package-radar 0.0.2

package/dist/index.mjs

@@ -0,0 +1,904 @@
+#!/usr/bin/env node
+
+// src/analyze.ts
+import OpenAI from "openai";
+var PACKAGE_NEWS_HOMES = {
+  typescript: {
+    label: "TypeScript blog",
+    url: "https://devblogs.microsoft.com/typescript/"
+  },
+  "@typescript/native": {
+    label: "TypeScript blog",
+    url: "https://devblogs.microsoft.com/typescript/"
+  },
+  expo: {
+    label: "Expo changelog",
+    url: "https://expo.dev/changelog"
+  },
+  "react-native": {
+    label: "React Native blog",
+    url: "https://reactnative.dev/blog"
+  },
+  react: {
+    label: "React blog",
+    url: "https://react.dev/blog"
+  },
+  next: {
+    label: "Next.js blog",
+    url: "https://nextjs.org/blog"
+  },
+  vue: {
+    label: "Vue blog",
+    url: "https://blog.vuejs.org/"
+  },
+  svelte: {
+    label: "Svelte blog",
+    url: "https://svelte.dev/blog"
+  },
+  "drizzle-orm": {
+    label: "Drizzle announcements",
+    url: "https://orm.drizzle.team/docs/latest-releases"
+  },
+  "@prisma/client": {
+    label: "Prisma blog",
+    url: "https://www.prisma.io/blog"
+  },
+  vite: {
+    label: "Vite blog",
+    url: "https://vite.dev/blog/"
+  },
+  tailwindcss: {
+    label: "Tailwind blog",
+    url: "https://tailwindcss.com/blog"
+  },
+  openai: {
+    label: "OpenAI changelog",
+    url: "https://developers.openai.com/changelog"
+  },
+  express: {
+    label: "Express releases",
+    url: "https://github.com/expressjs/express/releases"
+  },
+  "@nestjs/core": {
+    label: "NestJS releases",
+    url: "https://github.com/nestjs/nest/releases"
+  },
+  hono: {
+    label: "Hono releases",
+    url: "https://github.com/honojs/hono/releases"
+  },
+  "@trpc/server": {
+    label: "tRPC blog",
+    url: "https://trpc.io/blog"
+  },
+  zod: {
+    label: "Zod releases",
+    url: "https://github.com/colinhacks/zod/releases"
+  }
+};
+var SYSTEM_PROMPT = `You are Package Radar, a developer news briefing tool.
+
+Given a scanned Node/JS/TS project, search the web for MAJOR recent package/framework NEWS that is relevant to the detected stack.
+
+What counts as "major news":
+- New major/minor releases of libraries they use
+- Official blog posts, changelogs, RC/beta announcements
+- Breaking-change notices, migration guides, platform roadmap updates
+- Framework SDK releases (Expo, React Native, Next.js, TypeScript, etc.)
+
+What to EXCLUDE:
+- Security advisories, CVEs, vulnerability audits
+- Minor patch-only noise unless it is unusually important
+- Generic tips unrelated to recent public news
+- Invented URLs \u2014 only cite real sources you found via web search
+
+Rules:
+- Only cover technologies present in the project.
+- Prefer major releases and official announcements from the last ~1\u20134 weeks when possible; include slightly older major news if nothing fresher exists.
+- 3\u20136 items max. Quality over quantity.
+- Every item MUST include at least one real source URL (blog post, changelog, GitHub release, docs).
+- "whyCare" should tie the news to THIS project (versions installed, file counts, package manager).
+- "summary" is 1\u20132 sentences of what happened in the news.
+- "recommendation" is one short sentence (e.g. "Worth testing", "Wait for stable", "Read the migration guide").
+- headline like "5 things happened this week".
+- Emojis: \u{1F525} \u{1F4F1} \u26A1 \u{1F9F0} \u{1F9EA} \u{1F4E6} \u{1F680} etc. Never \u{1F512} for security.
+
+Return ONLY valid JSON:
+{
+  "headline": string,
+  "items": [
+    {
+      "emoji": string,
+      "title": string,
+      "summary": string,
+      "whyCare": string,
+      "recommendation": string,
+      "sources": [{ "title": string, "url": string }]
+    }
+  ]
+}`;
+function buildUserPrompt(input2) {
+  const { scan, versions } = input2;
+  const context = {
+    project: {
+      name: scan.packageJson.name ?? null,
+      packageManager: scan.packageManager
+    },
+    fileCounts: scan.fileCounts,
+    detectedStack: scan.detected.map((d) => ({
+      id: d.id,
+      label: d.label,
+      packageName: d.packageName,
+      installedVersion: d.installedVersion,
+      range: d.range
+    })),
+    registryVersions: versions.map((v) => ({
+      packageName: v.packageName,
+      installedVersion: v.installedVersion,
+      latestOnNpm: v.latestVersion,
+      behindLatest: v.behind
+    })),
+    knownOfficialHomes: scan.detected.map((d) => PACKAGE_NEWS_HOMES[d.packageName]).filter(Boolean),
+    today: (/* @__PURE__ */ new Date()).toISOString().slice(0, 10),
+    searchHints: scan.detected.map(
+      (d) => `${d.label} release announcement OR changelog OR blog ${(/* @__PURE__ */ new Date()).getFullYear()}`
+    )
+  };
+  return `Search for major package news relevant to this project, then produce a Package Radar news briefing as JSON.
+
+Project context:
+${JSON.stringify(context, null, 2)}
+
+Prefer sources like official blogs, GitHub Releases, framework changelogs, and reputable tech news (e.g. TypeScript blog for TS 7, Expo changelog for SDK releases).`;
+}
+function isHttpUrl(url) {
+  try {
+    const u = new URL(url);
+    return u.protocol === "http:" || u.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function normalizeSources(raw) {
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const s of raw) {
+    if (!s || typeof s !== "object") continue;
+    const title = String(s.title ?? "").trim() || "Source";
+    const url = String(s.url ?? "").trim();
+    if (!isHttpUrl(url)) continue;
+    out.push({ title, url });
+  }
+  return out;
+}
+function parseReport(content) {
+  try {
+    const cleaned = content.replace(/^```json\s*/i, "").replace(/^```\s*/i, "").replace(/\s*```$/i, "").trim();
+    const data = JSON.parse(cleaned);
+    if (!data || !Array.isArray(data.items)) return null;
+    const items = data.items.filter(
+      (i) => i && i.title && (i.whyCare || i.summary) && i.recommendation
+    ).map((i) => ({
+      emoji: i.emoji || "\u{1F4F0}",
+      title: i.title,
+      summary: i.summary || i.whyCare,
+      whyCare: i.whyCare || i.summary,
+      recommendation: i.recommendation,
+      sources: normalizeSources(i.sources)
+    })).filter((i) => i.sources.length > 0);
+    if (items.length === 0) return null;
+    return {
+      headline: data.headline || `${items.length} things happened this week`,
+      items
+    };
+  } catch {
+    return null;
+  }
+}
+function fallbackReport(input2) {
+  const items = [];
+  for (const v of input2.versions) {
+    if (!v.latestVersion) continue;
+    const tech = input2.scan.detected.find(
+      (d) => d.packageName === v.packageName
+    );
+    const home = PACKAGE_NEWS_HOMES[v.packageName];
+    const name = tech?.label.replace(/\s+\d.*$/, "") ?? v.packageName;
+    if (!v.behind && !home) continue;
+    const sources = [];
+    if (home) sources.push({ title: home.label, url: home.url });
+    sources.push({
+      title: `${v.packageName} on npm`,
+      url: `https://www.npmjs.com/package/${v.packageName}`
+    });
+    items.push({
+      emoji: "\u{1F4E6}",
+      title: v.behind ? `${name} ${v.latestVersion}` : `${name} latest: ${v.latestVersion}`,
+      summary: v.behind ? `npm latest is ${v.latestVersion}; this project is on ${v.installedVersion}.` : `You are on the current npm latest (${v.latestVersion}).`,
+      whyCare: input2.scan.fileCounts.typescript ? `Your project has ${input2.scan.fileCounts.typescript.toLocaleString()} TypeScript files and depends on ${v.packageName}.` : `Your project depends on ${v.packageName}.`,
+      recommendation: v.behind ? v.latestVersion.includes("rc") || v.latestVersion.includes("beta") ? "Wait for stable, then read the release notes." : "Skim the official release notes before upgrading." : "No action needed \u2014 check official channels next week.",
+      sources
+    });
+  }
+  if (items.length === 0) {
+    items.push({
+      emoji: "\u{1F4E1}",
+      title: "No major package headlines found offline",
+      summary: "Could not reach OpenAI web search. Showing official news homes for your stack.",
+      whyCare: "Re-run with a valid OpenAI API key for a live news briefing.",
+      recommendation: "Check official blogs for your main frameworks.",
+      sources: input2.scan.detected.map((d) => PACKAGE_NEWS_HOMES[d.packageName]).filter((h) => Boolean(h)).map((h) => ({ title: h.label, url: h.url }))
+    });
+  }
+  return {
+    headline: `${Math.min(items.length, 6)} package news items for your stack`,
+    items: items.slice(0, 6)
+  };
+}
+function extractResponseText(response) {
+  if (response.output_text?.trim()) return response.output_text.trim();
+  const chunks = [];
+  for (const item of response.output ?? []) {
+    if (item.type !== "message" || !item.content) continue;
+    for (const part of item.content) {
+      if (part.type === "output_text" && part.text) chunks.push(part.text);
+    }
+  }
+  return chunks.join("\n").trim();
+}
+async function generateReport(input2) {
+  const client = new OpenAI({ apiKey: input2.apiKey });
+  const model = input2.model ?? process.env.OPENAI_MODEL ?? "gpt-4.1-mini";
+  const userPrompt = buildUserPrompt({
+    scan: input2.scan,
+    versions: input2.versions
+  });
+  try {
+    const response = await client.responses.create({
+      model,
+      temperature: 0.3,
+      tools: [
+        {
+          type: "web_search",
+          search_context_size: "medium"
+        }
+      ],
+      tool_choice: "auto",
+      instructions: SYSTEM_PROMPT,
+      input: userPrompt
+    });
+    const content = extractResponseText(response);
+    if (!content) throw new Error("Empty response from OpenAI");
+    const parsed = parseReport(content);
+    if (parsed && parsed.items.length > 0) return parsed;
+    const completion = await client.chat.completions.create({
+      model,
+      temperature: 0.3,
+      response_format: { type: "json_object" },
+      messages: [
+        {
+          role: "system",
+          content: `${SYSTEM_PROMPT}
+
+If you cannot verify URLs, use only well-known official homes (TypeScript blog, Expo changelog, React blog, npm package pages, GitHub releases). Never invent article paths.`
+        },
+        { role: "user", content: userPrompt },
+        {
+          role: "user",
+          content: `Previous draft (may be partial):
+${content}
+
+Return corrected JSON only, with real source URLs.`
+        }
+      ]
+    });
+    const retry = completion.choices[0]?.message?.content;
+    if (retry) {
+      const retried = parseReport(retry);
+      if (retried && retried.items.length > 0) return retried;
+    }
+    return fallbackReport(input2);
+  } catch (err) {
+    console.warn(
+      `OpenAI news search failed (${err instanceof Error ? err.message : String(err)}). Using registry + official blogs only.
+`
+    );
+    return fallbackReport(input2);
+  }
+}
+
+// src/config.ts
+import fs from "fs/promises";
+import path from "path";
+import os from "os";
+import readline from "readline/promises";
+import { stdin as input, stdout as output } from "process";
+var CONFIG_DIR = path.join(os.homedir(), ".package-radar");
+var CONFIG_PATH = path.join(CONFIG_DIR, "config.json");
+var LEGACY_CONFIG_PATH = path.join(
+  os.homedir(),
+  ".code-radar",
+  "config.json"
+);
+var GITIGNORE_SECRETS_ENTRY = ".package-radar/";
+var GITIGNORE_SECRETS_COMMENT = "# OpenAI / package-radar secrets \u2014 never commit API keys";
+var GITIGNORE_MATCHES = /* @__PURE__ */ new Set([
+  ".package-radar",
+  ".package-radar/",
+  ".package-radar/**",
+  "**/.package-radar",
+  "**/.package-radar/",
+  "**/.package-radar/**",
+  // legacy name
+  ".code-radar",
+  ".code-radar/",
+  ".code-radar/**",
+  "**/.code-radar",
+  "**/.code-radar/",
+  "**/.code-radar/**"
+]);
+function getConfigPath() {
+  return CONFIG_PATH;
+}
+function gitignoreAlreadyIgnoresSecrets(content) {
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    if (GITIGNORE_MATCHES.has(trimmed)) return true;
+  }
+  return false;
+}
+async function ensureGitignoreHasSecretsEntry(projectRoot) {
+  const gitignorePath = path.join(projectRoot, ".gitignore");
+  let content = "";
+  try {
+    content = await fs.readFile(gitignorePath, "utf8");
+  } catch (err) {
+    const code = err && typeof err === "object" && "code" in err ? String(err.code) : "";
+    if (code !== "ENOENT") throw err;
+  }
+  if (gitignoreAlreadyIgnoresSecrets(content)) {
+    return { updated: false, gitignorePath };
+  }
+  let next = content;
+  if (next.length > 0 && !next.endsWith("\n")) {
+    next += "\n";
+  }
+  if (next.length > 0) {
+    next += "\n";
+  }
+  next += `${GITIGNORE_SECRETS_COMMENT}
+${GITIGNORE_SECRETS_ENTRY}
+`;
+  await fs.writeFile(gitignorePath, next, "utf8");
+  return { updated: true, gitignorePath };
+}
+async function loadConfig() {
+  try {
+    const raw = await fs.readFile(CONFIG_PATH, "utf8");
+    return JSON.parse(raw);
+  } catch {
+    try {
+      const raw = await fs.readFile(LEGACY_CONFIG_PATH, "utf8");
+      return JSON.parse(raw);
+    } catch {
+      return {};
+    }
+  }
+}
+async function saveConfig(config) {
+  await fs.mkdir(CONFIG_DIR, { recursive: true, mode: 448 });
+  await fs.writeFile(CONFIG_PATH, `${JSON.stringify(config, null, 2)}
+`, {
+    mode: 384
+  });
+}
+async function resolveApiKey(options) {
+  if (!options?.forcePrompt) {
+    const fromEnv = process.env.OPENAI_API_KEY?.trim();
+    if (fromEnv) return fromEnv;
+    const config = await loadConfig();
+    if (config.openaiApiKey?.trim()) return config.openaiApiKey.trim();
+  }
+  const rl = readline.createInterface({ input, output });
+  try {
+    const key = (await rl.question(
+      "Enter your OpenAI API key (saved to ~/.package-radar/config.json): "
+    )).trim();
+    if (!key) {
+      throw new Error("OpenAI API key is required.");
+    }
+    if (!key.startsWith("sk-")) {
+      console.warn(
+        "Warning: key does not look like a typical OpenAI key (sk-...). Continuing anyway."
+      );
+    }
+    const config = await loadConfig();
+    config.openaiApiKey = key;
+    await saveConfig(config);
+    console.log(`Saved API key to ${CONFIG_PATH}
+`);
+    return key;
+  } finally {
+    rl.close();
+  }
+}
+
+// src/format.ts
+var DIVIDER = "\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500";
+function printScanHeader(scan) {
+  console.log("\u{1F50D} Scanning your project...\n");
+  console.log("Detected:\n");
+  for (const tech of scan.detected) {
+    console.log(`\u2713 ${tech.label}`);
+  }
+  console.log(`
+${DIVIDER}
+`);
+}
+function printReport(report) {
+  const count = report.items.length;
+  const headline = report.headline || `${count} thing${count === 1 ? "" : "s"} happened this week`;
+  const withFire = headline.startsWith("\u{1F525}") ? headline : `\u{1F525} ${headline}`;
+  console.log(`${withFire}
+`);
+  for (let i = 0; i < report.items.length; i++) {
+    const item = report.items[i];
+    const n = i + 1;
+    if (i === 0) {
+      console.log(`${n}. ${item.title}
+`);
+    } else {
+      const title = item.title.startsWith(item.emoji) ? item.title : `${item.emoji} ${item.title}`;
+      console.log(`${title}
+`);
+    }
+    if (item.summary && item.summary !== item.whyCare) {
+      console.log(item.summary);
+      console.log("");
+    }
+    console.log("You should care because:");
+    console.log(item.whyCare);
+    console.log("");
+    if (item.sources.length > 0) {
+      console.log("Sources:");
+      for (const source of item.sources) {
+        console.log(`\u2022 ${source.title}`);
+        console.log(`  ${source.url}`);
+      }
+      console.log("");
+    }
+    console.log("Recommendation:");
+    console.log(item.recommendation);
+    console.log(`
+${DIVIDER}
+`);
+  }
+}
+function printError(message) {
+  console.error(`Error: ${message}`);
+}
+
+// src/scan.ts
+import fs2 from "fs/promises";
+import path2 from "path";
+var IGNORE_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  "dist",
+  "build",
+  ".git",
+  ".next",
+  ".expo",
+  "coverage",
+  ".turbo",
+  ".cache",
+  "ios",
+  "android",
+  "vendor",
+  ".yarn"
+]);
+var TECH_CATALOG = [
+  {
+    id: "react-native",
+    packageName: "react-native",
+    label: (v) => v ? `React Native ${v}` : "React Native"
+  },
+  {
+    id: "expo",
+    packageName: "expo",
+    label: (v) => v ? `Expo SDK ${major(v)}` : "Expo"
+  },
+  {
+    id: "typescript",
+    packageName: "typescript",
+    label: (v) => v ? `TypeScript ${v}` : "TypeScript"
+  },
+  {
+    // Some projects install TS 7 under this alias while keeping TS 6 as `typescript` for tooling
+    id: "typescript-native",
+    packageName: "@typescript/native",
+    label: (v) => v ? `TypeScript ${v}` : "TypeScript (native)"
+  },
+  {
+    id: "drizzle",
+    packageName: "drizzle-orm",
+    label: () => "Drizzle ORM"
+  },
+  {
+    id: "prisma",
+    packageName: "@prisma/client",
+    label: () => "Prisma"
+  },
+  {
+    id: "next",
+    packageName: "next",
+    label: (v) => v ? `Next.js ${v}` : "Next.js"
+  },
+  {
+    id: "react",
+    packageName: "react",
+    label: (v) => v ? `React ${v}` : "React"
+  },
+  {
+    id: "vue",
+    packageName: "vue",
+    label: (v) => v ? `Vue ${v}` : "Vue"
+  },
+  {
+    id: "svelte",
+    packageName: "svelte",
+    label: (v) => v ? `Svelte ${v}` : "Svelte"
+  },
+  {
+    id: "express",
+    packageName: "express",
+    label: (v) => v ? `Express ${v}` : "Express"
+  },
+  {
+    id: "nestjs",
+    packageName: "@nestjs/core",
+    label: () => "NestJS"
+  },
+  {
+    id: "fastify",
+    packageName: "fastify",
+    label: (v) => v ? `Fastify ${v}` : "Fastify"
+  },
+  {
+    id: "hono",
+    packageName: "hono",
+    label: (v) => v ? `Hono ${v}` : "Hono"
+  },
+  {
+    id: "zod",
+    packageName: "zod",
+    label: (v) => v ? `Zod ${v}` : "Zod"
+  },
+  {
+    id: "tailwind",
+    packageName: "tailwindcss",
+    label: (v) => v ? `Tailwind CSS ${v}` : "Tailwind CSS"
+  },
+  {
+    id: "vite",
+    packageName: "vite",
+    label: (v) => v ? `Vite ${v}` : "Vite"
+  },
+  {
+    id: "vitest",
+    packageName: "vitest",
+    label: () => "Vitest"
+  },
+  {
+    id: "jest",
+    packageName: "jest",
+    label: () => "Jest"
+  },
+  {
+    id: "openai",
+    packageName: "openai",
+    label: () => "OpenAI SDK"
+  },
+  {
+    id: "trpc",
+    packageName: "@trpc/server",
+    label: () => "tRPC"
+  }
+];
+function major(version) {
+  const cleaned = version.replace(/^[\^~>=<\s]*/, "");
+  return cleaned.split(".")[0] ?? cleaned;
+}
+function stripRange(range) {
+  return range.replace(/^[\^~>=<\s]*/, "").split(" ")[0] ?? range;
+}
+function mergeDependencies(pkg) {
+  return {
+    ...pkg.optionalDependencies,
+    ...pkg.peerDependencies,
+    ...pkg.devDependencies,
+    ...pkg.dependencies
+  };
+}
+async function findProjectRoot(startDir = process.cwd()) {
+  let dir = path2.resolve(startDir);
+  for (; ; ) {
+    try {
+      await fs2.access(path2.join(dir, "package.json"));
+      return dir;
+    } catch {
+      const parent = path2.dirname(dir);
+      if (parent === dir) {
+        throw new Error(
+          "No package.json found. Run package-radar from inside a Node project."
+        );
+      }
+      dir = parent;
+    }
+  }
+}
+async function detectPackageManager(projectRoot, pkg) {
+  if (pkg.packageManager?.startsWith("pnpm")) return "pnpm";
+  if (pkg.packageManager?.startsWith("yarn")) return "yarn";
+  if (pkg.packageManager?.startsWith("bun")) return "bun";
+  if (pkg.packageManager?.startsWith("npm")) return "npm";
+  const checks = [
+    ["yarn.lock", "yarn"],
+    ["pnpm-lock.yaml", "pnpm"],
+    ["bun.lockb", "bun"],
+    ["bun.lock", "bun"],
+    ["package-lock.json", "npm"]
+  ];
+  for (const [file, pm] of checks) {
+    try {
+      await fs2.access(path2.join(projectRoot, file));
+      return pm;
+    } catch {
+    }
+  }
+  return "unknown";
+}
+async function readInstalledVersion(projectRoot, packageName) {
+  const pkgPath = path2.join(
+    projectRoot,
+    "node_modules",
+    ...packageName.split("/"),
+    "package.json"
+  );
+  try {
+    const raw = await fs2.readFile(pkgPath, "utf8");
+    const json = JSON.parse(raw);
+    return json.version ?? null;
+  } catch {
+    return null;
+  }
+}
+async function countSourceFiles(projectRoot) {
+  let typescript = 0;
+  let javascript = 0;
+  async function walk(dir) {
+    let entries;
+    try {
+      entries = await fs2.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.startsWith(".") && entry.name !== ".env.example") {
+        if (entry.isDirectory()) continue;
+      }
+      if (entry.isDirectory()) {
+        if (IGNORE_DIRS.has(entry.name)) continue;
+        await walk(path2.join(dir, entry.name));
+        continue;
+      }
+      const ext = path2.extname(entry.name).toLowerCase();
+      if (ext === ".ts" || ext === ".tsx" || ext === ".mts" || ext === ".cts") {
+        typescript += 1;
+      } else if (ext === ".js" || ext === ".jsx" || ext === ".mjs" || ext === ".cjs") {
+        javascript += 1;
+      }
+    }
+  }
+  await walk(projectRoot);
+  return {
+    typescript,
+    javascript,
+    totalSource: typescript + javascript
+  };
+}
+async function scanProject(cwd = process.cwd()) {
+  const projectRoot = await findProjectRoot(cwd);
+  const raw = await fs2.readFile(path2.join(projectRoot, "package.json"), "utf8");
+  const packageJson = JSON.parse(raw);
+  const allDependencies = mergeDependencies(packageJson);
+  const packageManager = await detectPackageManager(projectRoot, packageJson);
+  const detected = [];
+  for (const tech of TECH_CATALOG) {
+    const range = allDependencies[tech.packageName];
+    if (!range) continue;
+    const installedVersion = await readInstalledVersion(projectRoot, tech.packageName) ?? stripRange(range);
+    detected.push({
+      id: tech.id,
+      label: tech.label(installedVersion),
+      packageName: tech.packageName,
+      installedVersion,
+      range
+    });
+  }
+  if (detected.length === 0) {
+    const top = Object.entries(allDependencies).slice(0, 8);
+    for (const [name, range] of top) {
+      const installedVersion = await readInstalledVersion(projectRoot, name) ?? stripRange(range);
+      detected.push({
+        id: name,
+        label: `${name}@${installedVersion}`,
+        packageName: name,
+        installedVersion,
+        range
+      });
+    }
+  }
+  const fileCounts = await countSourceFiles(projectRoot);
+  return {
+    projectRoot,
+    packageJson,
+    packageManager,
+    allDependencies,
+    detected,
+    fileCounts
+  };
+}
+
+// src/versions.ts
+function parseSemverParts(version) {
+  const cleaned = version.replace(/^[\^~>=<\s]*/, "").replace(/-.*$/, "");
+  const parts = cleaned.split(".").map((p) => Number.parseInt(p, 10));
+  if (parts.length < 1 || parts.some((n) => Number.isNaN(n))) return null;
+  return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
+}
+function isBehind(installed, latest) {
+  if (!installed || !latest) return null;
+  const a = parseSemverParts(installed);
+  const b = parseSemverParts(latest);
+  if (!a || !b) return installed !== latest;
+  for (let i = 0; i < 3; i++) {
+    if (a[i] < b[i]) return true;
+    if (a[i] > b[i]) return false;
+  }
+  return false;
+}
+async function fetchLatestVersion(packageName) {
+  const url = `https://registry.npmjs.org/${encodeURIComponent(packageName)}/latest`;
+  try {
+    const res = await fetch(url, {
+      headers: { Accept: "application/json" },
+      signal: AbortSignal.timeout(8e3)
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    return data.version ?? null;
+  } catch {
+    return null;
+  }
+}
+async function fetchLatestVersions(packages) {
+  const results = await Promise.all(
+    packages.map(async ({ packageName, installedVersion }) => {
+      const latestVersion = await fetchLatestVersion(packageName);
+      return {
+        packageName,
+        installedVersion,
+        latestVersion,
+        behind: isBehind(installedVersion, latestVersion)
+      };
+    })
+  );
+  return results;
+}
+
+// src/index.ts
+function printHelp() {
+  console.log(`package-radar \u2014 package news for your codebase
+
+Usage:
+  package-radar                 Scan current project and print this week's news radar
+  package-radar config          Prompt and save your OpenAI API key
+  package-radar config --show   Show whether a key is configured (does not print the key)
+  package-radar --help          Show this help
+
+What it does:
+  Detects your stack from package.json, looks up npm versions, then uses OpenAI
+  web search for major package/framework news with source links.
+
+Environment:
+  OPENAI_API_KEY             Overrides saved key for this run
+  OPENAI_MODEL               Model name (default: gpt-4.1-mini)
+
+Config file:
+  ${getConfigPath()}
+`);
+}
+async function runConfig(args) {
+  if (args.includes("--show") || args.includes("-s")) {
+    const config = await loadConfig();
+    const envSet = Boolean(process.env.OPENAI_API_KEY?.trim());
+    const fileSet = Boolean(config.openaiApiKey?.trim());
+    console.log(`Config: ${getConfigPath()}`);
+    console.log(`Saved key: ${fileSet ? "yes" : "no"}`);
+    console.log(`OPENAI_API_KEY env: ${envSet ? "set" : "not set"}`);
+    return;
+  }
+  if (args.includes("--clear")) {
+    const config = await loadConfig();
+    delete config.openaiApiKey;
+    await saveConfig(config);
+    console.log(`Cleared saved API key at ${getConfigPath()}`);
+    return;
+  }
+  await resolveApiKey({ forcePrompt: true });
+  try {
+    const root = await findProjectRoot();
+    const gitignore = await ensureGitignoreHasSecretsEntry(root);
+    if (gitignore.updated) {
+      console.log(
+        `Added .package-radar/ to ${gitignore.gitignorePath} so API keys are not committed.`
+      );
+    }
+  } catch {
+  }
+}
+async function runRadar() {
+  const apiKey = await resolveApiKey();
+  const scan = await scanProject();
+  const gitignore = await ensureGitignoreHasSecretsEntry(scan.projectRoot);
+  if (gitignore.updated) {
+    console.log(
+      `Added .package-radar/ to ${gitignore.gitignorePath} so API keys are not committed.
+`
+    );
+  }
+  printScanHeader(scan);
+  process.stdout.write("Checking npm for latest package versions...\n");
+  const versions = await fetchLatestVersions(
+    scan.detected.map((d) => ({
+      packageName: d.packageName,
+      installedVersion: d.installedVersion
+    }))
+  );
+  process.stdout.write(
+    "Searching the web for major package news (OpenAI)...\n\n"
+  );
+  const report = await generateReport({
+    apiKey,
+    scan,
+    versions
+  });
+  printReport(report);
+}
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.includes("--help") || args.includes("-h")) {
+    printHelp();
+    return;
+  }
+  if (args[0] === "config") {
+    await runConfig(args.slice(1));
+    return;
+  }
+  if (args[0] === "help") {
+    printHelp();
+    return;
+  }
+  if (args.length > 0 && !args[0].startsWith("-")) {
+    printError(`Unknown command: ${args[0]}`);
+    printHelp();
+    process.exitCode = 1;
+    return;
+  }
+  await runRadar();
+}
+main().catch((err) => {
+  printError(err instanceof Error ? err.message : String(err));
+  process.exitCode = 1;
+});