tend-cli 0.1.0 → 0.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +51 -61
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,95 +1,85 @@
|
|
|
1
1
|
# tend
|
|
2
2
|
|
|
3
|
-
|
|
3
|
+
|
|
4
4
|
|
|
5
|
-
|
|
6
|
-
findings with parallel AI sessions in a safe **scan → fix → re-scan** loop. It never
|
|
7
|
-
commits — fixes are left as uncommitted edits for you to review.
|
|
5
|
+
*Tend your code now so it never becomes an overgrown mess.*
|
|
8
6
|
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
7
|
+
> [!NOTE]
|
|
8
|
+
> **Early days (v0.x).** tend works, but it's young — flags and config may still
|
|
9
|
+
> change before 1.0. As with any tool that edits code, run it on a committed repo
|
|
10
|
+
> and review the changes. Feedback and issues are very welcome.
|
|
11
|
+
|
|
12
|
+
An open-source CLI that audits a JS/TS repo with standard scanners, then fixes the findings
|
|
13
|
+
with parallel AI sessions in a safe **scan → fix → re-scan** loop. It never commits — fixes
|
|
14
|
+
land as uncommitted edits for you to review.
|
|
13
15
|
|
|
14
|
-
##
|
|
16
|
+
## Quick start
|
|
15
17
|
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
18
|
+
```bash
|
|
19
|
+
npx tend-cli # changed files vs HEAD (the default)
|
|
20
|
+
npx tend-cli src/app lib/ # only findings under these paths
|
|
21
|
+
npx tend-cli --all # the entire backlog, repo-wide
|
|
22
|
+
```
|
|
20
23
|
|
|
21
|
-
|
|
24
|
+
Requires **Node ≥ 20** and a git repo. Review the edits with `tend diff`; undo the whole run
|
|
25
|
+
with `tend undo`.
|
|
22
26
|
|
|
23
|
-
|
|
24
|
-
|----------|-------|--------|
|
|
25
|
-
| AI fix loop | `eslint`+`sonarjs`, `knip`, `jscpd`, `semgrep` | findings fed to AI sessions |
|
|
26
|
-
| Deterministic | `osv-scanner` | dependency version bumps, no AI |
|
|
27
|
-
| Report-and-halt | `gitleaks` | secrets surfaced loudly, never AI-touched; exit non-zero |
|
|
27
|
+
## What it does
|
|
28
28
|
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
29
|
+
Scanners find problems; acting on them is the work. tend closes the loop —
|
|
30
|
+
**deterministic detection → AI fix → deterministic verification**. The scanners detect what's
|
|
31
|
+
wrong and confirm when it's fixed; the model only makes the edit in between. The worst case is
|
|
32
|
+
"tend changed nothing," never "tend broke your code."
|
|
32
33
|
|
|
33
|
-
|
|
34
|
-
|--------------|-----------|
|
|
35
|
-
| no eslint config | **tend's config** — eslint recommended + sonarjs recommended (TS/JSX parsed, no tsconfig needed) |
|
|
36
|
-
| eslint config, no sonarjs | **your config + sonarjs layered on top** — your rules *and* sonarjs in one pass |
|
|
37
|
-
| eslint config with sonarjs | **your config, untouched** |
|
|
34
|
+
Six scanners run on one of three tracks:
|
|
38
35
|
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
36
|
+
| Track | Tools | What tend does |
|
|
37
|
+
|-------|-------|----------------|
|
|
38
|
+
| **AI fix** | `eslint`+`sonarjs`, `knip`, `jscpd`, `semgrep` | each finding fixed by an AI session, then gated — kept only if it passes |
|
|
39
|
+
| **Report only** | `osv-scanner` | vulnerable deps surfaced with a suggested version bump (not applied) |
|
|
40
|
+
| **Report + fail** | `gitleaks` | secrets reported, never AI-touched; the run exits non-zero |
|
|
42
41
|
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
42
|
+
`eslint`+`sonarjs`, `knip`, and `jscpd` are **bundled and need zero setup**; the native tools
|
|
43
|
+
(`semgrep`, `osv-scanner`, `gitleaks`) you install yourself. See [docs/USAGE.md](docs/USAGE.md)
|
|
44
|
+
for full scanner behavior, flags, and config.
|
|
46
45
|
|
|
47
46
|
## Safety
|
|
48
47
|
|
|
49
|
-
- **In-place edits**
|
|
50
|
-
- A **silent snapshot** (tracked + untracked) is taken
|
|
51
|
-
|
|
48
|
+
- **In-place edits** to your working tree — no worktrees, no branches, no commits.
|
|
49
|
+
- A **silent snapshot** (tracked + untracked) is taken before any edit, so `tend undo` restores
|
|
50
|
+
the pre-run state exactly.
|
|
51
|
+
- Every fix must pass a gate — **anti-suppression · anti-regression · `tsc` · tests** — or it's
|
|
52
52
|
reverted atomically (code + its sibling test together).
|
|
53
|
-
- Tests are the behavior oracle: a fix may edit a test, but a **teeth check** rejects any
|
|
54
|
-
|
|
53
|
+
- Tests are the behavior oracle: a fix may edit a test, but a **teeth check** rejects any edit
|
|
54
|
+
that no longer fails on the old code.
|
|
55
55
|
|
|
56
|
-
##
|
|
56
|
+
## Configuration
|
|
57
57
|
|
|
58
|
-
|
|
59
|
-
|---------|--------------|
|
|
60
|
-
| `tend` / `tend run` | snapshot → audit → fix loop → report |
|
|
61
|
-
| `tend diff` | show only the tool's edits (your own changes filtered out) |
|
|
62
|
-
| `tend undo` | restore the pre-run snapshot exactly |
|
|
63
|
-
| `tend show <id>` | full detail on one finding (attempts, flow path, docs) |
|
|
64
|
-
| `tend retry <id>` | re-attempt a stubborn finding with a larger budget |
|
|
65
|
-
|
|
66
|
-
## Config (zero-config by default)
|
|
67
|
-
|
|
68
|
-
`cosmiconfig` discovery (`.tendrc`, `tend.config.js`, a `tend` key in `package.json`, …):
|
|
58
|
+
Zero-config by default. Drop a `.tendrc` (or a `tend` key in `package.json`) to tune it:
|
|
69
59
|
|
|
70
60
|
```jsonc
|
|
71
61
|
{
|
|
72
62
|
"maxSessions": 4,
|
|
73
63
|
"maxLoops": 5,
|
|
74
|
-
"perIssueBudget": 3,
|
|
75
|
-
"teethCheck": true,
|
|
76
|
-
"includeTests": false,
|
|
77
64
|
"model": "sonnet",
|
|
78
65
|
"effort": "high"
|
|
79
66
|
}
|
|
80
67
|
```
|
|
81
68
|
|
|
82
|
-
|
|
83
|
-
file. `model` is an alias (`sonnet` default, `opus`, `haiku`) or a full model id (e.g.
|
|
84
|
-
`claude-opus-4-8`); `effort` is the reasoning effort (`low | medium | high | xhigh | max`,
|
|
85
|
-
unset → claude's default). Both are passed straight to `claude -p`.
|
|
69
|
+
Full flags and config reference: **[docs/USAGE.md](docs/USAGE.md)**.
|
|
86
70
|
|
|
87
71
|
## Output
|
|
88
72
|
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
73
|
+
While it runs, a live task tree; when it finishes, a summary (fixed / couldn't-fix / left /
|
|
74
|
+
secrets, elapsed time, estimated AI cost & tokens) and a machine-readable `.tend/report.json`.
|
|
75
|
+
Pass `--plain` for line-per-event output in CI.
|
|
76
|
+
|
|
77
|
+
## Status & contributing
|
|
78
|
+
|
|
79
|
+
tend is **pre-1.0 (v0.x)** — interfaces may change between releases, so pin a version if you
|
|
80
|
+
need stability. Bug reports, ideas, and PRs are very welcome via
|
|
81
|
+
[GitHub issues](../../issues).
|
|
92
82
|
|
|
93
83
|
## License
|
|
94
84
|
|
|
95
|
-
MIT
|
|
85
|
+
[MIT](LICENSE)
|
package/package.json
CHANGED