}
 	}
 }