← All breaking-change reports

Mendapi 0.5.4: twelve fixes to the first minute of a CLI

mendapi · release · 2026-08-03 · upstream source

What changed

Version 0.5.4 is a first-run polish release: twelve fixes to the experience a new user hits in their first minute with the CLI. No new detection rules or migration packs — every change targets the gap between "installed it" and "trusted it".

From the release notes:

First-run polish release: twelve fixes to the experience a new user hits in their first minute with the CLI.

CLI conventions

  • mendapi --version now exists. It reads the installed version, single-sourced from package.json — there is no hand-maintained version string anywhere in the codebase.
  • Subcommand --help exits 0 instead of a usage-error code, matching CLI convention. Agents and CI wrappers that treat a non-zero exit as failure no longer misread a help request as an error.
  • Help text is written to stdout, not stderr, so mendapi fix --help | grep apply works the way a pipe should.
  • mendapi sync --help prints usage offline instead of triggering a network fetch. Asking for help is never a network event.

Output quality

  • Suppressed the node:sqlite ExperimentalWarning that every subcommand emitted on stderr. This also stops the warning from polluting MCP stdio logs when the server runs inside an agent.
  • mendapi scan caps the terminal report at 25 impacts with an honest "N more not shown" line. High-confidence findings are always shown; --json and --out output stays complete.

Environment and paths

  • engines and the docs now state the real minimum, Node 22.13 (node:sqlite is flagged below that). On older runtimes the CLI fails loud with a readable message instead of throwing ERR_UNKNOWN_BUILTIN_MODULE.
  • The change database resolves to ./.mendapi/sentinel.db and survives reinstalls. A MENDAPI_DB env override is supported.
  • --out-dir defaults to cwd/.mendapi, so dry-run patches and reports land in a predictable place.

MCP

  • serverInfo.version is read from package.json, so the MCP server never reports a stale version.
  • MCP tool list drift fixed in --help, the CLI summary, and the README — revalidate was missing from all three.

Known issue shipped with 0.5.4

Honest note: 0.5.4 ships with one bug we found right after cutting the release. mendapi scan -h is not normalized to --help before the subcommand runs, so instead of printing usage it performs a real scan of the current directory. It is harmless — exit 0, no network, no writes — but it is not what you asked for. Use mendapi scan --help until 0.5.5 lands with the fix.

Try it

npx [email protected] --help

Then scan a repo — file and line number, no code leaving your machine:

npx mendapi scan --repo .

Related

Change data is recorded from upstream provider releases, changelogs and OpenAPI spec diffs; every article names its source.