Lockfile Ofrenda: candles for the packages that stopped speaking

Описание и применение

Приложение Lockfile Ofrenda визуализирует «мёртвые» пакеты в package-lock.json, показывая их как свечи. При нажатии на свечу локальная модель Gemma генерирует памятный текст, проверяемый на достоверность; при сбое показывается копия данных из реестра.

Задача

Developers need to identify and acknowledge npm packages in their lockfile that are unpublished, deprecated, silent for two years, or have no maintainers, because npm outdated does not reveal these issues.

Результат

The app provides a visual and interactive way to identify and acknowledge quiet npm packages, ensuring developers are aware of potentially problematic dependencies without uploading data to external services.

Рабочий процесс

• Parse package-lock.json (v2/v3 or nested dependencies tree).
• Query registry.npmjs.org for each package’s last publish date, deprecation text, and maintainers.
• Score packages as quiet if unpublished, deprecated, silent for ≥730 days, or have no maintainers.
• Render an altar UI with a candle for each quiet package.
• On candle click, invoke local Gemma (via Ollama) to generate a remembrance slip.
• Ground the generated text against the registry facts; if it contains invented data, discard and show clerk copy.
• Allow user to snuff a candle to suppress future reminders in the session.

Доказательства

The app parses npm lockfile v2/v3 (and the older nested dependencies tree), asks registry.npmjs.org for last publish, deprecation text, and maintainers, then lights a marigold candle for anything unpublished, deprecated, silent for 730 days, or listed with no maintainers.

Источник

If Gemma is offline or fails that check, you get a clerk’s copy of the registry fields instead, labeled as such.

Источник

The system prompt is a clerk of a death register, not a poet with a search engine.

Источник