@jeeva1398/eventa 0.1.1 → 0.1.2

package/README.md

@@ -46,6 +46,24 @@ Global flags: `-p, --provider auto|ollama|local`, `-m, --model <name>`, `--host
 | `contextSize` | `8192` | |
 | `temperature` | `0.2` | |
 
+## Privacy & security
+
+Your code is only sent to the model running on your machine: the built-in runtime, or Ollama at `ollamaHost`. If you point that at a remote server, code goes there. Eventa makes these network calls:
+
+| When | Where | What is sent |
+|---|---|---|
+| First local use | npm registry | Downloads the runtime from a **pinned lockfile** with integrity hashes and **install scripts disabled** |
+| First local use | huggingface.co | Downloads the model from a pinned commit and verifies its **SHA-256** |
+| `eventa deps` | npm registry | Runs `npm audit` / `npm outdated`, which send your dependency names and versions (exactly as running them yourself would) |
+
+Other safeguards:
+- `explain` only reads source files inside the current project, never arbitrary paths from a pasted stack trace.
+- Model output is printed as text with terminal control sequences stripped, and is never executed.
+- `--run` executes only the command you type.
+- The npm package is published with provenance from GitHub Actions.
+
+Found a security problem? Please open a private advisory: https://github.com/Jeeva1398/eventa/security/advisories/new
+
 ## Limitations
 This is a 1.5B model. It is fast and private, but it can be wrong, so treat its answers as a strong hint, not a verdict. The facts Eventa computes itself (stack frames, audit fixes, unused/missing packages, static checks) are deterministic.
 

package/dist/index.js

@@ -92,10 +92,10 @@ var modelPath = (spec) => spec.url ? join2(modelsDir(), spec.file) : spec.file;
 var isDownloaded = (spec) => existsSync(modelPath(spec));
 
 // src/model/runtime.ts
-import { existsSync as existsSync2, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync } from "fs";
 import { createRequire } from "module";
 import { join as join3 } from "path";
-import { pathToFileURL } from "url";
+import { fileURLToPath, pathToFileURL } from "url";
 
 // src/context/exec.ts
 import { spawn } from "child_process";
@@ -135,15 +135,32 @@ async function installRuntime(log2 = () => {
   if (Number(process.versions.node.split(".")[0]) < 20) {
     throw new Error("The built-in runtime needs Node.js 20 or newer. Upgrade Node, or use Ollama.");
   }
+  if (!existsSync2(join3(LOCK_DIR, "package-lock.json"))) {
+    throw new Error("The built-in runtime is installed by the npm package. Use `npx @jeeva1398/eventa`, or run Ollama with this binary.");
+  }
   const dir = runtimeDir();
+  const platform = platformPackage();
+  rmSync(join3(dir, "node_modules"), { recursive: true, force: true });
   mkdirSync2(dir, { recursive: true });
-  const manifest = join3(dir, "package.json");
-  if (!existsSync2(manifest)) writeFileSync2(manifest, JSON.stringify({ name: "eventa-runtime", private: true }, null, 2));
+  for (const f of ["package.json", "package-lock.json"]) copyFileSync(join3(LOCK_DIR, f), join3(dir, f));
+  const lock = JSON.parse(readFileSync2(join3(dir, "package-lock.json"), "utf8"));
+  const expected = lock.packages[`node_modules/${platform}`]?.integrity;
+  if (!expected) throw new Error(`No pinned runtime binary for ${platform}.`);
   log2(`Installing the local runtime (node-llama-cpp ${LLAMA_VERSION}, about 80 MB, one time)\u2026`);
-  const r = await exec("npm", ["install", `node-llama-cpp@${LLAMA_VERSION}`, `${platformPackage()}@${LLAMA_VERSION}`, "--omit=optional", "--no-audit", "--no-fund", "--loglevel=error"], { cwd: dir });
-  if (r.code !== 0) throw new Error(`Runtime install failed:
-${r.stderr.trim()}`);
+  const npm = (args) => exec("npm", [...args, "--ignore-scripts", "--no-audit", "--no-fund", "--loglevel=error"], { cwd: dir });
+  const ci = await npm(["ci", "--omit=optional"]);
+  if (ci.code !== 0) throw new Error(`Runtime install failed:
+${ci.stderr.trim()}`);
+  const bin = await npm(["install", "--no-save", "--omit=optional", `${platform}@${LLAMA_VERSION}`]);
+  if (bin.code !== 0) throw new Error(`Runtime install failed:
+${bin.stderr.trim()}`);
+  const installed = JSON.parse(readFileSync2(join3(dir, "node_modules", ".package-lock.json"), "utf8")).packages[`node_modules/${platform}`]?.integrity;
+  if (installed !== expected) {
+    rmSync(join3(dir, "node_modules"), { recursive: true, force: true });
+    throw new Error(`Integrity check failed for ${platform}: expected ${expected}, got ${installed ?? "nothing"}.`);
+  }
 }
+var LOCK_DIR = fileURLToPath(new URL("../runtime/", import.meta.url));
 var cached;
 function loadRuntime() {
   cached ??= (async () => {
@@ -429,6 +446,7 @@ function formatLine(line, state) {
   if (heading) return chalk2.bold.underline(heading[2]);
   return line.replace(/\*\*([^*]+)\*\*/g, (_, t) => chalk2.bold(t)).replace(/`([^`]+)`/g, (_, t) => chalk2.yellow(t)).replace(/^(\s*)[-*]\s+/, (_, s) => `${s}\u2022 `);
 }
+var stripControl = (s) => s.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g, "");
 async function renderStream(tokens, opts = {}) {
   const out = opts.out ?? process.stdout;
   const pretty = !opts.raw && Boolean(out.isTTY);
@@ -437,8 +455,9 @@ async function renderStream(tokens, opts = {}) {
   let full = "";
   let pending = "";
   try {
-    for await (const token of tokens) {
+    for await (const raw of tokens) {
       spinner?.stop();
+      const token = stripControl(raw);
       full += token;
       if (!pretty) {
         out.write(token);
@@ -517,7 +536,7 @@ import chalk3 from "chalk";
 import ora2 from "ora";
 
 // src/context/deps.ts
-import { readdirSync, readFileSync as readFileSync2 } from "fs";
+import { readdirSync, readFileSync as readFileSync3, statSync as statSync2 } from "fs";
 import { builtinModules } from "module";
 import { extname, join as join4 } from "path";
 var SEVERITY_ORDER = ["critical", "high", "moderate", "low", "info"];
@@ -527,7 +546,7 @@ var IMPORT_RE = /(?:import|export)\s[^'"]*?from\s*['"]([^'"]+)['"]|import\s*\(\s
 var BUILTINS = new Set(builtinModules);
 function readPackageJson(cwd) {
   try {
-    return JSON.parse(readFileSync2(join4(cwd, "package.json"), "utf8"));
+    return JSON.parse(readFileSync3(join4(cwd, "package.json"), "utf8"));
   } catch {
     throw new Error(`No readable package.json in ${cwd}`);
   }
@@ -595,9 +614,11 @@ function scanImports(cwd, maxFiles = 3e3) {
       if (count >= maxFiles) return;
       if (e.isDirectory()) {
         if (!SKIP_DIRS.has(e.name) && !e.name.startsWith(".")) walk(join4(dir, e.name));
-      } else if (SOURCE_EXT.has(extname(e.name)) || /\.config\.[cm]?[jt]s$/.test(e.name)) {
+      } else if ((SOURCE_EXT.has(extname(e.name)) || /\.config\.[cm]?[jt]s$/.test(e.name)) && !/\.min\.[cm]?js$/.test(e.name)) {
+        const path = join4(dir, e.name);
+        if (statSync2(path).size > 1e6) continue;
         count++;
-        const text = readFileSync2(join4(dir, e.name), "utf8");
+        const text = readFileSync3(path, "utf8");
         for (const m of text.matchAll(IMPORT_RE)) {
           const name = packageName(m[1] ?? m[2] ?? m[3] ?? m[4]);
           if (name) found.add(name);
@@ -611,7 +632,7 @@ function scanImports(cwd, maxFiles = 3e3) {
 function binNames(cwd, dep) {
   let text;
   try {
-    text = readFileSync2(join4(cwd, "node_modules", dep, "package.json"), "utf8");
+    text = readFileSync3(join4(cwd, "node_modules", dep, "package.json"), "utf8");
   } catch {
     return [];
   }
@@ -839,7 +860,7 @@ Provider setting: ${config2.provider} \u2192 using ${active.name} (${active.mode
 }
 
 // src/commands/model.ts
-import { rmSync } from "fs";
+import { rmSync as rmSync2 } from "fs";
 import chalk5 from "chalk";
 function modelList() {
   const { localModel } = loadConfig();
@@ -865,20 +886,20 @@ function modelUse(id) {
 function modelRemove(id) {
   const spec = resolveModel(id);
   if (!spec.url) throw new Error("Refusing to delete a local file you provided yourself.");
-  rmSync(modelPath(spec), { force: true });
-  rmSync(`${modelPath(spec)}.part`, { force: true });
+  rmSync2(modelPath(spec), { force: true });
+  rmSync2(`${modelPath(spec)}.part`, { force: true });
   console.log(`Removed ${spec.id}`);
 }
 
 // src/commands/explain.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import { relative as relative2 } from "path";
 import chalk6 from "chalk";
 
 // src/context/stackParser.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
 import { isAbsolute, relative, resolve as resolve2 } from "path";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 var FRAME_RE = /^\s*at\s+(?:async\s+(?=[^(]*$))?(?:(.+?)\s+\()?((?:file:\/\/|node:|[A-Za-z]:[\\/]|[\\/.]).+?):(\d+)(?::(\d+))?\)?\s*$/;
 var HEADER_RE = /^((?:file:\/\/\/?)?(?:[A-Za-z]:)?[^\s:]+\.(?:[cm]?[jt]sx?)):(\d+)$/;
 var MESSAGE_RE = /^\s*(?:Uncaught\s+)?((?:[A-Z][A-Za-z]*)?Error(?:\s\[[A-Z0-9_]+\])?:\s.*)$/;
@@ -893,7 +914,7 @@ var PATTERN_CODES = [
 function toPath(file) {
   if (file.startsWith("file://")) {
     try {
-      return fileURLToPath(file);
+      return fileURLToPath2(file);
     } catch {
       return file;
     }
@@ -946,12 +967,16 @@ function parseStack(raw) {
   result.code = PATTERN_CODES.find(([re]) => re.test(text))?.[1] ?? CODE_RE.exec(text)?.[1];
   return result;
 }
+function insideProject(file, cwd) {
+  const rel = relative(resolve2(cwd), resolve2(file));
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute(rel) && !/(^|[\\/])node_modules([\\/]|$)/.test(rel);
+}
 function userFrames(parsed, cwd, limit = 3) {
-  return parsed.frames.filter((f) => !f.internal && !f.dependency).map((f) => ({ ...f, file: isAbsolute(f.file) ? f.file : resolve2(cwd, f.file) })).filter((f) => existsSync4(f.file)).slice(0, limit);
+  return parsed.frames.filter((f) => !f.internal && !f.dependency).map((f) => ({ ...f, file: isAbsolute(f.file) ? f.file : resolve2(cwd, f.file) })).filter((f) => insideProject(f.file, cwd) && existsSync4(f.file)).slice(0, limit);
 }
 function readSnippet(file, marked, radius = 15, cwd = process.cwd()) {
   const targets = (Array.isArray(marked) ? marked : [marked]).slice().sort((a, b) => a - b);
-  const lines2 = readFileSync3(file, "utf8").split(/\r?\n/);
+  const lines2 = readFileSync4(file, "utf8").split(/\r?\n/);
   const start = Math.max(1, targets[0] - radius);
   const end = Math.min(lines2.length, targets[targets.length - 1] + radius);
   const body = [];
@@ -1078,7 +1103,7 @@ ${r.stdout}`.trim();
     if (r.code === 0 && !parseStack(output).message) return null;
     return output;
   }
-  if (opts.file) return readFileSync4(opts.file, "utf8");
+  if (opts.file) return readFileSync5(opts.file, "utf8");
   if (words.length) return words.join(" ");
   return readStdin();
 }
@@ -1288,7 +1313,7 @@ async function reviewCommand(config2, opts) {
 
 // src/index.ts
 var program = new Command();
-program.name("eventa").description("Offline AI assistant for Node.js developers").version("0.1.1").option("-m, --model <name>", "model to use (overrides config)").option("--host <url>", "Ollama host URL").option("-p, --provider <name>", "auto | ollama | local").option("--raw", "print plain output without terminal formatting");
+program.name("eventa").description("Offline AI assistant for Node.js developers").version("0.1.2").option("-m, --model <name>", "model to use (overrides config)").option("--host <url>", "Ollama host URL").option("-p, --provider <name>", "auto | ollama | local").option("--raw", "print plain output without terminal formatting");
 var configFrom = (cmd) => {
   const g = cmd.optsWithGlobals();
   if (g.provider && !["auto", "ollama", "local"].includes(g.provider)) throw new Error("--provider must be auto, ollama or local");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeeva1398/eventa",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "Offline AI assistant for Node.js developers: explain errors, review diffs, audit dependencies.",
   "type": "module",
   "bin": {
@@ -8,6 +8,7 @@
   },
   "files": [
     "dist",
+    "runtime",
     "README.md",
     "LICENSE"
   ],