@stupify/cli 0.0.14 → 0.0.16

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stupify contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -2,6 +2,8 @@
 
 Local-only diagnostic CLI for checking whether AI is making you dumber.
 
+Released under the MIT License.
+
 Stupify has one analysis path:
 
 ```text
@@ -48,7 +50,8 @@ stupify --staged --max-search-input-tokens 24000
 ```
 
 The package is prepared for the public `@stupify` npm scope. Publishing should
-run the TypeScript build first so the executable points at `dist/stupify.js`.
+use the repository release workflow so npm receives Trusted Publishing
+provenance. See the repository release docs.
 
 This iteration intentionally does not run findings audit, validators, judges,
 baselines, hosted LLM APIs, GitHub integration, dashboards, or repo-wide

package/dist/analysis.js

@@ -74,6 +74,9 @@ function uncheckedSearchMatches(value, contexts) {
                 reason: match.reason ?? "",
                 proof: sourcePointer(context),
                 snapshot: sourceSnapshot(context),
+                filePath: context.filePath,
+                entityName: context.entityName,
+                entityKind: context.entityKind,
             }];
     });
 }

package/dist/constants.d.ts

@@ -1,4 +1,4 @@
-export declare const VERSION = "0.0.14";
+export declare const VERSION = "0.0.16";
 import type { ModelConfig, ModelId } from "./types.ts";
 export declare const DEFAULT_MODEL_ID: ModelId;
 export declare const MODEL_REGISTRY: Record<ModelId, ModelConfig>;

package/dist/constants.js

@@ -1,4 +1,4 @@
-export const VERSION = "0.0.14";
+export const VERSION = "0.0.16";
 export const DEFAULT_MODEL_ID = "gemma-4-e2b";
 export const MODEL_REGISTRY = {
     "gemma-4-e2b": {

package/dist/doctor.d.ts

@@ -1,4 +1,16 @@
-export declare function runDoctor(): Promise<Readonly<{
+import type { CliUi } from "./ui.ts";
+type CheckStatus = "ok" | "missing" | "info";
+type DoctorCheck = Readonly<{
+    label: string;
+    status: CheckStatus;
+    detail: string;
+    required?: boolean;
+}>;
+export type DoctorResult = Readonly<{
     exitCode: number;
     text: string;
-}>>;
+    checks: readonly DoctorCheck[];
+}>;
+export declare function runDoctor(): Promise<DoctorResult>;
+export declare function renderDoctorToUi(result: DoctorResult, ui: CliUi): void;
+export {};

package/dist/doctor.js

@@ -19,8 +19,20 @@ export async function runDoctor() {
     return {
         exitCode: requiredMissing ? 1 : 0,
         text: renderDoctor(checks),
+        checks,
     };
 }
+export function renderDoctorToUi(result, ui) {
+    const missingRequired = result.checks.filter((check) => check.required && check.status === "missing");
+    if (missingRequired.length > 0) {
+        ui.error(`Doctor found ${missingRequired.length} missing required dependency.`);
+    }
+    else {
+        ui.success("Doctor checks complete.");
+    }
+    ui.note(result.checks.map((check) => `${icon(check.status)} ${check.label}: ${check.detail}`).join("\n"), "Doctor");
+    ui.note("Local-only. Stupify does not upload source, diffs, filenames, repo URLs, commit messages, author names, or private package names.", "Privacy");
+}
 async function gitCheck() {
     try {
         const { stdout } = await execFileAsync("git", ["rev-parse", "--show-toplevel"], { maxBuffer: 1024 * 1024 });

package/dist/git.d.ts

@@ -1,4 +1,4 @@
-import { type NetDiff, type SourceRange, type StagedDiff } from "./types.ts";
+import { type BlameSummary, type NetDiff, type SourceRange, type StagedDiff } from "./types.ts";
 export declare function netDiffSince(since: string): Promise<NetDiff>;
 export declare function netDiffForCommit(commit: string): Promise<NetDiff>;
 export declare function netDiffForRecentCommits(count: number): Promise<NetDiff>;
@@ -10,3 +10,8 @@ export declare function stagedDiff(): Promise<StagedDiff>;
 export declare function gitRoot(): Promise<string>;
 export declare function gitPath(pathspec: string): Promise<string>;
 export declare function gitUserLabel(): Promise<string>;
+export declare function blameEntity(input: Readonly<{
+    filePath: string;
+    entityName: string;
+    rev: string;
+}>): Promise<BlameSummary | null>;

package/dist/git.js

@@ -98,6 +98,23 @@ export async function gitUserLabel() {
         return `${name} <${email}>`;
     return name || email || "working tree";
 }
+export async function blameEntity(input) {
+    try {
+        const { stdout } = await execFileAsync("git", [
+            "blame",
+            "--line-porcelain",
+            "-L",
+            `:${input.entityName}`,
+            input.rev,
+            "--",
+            input.filePath,
+        ], { maxBuffer: 16 * 1024 * 1024 });
+        return summarizeBlame(stdout);
+    }
+    catch {
+        return null;
+    }
+}
 async function netDiff(base, target, label, id) {
     const [text, stats, shortBase, shortTarget] = await Promise.all([
         diff(base, target),
@@ -115,11 +132,12 @@ async function netDiff(base, target, label, id) {
     };
 }
 async function sourceRange(base, target, label, id) {
-    const [stats, shortBase, shortTarget, committers] = await Promise.all([
+    const [stats, shortBase, shortTarget, committers, commitSubjects] = await Promise.all([
         diffStats(base, target),
         shortCommit(base),
         shortCommit(target),
         committersForRange(base, target),
+        commitSubjectsForRange(base, target),
     ]);
     return {
         id: id ?? sourceId(`net:${shortBase}..${shortTarget}`),
@@ -127,6 +145,7 @@ async function sourceRange(base, target, label, id) {
         base,
         target,
         committers,
+        commitSubjects,
         stats,
     };
 }
@@ -150,6 +169,17 @@ async function committersForRange(base, target) {
         return [];
     }
 }
+async function commitSubjectsForRange(base, target) {
+    try {
+        const { stdout } = await execFileAsync("git", ["log", "--format=%s", `${base}..${target}`], {
+            maxBuffer: 4 * 1024 * 1024,
+        });
+        return uniqueLines(stdout);
+    }
+    catch {
+        return [];
+    }
+}
 function uniqueLines(value) {
     const seen = new Set();
     const lines = [];
@@ -296,3 +326,43 @@ async function commitMessage(commit) {
 function firstLine(value) {
     return value.trim().split(/\r?\n/, 1)[0]?.trim() ?? "";
 }
+function summarizeBlame(output) {
+    const entries = new Map();
+    let currentCommit = "";
+    let currentAuthor = "";
+    let currentSubject = "";
+    for (const line of output.split(/\r?\n/)) {
+        const header = /^([0-9a-f]{40})\s+/.exec(line);
+        if (header?.[1]) {
+            currentCommit = header[1];
+            currentAuthor = "";
+            currentSubject = "";
+            continue;
+        }
+        if (line.startsWith("author ")) {
+            currentAuthor = line.slice("author ".length).trim();
+            continue;
+        }
+        if (line.startsWith("summary ")) {
+            currentSubject = line.slice("summary ".length).trim();
+            continue;
+        }
+        if (!line.startsWith("\t") || !currentCommit)
+            continue;
+        const previous = entries.get(currentCommit);
+        entries.set(currentCommit, {
+            commit: currentCommit,
+            author: currentAuthor || previous?.author || "unknown author",
+            subject: currentSubject || previous?.subject || currentCommit.slice(0, 7),
+            count: (previous?.count ?? 0) + 1,
+        });
+    }
+    const [best] = [...entries.values()].sort((a, b) => b.count - a.count);
+    if (!best)
+        return null;
+    return {
+        commit: best.commit.slice(0, 7),
+        author: best.author,
+        subject: best.subject,
+    };
+}

package/dist/hooks.d.ts

@@ -1,3 +1,5 @@
 import type { HookAction } from "./types.ts";
+import type { CliUi } from "./ui.ts";
 export declare function runHookCommand(action: HookAction): Promise<string>;
+export declare function renderHookResultToUi(result: string, ui: CliUi): void;
 export declare function hookSnippet(): string;

package/dist/hooks.js

@@ -14,6 +14,24 @@ export async function runHookCommand(action) {
         return installHook();
     return uninstallHook();
 }
+export function renderHookResultToUi(result, ui) {
+    const [firstLine = "Stupify hook: no status returned", ...rest] = result.split(/\r?\n/);
+    if (firstLine.includes("not installed")) {
+        ui.info(firstLine);
+    }
+    else if (firstLine.includes("installed") || firstLine.includes("updated") || firstLine.includes("uninstalled")) {
+        ui.success(firstLine);
+    }
+    else if (firstLine.includes("existing non-Stupify")) {
+        ui.warn(firstLine);
+    }
+    else {
+        ui.info(firstLine);
+    }
+    const detail = rest.join("\n").trim();
+    if (detail)
+        ui.note(detail, "Hook");
+}
 export function hookSnippet() {
     return managedBlock("stupify --staged");
 }

package/dist/render.d.ts

@@ -1,3 +1,6 @@
 import type { SearchCommand, SearchRunJson } from "./types.ts";
+import { type CliUi } from "./ui.ts";
 export declare function renderSearchRun(run: SearchRunJson, command: SearchCommand): string;
+export declare function renderSearchRunToUi(run: SearchRunJson, command: SearchCommand, ui: CliUi): void;
+export declare function renderSearchHumanText(run: SearchRunJson, command: SearchCommand): string;
 export declare function helpText(): string;

package/dist/render.js

@@ -3,16 +3,43 @@ import { format } from "./ui.js";
 export function renderSearchRun(run, command) {
     if (command.json)
         return JSON.stringify(run, null, 2);
+    return renderSearchHumanText(run, command);
+}
+export function renderSearchRunToUi(run, command, ui) {
+    if (command.json) {
+        ui.writeStdout(renderSearchRun(run, command));
+        return;
+    }
+    if (run.stats.skipped && run.stats.skipReason === "input_too_large") {
+        ui.warn("Search skipped: input is too large for precise local search.");
+        ui.note(oversizedText(run, command), "Skipped");
+        ui.outro("Warn-only. Nothing blocked.");
+        return;
+    }
+    if (run.stats.skipped && run.stats.skipReason === "no_candidates") {
+        ui.success("Search complete: no search targets found.");
+        ui.note(cleanSummaryText(run), "Summary");
+        ui.outro("No judgment-offload signals found.");
+        return;
+    }
+    if (run.matches.length === 0) {
+        ui.success("Search complete: no judgment-offload signals found.");
+        ui.note(cleanSummaryText(run), "Summary");
+        ui.outro("Warn-only. Nothing blocked.");
+        return;
+    }
+    ui.warn(format.warn(format.heading("AI SLOP DETECTED")));
+    ui.note(matchSummaryText(run, command), "Summary");
+    for (const group of groupMatchesByFile(run.matches)) {
+        ui.note(renderMatchGroup(group, run), group.filePath);
+    }
+    ui.outro(summaryLine(run));
+}
+export function renderSearchHumanText(run, command) {
     if (run.stats.skipped && run.stats.skipReason === "input_too_large") {
-        return `${format.heading("Search input is too large for precise local search.")}
-${format.heading("Size:")}
-~${run.stats.inputTokens ?? "unknown"} tokens
-${format.heading("Limit:")}
-${run.stats.inputTokenCap ?? "unknown"} tokens
-Stupify skipped the search rather than review truncated context.
-Nothing was blocked.
-${format.heading("Try:")}
-rerun with ${sourceHint(command)} --max-search-input-tokens ${Math.max((run.stats.inputTokens ?? 12_000) + 1, (run.stats.inputTokenCap ?? 12_000) * 2)}`;
+        return `${format.heading("Search skipped")}
+${oversizedText(run, command)}
+Warn-only. Nothing blocked.`;
     }
     if (run.stats.skipped && run.stats.skipReason === "no_candidates") {
         return `${format.heading("Search complete.")}
@@ -24,18 +51,12 @@ ${format.success("No search targets found.")}`;
 ${format.label("Patterns:")} ${run.patterns.join(", ")}
 ${format.success("No judgment-offload signals found.")}`;
     }
+    const groups = groupMatchesByFile(run.matches);
     return `${slopHeading()}
-${committerLabel(run)} (${sourceLabel(command)})
-
-${run.matches.map((match, index) => `${index + 1}. ${format.label(match.patternId)}
-${match.reason}
-
-\`\`\`
-${match.snapshot ?? match.proof}
-\`\`\`
-${format.muted(match.proof)}
+${matchSummaryText(run, command)}
 
-${match.checkWhy ?? "This pattern may indicate judgment-offload."}`).join("\n\n")}
+${groups.map((group) => `${format.heading(group.filePath)}
+${renderMatchGroup(group, run)}`).join("\n\n")}
 ${format.muted(summaryLine(run))}`;
 }
 export function helpText() {
@@ -85,6 +106,127 @@ Not included:
   Findings audit, validators, judges, baselines, sharing, hosted server calls, GitHub, dashboards, or repo-wide crawling.
 `;
 }
+function oversizedText(run, command) {
+    const targetLimit = Math.max((run.stats.inputTokens ?? 12_000) + 1, (run.stats.inputTokenCap ?? 12_000) * 2);
+    return [
+        `Size: ~${run.stats.inputTokens ?? "unknown"} tokens`,
+        `Limit: ${run.stats.inputTokenCap ?? "unknown"} tokens`,
+        "Stupify skipped the search rather than review truncated context.",
+        `Try: ${sourceHint(command)} --max-search-input-tokens ${targetLimit}`,
+    ].join("\n");
+}
+function cleanSummaryText(run) {
+    return [
+        `Patterns: ${run.patterns.join(", ")}`,
+        run.stats.filesChanged === undefined ? null : `Diff: ${run.stats.filesChanged} files, ${run.stats.entitiesScanned ?? 0} changed entities`,
+    ].filter(Boolean).join("\n");
+}
+function matchSummaryText(run, command) {
+    const fileCount = groupMatchesByFile(run.matches).length;
+    const fileNoun = fileCount === 1 ? "file" : "files";
+    return [
+        `${run.matches.length} ${signalNoun(run.matches.length)} across ${fileCount} ${fileNoun}`,
+        `${committerLabel(run)} · ${sourceLabel(command)}`,
+        "Warn-only. Nothing blocked.",
+        "",
+        patternSummaryLine(run),
+    ].filter((line) => line !== null).join("\n");
+}
+function patternSummaryLine(run) {
+    const counts = new Map();
+    for (const match of run.matches)
+        counts.set(patternLabel(match), (counts.get(patternLabel(match)) ?? 0) + 1);
+    return [...counts.entries()].map(([patternName, count]) => `${patternName} ${count}`).join(" · ");
+}
+function groupMatchesByFile(matches) {
+    const groups = new Map();
+    for (const match of matches) {
+        const filePath = proofFilePath(match.proof);
+        const group = groups.get(filePath) ?? [];
+        group.push(match);
+        groups.set(filePath, group);
+    }
+    return [...groups.entries()].map(([filePath, groupedMatches]) => ({
+        filePath,
+        matches: groupedMatches,
+    }));
+}
+function renderMatchGroup(group, run) {
+    return group.matches.map((match, index) => {
+        const lines = [
+            matchHeadline(match, run, index),
+            match.reason,
+            match.snapshot ? `\n\`\`\`\n${match.snapshot}\n\`\`\`` : null,
+            format.muted(`${proofDetail(match.proof)}${commitSubjectSuffix(run)}`),
+            match.checkWhy ?? "This pattern may indicate judgment-offload.",
+        ];
+        return lines.filter(Boolean).join("\n");
+    }).join("\n\n");
+}
+function matchHeadline(match, run, index) {
+    return `${index + 1}. ${format.label(patternLabel(match))}: ${headlineArgs(match)} -- ${matchBlameLabel(match, run)}`;
+}
+function patternLabel(match) {
+    return titleCase(match.patternName ?? match.patternId.replace(/_/g, " "));
+}
+function headlineArgs(match) {
+    const destination = entityNameFromProof(match.proof);
+    const source = firstBacktickedToken(match.reason) ?? firstLikelySource(match.reason, destination);
+    if (source && destination && source !== destination)
+        return `${codeLabel(source)} -> ${codeLabel(destination)}`;
+    if (destination)
+        return codeLabel(destination);
+    return codeLabel(match.targetId);
+}
+function matchBlameLabel(match, run) {
+    return match.blame ? blameSummaryLabel(match.blame) : runLevelBlameLabel(run);
+}
+function blameSummaryLabel(blame) {
+    return `${blame.author} (${blame.subject})`;
+}
+function runLevelBlameLabel(run) {
+    const author = committerLabel(run);
+    const subject = firstHumanSubject(run.stats.commitSubjects ?? []);
+    return subject ? `${author} (${subject})` : author;
+}
+function commitSubjectSuffix(run) {
+    const subject = firstHumanSubject(run.stats.commitSubjects ?? []);
+    return subject ? ` · commit: ${subject}` : "";
+}
+function firstHumanSubject(subjects) {
+    return subjects.map((subject) => subject.trim()).find(Boolean);
+}
+function codeLabel(value) {
+    return `\`${value}\``;
+}
+function titleCase(value) {
+    return value.replace(/\b[a-z]/g, (letter) => letter.toUpperCase());
+}
+function entityNameFromProof(proof) {
+    const parts = proof.split("::");
+    return parts[2] || parts[1] || undefined;
+}
+function firstBacktickedToken(value) {
+    const match = /`([^`]+)`/.exec(value);
+    return cleanToken(match?.[1]);
+}
+function firstLikelySource(value, destination) {
+    const tokens = [...value.matchAll(/\b[A-Z][A-Za-z0-9_]*(?:\[[^\]]+\])?\b/g)]
+        .map((match) => cleanToken(match[0]))
+        .filter((token) => Boolean(token));
+    return tokens.find((token) => token !== destination && token !== "The");
+}
+function cleanToken(value) {
+    const token = value?.trim().replace(/[.,;:]+$/, "");
+    return token || undefined;
+}
+function proofFilePath(proof) {
+    return proof.split("::")[0] || proof;
+}
+function proofDetail(proof) {
+    const [, ...rest] = proof.split("::");
+    return rest.length > 0 ? `::${rest.join("::")}` : proof;
+}
 function sourceHint(command) {
     if (command.kind === "staged")
         return "--staged";
@@ -146,6 +288,8 @@ function sinceLabel(since) {
     return `last ${count} ${unit}s`;
 }
 function summaryLine(run) {
-    const noun = run.matches.length === 1 ? "signal" : "signals";
-    return `${run.matches.length} ${noun}. Warn-only. Nothing blocked.`;
+    return `${run.matches.length} ${signalNoun(run.matches.length)}. Warn-only. Nothing blocked.`;
+}
+function signalNoun(count) {
+    return count === 1 ? "signal" : "signals";
 }

package/dist/sem-provider.js

@@ -36,6 +36,7 @@ function emptyChangeSet(label, stats, committers) {
         base: label,
         target: label,
         committers,
+        commitSubjects: undefined,
         contextCwd: process.cwd(),
         cleanup: async () => undefined,
         changes: [],
@@ -75,6 +76,7 @@ async function semChangeSetFromPatch(patch, debugSem, label = "stdin", committer
             base: label,
             target: label,
             committers,
+            commitSubjects: undefined,
             stats: { filesChanged: 0, additions: 0, deletions: 0 },
         }),
         contextCwd: process.cwd(),
@@ -199,6 +201,7 @@ function normalizeSemDiff(value, range) {
         base: range.base,
         target: range.target,
         committers: range.committers,
+        commitSubjects: range.commitSubjects,
         contextCwd: process.cwd(),
         cleanup: async () => undefined,
         changes,