What changed in each version of @valiqai/cli. Versions follow semver, and exit codes 0 to 3 never change meaning. Update with npm install -g @valiqai/cli; npx always runs the newest.

1.9.2

Scan ids that start with a dash, like -jHXoyDF3g, work in valiqai scans view|watch|cancel, problems and open. They were read as an unknown option. New scans no longer get such ids.

1.9.1

valiqai scans watch <id> --output report.xml writes the report, picking the format from the file's extension like valiqai scan does. It used to write nothing unless --format was given too.

1.9.0

valiqai mcp: an MCP server, so AI coding tools (Claude Code, Cursor, VS Code, Windsurf, …) can start scans, wait for them, read their problems, stop them, and see your domains and credits. It uses the same key as the CLI. Setup: https://www.valiqai.com/docs/cli-mcp
Scans started this way show "MCP" as where they came from, like CI scans show their provider.

1.8.2

Error links point at the new troubleshooting page, like https://www.valiqai.com/docs/cli-troubleshooting#vq101-no-api-key, now that the CLI docs are a page per topic with a page per command.

1.8.1

A new error, VQ711: ValiqAI now refuses a scan of a site behind HTTP basic auth, Vercel Deployment Protection, Cloudflare Access or Netlify password protection before it starts, so no credits are held for a scan that would only see the login wall. Scanning through that protection isn't available yet.

1.8.0

With a team key, valiqai domains (and link) also lists the domains your teammates verified, marked "Verified by a teammate": ValiqAI now lets a team key scan those.
Every request says which CLI sent it (valiqai-cli/1.8.0), so a key's row in ValiqAI shows the CLI version it was last used from.
A new error, VQ710, when a key's monthly credit limit is used up.

1.7.0

Error codes: every error ends with its code and a link to its fix, like VQ101 · https://www.valiqai.com/docs/cli#vq101-no-api-key; --json errors carry code and docs. When ValiqAI refuses a scan, the code names the cause (credits, an unverified domain, the key).
valiqai doctor: checks Node, the key and its expiry, that ValiqAI answers, valiqai.json, the linked domain, credits and CI, each with a tick or the fix. Exits 1 when something would stop a scan.
valiqai on its own shows who you're signed in as, this folder's site, the last scan, and what to try next. A mistyped command suggests the one you meant.
valiqai completion bash|zsh|fish|powershell completes commands, flags and their values.
Every command's --help ends with examples.
--quiet (only the result), --debug (each request, its status, time and request id; the key masked), --no-color and NO_COLOR.
A once-a-day background check mentions a newer version after a command; never in CI, off with VALIQAI_NO_UPDATE_NOTIFIER=1.

1.6.0

Look up results: valiqai scans (a table sized to your terminal; --site, --status, --source, -L), scans view <id> (--web), scans watch <id> (the same progress, exit codes and reports as scan), scans cancel <id>, and problems <id> (--severity, --category, --status).
Domains from the terminal: domains, domains add <domain> (prints the TXT record; --wait checks every 30 seconds until it verifies), domains verify, domains remove. They need a personal sign-in: run valiqai login again if yours is from before 1.6.0.
credits shows what the workspace has and what each scan reserves; open [scan|domain] opens it in the browser (--no-browser prints the address).
Every one takes --json, and exits 0 when it works and 1 when it doesn't.

1.5.0

GitHub Actions: the run's summary page shows the verdict, counts, tests and the worst open problems; open problems at --fail-on become error annotations (other blockers and highs, warnings); later steps read steps.<id>.outputs.run-url, scan-id, score, blockers, high, medium, status and exit-code. --no-github turns it off.
Reports: --format json|junit|sarif|markdown, and --output <file> to write it (the extension picks the format when --format doesn't). JUnit has a test case per test the scan ran, so GitLab, Jenkins, CircleCI, Bitbucket and Buildkite show them in their test views.
--json now includes problems.
valiqai init writes a GitLab job that keeps the JUnit report, and gives the GitHub step an id.

1.4.0

Scan types: --type e2e (sign-up, sign-in and the pages around them) or --type security (also your chatbot, with --chatbot-consent), the same two scans as the app, priced the same way. scan.type in valiqai.json sets the default; valiqai link asks.
Cost before you start: in a terminal, scan says what it reserves and what you have, and asks. --yes skips it; CI never asks. After starting it says what was reserved.
Progress: while it runs, a line each time more tests finish: "12 of 18 tests done · 2 problems so far".
--no-wait starts the scan, prints its link and exits 0. --open opens it in the browser.
Where it ran: scans from CI show the provider, branch, commit and a link to the job on their results page. --label adds a note.
When chatbot scans aren't available yet, a security request says it runs as End-to-End, instead of silently doing so.

1.3.0

Sign in from the browser: valiqai login opens ValiqAI, you check the code and approve, and the CLI gets its own 90-day key for the workspace you picked ("CLI · your-computer"). --no-browser prints the page for SSH; --key still saves a key you already have.
Workspaces: be signed in to your personal workspace and teams at once. valiqai switch changes the active one; --workspace or VALIQAI_WORKSPACE picks one for a command.
whoami shows the user, workspace and key (with its expiry), and --json. logout revokes a browser sign-in's key; --all signs out of everything.
valiqai link: ties a folder to a site in valiqai.json (address per environment, what fails the build). valiqai scan then needs no URL anywhere in the repository; --env production picks another address. valiqai init writes a job that just runs valiqai scan.
scan without a URL in a terminal offers your verified domains.
A key saved by 1.1.x keeps working until you sign in.

1.2.0

Busy workspace: when another scan in the workspace is still running, scan waits for it (up to --timeout) instead of failing the build.
--on-timeout cancel|keep: a scan still running at --timeout is now stopped by default, so it doesn't keep holding the workspace, and its unused credits are released. keep leaves it running.
No double billing on retries: in CI, each job attempt sends one Idempotency-Key, so a retried request returns the scan already started. "Re-run job" still starts a new scan. Set your own with --idempotency-key.
Stopping: Ctrl-C asks whether to stop the scan too. A CI cancellation (SIGTERM) stops it.
Rate limits: a 429 from ValiqAI is waited out, not counted as a failure.
The package is now an ES module, with a LICENSE and links on its npm page. ora is no longer a dependency.

1.1.2

valiqai login and config reset saved https://valiqai.com, which answers POSTs with 405, so every scan after a login failed. They save https://www.valiqai.com, and an address saved by 1.1.1 is moved to www when read.
logout and whoami work (they existed but weren't registered).
login shows why a key was refused, or that ValiqAI couldn't be reached.
init writes a GitHub Actions workflow or GitLab CI job that runs npx @valiqai/cli scan.
config set checks values; scan uses a saved timeout and defaultMode.

1.1.1

valiqai scan <url> for CI: --fail-on, --timeout, --json, exit codes 0 to 3, problems dismissed in ValiqAI don't fail the build.