grepxcel 0.1.0

Initial public release.

Features

• Pattern-based extraction — define a pattern file (.xlsx or .csv) once,
  extract structured JSON from any similarly-laid-out .xlsx file.
• Batch directory extraction — grepxcel extract -p pat.xlsx data_dir/
  expands directories to their .xlsx files automatically. Add -r /
  --recursive to recurse into subdirectories. Excel temp files (~$*.xlsx)
  are skipped. Empty directories produce a clear error message.
• sbom command — generates a CycloneDX 1.6 Software Bill of Materials
  listing grepxcel and every transitive dependency with PURLs, SPDX license
  identifiers, and SHA-256 hashes from pip's RECORD files. Uses only stdlib
  (importlib.metadata) — no external tool required. Output is accepted by
  Dependency-Track, Grype, and other SBOM consumers. The SBOM is also
  attached as a release artifact on GitHub Releases.
• generate-examples command — creates 4 ready-to-run example sets
  (pattern + data xlsx + README) in a local directory so new users can try
  grepxcel immediately without needing their own Excel files.
• MCP server (grepxcel mcp) — expose grepxcel as a Model Context Protocol
  server so AI agents can call extract, validate-pattern, lint, schema, docs,
  doctor, and generate-examples directly. Stdio transport. Install with
  pip install 'grepxcel[mcp]'.
• mcp-config command — prints the MCP server config block for your AI agent
  (Claude Code, Claude Desktop, Cursor). Detects the installed command path.
• lbl.match mode — lbl: fields now default to literal string matching
  instead of full regex. Labels like Term (months): or Breaks\n(minutes)
  work without regex escaping.
  • Global config: config: | lbl.match | literal (default) / glob / regexp
  • Per-field override: lbl:literal, lbl:glob, lbl:regexp in column A
  • glob mode: shell wildcards (* = any text including newlines, ? = one char)
  • regexp mode: opt-in for the previous full Python re.search behaviour
  • validate-pattern warns when a lbl: value looks like a regex but mode is
    literal or glob (e.g. \(, \., (?)
  • Verbose validate-pattern -v now shows lbl.match in config and per-field
    [mode] tags for explicit overrides
• Cell addressing
  • cell:B5 -> absolute
  • cell:next -> sequential, next non empty in direction order
  • seek: -> repositioning
  • dir: -> direction switching (LR / TD).
• Table matching — repeating mini-tables with:
  • HEADER
  • DATA -> mini-table data rows
    • DATA:1 -> 1 row
    • DATA:* -> any number of rows
    • DATA:{n,m} -> n to m rows
  • FOOTER
  • SPLITTER
  • SKIP_IF
• grepxcel.extract() Python API — one-call facade with support for:
  • sheet=,
  • all_sheets=True
  • output_format=
• draft command — generates a starter pattern using one of following options:
  • local GGUF model -> offline, the models will be downloaded.
  • GitHub Models -> for those still having it,
    stand GitHub changelog 2026-06-16
  • Claude API ->
• validate-pattern — validates pattern files without extracting.
• schema — generates a JSON Schema (draft 2020-12) from a pattern file.
• lint — inspects an Excel file for potential issues before extraction.
• doctor — preflight check for dependencies, API keys, model cache, proxy/TLS.
• docs — writes a colour-coded pattern-reference.xlsx.
• Structured logging — --log-format json writes NDJSON with an allow-list
  of safe keys only (no extracted cell values, ever). Non-reversible value
  fingerprint (value_len + value_sha8) aids diagnostics. Summary event with
  extraction statistics (counts + field names).
• --meta — opt-in _meta block in extracted JSON (run_id, stats, safe
  issues) for pipeline auto-verification.
• pattern.version — optional config: | pattern.version | N for
  forward-compatibility; absent defaults to 1.
• Corporate proxy support (experimental) — truststore, --ca-bundle /
  GREPXCEL_CA_BUNDLE for TLS-inspection proxies.
• Scoped .env — project-local and ~/.config/grepxcel/.env credential
  discovery; --strict-env refuses out-of-project .env files.
• generate-skill — emits a skill doc (--target claude or agents-md)
  for AI-agent integration.

Changed

• structlog integration — NDJSON file output now uses a structlog processor
  chain (allow-list filter → JSONRenderer) instead of manual dict building +
  json.dumps. The output format is unchanged; this is an internal refactor
  that makes the structured-log pipeline extensible for future output targets
  (OTLP, Datadog, etc.). structlog>=24.1 is now a core dependency.

Security

• MCP path sandboxing — all MCP server tools validate that file paths
  resolve within the server's working directory. Absolute paths pointing
  elsewhere, .. traversal, and symlink escapes are rejected with a clear
  error. Prevents an AI agent (or a prompt-injected one) from reading or
  writing files outside the intended project directory.
• Fail-closed XXE protection (defusedxml asserted at import).
• ZIP-bomb guard measures real decompressed size (stream, not metadata).
• AST-based ReDoS detection + hard per-match regex timeout.
• SSRF/file-read guards on server URLs (http(s) only).
• Scoped .env discovery (stops at project root).
• All GitHub Actions pinned to immutable commit SHAs.
• Cached-model sha256 integrity verification on every run.
• Structured JSON logs never contain extracted cell values (allow-list
  construction, not redaction).