gadriel 1.2.9 → 1.4.0

package/README.md

@@ -6,12 +6,13 @@ integrates with AI coding agents (Claude Code, Cursor, Copilot) via git hooks
 and an MCP server.
 
 > **📖 Full documentation:** **[https://gadriel.ai/docs](https://gadriel.ai/docs)**
-> — installation, authentication, first run, the CLI reference, supported
+> — installation, first run, the CLI reference, supported
 > languages, AI-assistant integration, false-positive handling, and more.
 
-> **Beta program:** This release is part of the Gadriel developer beta.
-> Sign up at [https://app.gadriel.ai/developers/](https://app.gadriel.ai/developers/)
-> to get your CLI token.
+> **No account required.** Install it and scan. On first run the CLI
+> registers this machine anonymously (free, unlimited) — there is no signup,
+> no token to paste, and no trial to expire. Signing in is optional and only
+> needed to attach a scan to a team account.
 
 > **Platform support:** Linux x64/arm64 (glibc), macOS (Intel & Apple Silicon),
 > and Windows x64. The correct prebuilt binary is selected automatically at
@@ -49,21 +50,20 @@ npm `optionalDependencies`.
 ## Quick start
 
 ```bash
-# 1. Authenticate — paste a token from https://app.gadriel.ai/developers/tokens
-gadriel auth login
+# 1. Scan the current repo — no login, no token, no setup step.
+gadriel scan .
 
-# 2. Scaffold code-security in your repo
-#    Creates .security/, git hooks, MCP server config, and CLAUDE.md.
-#    Also syncs the OSV CVE database for the languages it detects, so
-#    your first scan has CVE detection ready (only downloads the
-#    ecosystems your repo uses — pass --skip-osv to defer).
-gadriel code init
+# 2. Open the HTML report
+open .security/reports/index.html
+```
 
-# 3. Scan the current repo
-gadriel code scan .
+Optionally scaffold the repo integration — `.security/`, git hooks, MCP
+server config, and `CLAUDE.md`. This also syncs the OSV CVE database for the
+ecosystems it detects, so later scans have CVE detection ready (pass
+`--skip-osv` to defer):
 
-# 4. Open the HTML report
-open .security/reports/index.html
+```bash
+gadriel init
 ```
 
 > **New in 1.1.5 — Multi-language SAST false-positive remediation (31-repo audit):**
@@ -116,8 +116,8 @@ open .security/reports/index.html
 >   variadic-forwarder gates, web-framework-import gating for request-only
 >   rules, argument-shape narrowing, test/fuzz-path down-ranking, and
 >   protocol-mandated weak-crypto suppression via C/C++ caller-context.
-> - **Offline recovery hints** now point at `PREFLIGHT_OFFLINE=1` (the env var
->   that actually works) instead of a non-existent `--offline` flag.
+> - **Offline recovery hints** now point at `PREFLIGHT_OFFLINE=1`. (A `--offline`
+>   flag on `gadriel scan` also exists in current releases.)
 >
 > **🎉 1.0.0 — General Availability.** The first stable release of the
 > Gadriel code-security CLI. Highlights across the suite:
@@ -172,7 +172,7 @@ open .security/reports/index.html
 > setups. (If you skip it, the first scan still auto-syncs on demand.)
 
 > **Manual OSV sync** is still available any time:
-> `gadriel code policies --osv`
+> `gadriel policies --osv`
 
 ## Getting started (full guide)
 
@@ -182,22 +182,51 @@ Full onboarding guide: [https://gadriel.ai/docs](https://gadriel.ai/docs)
 
 | Command | What it does |
 |---|---|
-| `gadriel auth login` | Authenticate with your portal token |
-| `gadriel auth status` | Show current token name, expiry, and scopes |
-| `gadriel code init` | Scaffold `.security/`, git hooks, MCP server, `CLAUDE.md` |
-| `gadriel code scan` | Run SAST + SCA + secrets + config + container + API scans |
-| `gadriel code policies --osv` | Sync the OSV CVE vulnerability database (required once) |
-| `gadriel code watch` | Watch files and scan on save (Layer-1 fast path) |
-| `gadriel code findings` | Read findings from `.security/findings.json` |
-| `gadriel code fix <id>` | Confirm, dismiss, or hand a finding to an AI agent |
-| `gadriel code sbom` | Export an SBOM (SPDX 2.3 + CycloneDX 1.5) |
-| `gadriel code report` | Compliance reports + static HTML bundle + executive PDF |
-| `gadriel code dashboard` | Local web dashboard (binds `127.0.0.1`) |
-| `gadriel code mcp` | Start the MCP server for Claude Code / IDE integrations |
-| `gadriel code doctor --platform <p>` | Integration parity manifest for an AI-assistant platform |
+| `gadriel scan` | Run SAST + SCA + secrets + config + container + API scans |
+| `gadriel init` | Scaffold `.security/`, git hooks, MCP server, `CLAUDE.md` |
+| `gadriel findings` | Read findings from `.security/findings.json` |
+| `gadriel fix <id>` | Confirm, dismiss, or hand a finding to an AI agent |
+| `gadriel policies --osv` | Sync the OSV CVE vulnerability database (optional; enables CVE detection) |
+| `gadriel watch` | Watch files and scan on save (Layer-1 fast path) |
+| `gadriel sbom` | Export an SBOM (SPDX 2.3 + CycloneDX 1.5) |
+| `gadriel report` | Compliance reports + static HTML bundle + executive PDF |
+| `gadriel verdict` | Aggregated go / no-go readiness verdict |
+| `gadriel mcp` | Start the MCP server for Claude Code / IDE integrations |
+| `gadriel doctor` | Diagnose configuration issues |
+| `gadriel auth status` | Show this machine's credential (anonymous by default) |
+| `gadriel auth login --token <t>` | *Optional* — attach this machine to a team account |
 
 Output formats: `--format table|json|html|ocsf`.
 
+A global `--json` works on every command that has a machine-readable mode
+(`findings`, `verdict`, `skills list`, `store list`, `store status`,
+`learn status`, `doctor`, `policies`, `config scoring`) and overrides that
+command's own `--format`, so CI can pipe any of them without knowing which
+flag each one takes:
+
+```bash
+gadriel findings --json | jq '.findings[] | select(.severity == "high")'
+gadriel verdict  --json | jq -r '.verdict'
+```
+
+`--quiet` is a separate mode and does not imply JSON. `gadriel sbom --format`
+is unaffected — there `--format` selects the SBOM *standard* (SPDX vs
+CycloneDX), not the encoding.
+
+### Re-running `init`
+
+`init` refuses to overwrite an initialised repo unless you say how:
+
+| Flag | Effect |
+|------|--------|
+| `--upgrade` | Merge new settings and templates. **Scan data is preserved** — `findings.json`, `pillar-scores.json` and `metrics/` are left alone. |
+| `--add-missing` | Only add files that are absent; touch nothing that exists. |
+| `--force` | Overwrite everything, **including scan results**. Use after a partial or corrupted install. |
+
+> The older `gadriel code <verb>` spelling (e.g. `gadriel code scan`) still
+> works as a hidden alias, so existing hooks and CI pipelines keep running,
+> but the top-level verbs above are the current form.
+
 ## Scan flags
 
 | Flag | Default | Description |
@@ -212,7 +241,7 @@ Output formats: `--format table|json|html|ocsf`.
 
 ## Claude Code integration
 
-After `gadriel code init`, open Claude Code in your project directory:
+After `gadriel init`, open Claude Code in your project directory:
 
 ```bash
 claude
@@ -234,12 +263,11 @@ Slash commands available:
 | `0` | Clean — no gate tripped |
 | `1` | Security gate tripped (`--fail-on` threshold breached) |
 | `2` | Tooling error / crash |
-| `7` | Auth required — run `gadriel auth login` |
+| `7` | Licence/entitlement check failed (reserved) |
 
 ## Documentation & support
 
 - **Full docs: https://gadriel.ai/docs**
-- Getting started / CLI tokens: https://app.gadriel.ai/developers/
 - Support: https://gadriel.ai/docs
 
 ## License

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gadriel",
-  "version": "1.2.9",
+  "version": "1.4.0",
   "description": "Gadriel - Code-security CLI for AI-assisted development",
   "keywords": [
     "security",
@@ -17,7 +17,7 @@
     "url": "git+https://github.com/Gadriel-ai/preflight.git",
     "directory": "npm/gadriel"
   },
-  "license": "MIT",
+  "license": "UNLICENSED",
   "author": "Gadriel team",
   "type": "module",
   "bin": {
@@ -34,10 +34,10 @@
     "node": ">=18"
   },
   "optionalDependencies": {
-    "@gadriel/cli-linux-x64": "1.2.9",
-    "@gadriel/cli-linux-arm64": "1.2.9",
-    "@gadriel/cli-darwin-x64": "1.2.9",
-    "@gadriel/cli-darwin-arm64": "1.2.9",
-    "@gadriel/cli-win32-x64": "1.2.9"
+    "@gadriel/cli-linux-x64": "1.4.0",
+    "@gadriel/cli-linux-arm64": "1.4.0",
+    "@gadriel/cli-darwin-x64": "1.4.0",
+    "@gadriel/cli-darwin-arm64": "1.4.0",
+    "@gadriel/cli-win32-x64": "1.4.0"
   }
 }