@jeeva1398/eventa 0.1.0 → 0.1.2

package/README.md

@@ -27,7 +27,7 @@ Eventa parses the stack trace or `tsc` output, reads the source lines it points
 Reviews `git diff --staged`, falling back to unstaged changes. Use `--base main` to review everything since `main`. Each file gets static checks first (missing `await`, SQL/command injection, `eval`, sync fs, empty `catch`, disabled TLS, hard-coded secrets), then the model confirms or dismisses them and reports `- [severity] line N: problem → fix`.
 
 ### `eventa deps`
-Runs `npm audit` and `npm outdated` and scans your imports. It prints the vulnerabilities with their **exact fix commands**, outdated packages (flagging major bumps), unused dependencies and packages that are imported but not declared. Then it adds AI advice on upgrade risk. Use `--no-ai` for the report only.
+Runs `npm audit` and `npm outdated` and scans your imports. It prints the vulnerabilities with their **exact fix commands**, outdated packages (flagging major bumps), unused dependencies and packages that are imported but not declared. Then it prints an **action plan** built only from facts: the fix commands, verified breaking-change notes for about 25 popular packages (others say "read the changelog" instead of guessing), and cleanup commands. It is instant and works without the model. Add `--ai` for optional extra commentary from the model.
 
 ### More
 - `eventa ask <question>`: any Node.js question
@@ -46,6 +46,24 @@ Global flags: `-p, --provider auto|ollama|local`, `-m, --model <name>`, `--host
 | `contextSize` | `8192` | |
 | `temperature` | `0.2` | |
 
+## Privacy & security
+
+Your code is only sent to the model running on your machine: the built-in runtime, or Ollama at `ollamaHost`. If you point that at a remote server, code goes there. Eventa makes these network calls:
+
+| When | Where | What is sent |
+|---|---|---|
+| First local use | npm registry | Downloads the runtime from a **pinned lockfile** with integrity hashes and **install scripts disabled** |
+| First local use | huggingface.co | Downloads the model from a pinned commit and verifies its **SHA-256** |
+| `eventa deps` | npm registry | Runs `npm audit` / `npm outdated`, which send your dependency names and versions (exactly as running them yourself would) |
+
+Other safeguards:
+- `explain` only reads source files inside the current project, never arbitrary paths from a pasted stack trace.
+- Model output is printed as text with terminal control sequences stripped, and is never executed.
+- `--run` executes only the command you type.
+- The npm package is published with provenance from GitHub Actions.
+
+Found a security problem? Please open a private advisory: https://github.com/Jeeva1398/eventa/security/advisories/new
+
 ## Limitations
 This is a 1.5B model. It is fast and private, but it can be wrong, so treat its answers as a strong hint, not a verdict. The facts Eventa computes itself (stack frames, audit fixes, unused/missing packages, static checks) are deterministic.
 

package/dist/index.js

@@ -92,10 +92,10 @@ var modelPath = (spec) => spec.url ? join2(modelsDir(), spec.file) : spec.file;
 var isDownloaded = (spec) => existsSync(modelPath(spec));
 
 // src/model/runtime.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync } from "fs";
 import { createRequire } from "module";
 import { join as join3 } from "path";
-import { pathToFileURL } from "url";
+import { fileURLToPath, pathToFileURL } from "url";
 
 // src/context/exec.ts
 import { spawn } from "child_process";
@@ -135,15 +135,32 @@ async function installRuntime(log2 = () => {
   if (Number(process.versions.node.split(".")[0]) < 20) {
     throw new Error("The built-in runtime needs Node.js 20 or newer. Upgrade Node, or use Ollama.");
   }
+  if (!existsSync2(join3(LOCK_DIR, "package-lock.json"))) {
+    throw new Error("The built-in runtime is installed by the npm package. Use `npx @jeeva1398/eventa`, or run Ollama with this binary.");
+  }
   const dir = runtimeDir();
+  const platform = platformPackage();
+  rmSync(join3(dir, "node_modules"), { recursive: true, force: true });
   mkdirSync2(dir, { recursive: true });
-  const manifest = join3(dir, "package.json");
-  if (!existsSync2(manifest)) writeFileSync2(manifest, JSON.stringify({ name: "eventa-runtime", private: true }, null, 2));
+  for (const f of ["package.json", "package-lock.json"]) copyFileSync(join3(LOCK_DIR, f), join3(dir, f));
+  const lock = JSON.parse(readFileSync2(join3(dir, "package-lock.json"), "utf8"));
+  const expected = lock.packages[`node_modules/${platform}`]?.integrity;
+  if (!expected) throw new Error(`No pinned runtime binary for ${platform}.`);
   log2(`Installing the local runtime (node-llama-cpp ${LLAMA_VERSION}, about 80 MB, one time)\u2026`);
-  const r = await exec("npm", ["install", `node-llama-cpp@${LLAMA_VERSION}`, `${platformPackage()}@${LLAMA_VERSION}`, "--omit=optional", "--no-audit", "--no-fund", "--loglevel=error"], { cwd: dir });
-  if (r.code !== 0) throw new Error(`Runtime install failed:
-${r.stderr.trim()}`);
+  const npm = (args) => exec("npm", [...args, "--ignore-scripts", "--no-audit", "--no-fund", "--loglevel=error"], { cwd: dir });
+  const ci = await npm(["ci", "--omit=optional"]);
+  if (ci.code !== 0) throw new Error(`Runtime install failed:
+${ci.stderr.trim()}`);
+  const bin = await npm(["install", "--no-save", "--omit=optional", `${platform}@${LLAMA_VERSION}`]);
+  if (bin.code !== 0) throw new Error(`Runtime install failed:
+${bin.stderr.trim()}`);
+  const installed = JSON.parse(readFileSync2(join3(dir, "node_modules", ".package-lock.json"), "utf8")).packages[`node_modules/${platform}`]?.integrity;
+  if (installed !== expected) {
+    rmSync(join3(dir, "node_modules"), { recursive: true, force: true });
+    throw new Error(`Integrity check failed for ${platform}: expected ${expected}, got ${installed ?? "nothing"}.`);
+  }
 }
+var LOCK_DIR = fileURLToPath(new URL("../runtime/", import.meta.url));
 var cached;
 function loadRuntime() {
   cached ??= (async () => {
@@ -429,6 +446,7 @@ function formatLine(line, state) {
   if (heading) return chalk2.bold.underline(heading[2]);
   return line.replace(/\*\*([^*]+)\*\*/g, (_, t) => chalk2.bold(t)).replace(/`([^`]+)`/g, (_, t) => chalk2.yellow(t)).replace(/^(\s*)[-*]\s+/, (_, s) => `${s}\u2022 `);
 }
+var stripControl = (s) => s.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, "");
 async function renderStream(tokens, opts = {}) {
   const out = opts.out ?? process.stdout;
   const pretty = !opts.raw && Boolean(out.isTTY);
@@ -437,8 +455,9 @@ async function renderStream(tokens, opts = {}) {
   let full = "";
   let pending = "";
   try {
-    for await (const token of tokens) {
+    for await (const raw of tokens) {
       spinner?.stop();
+      const token = stripControl(raw);
       full += token;
       if (!pretty) {
         out.write(token);
@@ -517,7 +536,7 @@ import chalk3 from "chalk";
 import ora2 from "ora";
 
 // src/context/deps.ts
-import { readdirSync, readFileSync as readFileSync2 } from "fs";
+import { readdirSync, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
 import { builtinModules } from "module";
 import { extname, join as join4 } from "path";
 var SEVERITY_ORDER = ["critical", "high", "moderate", "low", "info"];
@@ -527,7 +546,7 @@ var IMPORT_RE = /(?:import|export)\s[^'"]*?from\s*['"]([^'"]+)['"]|import\s*\(\s
 var BUILTINS = new Set(builtinModules);
 function readPackageJson(cwd) {
   try {
-    return JSON.parse(readFileSync2(join4(cwd, "package.json"), "utf8"));
+    return JSON.parse(readFileSync3(join4(cwd, "package.json"), "utf8"));
   } catch {
     throw new Error(`No readable package.json in ${cwd}`);
   }
@@ -559,6 +578,11 @@ function fixPlan(vulns) {
   }
   return [...groups].map(([command, fixes]) => ({ command, fixes }));
 }
+function breaking(current, latest) {
+  const [cMajor, cMinor] = current.split(".");
+  const [lMajor, lMinor] = latest.split(".");
+  return cMajor !== lMajor || cMajor === "0" && cMinor !== lMinor;
+}
 function parseOutdated(text) {
   const json = parseJson(text) ?? {};
   return Object.entries(json).map(([name, v]) => ({
@@ -566,7 +590,7 @@ function parseOutdated(text) {
     current: v.current,
     wanted: v.wanted,
     latest: v.latest,
-    major: Boolean(v.current && v.latest && v.current.split(".")[0] !== v.latest.split(".")[0])
+    major: Boolean(v.current && v.latest && breaking(v.current, v.latest))
   }));
 }
 function packageName(specifier) {
@@ -590,9 +614,11 @@ function scanImports(cwd, maxFiles = 3e3) {
       if (count >= maxFiles) return;
       if (e.isDirectory()) {
         if (!SKIP_DIRS.has(e.name) && !e.name.startsWith(".")) walk(join4(dir, e.name));
-      } else if (SOURCE_EXT.has(extname(e.name)) || /\.config\.[cm]?[jt]s$/.test(e.name)) {
+      } else if ((SOURCE_EXT.has(extname(e.name)) || /\.config\.[cm]?[jt]s$/.test(e.name)) && !/\.min\.[cm]?js$/.test(e.name)) {
+        const path = join4(dir, e.name);
+        if (statSync2(path).size > 1e6) continue;
         count++;
-        const text = readFileSync2(join4(dir, e.name), "utf8");
+        const text = readFileSync3(path, "utf8");
         for (const m of text.matchAll(IMPORT_RE)) {
           const name = packageName(m[1] ?? m[2] ?? m[3] ?? m[4]);
           if (name) found.add(name);
@@ -606,7 +632,7 @@ function scanImports(cwd, maxFiles = 3e3) {
 function binNames(cwd, dep) {
   let text;
   try {
-    text = readFileSync2(join4(cwd, "node_modules", dep, "package.json"), "utf8");
+    text = readFileSync3(join4(cwd, "node_modules", dep, "package.json"), "utf8");
   } catch {
     return [];
   }
@@ -644,21 +670,99 @@ async function collectDeps(cwd) {
   };
 }
 
+// src/prompts/upgrades.ts
+var UPGRADE_NOTES = {
+  "express@5": "Express 5 uses path-to-regexp v8: wildcard routes must be named (`/*splat`) and optional params use braces; `req.param()` and `app.del()` were removed; rejected promises in async handlers now go to error middleware. Run your route tests.",
+  "body-parser@2": "body-parser 2 (used by Express 5) drops deprecated options and changes `urlencoded` `extended` default to false; check form parsing.",
+  "chalk@5": "chalk 5 is ESM-only; `require('chalk')` fails in CommonJS. Stay on 4 for CJS or migrate the project to ESM.",
+  "node-fetch@3": "node-fetch 3 is ESM-only. On Node 18+ prefer the built-in global `fetch` and remove the dependency.",
+  uuid: "Deep imports such as `require('uuid/v4')` were removed in v8; use `const { v4 } = require('uuid')`.",
+  "mongoose@7": "Mongoose 7 removed callback support from model methods (use async/await) and changed the `strictQuery` default.",
+  "mongoose@8": "Mongoose 7 removed callback support from model methods (use async/await) and changed the `strictQuery` default; Mongoose 8 needs MongoDB 4.4+.",
+  "jest@28": "Jest 28 no longer bundles jsdom (install `jest-environment-jsdom`) and renamed `testURL` to `testEnvironmentOptions.url`.",
+  "jest@29": "Jest 28 no longer bundles jsdom (install `jest-environment-jsdom`) and renamed `testURL` to `testEnvironmentOptions.url`; Jest 29 changed the default snapshot format.",
+  "eslint@9": "ESLint 9 uses flat config (`eslint.config.js`) by default and ignores `.eslintrc`; many plugins need updated versions.",
+  "typescript@5": "TypeScript 5 deprecates flags such as `importsNotUsedAsValues` and implements standard decorators unless `experimentalDecorators` is set; expect some new type errors.",
+  "axios@1": "axios 1.x adds an `exports` map, so deep imports like `axios/lib/...` break, and some TypeScript types were renamed.",
+  helmet: "Newer helmet enables a strict Content-Security-Policy and cross-origin headers by default, which can block inline scripts and third-party assets; test your pages.",
+  inquirer: "inquirer 9+ is ESM-only and v10+ moved to the new `@inquirer/prompts` API.",
+  got: "got 12+ is ESM-only and changed several option names; consider native `fetch` for simple calls.",
+  "webpack@5": "webpack 5 removed automatic Node.js polyfills (`Buffer`, `process`, `crypto`) for browser bundles; add `resolve.fallback` where needed. It also fixes ERR_OSSL_EVP_UNSUPPORTED on Node 17+.",
+  dotenv: "Low risk: dotenv 16 keeps the same `config()` API and adds multiline values.",
+  "@nestjs/core@11": "Nest 11 requires Node 20+ and uses Express 5 by default, so wildcard routes change syntax (`*` must be named, e.g. `*splat`). Upgrade all `@nestjs/*` packages together.",
+  "@nestjs/common@11": "Nest 11 requires Node 20+ and uses Express 5 by default, so wildcard routes change syntax (`*` must be named, e.g. `*splat`). Upgrade all `@nestjs/*` packages together.",
+  "@prisma/client": "Prisma 5 removed `rejectOnNotFound` (use `findUniqueOrThrow`); Prisma 6 needs Node 18.18+ and TypeScript 5.1+, and `Bytes` fields become `Uint8Array`. Upgrade `prisma` and `@prisma/client` to the same version and re-run `prisma generate`.",
+  prisma: "Upgrade `prisma` and `@prisma/client` to the same version and re-run `prisma generate`; Prisma 5 removed `rejectOnNotFound`, Prisma 6 needs Node 18.18+ and TypeScript 5.1+.",
+  "class-validator@0": "Low risk for most apps: 0.14 fixes a security issue where unknown values skipped validation; `forbidUnknownValues` now defaults to true, so plain objects without decorators are rejected.",
+  "redis@4": "node-redis 4 is promise-based: call `await client.connect()` before use, and commands are camelCase (`hSet`, not `hset`) with no callbacks.",
+  glob: "glob 9+ has a promise API only (no callbacks) and a named export: `import { glob } from 'glob'`.",
+  rimraf: "rimraf 4+ has a promise API only and a named export: `import { rimraf } from 'rimraf'`."
+};
+var major = (version) => version?.split(".")[0];
+function upgradeNote(name, latest) {
+  return UPGRADE_NOTES[`${name}@${major(latest)}`] ?? UPGRADE_NOTES[name];
+}
+
+// src/context/depsPlan.ts
+var SEVERITY_RANK = ["critical", "high", "moderate", "low", "info"];
+function buildPlan(r) {
+  const sections = [];
+  const byName = new Map(r.vulnerabilities.map((v) => [v.name, v]));
+  if (r.vulnerabilities.length) {
+    const items = fixPlan(r.vulnerabilities).map(({ command, fixes }) => {
+      const vulns = fixes.map((n) => byName.get(n));
+      const worst = vulns.map((v) => v.severity).sort((a, b) => SEVERITY_RANK.indexOf(a) - SEVERITY_RANK.indexOf(b))[0];
+      const titles = vulns.map((v) => `${v.name}: ${v.title ?? "advisory"}`).join("; ");
+      if (command === "no fix available") return `- **No fix available** (${worst}): ${titles}. Replace the package or check whether the vulnerable code is reachable.`;
+      const major2 = command.endsWith("(major)");
+      return `- \`${command.replace(" (major)", "")}\`${major2 ? " **(major version, see notes below)**" : ""} (${worst}): ${titles}.`;
+    });
+    sections.push(`**1. Security**
+${items.join("\n")}`);
+  }
+  const majors = r.outdated.filter((o) => o.major);
+  if (majors.length) {
+    const items = majors.map((o) => {
+      const note = upgradeNote(o.name, o.latest);
+      return `- **${o.name} ${o.current ?? "?"} \u2192 ${o.latest}**: ${note ?? "no verified notes. Read its changelog / release notes before upgrading."}`;
+    });
+    sections.push(`**2. Major upgrades**
+${items.join("\n")}`);
+  }
+  const cleanup = [];
+  if (r.unused.length) cleanup.push(`- \`npm uninstall ${r.unused.join(" ")}\`: not imported anywhere (double-check config files, scripts and dynamic requires first).`);
+  if (r.missing.length) cleanup.push(`- \`npm install ${r.missing.join(" ")}\`: imported in code but missing from package.json.`);
+  const minors = r.outdated.filter((o) => !o.major);
+  if (minors.length) cleanup.push(`- \`npm update\`: safe minor/patch updates for ${minors.map((m) => m.name).join(", ")}.`);
+  if (cleanup.length) sections.push(`**3. Cleanup**
+${cleanup.join("\n")}`);
+  return sections.join("\n\n");
+}
+
 // src/prompts/deps.ts
 function depsPrompt(r, nodeVersion) {
-  const lines = [`Node ${nodeVersion}`];
+  const lines2 = [`Node ${nodeVersion}`];
   if (r.vulnerabilities.length) {
-    lines.push("Vulnerabilities:", ...r.vulnerabilities.slice(0, 20).map((v) => `- ${v.name} [${v.severity}] ${v.title ?? ""}`));
-    lines.push("Fix commands (already computed and correct):", ...fixPlan(r.vulnerabilities).map((f) => `- ${f.command} \u2192 fixes ${f.fixes.join(", ")}`));
+    const title = new Map(r.vulnerabilities.map((v) => [v.name, v.title]));
+    lines2.push("Vulnerabilities:", ...r.vulnerabilities.slice(0, 20).map((v) => `- ${v.name} [${v.severity}] ${v.title ?? ""}`));
+    lines2.push(
+      "Fix commands (already computed and correct):",
+      ...fixPlan(r.vulnerabilities).map((f) => `- ${f.command} \u2192 fixes ${f.fixes.map((n) => title.get(n) ? `${n} (${title.get(n)})` : n).join(", ")}`)
+    );
   }
   if (r.outdated.length) {
-    lines.push("Outdated:", ...r.outdated.slice(0, 25).map((o) => `- ${o.name} ${o.current ?? "not installed"} \u2192 latest ${o.latest}${o.major ? " (MAJOR)" : ""}`));
+    lines2.push("Outdated:", ...r.outdated.slice(0, 25).map((o) => `- ${o.name} ${o.current ?? "not installed"} \u2192 latest ${o.latest}${o.major ? " (MAJOR)" : ""}`));
+    const notes = r.outdated.filter((o) => o.major).map((o) => [o, upgradeNote(o.name, o.latest)]);
+    const known = notes.filter(([, n]) => n);
+    if (known.length) lines2.push("Verified upgrade notes:", ...known.map(([o, n]) => `- ${o.name} \u2192 ${o.latest}: ${n}`));
+    const unknown = notes.filter(([, n]) => !n).map(([o]) => o.name);
+    if (unknown.length) lines2.push(`No verified notes for: ${unknown.join(", ")}`);
   }
-  if (r.unused.length) lines.push(`Possibly unused dependencies: ${r.unused.join(", ")}`);
-  if (r.missing.length) lines.push(`Imported but not declared in package.json: ${r.missing.join(", ")}`);
+  if (r.unused.length) lines2.push(`Possibly unused dependencies: ${r.unused.join(", ")}`);
+  if (r.missing.length) lines2.push(`Imported but not declared in package.json: ${r.missing.join(", ")}`);
   return {
-    instruction: "You are given facts about a Node.js project's dependencies. Write a short, prioritized action plan:\n1. Security: repeat each fix command exactly as given and say in one line why it matters. Never change versions.\n2. Major upgrades (marked MAJOR only): for each, the main breaking-change risk you know of and what to check.\n3. Cleanup: unused packages to remove and missing packages to add.\nDo not repeat the raw lists. Do not invent versions or advisories. Skip any section with nothing to do.",
-    input: lines.join("\n")
+    instruction: "You are given facts about a Node.js project's dependencies. Write a short, prioritized action plan:\n1. Security: repeat each fix command exactly as given and say in one line why it matters, based only on the advisory titles. Never change versions.\n2. Major upgrades (marked MAJOR only): restate the verified upgrade note for each. For packages with no verified notes, say to read their changelog before upgrading; do not guess API changes.\n3. Cleanup: unused packages to remove and missing packages to add.\nDo not repeat the raw lists. Do not invent versions, advisories or APIs. Skip any section with nothing to do.",
+    input: lines2.join("\n")
   };
 }
 
@@ -702,9 +806,10 @@ async function depsCommand(config2, opts) {
   const spinner = !opts.json && process.stderr.isTTY ? ora2({ text: "Running npm audit and npm outdated\u2026", stream: process.stderr }).start() : null;
   const report = await collectDeps(cwd).finally(() => spinner?.stop());
   const wantAi = opts.ai && !isHealthy(report);
+  const plan = isHealthy(report) ? "" : buildPlan(report);
   if (opts.json) {
     const analysis = wantAi ? await generate(config2, depsPrompt(report, process.versions.node), { json: true }) : void 0;
-    printJson({ ...report, analysis });
+    printJson({ ...report, plan, analysis });
     return;
   }
   printReport(report);
@@ -712,11 +817,18 @@ async function depsCommand(config2, opts) {
     console.log(chalk3.green("\u2714 Dependencies look healthy."));
     return;
   }
+  console.log(chalk3.bold.underline("Action plan"));
+  await renderStream(lines(plan), { raw: opts.raw });
   if (wantAi) {
-    console.log(chalk3.bold.underline("Advice"));
+    console.log(chalk3.bold.underline("\nAI notes"));
     await generate(config2, depsPrompt(report, process.versions.node), opts);
+  } else {
+    console.log(chalk3.dim("\nRun with --ai for extra AI commentary."));
   }
 }
+async function* lines(text) {
+  yield text;
+}
 
 // src/commands/doctor.ts
 import chalk4 from "chalk";
@@ -735,8 +847,8 @@ async function probe(name, check) {
   }
 }
 async function doctorCommand(config2) {
-  const major = Number(process.versions.node.split(".")[0]);
-  if (major >= 20) ok(`Node.js ${process.versions.node}`);
+  const major2 = Number(process.versions.node.split(".")[0]);
+  if (major2 >= 20) ok(`Node.js ${process.versions.node}`);
   else fail(`Node.js ${process.versions.node}`, "Eventa needs Node.js 20 or newer");
   const ollamaOk = await probe(`Ollama (${config2.model})`, () => new OllamaProvider(config2.model, config2.ollamaHost).check());
   const localOk = await probe(`Built-in runtime (${config2.localModel})`, () => new LocalProvider(config2.localModel).check());
@@ -744,11 +856,11 @@ async function doctorCommand(config2) {
   console.log(chalk4.dim(`
 Provider setting: ${config2.provider} \u2192 using ${active.name} (${active.model})`));
   if (!ollamaOk && !localOk) console.log(chalk4.dim("Neither is ready yet. Eventa installs the built-in runtime and model on first use, or run `eventa model pull` now."));
-  return major >= 20 && (ollamaOk || localOk);
+  return major2 >= 20 && (ollamaOk || localOk);
 }
 
 // src/commands/model.ts
-import { rmSync } from "fs";
+import { rmSync as rmSync2 } from "fs";
 import chalk5 from "chalk";
 function modelList() {
   const { localModel } = loadConfig();
@@ -774,20 +886,20 @@ function modelUse(id) {
 function modelRemove(id) {
   const spec = resolveModel(id);
   if (!spec.url) throw new Error("Refusing to delete a local file you provided yourself.");
-  rmSync(modelPath(spec), { force: true });
-  rmSync(`${modelPath(spec)}.part`, { force: true });
+  rmSync2(modelPath(spec), { force: true });
+  rmSync2(`${modelPath(spec)}.part`, { force: true });
   console.log(`Removed ${spec.id}`);
 }
 
 // src/commands/explain.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { relative as relative2 } from "path";
 import chalk6 from "chalk";
 
 // src/context/stackParser.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
 import { isAbsolute, relative, resolve as resolve2 } from "path";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 var FRAME_RE = /^\s*at\s+(?:async\s+(?=[^(]*$))?(?:(.+?)\s+\()?((?:file:\/\/|node:|[A-Za-z]:[\\/]|[\\/.]).+?):(\d+)(?::(\d+))?\)?\s*$/;
 var HEADER_RE = /^((?:file:\/\/\/?)?(?:[A-Za-z]:)?[^\s:]+\.(?:[cm]?[jt]sx?)):(\d+)$/;
 var MESSAGE_RE = /^\s*(?:Uncaught\s+)?((?:[A-Z][A-Za-z]*)?Error(?:\s\[[A-Z0-9_]+\])?:\s.*)$/;
@@ -802,7 +914,7 @@ var PATTERN_CODES = [
 function toPath(file) {
   if (file.startsWith("file://")) {
     try {
-      return fileURLToPath(file);
+      return fileURLToPath2(file);
     } catch {
       return file;
     }
@@ -855,17 +967,21 @@ function parseStack(raw) {
   result.code = PATTERN_CODES.find(([re]) => re.test(text))?.[1] ?? CODE_RE.exec(text)?.[1];
   return result;
 }
+function insideProject(file, cwd) {
+  const rel = relative(resolve2(cwd), resolve2(file));
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel) && !/(^|[\\/])node_modules([\\/]|$)/.test(rel);
+}
 function userFrames(parsed, cwd, limit = 3) {
-  return parsed.frames.filter((f) => !f.internal && !f.dependency).map((f) => ({ ...f, file: isAbsolute(f.file) ? f.file : resolve2(cwd, f.file) })).filter((f) => existsSync4(f.file)).slice(0, limit);
+  return parsed.frames.filter((f) => !f.internal && !f.dependency).map((f) => ({ ...f, file: isAbsolute(f.file) ? f.file : resolve2(cwd, f.file) })).filter((f) => insideProject(f.file, cwd) && existsSync4(f.file)).slice(0, limit);
 }
 function readSnippet(file, marked, radius = 15, cwd = process.cwd()) {
   const targets = (Array.isArray(marked) ? marked : [marked]).slice().sort((a, b) => a - b);
-  const lines = readFileSync3(file, "utf8").split(/\r?\n/);
+  const lines2 = readFileSync4(file, "utf8").split(/\r?\n/);
   const start = Math.max(1, targets[0] - radius);
-  const end = Math.min(lines.length, targets[targets.length - 1] + radius);
+  const end = Math.min(lines2.length, targets[targets.length - 1] + radius);
   const body = [];
   for (let n = start; n <= end; n++) {
-    body.push(targets.includes(n) ? `${lines[n - 1]}  // <-- line ${n}, in the stack trace` : lines[n - 1]);
+    body.push(targets.includes(n) ? `${lines2[n - 1]}  // <-- line ${n}, in the stack trace` : lines2[n - 1]);
   }
   return `// ${relative(cwd, file) || file} (lines ${start}-${end})
 ${body.join("\n")}`;
@@ -873,12 +989,12 @@ ${body.join("\n")}`;
 function snippetsFor(frames, radius, cwd) {
   const byFile = /* @__PURE__ */ new Map();
   for (const f of frames) {
-    const lines = byFile.get(f.file) ?? [];
-    const last = lines[lines.length - 1];
-    if (last === void 0 || Math.abs(f.line - last) <= radius * 2) lines.push(f.line);
-    byFile.set(f.file, lines);
+    const lines2 = byFile.get(f.file) ?? [];
+    const last = lines2[lines2.length - 1];
+    if (last === void 0 || Math.abs(f.line - last) <= radius * 2) lines2.push(f.line);
+    byFile.set(f.file, lines2);
   }
-  return [...byFile].map(([file, lines]) => readSnippet(file, lines, radius, cwd));
+  return [...byFile].map(([file, lines2]) => readSnippet(file, lines2, radius, cwd));
 }
 
 // src/context/tokens.ts
@@ -987,7 +1103,7 @@ ${r.stdout}`.trim();
     if (r.code === 0 && !parseStack(output).message) return null;
     return output;
   }
-  if (opts.file) return readFileSync4(opts.file, "utf8");
+  if (opts.file) return readFileSync5(opts.file, "utf8");
   if (words.length) return words.join(" ");
   return readStdin();
 }
@@ -1197,7 +1313,7 @@ async function reviewCommand(config2, opts) {
 
 // src/index.ts
 var program = new Command();
-program.name("eventa").description("Offline AI assistant for Node.js developers").version("0.1.0").option("-m, --model <name>", "model to use (overrides config)").option("--host <url>", "Ollama host URL").option("-p, --provider <name>", "auto | ollama | local").option("--raw", "print plain output without terminal formatting");
+program.name("eventa").description("Offline AI assistant for Node.js developers").version("0.1.2").option("-m, --model <name>", "model to use (overrides config)").option("--host <url>", "Ollama host URL").option("-p, --provider <name>", "auto | ollama | local").option("--raw", "print plain output without terminal formatting");
 var configFrom = (cmd) => {
   const g = cmd.optsWithGlobals();
   if (g.provider && !["auto", "ollama", "local"].includes(g.provider)) throw new Error("--provider must be auto, ollama or local");
@@ -1215,7 +1331,7 @@ program.command("review").description("review your staged git diff (falls back t
   const { config: config2, raw } = configFrom(cmd);
   await reviewCommand(config2, { ...opts, raw });
 });
-program.command("deps").description("audit dependencies: vulnerabilities, outdated, unused and missing packages").option("--no-ai", "only print the report, skip AI advice").option("--json", "print JSON output").action(async (opts, cmd) => {
+program.command("deps").description("audit dependencies: vulnerabilities, outdated, unused and missing packages").option("--ai", "also ask the model for extra commentary (the action plan itself is always deterministic)").option("--json", "print JSON output").action(async (opts, cmd) => {
   const { config: config2, raw } = configFrom(cmd);
   await depsCommand(config2, { ...opts, raw });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeeva1398/eventa",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "Offline AI assistant for Node.js developers: explain errors, review diffs, audit dependencies.",
   "type": "module",
   "bin": {
@@ -8,6 +8,7 @@
   },
   "files": [
     "dist",
+    "runtime",
     "README.md",
     "LICENSE"
   ],