
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
@n-dx/graview
Advanced tools
Projects an n-dx project (PRD tree, code analysis, agent runs) into a Graview declaration document and seed snapshot, and drives the graview CLI on them
Projects an n-dx project into Graview: a typed context
graph of the product layer (areas, capabilities, constraints), the change
layer (changes, tasks, releases), the code (zones, components) and the work
(agent runs, commits), declared once in n-dx.graview.json and filled from
the rex tree, sourcevision's output and hench's run records.
ndx graview emit . # writes document.json and snapshot.json under the layout's graview dir
ndx graview check . # graview check on the emitted declaration
ndx graview describe . # a text readout of the graph, or one place with --place <slug>
ndx graview serve . # graview serve: the store over HTTP and its live WebSocket wire, for a Graview face to connect to
ndx graview mcp . # graview mcp --read-only: search_graph, get_node, describe_place, …
ndx graview info . # where the projection lands, which binary, and the hub's rex endpoint a face writes back through
Nothing here depends on @graview/*. The graview binary is resolved from
graview.bin in the project config, NDX_GRAVIEW_BIN, PATH, the installed
@n-dx/graview-face's own graview (it pins the same release), then
npx -y graview@0.1.20. Install it once with npm i -g graview to skip the
npx round-trip.
Config keys (.ndx/config.json or .n-dx.json):
| Key | Meaning |
|---|---|
graview.bin | Path to the graview binary or its cli.js; a .js path runs under the current Node |
graview.includeFiles | Project file nodes (default true); false leaves them out, the same as --no-files |
graview.proposeProductLayer | On a v1 tree, draw the areas, capabilities and constraints rex's migration plan proposes, each marked proposed (default true); false projects the tree as changes only |
graview.mainRef | The branch commits, landings and releases are read from (main, upstream/main). Unset, rex's default: the first of origin/HEAD, origin/main, main that resolves |
graview.app | Retired, and now only warned about. The product face is the graview-face extension: install @n-dx/graview-face (or list a checkout under extensions.paths in <ndx home>/config.json) and run ndx extensions enable graview-face. ndx graview serve then runs it on the fresh projection with NDX_GRAVIEW_DIR pointing at the files |
FAQs
Projects an n-dx project (PRD tree, code analysis, agent runs) into a Graview declaration document and seed snapshot, and drives the graview CLI on them
The npm package @n-dx/graview receives a total of 212 weekly downloads. As such, @n-dx/graview popularity was classified as not popular.
We found that @n-dx/graview demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.