githits 0.13.0 → 0.14.0

package/dist/shared/{chunk-a4ta089j.js → chunk-6n137tvc.js}

@@ -1 +1 @@
-import{loadAutoLoginAuthSessionMetadata2,clearAutoLoginAuthSessionMetadata2,createAuthCommandDependencies2,createLogoutCommandDependencies2,createAuthStatusDependencies2,createContainer2}from"./chunk-wzqb1a28.js";export{clearAutoLoginAuthSessionMetadata2 as clearAutoLoginAuthSessionMetadata,createAuthCommandDependencies2 as createAuthCommandDependencies,createAuthStatusDependencies2 as createAuthStatusDependencies,createContainer2 as createContainer,createLogoutCommandDependencies2 as createLogoutCommandDependencies,loadAutoLoginAuthSessionMetadata2 as loadAutoLoginAuthSessionMetadata};
+import{loadAutoLoginAuthSessionMetadata2,clearAutoLoginAuthSessionMetadata2,createAuthCommandDependencies2,createLogoutCommandDependencies2,createAuthStatusDependencies2,createContainer2}from"./chunk-38y7cewx.js";export{clearAutoLoginAuthSessionMetadata2 as clearAutoLoginAuthSessionMetadata,createAuthCommandDependencies2 as createAuthCommandDependencies,createAuthStatusDependencies2 as createAuthStatusDependencies,createContainer2 as createContainer,createLogoutCommandDependencies2 as createLogoutCommandDependencies,loadAutoLoginAuthSessionMetadata2 as loadAutoLoginAuthSessionMetadata};

package/dist/shared/{chunk-pxb26at5.js → chunk-p501y1h6.js}

@@ -1,2 +1,2 @@
-var description="The code context layer for AI coding agents";var version2="0.13.0";
+var description="The code context layer for AI coding agents";var version2="0.14.0";
 export{description,version2};

package/gemini-extension.json

@@ -1,6 +1,6 @@
 {
   "name": "githits",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "The code context layer for AI coding agents",
   "mcpServers": {
     "githits": {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "githits",
   "description": "The code context layer for AI coding agents",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "mcpName": "com.githits/githits",
   "type": "module",
   "workspaces": [

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "githits",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "The code context layer for AI coding agents",
   "author": {
     "name": "GitHits"

package/server.json

@@ -16,7 +16,7 @@
     "source": "github",
     "id": "1165453165"
   },
-  "version": "0.13.0",
+  "version": "0.14.0",
   "remotes": [
     {
       "type": "streamable-http",
@@ -28,7 +28,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "githits",
-      "version": "0.13.0",
+      "version": "0.14.0",
       "runtimeHint": "npx",
       "transport": {
         "type": "stdio"

package/skills/githits-code/references/code-and-docs.md

@@ -6,6 +6,8 @@ Package target syntax requires an explicit registry: `registry:name[@version]`,
 
 `githits search "<query>" --in <target>` searches indexed dependency code, docs, symbols, and exact standalone documentation sites. Repeat `--in` for multiple targets. Use `--source code`, `--source docs`, or `--source symbol` to force a source; omit it for auto-routing. For a standalone site, pass `--source docs --in site:<host[/path]>`.
 
+Search text shows producer-proven matched source and structural documentation previews. Path-only matches render as compact file headers; they do not prove a source-content match. Follow the emitted read locator when source context is needed. JSON preserves compatibility evidence and adds indexed-field provenance, matched source, and documentation previews.
+
 Useful filters: `--kind`, `--category`, `--path-prefix`, `--intent`, `--public`, `--name`, `--lang`, `--limit`, `--offset`, `--wait`, `--allow-partial`, `--json`.
 
 If search returns a `searchRef`, continue with `githits search-status <searchRef> [--wait <seconds>]` only when the output explicitly supplies that follow-up, including for active `PENDING`, `INDEXING`, or `SEARCHING` progress or a completed result with an evidence notice. The bounded wait defaults to 20 seconds, and the explicit value must be an integer from 0 to 60. Terminal `DEFERRED`, `TIMEOUT`, or `FAILED` progress, and unrecognized statuses, do not advance: keep any disclosed evidence, do not poll the same reference, and follow the rendered new-search action.

package/skills/githits-package/SKILL.md

@@ -32,6 +32,7 @@ githits pkg info npm:express --verbose --json
 githits pkg vulns npm:lodash@4.17.20 --severity high
 githits pkg vulns npm:lodash --scope all --include-withdrawn --json
 githits pkg vulns npm:lodash@4.17.21 --scope non_affecting
+githits pkg vulns npm:express@4.17.1 --transitive --scope all --json
 
 githits pkg deps npm:express
 githits pkg deps npm:express --lifecycle all
@@ -49,6 +50,7 @@ githits pkg upgrade-review --package npm:zod@4.3.6..4.4.3 --package npm:lint-sta
 
 - Need current package health: start with `githits pkg info <registry:name>`.
 - Need security status for a specific installed version: use `githits pkg vulns <registry:name@version>`.
+- Need vulnerabilities in resolved dependency versions: add `pkg vulns --transitive`; this opt-in adds graph-analysis cost and audits the resolved graph, not a local application lockfile.
 - Need historical advisories that do not affect the inspected version: use `pkg vulns --scope non_affecting`; use `--scope all` for affected plus historical rows.
 - Need dependency footprint: start with `pkg deps`; add `--lifecycle all` for non-runtime groups and `--depth <n>` for aggregate transitive graph data.
 - Need upgrade evidence for dependency updates, outdated package bumps, or lockfile changes: prefer `pkg upgrade-review` because it compares current vs target vulnerabilities, changelog range evidence, deprecation metadata, peer changes, dependency changes, and transitive security evidence by default. It reports facts only; you still own the final assessment.
@@ -57,7 +59,7 @@ githits pkg upgrade-review --package npm:zod@4.3.6..4.4.3 --package npm:lint-sta
 ## Gotchas
 
 - Vulnerability data is not available for `vcpkg` or `zig`.
-- Dependency graphs support npm, PyPI, Hex, Crates, Zig, vcpkg, RubyGems, Go, and Swift; NuGet/Maven/Packagist are not dependency-graph targets.
+- Dependency graphs support npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, Zig, vcpkg, RubyGems, Go, and Swift.
 - Go exact-version inputs accept either `v1.2.3` or `1.2.3` (including pseudo versions) and are sent in canonical `v`-prefixed form. Other changelog range inputs omit a leading `v`, except Swift release tags.
 - For repeatable `pkg upgrade-review --package` entries, use `<registry>:<name>@<current>..<target>`.
 - Prefer structured JSON for final comparisons; terminal text is optimized for human scanning.

package/skills/githits-package/references/package.md

@@ -11,7 +11,11 @@ Swift package targets use `swift:github.com/<owner>/<repo>`; Zig package targets
 
 `githits pkg vulns <registry:name[@version]>` lists known OSV/CVE advisories. Omit the version for latest.
 
-Flags: `--severity low|medium|high|critical`, `--scope affected|non_affecting|all`, `--include-withdrawn`, `--verbose`, `--json`.
+Flags: `--severity low|medium|high|critical`, `--scope affected|non_affecting|all`, `--include-withdrawn`, `--transitive`, `--verbose`, `--json`.
+
+Direct-only is the default. `--transitive` adds vulnerability evidence for versions in the resolved dependency graph, at additional graph-analysis cost; it does not inspect a local application lockfile. `--severity` and `--scope` apply to root and dependency rows. `--include-withdrawn` affects direct rows only; transitive withdrawn advisories remain excluded. Use `--scope all` for affected plus historical dependency advisories, or `--scope non_affecting` for historical rows.
+
+CLI text shows every selected direct and transitive advisory row. `--verbose` adds aliases, dates, malicious-advisory markers, and complete range/fix evidence; `--json` retains structured advisory-wide affected ranges and fixed versions. Compact MCP text remains capped; use `verbose:true` for all selected rows.
 
 Supported registries: npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, RubyGems, Go, Swift. vcpkg and Zig are unsupported for vulnerability data.
 
@@ -21,6 +25,8 @@ Supported registries: npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, RubyGems,
 
 Flags: `--lifecycle runtime|development|build|peer|optional|all`, `--depth 1-10`, `--verbose`, `--json`.
 
+Supported dependency registries: npm, PyPI, Hex, Crates, NuGet, Maven, Packagist, RubyGems, Go, Swift, vcpkg, and Zig.
+
 Use `--depth` to request transitive output capped to that traversal depth. Omit it for direct dependencies only.
 
 ## Changelog
@@ -46,7 +52,7 @@ Use `pkg upgrade-review` for dependency update assessment instead of inferring s
 ## Command Name Mapping
 
 - `githits pkg info` maps to MCP `pkg_info`.
-- `githits pkg vulns` maps to MCP `pkg_vulns`.
+- `githits pkg vulns` maps to MCP `pkg_vulns`; CLI `--transitive` maps to `include_transitive:true`.
 - `githits pkg deps` maps to MCP `pkg_deps`.
 - `githits pkg changelog` maps to MCP `pkg_changelog`.
 - `githits pkg upgrade-review` maps to MCP `pkg_upgrade_review`.