Publish to npm registry

[ProduktEntdecker]

Overview

Publish PatchPilot to npm so users can install it with npm install -g patchpilot or use it with npx patchpilot.

Why

• Currently requires local path in Claude Code settings
• If folder is moved/deleted, configuration breaks
• npm publish enables: npx patchpilot (works everywhere)

Tasks

• Add proper package metadata (author, repository, homepage)
• Add keywords for npm search discoverability
• Create npm account or use existing
• Run npm publish
• Update README with npm install instructions
• Update Claude Code settings example to use npx patchpilot

After Publishing

Settings become portable:

{
  "hooks": {
    "PreToolUse": [{
      "matcher": "Bash",
      "hooks": [{
        "type": "command",
        "command": "npx patchpilot",
        "timeout": 10000
      }]
    }]
  }
}

Priority: P1

[coderabbitai]

📝 CodeRabbit Plan Mode

Generate an implementation plan and prompts that you can use with your favorite coding agent.

✅ Successfully generated implementation plan.

💡 Use @coderabbitai <feedback> to replan

Examples

• Example 1
• Example 2

---

🔗 Similar Issues

Related Issues

• Command parser for npm/pip/brew install #2

👤 Suggested Assignees

• ProduktEntdecker

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[coderabbitai]

Coding Plan

Approach

Publish PatchPilot to the npm registry to enable installation via npm install -g patchpilot or usage with npx patchpilot, eliminating the need for local path configuration in Claude Code settings.

Observations

PatchPilot is a TypeScript-based CLI security scanner (v0.2.0) designed as a Claude Code pre-execution hook. The package.json is already configured with a bin entry pointing to dist/index.js, ES module support, and build scripts for TypeScript compilation. The entry point (src/index.ts) has the proper shebang line, and the tool reads JSON from stdin to analyze package manager commands for vulnerabilities. Documentation exists in README.md with Claude Code integration examples, though it currently references local configuration.

Assumptions

Assumption 1: Repository and Author Information

Options Considered:

• Use placeholder values and update later
• Require developer to provide values before proceeding

Chosen Option: 2

Rationale: Implementation plan will specify where developer input is needed, as publishing with accurate metadata is better than publishing with placeholders that need correction.

Assumption 2: Package Version Strategy

Options Considered:

• Keep version at 0.2.0 for initial npm publish
• Bump to 1.0.0 to indicate first public release

Chosen Option: 1

Rationale: The ticket doesn't specify changing the version, and 0.2.0 appropriately signals ongoing development. Version bumping can follow semantic versioning conventions in future releases.

💡 User Tips

Regenerate the plan with different choices with @coderabbitai <feedback>.

Implementation Steps

Phase 1: Package Configuration

Prepare package.json with all necessary metadata and configuration for npm publishing, following npm best practices for discoverability and proper distribution control.

Task 1: Add Package Metadata

Update package.json to include required and recommended metadata fields for npm registry publishing:

• Populate the author field with maintainer name and email (developer to provide actual value)
• Add description field with concise package summary: "Security scanner for Claude Code that checks npm, pip, and brew packages for vulnerabilities before installation"
• Add repository object with type: "git" and url pointing to the source repository (developer to provide actual repository URL)
• Add bugs field with URL to issue tracker
• Add homepage field pointing to repository or project documentation
• Add keywords array for npm search discoverability: ["security", "vulnerability", "scanner", "claude-code", "osv", "npm", "pip", "brew", "package-manager", "cli"]
• Add files array specifying which files to include in distribution: ["dist/**/*", "README.md", "LICENSE"] to exclude source files and dev tooling
• Add engines field specifying minimum Node.js version (recommend "node": ">=18.0.0" based on modern TypeScript/ES modules usage)

Task 2: Add Pre-Publish Automation

Add npm script to ensure package is properly built before publishing:

• Add prepublishOnly script to package.json scripts: "prepublishOnly": "npm run build" to automatically compile TypeScript before publishing
• This ensures dist/ directory is always up-to-date when publishing to npm

🤖 Prompt for AI agents

Configure package.json for npm publishing with proper metadata and automation.

Update package.json to add:
- `author` field with maintainer information
- `description`: "Security scanner for Claude Code that checks npm, pip, and
brew packages for vulnerabilities before installation"
- `repository` object with type and URL
- `bugs` field with issue tracker URL
- `homepage` field
- `keywords` array: ["security", "vulnerability", "scanner", "claude-code",
"osv", "npm", "pip", "brew", "package-manager", "cli"]
- `files` array: ["dist/**/*", "README.md", "LICENSE"]
- `engines` field with "node": ">=18.0.0"
- `prepublishOnly` script: "npm run build" in the scripts section

Phase 2: Publishing & Documentation

Execute the npm publish workflow and update documentation to reflect the new installation methods, making the tool accessible via npm registry.

Task 1: Verify Package Readiness

Perform dry-run verification before actual publishing:

• Run npm pack to generate a tarball and verify which files will be included in the published package
• Inspect the generated .tgz file contents to confirm only intended files (dist/, README.md, LICENSE, package.json) are included
• Verify that the package size is reasonable (should be small since only compiled JavaScript is included)
• Delete the .tgz file after verification

Task 2: Publish to npm Registry

Execute the npm publish command to make the package available on the registry:

• Ensure developer is logged in to npm (npm login) using existing account or newly created account
• Run npm publish from the project root (prepublishOnly script will automatically build first)
• Verify successful publish by visiting the package page on npmjs.com
• Test installation with npm install -g patchpilot and npx patchpilot --help to confirm availability

Task 3: Update Installation Documentation

Revise README.md to reflect npm-based installation and remove local path dependencies:

• Update the installation section in README.md to replace local path instructions with npm installation methods
• Add installation options: npm install -g patchpilot for global installation or note that npx patchpilot works without installation
• Update the Claude Code settings example to use npx patchpilot instead of any local path reference (matching the "After Publishing" settings JSON from the ticket)
• Add a brief note that npx will automatically fetch the latest version from npm, ensuring users always have up-to-date security scanning
• Keep the workflow diagram and "What it protects" sections unchanged as they remain accurate

🤖 Prompt for AI agents

Publish the package to npm and update documentation for npm-based installation.

Manual steps (not codegen):
- Run `npm pack` to verify package contents
- Run `npm publish` to publish to npm registry
- Verify installation with `npm install -g patchpilot` and `npx patchpilot
--help`

Update README.md:
- Replace installation section to use npm methods: `npm install -g patchpilot`
or `npx patchpilot`
- Update Claude Code settings example to use `npx patchpilot` instead of local
path reference
- Add note that npx automatically fetches the latest version from npm
- Keep workflow diagram and "What it protects" sections unchanged

---

🚀 Next Steps

🤖 All AI agent prompts combined

Task: 1

Configure package.json for npm publishing with proper metadata and automation.

Update package.json to add:
- `author` field with maintainer information
- `description`: "Security scanner for Claude Code that checks npm, pip, and
brew packages for vulnerabilities before installation"
- `repository` object with type and URL
- `bugs` field with issue tracker URL
- `homepage` field
- `keywords` array: ["security", "vulnerability", "scanner", "claude-code",
"osv", "npm", "pip", "brew", "package-manager", "cli"]
- `files` array: ["dist/**/*", "README.md", "LICENSE"]
- `engines` field with "node": ">=18.0.0"
- `prepublishOnly` script: "npm run build" in the scripts section
===============================================================================

Task: 2

Publish the package to npm and update documentation for npm-based installation.

Manual steps (not codegen):
- Run `npm pack` to verify package contents
- Run `npm publish` to publish to npm registry
- Verify installation with `npm install -g patchpilot` and `npx patchpilot
--help`

Update README.md:
- Replace installation section to use npm methods: `npm install -g patchpilot`
or `npx patchpilot`
- Update Claude Code settings example to use `npx patchpilot` instead of local
path reference
- Add note that npx automatically fetches the latest version from npm
- Keep workflow diagram and "What it protects" sections unchanged

💡 Iterate on the plan with: @coderabbitai <feedback>

Example Feedback
- @coderabbitai You can skip phase 3. Add a simple unit test case for phase 2.
- @coderabbitai For assumption 1 go ahead with option 3 and replan.

---

💬 Have feedback or questions? Drop into our discord!