agentinel 1.0.4 → 1.0.5

package/README.md

@@ -89,7 +89,9 @@ Agentinel provides an opt-in **PATH shim**. By default, running `npx asen init`
 npx asen init
 ```
 
-This puts a tiny, fail-open wrapper script earlier in your `PATH`. When you type `npm install`, the shim checks the package first. If it's safe, the real `npm` command runs instantly. 
+This puts a tiny, fail-open wrapper script earlier in your `PATH`. When you type `npm install <pkg>`, the shim checks the package first. If it's safe, the real `npm` command runs instantly. 
+
+As a bonus, if you just run a plain `npm install` with no arguments, the shim instantly checks your unstaged `package.json` for any newly added dependencies, ensuring that packages you pasted in are scanned before they resolve!
 
 **Terminal Example:**
 ```bash
@@ -166,16 +168,34 @@ Here are all the commands:
 Wires up agent hooks and git hooks in the current repo, and installs the global PATH shim for human terminal protection.
 ```bash
 $ npx asen init
-wrote .agentinel.json
-registered the Claude Code PreToolUse hook in .claude/settings.json
-installed the git pre-commit hook in .git/hooks
-wrote shims for npm, npx, pnpm, yarn, bun in /Users/user/.agentinel/bin
-added the shims to PATH in /Users/user/.zshrc
-Mode is strict, so a risky package typed at the terminal will be blocked.
-Open a new terminal, or run `asen unshim` to undo this.
 
-agentinel is set up. New npm packages will be checked before they land.
-Default mode is strict. Set "mode": "warn" in .agentinel.json to only warn instead.
+╭─ agentinel ──────────────────────────────╮
+│  agentinel setup complete                │
+│                                          │
+│  New npm packages will be checked before │
+│  they land.                              │
+│                                          │
+│  ✔ wrote .agentinel.json                 │
+│  ✔ registered the Claude Code PreToolUse │
+│  hook in .claude/settings.json           │
+│  ✔ installed the git pre-commit hook in  │
+│  .git/hooks                              │
+│  ✔ wrote shims for npm, npx, pnpm, yarn, │
+│  bun in /Users/user/.agentinel/bin       │
+│  ✔ added the shims to PATH in            │
+│  /Users/user/.zshrc                      │
+│  ✔ Open a new terminal, or run `asen     │
+│  unshim` to undo this.                   │
+│                                          │
+│  Default mode is strict. Set "mode":     │
+│  "warn" in .agentinel.json to only warn  │
+│  instead.                                │
+╰──────────────────────────────────────────╯
+
+Performance Tip:
+The hook runs on every command, and resolving through npx each time is slow.
+For faster hooks, add it to the repo and run init again:
+  npm install --save-dev agentinel && npx asen init
 ```
 
 When used with `--no-shim`, it wires up hooks but skips installing the global PATH shim.

package/dist/asen.js

@@ -862,7 +862,10 @@ function collectFromDependencies(lock, found) {
 var RESET = "\x1B[0m";
 var YELLOW = "\x1B[33m";
 var RED = "\x1B[31m";
+var GREEN = "\x1B[32m";
+var CYAN = "\x1B[36m";
 var DIM = "\x1B[2m";
+var BOLD = "\x1B[1m";
 var WIDTH = 46;
 var TITLE = "agentinel";
 function supportsColor(stream = process.stdout) {
@@ -952,6 +955,39 @@ function draw(b, paint) {
   return b.action ? `${box}
   ${paint(DIM, b.action)}` : box;
 }
+function drawSuccessBox(heading, body, stream = process.stdout) {
+  const inner = WIDTH - 4;
+  const text = inner - 1;
+  const hasColor = supportsColor(stream);
+  const color = hasColor ? GREEN : "";
+  const paint = (code, str) => hasColor ? `${code}${str}${RESET}` : str;
+  const titlePart = hasColor ? `${BOLD}${TITLE}${RESET}${color}` : TITLE;
+  const top = paint(color, `\u256D\u2500 ${titlePart} ${"\u2500".repeat(WIDTH - TITLE.length - 5)}\u256E`);
+  const bottom = paint(color, `\u2570${"\u2500".repeat(WIDTH - 2)}\u256F`);
+  const rows = [];
+  const push = (line, styled) => {
+    const edge = paint(color, "\u2502");
+    const plainLine = (styled ?? line).replace(/\x1b\[[0-9;]*m/g, "");
+    const pad = " ".repeat(Math.max(0, inner - plainLine.length));
+    rows.push(`${edge}  ${styled ?? line}${pad}${edge}`);
+  };
+  push(heading, paint(BOLD, heading));
+  push("");
+  for (const line of body) {
+    if (line === "") {
+      push("");
+      continue;
+    }
+    if (line.includes("\x1B")) {
+      push(line, line);
+    } else {
+      for (const wrapped of wrap(line, text)) {
+        push(wrapped);
+      }
+    }
+  }
+  return [top, ...rows, bottom].join("\n");
+}
 function wrap(line, width) {
   const lines = [];
   let current = "";
@@ -1107,7 +1143,7 @@ function startupFilePath(target) {
   }
   return join5(target.home, ".profile");
 }
-function installShim(repoRoot, target = currentTarget()) {
+function installShim(repoRoot, target = currentTarget(), messages = []) {
   const dir = shimDirectory(target.home);
   mkdirSync(dir, { recursive: true });
   for (const client of CLIENTS) {
@@ -1117,13 +1153,9 @@ function installShim(repoRoot, target = currentTarget()) {
       chmodSync(path, 493);
     }
   }
-  console.log(`wrote shims for ${CLIENTS.join(", ")} in ${dir}`);
-  addPathLine(target);
-  const mode = loadConfig(repoRoot).mode;
-  console.log(
-    mode === "strict" ? "Mode is strict, so a risky package typed at the terminal will be blocked." : "Mode is warn, so a risky package typed at the terminal will be reported, not blocked."
-  );
-  console.log("Open a new terminal, or run `asen unshim` to undo this.");
+  messages.push(`wrote shims for ${CLIENTS.join(", ")} in ${dir}`);
+  addPathLine(target, messages);
+  messages.push("Open a new terminal, or run `asen unshim` to undo this.");
   return 0;
 }
 function removeShim(target = currentTarget()) {
@@ -1141,17 +1173,17 @@ function pathLine(target) {
   return `export PATH="$HOME/.agentinel/bin:$PATH" ${RC_MARKER}
 `;
 }
-function addPathLine(target) {
+function addPathLine(target, messages) {
   const path = startupFilePath(target);
   const existing = existsSync4(path) ? readFileSync5(path, "utf8") : "";
   if (existing.includes(RC_MARKER)) {
-    console.log(`${path} already puts the shims on PATH, left alone`);
+    messages.push(`${path} already puts the shims on PATH, left alone`);
     return;
   }
   mkdirSync(join5(path, ".."), { recursive: true });
   const separator = existing === "" || existing.endsWith("\n") ? "" : "\n";
   writeFileSync2(path, `${existing}${separator}${pathLine(target)}`, "utf8");
-  console.log(`added the shims to PATH in ${path}`);
+  messages.push(`added the shims to PATH in ${path}`);
 }
 function removePathLine(target) {
   const path = startupFilePath(target);
@@ -1268,12 +1300,15 @@ async function runCheckCommand(command) {
   if (!command) {
     return 0;
   }
-  const { installs, executes } = parseCommand(command);
+  const { installs, executes, lockfile } = parseCommand(command);
+  const repoRoot = repoRootOrCwd();
   const names = [.../* @__PURE__ */ new Set([...installs, ...executes])];
   if (names.length === 0) {
-    return 0;
+    if (!lockfile) return 0;
+    const workingTree = newWorkingTreeDependencies(repoRoot);
+    if (workingTree.length === 0) return 0;
+    names.push(...workingTree);
   }
-  const repoRoot = repoRootOrCwd();
   const config = loadConfig(repoRoot);
   const verdicts = await checkPackages(names, config);
   for (const verdict of verdicts) {
@@ -1297,21 +1332,30 @@ var HOOK_MARKER = "agentinel";
 var HOOK_SUBCOMMAND = "hook claude-code";
 function runInit(options = {}) {
   const repoRoot = repoRootOrCwd();
-  writeConfig(repoRoot);
-  wireClaudeCodeHook(repoRoot, claudeCodeCommand(repoRoot));
-  wireOtherAgents(repoRoot, agentHookCommand(repoRoot));
-  wirePreCommitHook(repoRoot, gitHookCommand(repoRoot));
+  const messages = [];
+  writeConfig(repoRoot, messages);
+  wireClaudeCodeHook(repoRoot, claudeCodeCommand(repoRoot), messages);
+  wireOtherAgents(repoRoot, agentHookCommand(repoRoot), messages);
+  wirePreCommitHook(repoRoot, gitHookCommand(repoRoot), messages);
   if (options.shim) {
-    installShim(repoRoot, options.shimTarget);
-  }
-  console.log("\nagentinel is set up. New npm packages will be checked before they land.");
-  console.log(
-    'Default mode is strict. Set "mode": "warn" in .agentinel.json to only warn instead.'
-  );
+    installShim(repoRoot, options.shimTarget, messages);
+  }
+  const successBox = drawSuccessBox("agentinel setup complete", [
+    "New npm packages will be checked before they land.",
+    "",
+    ...messages.map((m) => `\u2714 ${m}`),
+    "",
+    `Default mode is ${GREEN}strict${RESET}.`,
+    'Set "mode": "warn" in .agentinel.json to only warn instead.'
+  ]);
+  console.log(`
+${successBox}`);
   if (!hasLocalInstall(repoRoot)) {
-    console.log("\nThe hook runs on every command, and going through npx each time is slow.");
-    console.log("For faster hooks, add it to the repo and run init again:");
-    console.log("  npm install --save-dev agentinel && npx asen init");
+    console.log(`
+${CYAN}Performance Tip:${RESET}`);
+    console.log(`The hook runs on every command, and resolving through npx each time is slow.`);
+    console.log(`For faster hooks, add it to the repo and run init again:`);
+    console.log(`  ${DIM}npm install --save-dev agentinel && npx asen init${RESET}`);
   }
   return 0;
 }
@@ -1327,16 +1371,16 @@ function claudeCodeCommand(repoRoot) {
 function gitHookCommand(repoRoot) {
   return hasLocalInstall(repoRoot) ? "./node_modules/.bin/asen" : "npx agentinel";
 }
-function writeConfig(repoRoot) {
+function writeConfig(repoRoot, messages) {
   const path = configPath(repoRoot);
   if (existsSync5(path)) {
-    console.log(".agentinel.json already exists, left alone");
+    messages.push(".agentinel.json already exists, left alone");
     return;
   }
   saveConfig(repoRoot, defaultConfig());
-  console.log("wrote .agentinel.json");
+  messages.push("wrote .agentinel.json");
 }
-function wireClaudeCodeHook(repoRoot, command) {
+function wireClaudeCodeHook(repoRoot, command, messages) {
   const dir = join6(repoRoot, ".claude");
   const path = join6(dir, "settings.json");
   let settings = {};
@@ -1347,14 +1391,14 @@ function wireClaudeCodeHook(repoRoot, command) {
         settings = parsed;
       }
     } catch {
-      console.log(".claude/settings.json is not valid JSON, skipping the Claude Code hook");
+      messages.push(".claude/settings.json is not valid JSON, skipping the Claude Code hook");
       return;
     }
   }
   const hooks = asRecord2(settings.hooks) ?? {};
   const preToolUse = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
   if (alreadyRegistered(preToolUse)) {
-    console.log("Claude Code hook already registered, left alone");
+    messages.push("Claude Code hook already registered, left alone");
     return;
   }
   preToolUse.push({
@@ -1365,7 +1409,7 @@ function wireClaudeCodeHook(repoRoot, command) {
   settings.hooks = hooks;
   mkdirSync2(dir, { recursive: true });
   writeFileSync3(path, JSON.stringify(settings, null, 2) + "\n", "utf8");
-  console.log("registered the Claude Code PreToolUse hook in .claude/settings.json");
+  messages.push("registered the Claude Code PreToolUse hook in .claude/settings.json");
 }
 function agentHookCommand(repoRoot) {
   if (isWindows()) {
@@ -1373,31 +1417,31 @@ function agentHookCommand(repoRoot) {
   }
   return hasLocalInstall(repoRoot) ? '"$(git rev-parse --show-toplevel)"/node_modules/.bin/asen' : "npx agentinel";
 }
-function wireOtherAgents(repoRoot, command) {
+function wireOtherAgents(repoRoot, command, messages) {
   if (uses(repoRoot, ".codex")) {
-    wireCodexHook(repoRoot, command);
+    wireCodexHook(repoRoot, command, messages);
   }
   if (uses(repoRoot, ".copilot") || existsSync5(join6(repoRoot, ".github", "hooks"))) {
-    wireCopilotHook(repoRoot, command);
+    wireCopilotHook(repoRoot, command, messages);
   }
   if (uses(repoRoot, ".gemini")) {
-    wireGeminiHook(repoRoot, command);
+    wireGeminiHook(repoRoot, command, messages);
   }
 }
 function uses(repoRoot, dir) {
   return existsSync5(join6(repoRoot, dir)) || existsSync5(join6(homedir2(), dir));
 }
-function wireCodexHook(repoRoot, command) {
+function wireCodexHook(repoRoot, command, messages) {
   const path = join6(repoRoot, ".codex", "hooks.json");
   const file = readJson(path);
   if (file === null) {
-    console.log(".codex/hooks.json is not valid JSON, skipping the Codex hook");
+    messages.push(".codex/hooks.json is not valid JSON, skipping the Codex hook");
     return;
   }
   const hooks = asRecord2(file.hooks) ?? {};
   const preToolUse = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
   if (registers(preToolUse, "codex")) {
-    console.log("Codex hook already registered, left alone");
+    messages.push("Codex hook already registered, left alone");
     return;
   }
   preToolUse.push({
@@ -1407,19 +1451,19 @@ function wireCodexHook(repoRoot, command) {
   hooks.PreToolUse = preToolUse;
   file.hooks = hooks;
   writeJson(path, file);
-  console.log("registered the Codex PreToolUse hook in .codex/hooks.json");
+  messages.push("registered the Codex PreToolUse hook in .codex/hooks.json");
 }
-function wireCopilotHook(repoRoot, command) {
+function wireCopilotHook(repoRoot, command, messages) {
   const path = join6(repoRoot, ".github", "hooks", "agentinel.json");
   const file = readJson(path);
   if (file === null) {
-    console.log(".github/hooks/agentinel.json is not valid JSON, skipping the Copilot hook");
+    messages.push(".github/hooks/agentinel.json is not valid JSON, skipping the Copilot hook");
     return;
   }
   const hooks = asRecord2(file.hooks) ?? {};
   const preToolUse = Array.isArray(hooks.preToolUse) ? hooks.preToolUse : [];
   if (registers(preToolUse, "copilot")) {
-    console.log("Copilot hook already registered, left alone");
+    messages.push("Copilot hook already registered, left alone");
     return;
   }
   preToolUse.push({ type: "command", matcher: "bash", bash: `${command} hook copilot` });
@@ -1427,19 +1471,19 @@ function wireCopilotHook(repoRoot, command) {
   file.version = 1;
   file.hooks = hooks;
   writeJson(path, file);
-  console.log("registered the Copilot preToolUse hook in .github/hooks/agentinel.json");
+  messages.push("registered the Copilot preToolUse hook in .github/hooks/agentinel.json");
 }
-function wireGeminiHook(repoRoot, command) {
+function wireGeminiHook(repoRoot, command, messages) {
   const path = join6(repoRoot, ".gemini", "settings.json");
   const file = readJson(path);
   if (file === null) {
-    console.log(".gemini/settings.json is not valid JSON, skipping the Gemini hook");
+    messages.push(".gemini/settings.json is not valid JSON, skipping the Gemini hook");
     return;
   }
   const hooks = asRecord2(file.hooks) ?? {};
   const beforeTool = Array.isArray(hooks.BeforeTool) ? hooks.BeforeTool : [];
   if (registers(beforeTool, "gemini")) {
-    console.log("Gemini hook already registered, left alone");
+    messages.push("Gemini hook already registered, left alone");
     return;
   }
   beforeTool.push({
@@ -1449,7 +1493,7 @@ function wireGeminiHook(repoRoot, command) {
   hooks.BeforeTool = beforeTool;
   file.hooks = hooks;
   writeJson(path, file);
-  console.log("registered the Gemini BeforeTool hook in .gemini/settings.json");
+  messages.push("registered the Gemini BeforeTool hook in .gemini/settings.json");
 }
 function readJson(path) {
   if (!existsSync5(path)) {
@@ -1490,9 +1534,9 @@ function hooksDirectory(repoRoot) {
   }
   return join6(repoRoot, ".git", "hooks");
 }
-function wirePreCommitHook(repoRoot, command) {
+function wirePreCommitHook(repoRoot, command, messages) {
   if (!existsSync5(join6(repoRoot, ".git"))) {
-    console.log("not a git repo, skipping the pre-commit hook");
+    messages.push("not a git repo, skipping the pre-commit hook");
     return;
   }
   const dir = hooksDirectory(repoRoot);
@@ -1504,18 +1548,18 @@ ${command} hook pre-commit
   if (existsSync5(path)) {
     const existing = readFileSync6(path, "utf8");
     if (existing.includes(HOOK_MARKER)) {
-      console.log("pre-commit hook already installed, left alone");
+      messages.push("pre-commit hook already installed, left alone");
       return;
     }
-    console.log("a pre-commit hook already exists, not overwriting it");
-    console.log(`add this line to ${path}:
+    messages.push("a pre-commit hook already exists, not overwriting it");
+    messages.push(`add this line to ${path}:
   ${command} hook pre-commit`);
     return;
   }
   mkdirSync2(dir, { recursive: true });
   writeFileSync3(path, script, "utf8");
   chmodSync2(path, 493);
-  console.log(`installed the git pre-commit hook in ${dir}`);
+  messages.push(`installed the git pre-commit hook in ${dir}`);
 }
 function alreadyRegistered(preToolUse) {
   return JSON.stringify(preToolUse).includes(`${HOOK_SUBCOMMAND}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentinel",
-  "version": "1.0.4",
+  "version": "1.0.5",
   "description": "Catches AI hallucinated npm packages before an agent installs them",
   "license": "MIT",
   "author": "Aman Janwani",