Emendant CLI is now available on npm

Emendant is now publicly available on npm. It is a local command line tool for TypeScript and JavaScript developers who need to know what a supported SDK upgrade will change in their own source before they install it.

A dependency update tells you which version changed. The work starts when that new version breaks a call site somewhere in your repository. Emendant reads the installed versions and the source, reports each affected use with the provider’s tagged evidence, and can write a narrow patch for eligible findings. It then checks that patch before it offers it. You can run the public release now with no account:

npx emendant scan

What has launched

The public CLI includes the complete local workflow:

• emendant scan detects installed packages, selects relevant feed entries, follows affected API values across local files, and reports exact call sites.
• emendant explain <change-id> shows the feed entry, migration guidance and tagged primary sources behind a finding.
• emendant fix writes eligible patches into .emendant/patches/ and checks them in a copy of the repository outside the working tree.
• emendant feed update fetches a newer signed feed, while emendant feed status reports which feed a scan would use without making a request.
• emendant scan --sarif produces a SARIF 2.1.0 log for code-scanning tools.

The release matches TypeScript and JavaScript source for six npm packages: ai, openai, @anthropic-ai/sdk, langchain, @langchain/core and @google/genai. It requires Node.js 20 or later. The support matrix is the current record of package and language coverage.

Why we built it

Changing a version in package.json is usually the smallest part of an SDK upgrade. The slower part is finding which imports, method calls and values in your source rely on an API that moved, changed or disappeared.

Emendant records those provider changes as data. Each feed entry names one change, its affected release, structural matchers, migration guidance and primary sources. A scan combines that feed with the versions and source on your machine. If the feed does not describe a change, Emendant does not invent one. If it cannot attribute a use to the package, it does not report a finding.

This is deliberately narrower than a code review or a dependency update. The goal is to show the source work behind a supported upgrade, with enough evidence for you to inspect every result.

What a real result contains

Here is one complete proof from the launch evidence packet.

AI SDK 5 removed the ai/react entrypoint. In the third-party repository vercel-labs/ai-sdk-preview-attachments, Emendant found this affected source call before the upgrade:

import { useChat } from "ai/react";

The exact finding was ai-npm-5.0.0-react-subpath-removed at app/(preview)/page.tsx:10:1, with pending placement. That repository commits two lockfiles that disagree about ai, so Emendant places it as a range, declared >=4.0.21 <=4.3.19, rather than picking one of them. The whole range is below 5.0.0, so moving to ai@5.0.0 was the change that affected the import. The finding links the tagged AI SDK 5 migration guide and the release’s tagged package.json.

That repository did not receive a patch. The correct rewrite needs another package, and Emendant does not update dependencies. Verification was inconclusive, so the tool withheld the patch instead of presenting an unproved result.

The bounded patch proof comes from Emendant/demo, a public repository built to make the check repeatable. The tagged guide records the CoreMessage to ModelMessage rename. Emendant wrote these three edits:

import { CoreMessage } from 'ai';
import { ModelMessage } from 'ai';

export function systemPrompt(): CoreMessage {
export function systemPrompt(): ModelMessage {

  history: CoreMessage[] = [],
  history: ModelMessage[] = [],

The patch changed three lines in one file, with three added and three removed lines. Its grade was TYPECHECKED. It was applied in a copy of the repository, where these commands passed:

npm install ai@5.0.0 --ignore-scripts --no-audit --no-fund
npm rebuild
npm run typecheck

The repository had no test script, so no tests ran. The grade stayed typechecked. It was not rounded up to test verified.

Patches say exactly what was checked

Emendant writes one diff per eligible finding into .emendant/patches/. It never edits a source file, stages a change, creates a commit or changes git history. The default limit is 40 added and removed lines across one finding. Anything larger is reported unfixed with the reason.

Checks come from the repository. Emendant uses explicit commands from emendant.json when present. Otherwise, it finds the repository’s own typecheck and test scripts or installed tools. A repository with no checks can still receive a patch, but that patch says structurally checked rather than claiming that code ran.

There are four grades, and only two describe a green command run:

failed and inconclusive are not grades. Both withhold the patch. This keeps a red baseline, an incomplete upgrade or a failed install from becoming a false claim about the patch.

Local by default, explicit when it is not

The scan process is local and read only. It does not run repository code, send telemetry or upload source. It makes no network request. The feed ships inside the npm package, and automatic updates stay off until you turn them on. If npx needs to install Emendant first, npm contacts its registry before the scan starts.

Fix mode has two explicit exceptions:

• To prove a patch for a release you have not installed, Emendant asks your own package manager for that release. The request comes from a tree containing manifests and lockfiles, but no source. Checks then run in a scratch copy.
• Some findings need a model to write a patch. Nothing is sent unless you name a provider with --model-provider. A hosted provider can then receive the matched block, about twenty lines of context and the file’s imports directly from your machine.

Checks run behind the strongest boundary the machine provides. On the measured macOS run, the boundary confined writes and removed network, credentials, the normal home and most environment data. It did not confine reads, memory or CPU, and the report said so.

Read the security page and privacy notice for the full boundary.

Current limits

Emendant reports only changes that have both a feed entry and an attributable use in the repository. It does not find every breaking change in every package. It does not match Python source, review general code, update dependency versions or fix every finding.

Run Emendant on your repository

Emendant is available now from the npm package page. Run the scan before your next supported SDK upgrade:

npx emendant scan

Use the CLI reference and support matrix to check the current commands and scope. If you complete a scan, send the result to contact@emendant.com. A useful clean result is welcome too. For a coverage request that does not need a reply, use the request form.