v0.6.0

hosted-only: retire the self-host story

README, ROADMAP, ARCHITECTURE §18, and the public site now describe the
hosted service only. Remove the GitHub Action (action.yml + example) —
it booted the self-hosted compose stack, which the hosted auth/credit
model no longer supports. Drop open-source references and GitHub links
from the landing page, OG image, llms.txt, JSON-LD, and pricing page.
CLI README/pyproject lose GitHub Releases links and the self-hosted
description ahead of the repo going private. Drop stale test counts and
the removed `virgil config set api_url` from the VS Code docs.

v0.5.0

prod compose: restart: unless-stopped on all services — web stayed do…

v0.4.2 — CLI live progress (real-time phase + message)

Two bugs in the post-scan progress display, surfaced during the launch smoke test.

Fixed

• cli.client.stream_events now JSON-decodes the SSE data field instead of passing a raw string back. Each yielded event is {"event": "...", "data": dict}.
• _stream_progress reads data["phase"] and data["message"] and renders phase · message — previously it tried to split a JSON string on a " · " separator that never existed, so the spinner stuck on queued · {raw JSON} for the entire run.
• iter_lines(chunk_size=1) for line-at-a-time flushing — without this, SSE events buffer up to ~512 bytes and the spinner sits on a stale phase while the next event waits in the socket buffer.

End result: the CLI now updates in real time as scans progress through cloning → scanning → correlating → reporting, with the latest per-phase log line.

v0.4.1 — auto-fall-back to hosted default

Patch on top of v0.4.0 for users with stale local-dev configs.

If your saved `api_url` is a localhost address and that backend isn't running, the CLI now retries once against the hosted default (`https://virgilhq.app/api\`) and prints a one-line notice. Your saved config is untouched, so once you bring your local stack back up it's used again.

Non-localhost `api_url` values still fail loudly — public misconfigurations shouldn't silently re-route.

This makes the `pipx install virgilhq && virgil scan .` experience truly idempotent for returning users.

v0.4.0 — default to hosted virgilhq.app

The CLI now defaults to the hosted instance at https://virgilhq.app. After this release, pipx install virgilhq && virgil scan . works end-to-end without running anything locally — no docker compose up, no env vars.

Changes

• DEFAULT_API_URL → https://virgilhq.app/api
• DEFAULT_WEB_URL → https://virgilhq.app
• README, --help text, and module docstring updated to match.

Self-hosting still works

Point the CLI at your own stack:

virgil config set api_url=http://localhost:8000
virgil config set web_url=http://localhost:3000

Env overrides (VIRGIL_API, VIRGIL_WEB) continue to take precedence over both the config file and the new defaults.

virgilhq 0.3.1 — bare-arg scan target

Drop the `--url` ceremony for the common case. `virgil scan` now auto-detects whether the positional argument is a local path or a remote repo:

```
virgil scan . # local
virgil scan https://github.com/x/y # remote, full URL
virgil scan github.com/x/y # remote, bare host
virgil scan x/y # remote, GitHub shorthand
```

The `x/y` shorthand only kicks in when no local directory of that name exists, so it can't silently hijack a literal relative path. `--url` still works for back-compat.

14 unit tests pin the resolver branches.

virgilhq 0.3.0 — proper triage CLI

First pass at a real terminal triage surface for Virgil, instead of a thin launcher into the web app.

What's new

• scan --show {triage|report|surface|ask_virgil} — pick where the CLI lands once the scan finishes. Default is triage (counts → ranked priority panel → next-steps). The raw findings table is no longer printed by default — that's virgil findings ID now.
• virgil clusters / virgil cluster — list every cluster with severity-grouped, color-coded sections; drill into one by key (prefix matches work).
• virgil finding FINDING_ID — single-finding drill, including the why-flagged trace (scanner + rule, file:line, evidence, cwe/cve refs, code-context note) and the LLM enrichment prose.
• virgil chat AUDIT_ID — SSE-streamed REPL, one-shot -m, session resume via --session.
• virgil open AUDIT_ID [--page …] [--print] — launches the web app on the chosen tab.
• virgil config (show / get / set / unset / path) backed by ~/.config/virgil/config.json. Validated values for default_fail_on and default_post_scan_view.
• Global --json — machine-readable output to stdout, progress UI routed to stderr. virgil --json scan . > scan.json pipes cleanly in CI. SARIF was already piping via virgil report ID --format sarif > findings.sarif.

Fixed

• The CLI read AI_SEC_AUDIT_API while the docs and README advertised VIRGIL_API — they now agree (VIRGIL_API).

Install

pipx install virgilhq
# or
pip install virgilhq

The command on your $PATH is still virgil.