@mondoohq/xgrep 0.28.1 → 0.29.0

package/README.md

@@ -10,27 +10,46 @@ code-intelligence and AI-agent features on top of scanning.
 This npm package ships prebuilt `xgrep` binaries for Linux, macOS, and Windows
 (amd64 and arm64; the macOS binaries are signed and notarized).
 
-## Quick start
+## Install
 
-xgrep ships with a built-in rule corpus, so no rules file is needed to get
-started — run it straight from npx:
+Install globally to add the `xgrep` command to your `PATH` — the recommended way
+to use it interactively:
 
 ```bash
-# Scan the current directory with the built-in rules (defaults to security)
-npx @mondoohq/xgrep scan .
+npm install -g @mondoohq/xgrep
+xgrep scan .
 ```
 
+Or add it as a project dev dependency:
+
 ```bash
-# Choose a category (default: security)
-npx @mondoohq/xgrep scan --category correctness .
+npm install --save-dev @mondoohq/xgrep
+```
+
+Prefer zero-install? Run any command below through `npx @mondoohq/xgrep …`
+instead of `xgrep …` (handy for one-offs and CI). Pin a version
+(`@mondoohq/xgrep@<version>`) for reproducible builds.
+
+## Quick start
+
+xgrep ships with a built-in rule corpus, so no rules file is needed to get
+started:
+
+```bash
+# Scan the current directory with the built-in rules. `xgrep scan` with no path
+# defaults to the current directory.
+xgrep scan
+
+# Choose a category (default: security, secrets)
+xgrep scan --category correctness .
 
 # Machine-readable output
-npx @mondoohq/xgrep scan --json .
-npx @mondoohq/xgrep scan --sarif .                          # GitHub Code Scanning
-npx @mondoohq/xgrep scan --gitlab -o gl-sast-report.json .  # GitLab SAST
+xgrep scan --json .
+xgrep scan --sarif .                          # GitHub Code Scanning
+xgrep scan --gitlab -o gl-sast-report.json .  # GitLab SAST
 
 # Bring your own rules: point -f at a rule file or a directory of rules
-npx @mondoohq/xgrep scan -f rules.yaml src/
+xgrep scan -f rules.yaml src/
 ```
 
 A scan target can also be a **remote git repository** — xgrep clones it
@@ -38,20 +57,33 @@ A scan target can also be a **remote git repository** — xgrep clones it
 needed:
 
 ```bash
-npx @mondoohq/xgrep scan github.com/mondoohq/xgrep            # host/owner/repo shorthand
-npx @mondoohq/xgrep scan https://github.com/mondoohq/xgrep    # or a full HTTPS/SSH URL
-npx @mondoohq/xgrep scan github.com/mondoohq/xgrep --ref v1.2.0   # a branch, tag, or commit
+xgrep scan github.com/mondoohq/xgrep            # host/owner/repo shorthand
+xgrep scan https://github.com/mondoohq/xgrep    # or a full HTTPS/SSH URL
+xgrep scan github.com/mondoohq/xgrep --ref v1.2.0   # a branch, tag, or commit
 ```
 
-## Install
+## Add it to CI
 
-To add the `xgrep` command to your `PATH` instead of using npx:
+Scaffold a ready-to-commit CI workflow for your provider (GitHub Actions, GitLab,
+or Azure Pipelines) — it installs xgrep and runs a diff-aware scan on every pull
+request:
 
 ```bash
-# Global install
-npm install -g @mondoohq/xgrep
-xgrep scan .
+xgrep ci --init
+```
 
-# Or as a project dev dependency
-npm install --save-dev @mondoohq/xgrep
+## AI-agent skills (Claude Code)
+
+xgrep bundles [Claude Code](https://www.claude.com/product/claude-code) skills for
+triaging findings, fixing them, and navigating code with the code graph. Install
+them into your Claude Code environment:
+
+```bash
+xgrep skill list       # see the bundled skills
+xgrep skill install    # install them (into ~/.claude/plugins/)
 ```
+
+The skills are Claude Code plugins today. To drive fixes with another agent
+without the skills, `xgrep fix --agent codex` (or a custom command) works
+directly. See the [documentation](https://github.com/mondoohq/xgrep) for the full
+scan → triage → fix workflow.

package/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 const path = require('path');
 const child_process = require('child_process');
-const mapping = { linux_arm64: { name: [ '@mondoohq', 'xgrep_linux_arm64' ], bin: 'xgrep' }, linux_x64: { name: [ '@mondoohq', 'xgrep_linux_amd64' ], bin: 'xgrep' }, win32_arm64: { name: [ '@mondoohq', 'xgrep_windows_arm64' ], bin: 'xgrep.exe' }, win32_x64: { name: [ '@mondoohq', 'xgrep_windows_amd64' ], bin: 'xgrep.exe' }, darwin_x64: { name: [ '@mondoohq', 'xgrep_darwin_amd64' ], bin: 'xgrep' }, darwin_arm64: { name: [ '@mondoohq', 'xgrep_darwin_arm64' ], bin: 'xgrep' } };
+const mapping = { win32_arm64: { name: [ '@mondoohq', 'xgrep_windows_arm64' ], bin: 'xgrep.exe' }, linux_x64: { name: [ '@mondoohq', 'xgrep_linux_amd64' ], bin: 'xgrep' }, linux_arm64: { name: [ '@mondoohq', 'xgrep_linux_arm64' ], bin: 'xgrep' }, win32_x64: { name: [ '@mondoohq', 'xgrep_windows_amd64' ], bin: 'xgrep.exe' }, darwin_x64: { name: [ '@mondoohq', 'xgrep_darwin_amd64' ], bin: 'xgrep' }, darwin_arm64: { name: [ '@mondoohq', 'xgrep_darwin_arm64' ], bin: 'xgrep' } };
 const definition = mapping[process.platform + '_' + process.arch];
 const packageJsonPath = require.resolve(path.join(...definition.name, 'package.json'));
 const packagePath = path.join(path.dirname(packageJsonPath), definition.bin);

package/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@mondoohq/xgrep",
-  "version": "0.28.1",
+  "version": "0.29.0",
   "bin": {
     "xgrep": "index.js"
   },
   "optionalDependencies": {
-    "@mondoohq/xgrep_linux_arm64": "0.28.1",
-    "@mondoohq/xgrep_linux_amd64": "0.28.1",
-    "@mondoohq/xgrep_windows_arm64": "0.28.1",
-    "@mondoohq/xgrep_windows_amd64": "0.28.1",
-    "@mondoohq/xgrep_darwin_amd64": "0.28.1",
-    "@mondoohq/xgrep_darwin_arm64": "0.28.1"
+    "@mondoohq/xgrep_windows_arm64": "0.29.0",
+    "@mondoohq/xgrep_linux_amd64": "0.29.0",
+    "@mondoohq/xgrep_linux_arm64": "0.29.0",
+    "@mondoohq/xgrep_windows_amd64": "0.29.0",
+    "@mondoohq/xgrep_darwin_amd64": "0.29.0",
+    "@mondoohq/xgrep_darwin_arm64": "0.29.0"
   },
   "os": [
-    "linux",
     "win32",
+    "linux",
     "darwin"
   ],
   "cpu": [