@jeeva1398/eventa 0.1.0 → 0.1.1

package/README.md

@@ -27,7 +27,7 @@ Eventa parses the stack trace or `tsc` output, reads the source lines it points
 Reviews `git diff --staged`, falling back to unstaged changes. Use `--base main` to review everything since `main`. Each file gets static checks first (missing `await`, SQL/command injection, `eval`, sync fs, empty `catch`, disabled TLS, hard-coded secrets), then the model confirms or dismisses them and reports `- [severity] line N: problem → fix`.
 
 ### `eventa deps`
-Runs `npm audit` and `npm outdated` and scans your imports. It prints the vulnerabilities with their **exact fix commands**, outdated packages (flagging major bumps), unused dependencies and packages that are imported but not declared. Then it adds AI advice on upgrade risk. Use `--no-ai` for the report only.
+Runs `npm audit` and `npm outdated` and scans your imports. It prints the vulnerabilities with their **exact fix commands**, outdated packages (flagging major bumps), unused dependencies and packages that are imported but not declared. Then it prints an **action plan** built only from facts: the fix commands, verified breaking-change notes for about 25 popular packages (others say "read the changelog" instead of guessing), and cleanup commands. It is instant and works without the model. Add `--ai` for optional extra commentary from the model.
 
 ### More
 - `eventa ask <question>`: any Node.js question

package/dist/index.js

@@ -559,6 +559,11 @@ function fixPlan(vulns) {
   }
   return [...groups].map(([command, fixes]) => ({ command, fixes }));
 }
+function breaking(current, latest) {
+  const [cMajor, cMinor] = current.split(".");
+  const [lMajor, lMinor] = latest.split(".");
+  return cMajor !== lMajor || cMajor === "0" && cMinor !== lMinor;
+}
 function parseOutdated(text) {
   const json = parseJson(text) ?? {};
   return Object.entries(json).map(([name, v]) => ({
@@ -566,7 +571,7 @@ function parseOutdated(text) {
     current: v.current,
     wanted: v.wanted,
     latest: v.latest,
-    major: Boolean(v.current && v.latest && v.current.split(".")[0] !== v.latest.split(".")[0])
+    major: Boolean(v.current && v.latest && breaking(v.current, v.latest))
   }));
 }
 function packageName(specifier) {
@@ -644,21 +649,99 @@ async function collectDeps(cwd) {
   };
 }
 
+// src/prompts/upgrades.ts
+var UPGRADE_NOTES = {
+  "express@5": "Express 5 uses path-to-regexp v8: wildcard routes must be named (`/*splat`) and optional params use braces; `req.param()` and `app.del()` were removed; rejected promises in async handlers now go to error middleware. Run your route tests.",
+  "body-parser@2": "body-parser 2 (used by Express 5) drops deprecated options and changes `urlencoded` `extended` default to false; check form parsing.",
+  "chalk@5": "chalk 5 is ESM-only; `require('chalk')` fails in CommonJS. Stay on 4 for CJS or migrate the project to ESM.",
+  "node-fetch@3": "node-fetch 3 is ESM-only. On Node 18+ prefer the built-in global `fetch` and remove the dependency.",
+  uuid: "Deep imports such as `require('uuid/v4')` were removed in v8; use `const { v4 } = require('uuid')`.",
+  "mongoose@7": "Mongoose 7 removed callback support from model methods (use async/await) and changed the `strictQuery` default.",
+  "mongoose@8": "Mongoose 7 removed callback support from model methods (use async/await) and changed the `strictQuery` default; Mongoose 8 needs MongoDB 4.4+.",
+  "jest@28": "Jest 28 no longer bundles jsdom (install `jest-environment-jsdom`) and renamed `testURL` to `testEnvironmentOptions.url`.",
+  "jest@29": "Jest 28 no longer bundles jsdom (install `jest-environment-jsdom`) and renamed `testURL` to `testEnvironmentOptions.url`; Jest 29 changed the default snapshot format.",
+  "eslint@9": "ESLint 9 uses flat config (`eslint.config.js`) by default and ignores `.eslintrc`; many plugins need updated versions.",
+  "typescript@5": "TypeScript 5 deprecates flags such as `importsNotUsedAsValues` and implements standard decorators unless `experimentalDecorators` is set; expect some new type errors.",
+  "axios@1": "axios 1.x adds an `exports` map, so deep imports like `axios/lib/...` break, and some TypeScript types were renamed.",
+  helmet: "Newer helmet enables a strict Content-Security-Policy and cross-origin headers by default, which can block inline scripts and third-party assets; test your pages.",
+  inquirer: "inquirer 9+ is ESM-only and v10+ moved to the new `@inquirer/prompts` API.",
+  got: "got 12+ is ESM-only and changed several option names; consider native `fetch` for simple calls.",
+  "webpack@5": "webpack 5 removed automatic Node.js polyfills (`Buffer`, `process`, `crypto`) for browser bundles; add `resolve.fallback` where needed. It also fixes ERR_OSSL_EVP_UNSUPPORTED on Node 17+.",
+  dotenv: "Low risk: dotenv 16 keeps the same `config()` API and adds multiline values.",
+  "@nestjs/core@11": "Nest 11 requires Node 20+ and uses Express 5 by default, so wildcard routes change syntax (`*` must be named, e.g. `*splat`). Upgrade all `@nestjs/*` packages together.",
+  "@nestjs/common@11": "Nest 11 requires Node 20+ and uses Express 5 by default, so wildcard routes change syntax (`*` must be named, e.g. `*splat`). Upgrade all `@nestjs/*` packages together.",
+  "@prisma/client": "Prisma 5 removed `rejectOnNotFound` (use `findUniqueOrThrow`); Prisma 6 needs Node 18.18+ and TypeScript 5.1+, and `Bytes` fields become `Uint8Array`. Upgrade `prisma` and `@prisma/client` to the same version and re-run `prisma generate`.",
+  prisma: "Upgrade `prisma` and `@prisma/client` to the same version and re-run `prisma generate`; Prisma 5 removed `rejectOnNotFound`, Prisma 6 needs Node 18.18+ and TypeScript 5.1+.",
+  "class-validator@0": "Low risk for most apps: 0.14 fixes a security issue where unknown values skipped validation; `forbidUnknownValues` now defaults to true, so plain objects without decorators are rejected.",
+  "redis@4": "node-redis 4 is promise-based: call `await client.connect()` before use, and commands are camelCase (`hSet`, not `hset`) with no callbacks.",
+  glob: "glob 9+ has a promise API only (no callbacks) and a named export: `import { glob } from 'glob'`.",
+  rimraf: "rimraf 4+ has a promise API only and a named export: `import { rimraf } from 'rimraf'`."
+};
+var major = (version) => version?.split(".")[0];
+function upgradeNote(name, latest) {
+  return UPGRADE_NOTES[`${name}@${major(latest)}`] ?? UPGRADE_NOTES[name];
+}
+
+// src/context/depsPlan.ts
+var SEVERITY_RANK = ["critical", "high", "moderate", "low", "info"];
+function buildPlan(r) {
+  const sections = [];
+  const byName = new Map(r.vulnerabilities.map((v) => [v.name, v]));
+  if (r.vulnerabilities.length) {
+    const items = fixPlan(r.vulnerabilities).map(({ command, fixes }) => {
+      const vulns = fixes.map((n) => byName.get(n));
+      const worst = vulns.map((v) => v.severity).sort((a, b) => SEVERITY_RANK.indexOf(a) - SEVERITY_RANK.indexOf(b))[0];
+      const titles = vulns.map((v) => `${v.name}: ${v.title ?? "advisory"}`).join("; ");
+      if (command === "no fix available") return `- **No fix available** (${worst}): ${titles}. Replace the package or check whether the vulnerable code is reachable.`;
+      const major2 = command.endsWith("(major)");
+      return `- \`${command.replace(" (major)", "")}\`${major2 ? " **(major version, see notes below)**" : ""} (${worst}): ${titles}.`;
+    });
+    sections.push(`**1. Security**
+${items.join("\n")}`);
+  }
+  const majors = r.outdated.filter((o) => o.major);
+  if (majors.length) {
+    const items = majors.map((o) => {
+      const note = upgradeNote(o.name, o.latest);
+      return `- **${o.name} ${o.current ?? "?"} \u2192 ${o.latest}**: ${note ?? "no verified notes. Read its changelog / release notes before upgrading."}`;
+    });
+    sections.push(`**2. Major upgrades**
+${items.join("\n")}`);
+  }
+  const cleanup = [];
+  if (r.unused.length) cleanup.push(`- \`npm uninstall ${r.unused.join(" ")}\`: not imported anywhere (double-check config files, scripts and dynamic requires first).`);
+  if (r.missing.length) cleanup.push(`- \`npm install ${r.missing.join(" ")}\`: imported in code but missing from package.json.`);
+  const minors = r.outdated.filter((o) => !o.major);
+  if (minors.length) cleanup.push(`- \`npm update\`: safe minor/patch updates for ${minors.map((m) => m.name).join(", ")}.`);
+  if (cleanup.length) sections.push(`**3. Cleanup**
+${cleanup.join("\n")}`);
+  return sections.join("\n\n");
+}
+
 // src/prompts/deps.ts
 function depsPrompt(r, nodeVersion) {
-  const lines = [`Node ${nodeVersion}`];
+  const lines2 = [`Node ${nodeVersion}`];
   if (r.vulnerabilities.length) {
-    lines.push("Vulnerabilities:", ...r.vulnerabilities.slice(0, 20).map((v) => `- ${v.name} [${v.severity}] ${v.title ?? ""}`));
-    lines.push("Fix commands (already computed and correct):", ...fixPlan(r.vulnerabilities).map((f) => `- ${f.command} \u2192 fixes ${f.fixes.join(", ")}`));
+    const title = new Map(r.vulnerabilities.map((v) => [v.name, v.title]));
+    lines2.push("Vulnerabilities:", ...r.vulnerabilities.slice(0, 20).map((v) => `- ${v.name} [${v.severity}] ${v.title ?? ""}`));
+    lines2.push(
+      "Fix commands (already computed and correct):",
+      ...fixPlan(r.vulnerabilities).map((f) => `- ${f.command} \u2192 fixes ${f.fixes.map((n) => title.get(n) ? `${n} (${title.get(n)})` : n).join(", ")}`)
+    );
   }
   if (r.outdated.length) {
-    lines.push("Outdated:", ...r.outdated.slice(0, 25).map((o) => `- ${o.name} ${o.current ?? "not installed"} \u2192 latest ${o.latest}${o.major ? " (MAJOR)" : ""}`));
+    lines2.push("Outdated:", ...r.outdated.slice(0, 25).map((o) => `- ${o.name} ${o.current ?? "not installed"} \u2192 latest ${o.latest}${o.major ? " (MAJOR)" : ""}`));
+    const notes = r.outdated.filter((o) => o.major).map((o) => [o, upgradeNote(o.name, o.latest)]);
+    const known = notes.filter(([, n]) => n);
+    if (known.length) lines2.push("Verified upgrade notes:", ...known.map(([o, n]) => `- ${o.name} \u2192 ${o.latest}: ${n}`));
+    const unknown = notes.filter(([, n]) => !n).map(([o]) => o.name);
+    if (unknown.length) lines2.push(`No verified notes for: ${unknown.join(", ")}`);
   }
-  if (r.unused.length) lines.push(`Possibly unused dependencies: ${r.unused.join(", ")}`);
-  if (r.missing.length) lines.push(`Imported but not declared in package.json: ${r.missing.join(", ")}`);
+  if (r.unused.length) lines2.push(`Possibly unused dependencies: ${r.unused.join(", ")}`);
+  if (r.missing.length) lines2.push(`Imported but not declared in package.json: ${r.missing.join(", ")}`);
   return {
-    instruction: "You are given facts about a Node.js project's dependencies. Write a short, prioritized action plan:\n1. Security: repeat each fix command exactly as given and say in one line why it matters. Never change versions.\n2. Major upgrades (marked MAJOR only): for each, the main breaking-change risk you know of and what to check.\n3. Cleanup: unused packages to remove and missing packages to add.\nDo not repeat the raw lists. Do not invent versions or advisories. Skip any section with nothing to do.",
-    input: lines.join("\n")
+    instruction: "You are given facts about a Node.js project's dependencies. Write a short, prioritized action plan:\n1. Security: repeat each fix command exactly as given and say in one line why it matters, based only on the advisory titles. Never change versions.\n2. Major upgrades (marked MAJOR only): restate the verified upgrade note for each. For packages with no verified notes, say to read their changelog before upgrading; do not guess API changes.\n3. Cleanup: unused packages to remove and missing packages to add.\nDo not repeat the raw lists. Do not invent versions, advisories or APIs. Skip any section with nothing to do.",
+    input: lines2.join("\n")
   };
 }
 
@@ -702,9 +785,10 @@ async function depsCommand(config2, opts) {
   const spinner = !opts.json && process.stderr.isTTY ? ora2({ text: "Running npm audit and npm outdated\u2026", stream: process.stderr }).start() : null;
   const report = await collectDeps(cwd).finally(() => spinner?.stop());
   const wantAi = opts.ai && !isHealthy(report);
+  const plan = isHealthy(report) ? "" : buildPlan(report);
   if (opts.json) {
     const analysis = wantAi ? await generate(config2, depsPrompt(report, process.versions.node), { json: true }) : void 0;
-    printJson({ ...report, analysis });
+    printJson({ ...report, plan, analysis });
     return;
   }
   printReport(report);
@@ -712,11 +796,18 @@ async function depsCommand(config2, opts) {
     console.log(chalk3.green("\u2714 Dependencies look healthy."));
     return;
   }
+  console.log(chalk3.bold.underline("Action plan"));
+  await renderStream(lines(plan), { raw: opts.raw });
   if (wantAi) {
-    console.log(chalk3.bold.underline("Advice"));
+    console.log(chalk3.bold.underline("\nAI notes"));
     await generate(config2, depsPrompt(report, process.versions.node), opts);
+  } else {
+    console.log(chalk3.dim("\nRun with --ai for extra AI commentary."));
   }
 }
+async function* lines(text) {
+  yield text;
+}
 
 // src/commands/doctor.ts
 import chalk4 from "chalk";
@@ -735,8 +826,8 @@ async function probe(name, check) {
   }
 }
 async function doctorCommand(config2) {
-  const major = Number(process.versions.node.split(".")[0]);
-  if (major >= 20) ok(`Node.js ${process.versions.node}`);
+  const major2 = Number(process.versions.node.split(".")[0]);
+  if (major2 >= 20) ok(`Node.js ${process.versions.node}`);
   else fail(`Node.js ${process.versions.node}`, "Eventa needs Node.js 20 or newer");
   const ollamaOk = await probe(`Ollama (${config2.model})`, () => new OllamaProvider(config2.model, config2.ollamaHost).check());
   const localOk = await probe(`Built-in runtime (${config2.localModel})`, () => new LocalProvider(config2.localModel).check());
@@ -744,7 +835,7 @@ async function doctorCommand(config2) {
   console.log(chalk4.dim(`
 Provider setting: ${config2.provider} \u2192 using ${active.name} (${active.model})`));
   if (!ollamaOk && !localOk) console.log(chalk4.dim("Neither is ready yet. Eventa installs the built-in runtime and model on first use, or run `eventa model pull` now."));
-  return major >= 20 && (ollamaOk || localOk);
+  return major2 >= 20 && (ollamaOk || localOk);
 }
 
 // src/commands/model.ts
@@ -860,12 +951,12 @@ function userFrames(parsed, cwd, limit = 3) {
 }
 function readSnippet(file, marked, radius = 15, cwd = process.cwd()) {
   const targets = (Array.isArray(marked) ? marked : [marked]).slice().sort((a, b) => a - b);
-  const lines = readFileSync3(file, "utf8").split(/\r?\n/);
+  const lines2 = readFileSync3(file, "utf8").split(/\r?\n/);
   const start = Math.max(1, targets[0] - radius);
-  const end = Math.min(lines.length, targets[targets.length - 1] + radius);
+  const end = Math.min(lines2.length, targets[targets.length - 1] + radius);
   const body = [];
   for (let n = start; n <= end; n++) {
-    body.push(targets.includes(n) ? `${lines[n - 1]}  // <-- line ${n}, in the stack trace` : lines[n - 1]);
+    body.push(targets.includes(n) ? `${lines2[n - 1]}  // <-- line ${n}, in the stack trace` : lines2[n - 1]);
   }
   return `// ${relative(cwd, file) || file} (lines ${start}-${end})
 ${body.join("\n")}`;
@@ -873,12 +964,12 @@ ${body.join("\n")}`;
 function snippetsFor(frames, radius, cwd) {
   const byFile = /* @__PURE__ */ new Map();
   for (const f of frames) {
-    const lines = byFile.get(f.file) ?? [];
-    const last = lines[lines.length - 1];
-    if (last === void 0 || Math.abs(f.line - last) <= radius * 2) lines.push(f.line);
-    byFile.set(f.file, lines);
+    const lines2 = byFile.get(f.file) ?? [];
+    const last = lines2[lines2.length - 1];
+    if (last === void 0 || Math.abs(f.line - last) <= radius * 2) lines2.push(f.line);
+    byFile.set(f.file, lines2);
   }
-  return [...byFile].map(([file, lines]) => readSnippet(file, lines, radius, cwd));
+  return [...byFile].map(([file, lines2]) => readSnippet(file, lines2, radius, cwd));
 }
 
 // src/context/tokens.ts
@@ -1197,7 +1288,7 @@ async function reviewCommand(config2, opts) {
 
 // src/index.ts
 var program = new Command();
-program.name("eventa").description("Offline AI assistant for Node.js developers").version("0.1.0").option("-m, --model <name>", "model to use (overrides config)").option("--host <url>", "Ollama host URL").option("-p, --provider <name>", "auto | ollama | local").option("--raw", "print plain output without terminal formatting");
+program.name("eventa").description("Offline AI assistant for Node.js developers").version("0.1.1").option("-m, --model <name>", "model to use (overrides config)").option("--host <url>", "Ollama host URL").option("-p, --provider <name>", "auto | ollama | local").option("--raw", "print plain output without terminal formatting");
 var configFrom = (cmd) => {
   const g = cmd.optsWithGlobals();
   if (g.provider && !["auto", "ollama", "local"].includes(g.provider)) throw new Error("--provider must be auto, ollama or local");
@@ -1215,7 +1306,7 @@ program.command("review").description("review your staged git diff (falls back t
   const { config: config2, raw } = configFrom(cmd);
   await reviewCommand(config2, { ...opts, raw });
 });
-program.command("deps").description("audit dependencies: vulnerabilities, outdated, unused and missing packages").option("--no-ai", "only print the report, skip AI advice").option("--json", "print JSON output").action(async (opts, cmd) => {
+program.command("deps").description("audit dependencies: vulnerabilities, outdated, unused and missing packages").option("--ai", "also ask the model for extra commentary (the action plan itself is always deterministic)").option("--json", "print JSON output").action(async (opts, cmd) => {
   const { config: config2, raw } = configFrom(cmd);
   await depsCommand(config2, { ...opts, raw });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeeva1398/eventa",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Offline AI assistant for Node.js developers: explain errors, review diffs, audit dependencies.",
   "type": "module",
   "bin": {