@memi-design/cli
Advanced tools
@memi-design/cli - npm Package Compare versions
| # Dependency trust ledger | ||
| This ledger explains why the published CLI installs each direct runtime | ||
| dependency. It is a review aid, not a claim that a dependency is risk-free. | ||
| The base CLI is intentionally read-only by default, but it still needs local | ||
| filesystem, subprocess, archive, and network capabilities for explicit user | ||
| commands. | ||
| ## Review record | ||
| - Reviewed: 2026-08-02 | ||
| - Package: `@memi-design/cli` 2.7.5 source baseline | ||
| - Known-vulnerability check: `npm audit --omit=dev --audit-level=high` | ||
| - Baseline result: zero known production vulnerabilities | ||
| - Artifact evidence: captured by `npm run pack:dry-run` at every release gate | ||
| `npm audit` and third-party supply-chain services answer different questions. | ||
| A clean audit does not remove the need to inspect dynamic loading, subprocess, | ||
| or network behavior. Conversely, a capability warning is not by itself a | ||
| confirmed vulnerability. | ||
| ## Base CLI dependencies | ||
| | Dependency | Execution boundary | Why it is installed | | ||
| | --- | --- | --- | | ||
| | `commander` | CLI parsing | Stable command and help surface. | | ||
| | `zod` | Input and artifact validation | Validates untrusted configuration and structured output. | | ||
| | `effect` | Core execution paths | Typed effect and error-handling primitives used by the engine. | | ||
| | `chalk`, `ora` | Terminal interaction | Human-readable, non-machine CLI output. | | ||
| | `pino`, `pino-pretty` | Logging | `pino-pretty` is dynamically selected only for local, non-test logging. | | ||
| | `@chenglou/pretext` | Interface analysis | Text layout measurement. | | ||
| | `cross-spawn` | Local subprocesses | Cross-platform, argument-safe command execution. | | ||
| | `tar` | Archive handling | Reads and validates release/archive inputs. | | ||
| | `ws`, `@modelcontextprotocol/sdk` | MCP | Local MCP stdio/WebSocket capability when explicitly started. | | ||
| ## Deferred feature dependencies | ||
| | Dependency | Loaded by | Future separation criterion | | ||
| | --- | --- | --- | | ||
| | `@anthropic-ai/sdk` | Anthropic AI provider | Move to an optional provider adapter without weakening no-key workflows. | | ||
| | `xlsx-populate`, `ssf` | Excel research import | Move to an optional spreadsheet adapter while preserving CSV-only use with no extra install. | | ||
| ## Deliberately removed from the CLI runtime | ||
| `react` was a direct dependency even though the CLI only writes React imports | ||
| into generated consumer-project source. The package does not import React at | ||
| runtime, so consumers—not the audit CLI—own the React version and installation. | ||
| ## Alert handling policy | ||
| Socket-style alerts for filesystem access, shell access, environment reads, URL | ||
| strings, or network access must be triaged to a direct source location and an | ||
| explicit command path. The release gate should block on known high/critical | ||
| vulnerabilities or an unexplained capability—not on a blanket attempt to make a | ||
| local developer tool appear capability-free. | ||
| Before each release, run: | ||
| ```bash | ||
| npm audit --omit=dev --audit-level=high | ||
| npm run pack:dry-run | ||
| ``` | ||
| Review this ledger whenever a direct runtime dependency changes. |
+1
-1
@@ -73,3 +73,3 @@ # memi — @memi-design/cli | ||
| GitHub Action: `uses: memi-design/memi@v2` with `version: "2.7.5"`. | ||
| GitHub Action: `uses: memi-design/memi@v2` with `version: "2.7.6"`. | ||
@@ -76,0 +76,0 @@ ## Dependency graph |
@@ -5,3 +5,3 @@ { | ||
| "display_name": "memi", | ||
| "version": "2.7.5", | ||
| "version": "2.7.6", | ||
| "description": "Memi is the read-only design engineering audit and skill layer for coding agents.", | ||
@@ -8,0 +8,0 @@ "long_description": "memi gives MCP-compatible agents design-system memory and interface-quality tools. It exposes Apple-platform briefs, approval-gated SwiftUI scaffolds, UI audits, Tailwind tokens, shadcn registry workflows, Figma context, design docs, and implementation diagnostics through the @memi-design/cli npm package.", |
@@ -6,3 +6,3 @@ const { spawn } = require("node:child_process"); | ||
| "-y", | ||
| "@memi-design/cli@2.7.5", | ||
| "@memi-design/cli@2.7.6", | ||
| "mcp", "start", "--no-figma", | ||
@@ -9,0 +9,0 @@ ]; |
+14
-17
| { | ||
| "name": "@memi-design/cli", | ||
| "version": "2.7.5", | ||
| "version": "2.7.6", | ||
| "mcpName": "io.github.sarveshsea/memi", | ||
| "description": "Memi is the read-only design engineering audit and skill layer for coding agents.", | ||
| "description": "Read-only design engineering audit and skill layer for coding agents: file-anchored UI evidence before merge.", | ||
| "type": "module", | ||
@@ -29,3 +29,3 @@ "main": "dist/index.js", | ||
| "build:codex-plugin-assets": "node scripts/generate-codex-plugin-assets.mjs", | ||
| "build:mcpb": "mkdir -p .dist && npx -y @anthropic-ai/mcpb@latest validate mcpb/manifest.json && npx -y @anthropic-ai/mcpb@latest pack mcpb .dist/memi-2.7.5.mcpb", | ||
| "build:mcpb": "mkdir -p .dist && npx -y @anthropic-ai/mcpb@latest validate mcpb/manifest.json && npx -y @anthropic-ai/mcpb@latest pack mcpb .dist/memi-2.7.6.mcpb", | ||
| "bench:cli": "node scripts/bench-cli.mjs", | ||
@@ -58,3 +58,3 @@ "growth:status": "node scripts/growth-status.mjs", | ||
| "check:public-release": "node scripts/check-public-release-gate.mjs", | ||
| "publish:smithery": "npm run build:mcpb && npx -y smithery@latest mcp publish .dist/memi-2.7.5.mcpb -n sarveshsea/memi", | ||
| "publish:smithery": "npm run build:mcpb && npx -y smithery@latest mcp publish .dist/memi-2.7.6.mcpb -n sarveshsea/memi", | ||
| "security:audit": "npm audit --omit=dev --audit-level=high", | ||
@@ -79,20 +79,17 @@ "validate:presets": "node scripts/build-presets.mjs", | ||
| "keywords": [ | ||
| "design-ci", | ||
| "ui-audit", | ||
| "accessibility", | ||
| "design-system", | ||
| "design-tokens", | ||
| "tailwindcss", | ||
| "shadcn", | ||
| "shadcn-registry", | ||
| "figma-to-code", | ||
| "design-tokens", | ||
| "tailwind-audit", | ||
| "ux-audit", | ||
| "user-research", | ||
| "mcp-server", | ||
| "agent-skills", | ||
| "coding-agents", | ||
| "github-actions", | ||
| "codex-plugin", | ||
| "hermes", | ||
| "interface-understanding", | ||
| "design-engineering", | ||
| "design-sandbox", | ||
| "claude-code", | ||
| "ai-design-tools", | ||
| "component-generator", | ||
| "ui-audit" | ||
| "figma-to-code" | ||
| ], | ||
@@ -116,2 +113,3 @@ "engines": { | ||
| "docs/PROOF.md", | ||
| "docs/DEPENDENCY_TRUST.md", | ||
| "docs/case-studies/memi-2.7-six-repo/README.md", | ||
@@ -142,3 +140,2 @@ "docs/case-studies/memi-2.7-six-repo/results.json", | ||
| "pino-pretty": "^13.0.0", | ||
| "react": "^18.3.1", | ||
| "ssf": "^0.11.2", | ||
@@ -145,0 +142,0 @@ "tar": "7.5.22", |
+60
-14
| <p align="center"> | ||
| <img src="assets/readme-hero.svg" alt="Memi reads an interface, records a file-anchored finding, and verifies the rerun without writing source files." width="100%" /> | ||
| <img src="https://raw.githubusercontent.com/memi-design/memi/main/assets/memi-brand-banner.png" alt="Memi — the design layer for agentic AI." width="100%" /> | ||
| </p> | ||
@@ -15,5 +15,5 @@ | ||
| **Read-only design engineering for coding agents.** | ||
| **Design CI for coding agents.** | ||
| Memi is the **read-only design engineering audit and skill layer for coding agents**. It gives Codex, Claude Code, Cursor, Grok Build, and MCP clients file-anchored interface evidence before they edit UI. | ||
| Memi is the **read-only design engineering audit and skill layer for coding agents**. It gives Codex, Claude Code, Cursor, Grok Build, and MCP clients file-anchored UI evidence before merge. | ||
@@ -24,3 +24,3 @@ The first pass reads the product you already have, identifies accessibility, hierarchy, state, responsive, motion, and token risks, then reruns the same deterministic check after a scoped fix. Your code remains the source of truth. | ||
| [npm](https://www.npmjs.com/package/@memi-design/cli) · [memoire.cv](https://memoire.cv) · [current versions](docs/CURRENT_RELEASE.md) · [MCP Registry](https://registry.modelcontextprotocol.io) · [Agent Skills](https://skills.sh/memi-design/memi) | ||
| [npm](https://www.npmjs.com/package/@memi-design/cli) · [memoire.cv](https://memoire.cv) · [current versions](https://github.com/memi-design/memi/blob/main/docs/CURRENT_RELEASE.md) · [MCP Registry](https://registry.modelcontextprotocol.io) · [Agent Skills](https://skills.sh/memi-design/memi) | ||
@@ -56,2 +56,35 @@ ## Quickstart | ||
| ## Evidence at a glance | ||
| These are the measured results currently available in the [V15 confirmatory audit](https://github.com/memi-design/memi/tree/main/docs/research/memi-2.7-prospective-study/v15-2.7.3-confirmatory). They describe that study; they are not estimates for your repository. | ||
| | Measured record | What it means | Boundary | | ||
| | --- | --- | --- | | ||
| | **36 / 36** frozen execution receipts admitted | Every preregistered agent cell had an auditable receipt | Receipt admission, not universal performance | | ||
| | **10 complete model-graded matched pairs** | Rendered design-quality comparisons survived the prespecified screen | Model-graded evidence, not independent practitioner review | | ||
| | **0** model calls required in deterministic CI enforcement | The pull-request gate can rerun file-anchored checks without an LLM | This describes the CI path, not every optional workflow | | ||
| The full study also reports exclusions, failures, and limits. **No superiority, speed, or dollar-savings claim is made.** | ||
| **Separate historical release record:** the 2.7 candidate record reported **2,187 / 2,187** tests passed. It is release evidence, not part of V15 and not proof that every project benefits. | ||
| ## Benchmarks and paper | ||
| <p align="center"> | ||
| <a href="https://github.com/memi-design/memi/releases/download/v2.7.4/memi-2.7.3-confirmatory-audit.pdf"> | ||
| <img src="https://raw.githubusercontent.com/memi-design/memi/main/assets/readme-benchmark.svg" alt="V15 benchmark preview. Blinded quality non-inferiority passed for the scoped Buzzr and Paraform tasks, while 0 of 21 corrected resource tests rejected the null. The study does not establish general superiority, speed, or cost savings." width="100%" /> | ||
| </a> | ||
| </p> | ||
| The graphic is a compact reading guide to the [public technical paper](https://github.com/memi-design/memi/releases/download/v2.7.4/memi-2.7.3-confirmatory-audit.pdf), not a leaderboard. The primary measure was a blinded, model-graded 100-point design-quality rubric. The preregistered question was narrow: could Memi stay within five points of its paired baseline on each renderable task? | ||
| | Benchmark result | Exact reading | | ||
| | --- | --- | | ||
| | Buzzr / Expo: mean **+1.4**, one-sided lower bound **+0.2** | Above the −5 non-inferiority margin; the scoped gate passed. | | ||
| | Paraform / web: mean **−0.4**, one-sided lower bound **−3.4** | Still above the −5 margin; the scoped gate passed. | | ||
| | Resource estimates: **0 / 21** task-by-resource estimates had a Holm-corrected test reject | No supported claim that Memi is faster, cheaper, or uses fewer tokens. | | ||
| | Nate / SwiftUI | Functional and resource receipts are retained, but there is no admitted visual-quality pair. | | ||
| **Benchmark contracts are separate from study results.** [InterfaceBench v1](https://github.com/memi-design/memi/blob/main/benchmarks/interfacebench-v1.json) specifies 100 target tasks with 5 pinned seed tasks; it is not an aggregate performance score. [DesignWorkBench v2](https://github.com/memi-design/memi/blob/main/docs/audits/memi-designworkbench-v2-readiness.md) holds 300 task contracts and still requires practitioner calibration before any certification claim. | ||
| ## What you get | ||
@@ -69,5 +102,17 @@ | ||
| ## Prompts that map to real workflows | ||
| After installing a skill, paste one of these into Codex, Claude Code, Cursor, or another compatible agent. | ||
| | Goal | Copy-paste prompt | Supporting workflow | | ||
| | --- | --- | --- | | ||
| | Establish a baseline before a UI change | **Audit this frontend before editing it.** Prioritize the five changes with the clearest `file:line` evidence. | `audit-frontend-design` and a read-only `memi diagnose` pass | | ||
| | Turn evidence into a small, consistent plan | **Turn the findings into a scoped UI change plan.** Reuse the existing tokens and components; do not edit until the plan is explicit. | `remember-design-system` context for a reviewed implementation plan | | ||
| | Protect a pull request from new interface debt | **Set up a deterministic design CI gate for this pull request.** Fail only on newly introduced interface debt and save SARIF plus the HTML report. | `enforce-design-ci` and the GitHub Action workflow | | ||
| The first three workflows are evidence, planning, and CI gates. Write-capable scaffolds and Figma actions remain explicit choices. | ||
| ## Research, stated plainly | ||
| The [V15 confirmatory audit](docs/research/memi-2.7-prospective-study/v15-2.7.3-confirmatory/README.md) is a reproducible release study, not a product claim page. | ||
| The [V15 confirmatory audit](https://github.com/memi-design/memi/blob/main/docs/research/memi-2.7-prospective-study/v15-2.7.3-confirmatory/README.md) is a reproducible release study, not a product claim page. | ||
@@ -79,7 +124,7 @@ | What the audit observed | What it does **not** establish | | ||
| | **Quality non-inferiority passed** for the two graded task families: Buzzr and Paraform | That every interface, platform, or task benefits | | ||
| | **0 corrected resource tests rejected**; billing records were not collected | Faster, cheaper, or dollar-saving operation | | ||
| | **0 / 26 secondary tests rejected after Holm correction**; billing records were not collected | Faster, cheaper, or dollar-saving operation | | ||
| **No superiority, speed, or dollar-savings claim is made.** The study reports exclusions without imputation and keeps functional, rendered-quality, and resource evidence separate. | ||
| Read the [conference-style audit PDF](docs/research/memi-2.7-prospective-study/v15-2.7.3-confirmatory/memi-2.7.3-confirmatory-audit.pdf), inspect the [protocol and receipts](docs/research/memi-2.7-prospective-study/v15-2.7.3-confirmatory/), or review the [V17 preregistration](docs/research/memi-2.7-prospective-study/v17-routing-quality/README.md) for the next routing-quality study. The complete [InterfaceBench contract](benchmarks/interfacebench-v1.json) and [DesignWorkBench v2 readiness report](docs/audits/memi-designworkbench-v2-readiness.md) remain separate from release evidence. | ||
| Read the [conference-style audit PDF](https://github.com/memi-design/memi/blob/main/docs/research/memi-2.7-prospective-study/v15-2.7.3-confirmatory/memi-2.7.3-confirmatory-audit.pdf), inspect the [protocol and receipts](https://github.com/memi-design/memi/tree/main/docs/research/memi-2.7-prospective-study/v15-2.7.3-confirmatory), or review the [V17 preregistration](https://github.com/memi-design/memi/blob/main/docs/research/memi-2.7-prospective-study/v17-routing-quality/README.md) for the next routing-quality study. The complete [InterfaceBench contract](https://github.com/memi-design/memi/blob/main/benchmarks/interfacebench-v1.json) and [DesignWorkBench v2 readiness report](https://github.com/memi-design/memi/blob/main/docs/audits/memi-designworkbench-v2-readiness.md) remain separate from release evidence. | ||
@@ -89,3 +134,3 @@ <details> | ||
| Memi InterfaceBench is a 100 target tasks specification with 5 pinned seed tasks; it is not a published performance score. The historical 2.7 candidate record reported 2,187/2,187 tests and 70.57% statements coverage. The greater-than-25% claim remains **not verified**. Memi DesignWorkBench v2 holds 300 task contracts and requires practitioner calibration before any certification claim. Inspect the [benchmark contract](benchmarks/interfacebench-v1.json) and [workflow evidence](docs/case-studies/memi-2.7-workflow-proof/results.json). | ||
| Memi InterfaceBench is a 100 target tasks specification with 5 pinned seed tasks; it is not a published performance score. The historical 2.7 candidate record reported 2,187/2,187 tests and 70.57% statements coverage. The greater-than-25% claim remains **not verified**. Memi DesignWorkBench v2 holds 300 task contracts and requires practitioner calibration before any certification claim. Inspect the [benchmark contract](https://github.com/memi-design/memi/blob/main/benchmarks/interfacebench-v1.json) and [workflow evidence](https://github.com/memi-design/memi/blob/main/docs/case-studies/memi-2.7-workflow-proof/results.json). | ||
@@ -144,3 +189,3 @@ </details> | ||
| [GitHub Action guide](docs/GITHUB_ACTION_MARKETPLACE.md) · [CI recipes](docs/CI_RECIPES.md) · [team rollout](docs/TEAM_ROLLOUT.md) | ||
| [GitHub Action guide](https://github.com/memi-design/memi/blob/main/docs/GITHUB_ACTION_MARKETPLACE.md) · [CI recipes](https://github.com/memi-design/memi/blob/main/docs/CI_RECIPES.md) · [team rollout](https://github.com/memi-design/memi/blob/main/docs/TEAM_ROLLOUT.md) | ||
@@ -173,10 +218,11 @@ ## Agent and MCP setup | ||
| [Agent stack guide](docs/AGENT_STACKS.md) · [copy-paste recipes](docs/AGENT_RECIPES.md) · [full skill router](skills/memoire-design-tooling/SKILL.md) | ||
| [Agent stack guide](docs/AGENT_STACKS.md) · [copy-paste recipes](https://github.com/memi-design/memi/blob/main/docs/AGENT_RECIPES.md) · [full skill router](skills/memoire-design-tooling/SKILL.md) | ||
| ## Trust and proof | ||
| - [Release gates](docs/RELEASE_GATES.md) — package, provenance, clean-install, MCP, plugin, binary, and public-surface checks. | ||
| - [Current release truth](docs/CURRENT_RELEASE.md) — one source for npm, GitHub, Action, Studio, and website versions. | ||
| - [Reproducible case studies](docs/case-studies/README.md) — pinned evidence, abstentions, and paired protocols. | ||
| - [Audit reports](docs/audits/) — timestamped findings, evidence gaps, score caps, and owners. | ||
| - [Release gates](https://github.com/memi-design/memi/blob/main/docs/RELEASE_GATES.md) — package, provenance, clean-install, MCP, plugin, binary, and public-surface checks. | ||
| - [Current release truth](https://github.com/memi-design/memi/blob/main/docs/CURRENT_RELEASE.md) — one source for npm, GitHub, Action, Studio, and website versions. | ||
| - [Reproducible case studies](https://github.com/memi-design/memi/tree/main/docs/case-studies) — pinned evidence, abstentions, and paired protocols. | ||
| - [Audit reports](https://github.com/memi-design/memi/tree/main/docs/audits) — timestamped findings, evidence gaps, score caps, and owners. | ||
| - [Dependency trust ledger](docs/DEPENDENCY_TRUST.md) — direct dependency purpose, dynamic boundaries, and review policy. | ||
| - [`llms.txt`](llms.txt) — compact machine-readable product map. | ||
@@ -183,0 +229,0 @@ |
+3
-3
@@ -6,3 +6,3 @@ { | ||
| "description": "Memi is the read-only design engineering audit and skill layer for coding agents.", | ||
| "version": "2.7.5", | ||
| "version": "2.7.6", | ||
| "websiteUrl": "https://memoire.cv", | ||
@@ -18,3 +18,3 @@ "repository": { | ||
| "identifier": "@memi-design/cli", | ||
| "version": "2.7.5", | ||
| "version": "2.7.6", | ||
| "transport": { | ||
@@ -42,5 +42,5 @@ "type": "stdio" | ||
| "tool": "memi-release", | ||
| "version": "2.7.5" | ||
| "version": "2.7.6" | ||
| } | ||
| } | ||
| } |
@@ -15,3 +15,3 @@ --- | ||
| ```bash | ||
| npx -y @memi-design/cli@2.7.5 diagnose . --json --no-write --fail-on none | ||
| npx -y @memi-design/cli@2.7.6 diagnose . --json --no-write --fail-on none | ||
| ``` | ||
@@ -22,4 +22,4 @@ | ||
| ```bash | ||
| npx -y @memi-design/cli@2.7.5 ux audit . --json --no-write | ||
| npx -y @memi-design/cli@2.7.5 craft audit . --json --no-write | ||
| npx -y @memi-design/cli@2.7.6 ux audit . --json --no-write | ||
| npx -y @memi-design/cli@2.7.6 craft audit . --json --no-write | ||
| ``` | ||
@@ -26,0 +26,0 @@ |
@@ -13,3 +13,3 @@ --- | ||
| ```bash | ||
| npx -y @memi-design/cli@2.7.5 ios brief --platform ios --intent "<task>" --detail compact --json | ||
| npx -y @memi-design/cli@2.7.6 ios brief --platform ios --intent "<task>" --detail compact --json | ||
| ``` | ||
@@ -24,3 +24,3 @@ | ||
| ```bash | ||
| npx -y @memi-design/cli@2.7.5 ios scaffold FeatureName \ | ||
| npx -y @memi-design/cli@2.7.6 ios scaffold FeatureName \ | ||
| --kind screen \ | ||
@@ -27,0 +27,0 @@ --module AppModule \ |
@@ -15,3 +15,3 @@ --- | ||
| ```bash | ||
| npx -y @memi-design/cli@2.7.5 init --team --kit universal --json | ||
| npx -y @memi-design/cli@2.7.6 init --team --kit universal --json | ||
| ``` | ||
@@ -24,3 +24,3 @@ | ||
| ```bash | ||
| npx -y @memi-design/cli@2.7.5 ci . --no-scope --report --json | ||
| npx -y @memi-design/cli@2.7.6 ci . --no-scope --report --json | ||
| ``` | ||
@@ -49,3 +49,3 @@ | ||
| with: | ||
| version: "2.7.5" | ||
| version: "2.7.6" | ||
| ``` | ||
@@ -52,0 +52,0 @@ |
@@ -27,3 +27,3 @@ --- | ||
| ```bash | ||
| npx -y @memi-design/cli@2.7.5 agent brief . --intent "<interface task>" --detail compact --json | ||
| npx -y @memi-design/cli@2.7.6 agent brief . --intent "<interface task>" --detail compact --json | ||
| ``` | ||
@@ -30,0 +30,0 @@ |
| { | ||
| "version": "2.7.5", | ||
| "version": "2.7.6", | ||
| "description": "Mémoire skill registry — defines available skills, activation contexts, and dependencies", | ||
@@ -4,0 +4,0 @@ "defaultSkill": "SUPERPOWER", |
@@ -15,3 +15,3 @@ --- | ||
| ```bash | ||
| npx -y @memi-design/cli@2.7.5 agent brief . --intent "<user's interface task>" --detail compact --json | ||
| npx -y @memi-design/cli@2.7.6 agent brief . --intent "<user's interface task>" --detail compact --json | ||
| ``` | ||
@@ -22,3 +22,3 @@ | ||
| ```bash | ||
| npx -y @memi-design/cli@2.7.5 tokens --from ./src --report --json | ||
| npx -y @memi-design/cli@2.7.6 tokens --from ./src --report --json | ||
| ``` | ||
@@ -25,0 +25,0 @@ |
New alerts
AI-detected potential code anomaly
Supply chain riskAI has identified unusual behaviors that may pose a security risk.
Fixed alerts
AI-detected potential code anomaly
Supply chain riskAI has identified unusual behaviors that may pose a security risk.
Improved metrics
- Total package byte prevSize
2003318
0.41%- Dependency count
19
-5%- Number of package files
48
2.13%- Number of lines in readme file
239
23.83%Dependency changes
- Removed
react@^18.3.1- Removed
js-tokens@4.0.0(transitive)- Removed
loose-envify@1.4.0(transitive)- Removed
react@18.3.1(transitive)