npm & git for the agentic era
One command surface that works the same whether a human runs it or a code agent does — graph-aware, non-blocking, reversible, and still just npm and git underneath. Built for code agents that need JSON and deterministic exits, and for the developers overseeing them who need to trust what just happened to their release.
$ npm install -g @x12i/npm
Or run without installing: npx @x12i/npm@latest --full-flow
One command. Every package. Every time.
What xnpm gives you back
npm does its job. The workflow around it — ordering, safety, sequencing — nobody built that part.
Learn why →Pack check, sensitive-file block, post-bump re-validation — before anything reaches the registry.
Publish safety →Tarball inspection catches weaponized binding.gyp — no CVE, no advisory required.
Install security →Deterministic phrase catalog — not an LLM. Same input, same command. Safe to script.
See how →JSON plans, deterministic exits, no hidden prompts — plus what an agent can run without approval, and what still needs your --yes.
dependsOn controls publish order. Local file: dev links sync to registry ranges for publish, then restore.
Submit fixes, pull the fixed version, verify. Change requests become traceable — not permanent workarounds.
See how →Every run is journaled. One command restores the exact prior state. Try things without consequences.
See how →xgit status, xgit push — natural git passthrough plus monorepo cross-solve.
xnpm scripts init and init runbook — preflight, core, ordered publish shell for agents.
Global, npx, or CI — same command everywhere. Run xnpm doctor to verify your environment.
Get started →Does it replace npm? Is ask an LLM? What if publish works but push fails?
Read FAQ →Every flag, passthrough rule, and copy-paste example in one place.
See all →What runs when you type one command
xnpm --full-flow
Find all packages under the current directory
Sort local packages by dependency order
Scan new dependency tarballs for Phantom Gyp before install
Align dependencies before build and test
Run builds in correct order, stop on failure
Block the publish path if tests fail
Inspect what npm would actually publish
Hand off to real npm binary, in order
Structured result for humans, CI, and agents