@mondoohq/xgrep 0.67.0 → 0.69.1

package/README.md

@@ -10,6 +10,8 @@ code-intelligence and AI-agent features on top of scanning.
 This npm package ships prebuilt `xgrep` binaries for Linux, macOS, and Windows
 (amd64 and arm64; the macOS binaries are signed and notarized).
 
+**Documentation: https://mondoo.com/docs/xgrep**
+
 ## Install
 
 Install globally to add the `xgrep` command to your `PATH` — the recommended way
@@ -57,9 +59,9 @@ A scan target can also be a **remote git repository** — xgrep clones it
 needed:
 
 ```bash
-xgrep scan github.com/mondoohq/xgrep            # host/owner/repo shorthand
-xgrep scan https://github.com/mondoohq/xgrep    # or a full HTTPS/SSH URL
-xgrep scan github.com/mondoohq/xgrep --ref v1.2.0   # a branch, tag, or commit
+xgrep scan github.com/mondoohq/skills           # host/owner/repo shorthand
+xgrep scan https://github.com/mondoohq/skills   # or a full HTTPS/SSH URL
+xgrep scan github.com/mondoohq/skills --ref v1.2.0   # a branch, tag, or commit
 ```
 
 ## Add it to CI
@@ -89,5 +91,5 @@ They also install into Codex, Gemini CLI, and Cursor — see the
 
 `xgrep fix` also drives an agent directly (`--agent codex`, or a custom command)
 if you'd rather not install the skills. See the
-[documentation](https://github.com/mondoohq/xgrep) for the full scan → triage →
+[documentation](https://xgrep.ai) for the full scan → triage →
 fix workflow.

package/bin/xgrep.js

@@ -0,0 +1,125 @@
+#!/usr/bin/env node
+// Copyright (c) Mondoo, Inc. All rights reserved. 2026
+// SPDX-License-Identifier: LicenseRef-Mondoo-Proprietary
+
+// Launcher for the `xgrep` command installed from npm.
+//
+// npm cannot ship one package with six platform binaries, so `@mondoohq/xgrep`
+// is a thin wrapper: it declares the six `@mondoohq/xgrep_<os>_<arch>` packages
+// as optionalDependencies (npm installs only the one matching `os`/`cpu`) and
+// this script execs whichever one landed.
+//
+// Its whole job is to be invisible. Two things make it visible, and both are
+// what this file exists to get right:
+//
+//   - THE EXIT CODE. xgrep's exit code is its CI contract (0 clean, 1 findings
+//     under --error, 2 fatal, 3 missing upload, 4 incomplete scan — see
+//     docs/08-integrations/ci.md). A launcher that spawns the child and never
+//     reads its status exits 0 always, which silently disables every gate for
+//     everyone who installed from npm — and npm is the install path our own CI
+//     documentation recommends. See xgrep#2745.
+//   - SIGNALS. Without forwarding, Ctrl+C kills the launcher and leaves the
+//     scan running detached, still holding its temp files.
+
+'use strict';
+
+const os = require('os');
+const path = require('path');
+const { spawn } = require('child_process');
+
+// The platform packages, keyed by `${process.platform}_${process.arch}`.
+// Keep in sync with the goreleaser build matrix (.goreleaser*.yaml) and the
+// package list in .github/workflows/release.yml.
+const PLATFORM_PACKAGES = {
+  linux_x64: { pkg: '@mondoohq/xgrep_linux_amd64', bin: 'xgrep' },
+  linux_arm64: { pkg: '@mondoohq/xgrep_linux_arm64', bin: 'xgrep' },
+  darwin_x64: { pkg: '@mondoohq/xgrep_darwin_amd64', bin: 'xgrep' },
+  darwin_arm64: { pkg: '@mondoohq/xgrep_darwin_arm64', bin: 'xgrep' },
+  win32_x64: { pkg: '@mondoohq/xgrep_windows_amd64', bin: 'xgrep.exe' },
+  win32_arm64: { pkg: '@mondoohq/xgrep_windows_arm64', bin: 'xgrep.exe' },
+};
+
+// xgrep's own fatal-error code, so a launcher failure is reported the same way
+// the binary would report one rather than as a findings exit.
+const EXIT_FATAL = 2;
+
+function fail(message) {
+  process.stderr.write(`xgrep: ${message}\n`);
+  process.exit(EXIT_FATAL);
+}
+
+// resolveBinary finds the platform binary, or explains why it cannot.
+//
+// The failure modes here are all things a user can act on — an unsupported
+// platform, or an install that skipped optionalDependencies (`--no-optional`,
+// `--omit=optional`, or a lockfile built on another platform) — so each gets a
+// sentence rather than a module-resolution stack trace.
+function resolveBinary() {
+  const key = `${process.platform}_${process.arch}`;
+  const target = PLATFORM_PACKAGES[key];
+  if (!target) {
+    const supported = Object.keys(PLATFORM_PACKAGES).sort().join(', ');
+    fail(
+      `no prebuilt binary for ${process.platform}/${process.arch}.\n` +
+        `  supported: ${supported}\n` +
+        '  build from source: https://xgrep.ai'
+    );
+  }
+  let pkgJson;
+  try {
+    pkgJson = require.resolve(path.posix.join(target.pkg, 'package.json'));
+  } catch {
+    fail(
+      `the platform package ${target.pkg} is not installed.\n` +
+        '  it ships as an optionalDependency, so this usually means the install ran with\n' +
+        '  --no-optional / --omit=optional, or a lockfile from a different platform was used.\n' +
+        `  fix: npm install ${target.pkg}`
+    );
+  }
+  return path.join(path.dirname(pkgJson), target.bin);
+}
+
+function main() {
+  const child = spawn(resolveBinary(), process.argv.slice(2), {
+    stdio: 'inherit',
+    env: process.env,
+  });
+
+  // Forward signals so Ctrl+C reaches the scan instead of orphaning it. xgrep
+  // handles SIGINT/SIGTERM itself (it flushes telemetry and exits 130), so the
+  // child is left to exit on its own terms and `close` below reports whatever
+  // it chose. kill() throws if the child is already gone — a race we can ignore.
+  const forwarded = ['SIGINT', 'SIGTERM', 'SIGHUP', 'SIGQUIT', 'SIGBREAK'];
+  const handlers = [];
+  for (const signal of forwarded) {
+    // Windows has no SIGHUP/SIGQUIT and rejects a listener for them.
+    if (!(signal in os.constants.signals)) continue;
+    const handler = () => {
+      try {
+        child.kill(signal);
+      } catch {
+        /* already exited */
+      }
+    };
+    handlers.push([signal, handler]);
+    process.on(signal, handler);
+  }
+
+  child.on('error', (err) => fail(`could not run the xgrep binary: ${err.message}`));
+
+  child.on('close', (code, signal) => {
+    // Stop holding the event loop open, so the exit below is the process's own.
+    for (const [sig, handler] of handlers) process.removeListener(sig, handler);
+
+    if (signal) {
+      // Killed rather than exited. Report it the way a shell does (128+signum)
+      // so `$?` means the same thing through the launcher as without it.
+      const signum = os.constants.signals[signal];
+      process.exit(signum ? 128 + signum : EXIT_FATAL);
+    }
+    // `code` is null only when a signal was delivered, which is handled above.
+    process.exit(code === null ? EXIT_FATAL : code);
+  });
+}
+
+main();

package/package.json

@@ -1,35 +1,37 @@
 {
   "name": "@mondoohq/xgrep",
-  "version": "0.67.0",
-  "bin": {
-    "xgrep": "index.js"
+  "version": "0.69.1",
+  "description": "A fast, Semgrep-compatible code scanner written in Go.",
+  "keywords": [
+    "sast",
+    "code-scanner",
+    "semgrep",
+    "security",
+    "static-analysis",
+    "xgrep",
+    "cli"
+  ],
+  "homepage": "https://xgrep.ai",
+  "bugs": {
+    "url": "https://xgrep.ai"
   },
-  "optionalDependencies": {
-    "@mondoohq/xgrep_linux_amd64": "0.67.0",
-    "@mondoohq/xgrep_linux_arm64": "0.67.0",
-    "@mondoohq/xgrep_windows_amd64": "0.67.0",
-    "@mondoohq/xgrep_windows_arm64": "0.67.0",
-    "@mondoohq/xgrep_darwin_arm64": "0.67.0",
-    "@mondoohq/xgrep_darwin_amd64": "0.67.0"
+  "license": "LicenseRef-Mondoo-Proprietary",
+  "bin": {
+    "xgrep": "bin/xgrep.js"
   },
-  "os": [
-    "linux",
-    "win32",
-    "darwin"
-  ],
-  "cpu": [
-    "x64",
-    "arm64"
-  ],
   "files": [
+    "bin/",
     "README.md"
   ],
-  "keywords": [
-    "sast,code-scanner,semgrep,security,static-analysis,xgrep,cli"
-  ],
-  "description": "A fast, Semgrep-compatible code scanner written in Go. Supports pattern matching, taint analysis, and autofix across 20+ programming languages.",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/mondoohq/xgrep.git"
+  "engines": {
+    "node": ">=18"
+  },
+  "optionalDependencies": {
+    "@mondoohq/xgrep_darwin_amd64": "0.69.1",
+    "@mondoohq/xgrep_darwin_arm64": "0.69.1",
+    "@mondoohq/xgrep_linux_amd64": "0.69.1",
+    "@mondoohq/xgrep_linux_arm64": "0.69.1",
+    "@mondoohq/xgrep_windows_amd64": "0.69.1",
+    "@mondoohq/xgrep_windows_arm64": "0.69.1"
   }
-}
+}

package/index.js

@@ -1,11 +0,0 @@
-#!/usr/bin/env node
-const path = require('path');
-const child_process = require('child_process');
-const mapping = { linux_x64: { name: [ '@mondoohq', 'xgrep_linux_amd64' ], bin: 'xgrep' }, linux_arm64: { name: [ '@mondoohq', 'xgrep_linux_arm64' ], bin: 'xgrep' }, win32_x64: { name: [ '@mondoohq', 'xgrep_windows_amd64' ], bin: 'xgrep.exe' }, win32_arm64: { name: [ '@mondoohq', 'xgrep_windows_arm64' ], bin: 'xgrep.exe' }, darwin_arm64: { name: [ '@mondoohq', 'xgrep_darwin_arm64' ], bin: 'xgrep' }, darwin_x64: { name: [ '@mondoohq', 'xgrep_darwin_amd64' ], bin: 'xgrep' } };
-const definition = mapping[process.platform + '_' + process.arch];
-const packageJsonPath = require.resolve(path.join(...definition.name, 'package.json'));
-const packagePath = path.join(path.dirname(packageJsonPath), definition.bin);
-child_process.spawn(packagePath, process.argv.splice(2), {
-  stdio: 'inherit',
-  env: process.env,
-});