cli-v4.8.0

Key Highlights

• Adds --github to print each finding as a GitHub Actions annotation on the causing line.
• Adds --list-rules to print every rule without scanning, as text or JSON.
• Extends install to accept devin and windsurf, and detects Replit Agent via .replit files.
• Improves install/update reliability by waiting on idle connections, preserving existing skills when offline, and verifying engine binaries against committed digests.
• Updates the bundled detector engine to 0.1.18 with hard offset shadow advisory and skill v4.8.0 accuracy fixes.

New Features

• GitHub Actions annotations via npx impeccable@latest detect --github src/.
• Rule listing with --list-rules in text or --json format.
• Installer support for devin and windsurf.
• Replit Agent detection when a project has a .replit file.
• Install/update waits on idle connections instead of a fixed 120-second timeout.
• Updates without network access keep existing installed skills.
• Engine binary verification against digests committed with the package.
• Bundled engine 0.1.18 with hard offset shadow advisory and detector accuracy fixes from skill v4.8.0.

Full Release Notes

- **GitHub Actions annotations.** `--github` prints each finding as an annotation on the line that caused it. Thanks to @mvanhorn.
<pre>`npx impeccable@latest detect --github src/`</pre>

- **The rule list.** `--list-rules` prints every rule without scanning, as text or `--json`.

- **Devin and Replit Agent.** `install` accepts `devin` and `windsurf`, and names Replit Agent when a project has a `.replit` file.

- **Steadier installs.** `install` and `update` wait on an idle connection instead of a fixed 120 seconds, and an update with no network keeps the skills you have. The engine binary is checked against digests committed with the package before it runs.

- **The current detector.** Engine 0.1.18 brings the hard offset shadow advisory and every accuracy fix in skill v4.8.0.

Related Repositories