Lockfile Ofrenda: candles for the packages that stopped speaking

说明与用途

Lockfile Ofrenda 将 npm 锁文件中已停用的包可视化为蜡烛。点击蜡烛时，本地 Gemma 模型生成纪念文本，并进行事实核对；若模型失败，则显示注册表数据副本。

问题

Developers need to identify and acknowledge npm packages in their lockfile that are unpublished, deprecated, silent for two years, or have no maintainers, because npm outdated does not reveal these issues.

结果

The app provides a visual and interactive way to identify and acknowledge quiet npm packages, ensuring developers are aware of potentially problematic dependencies without uploading data to external services.

工作流

• Parse package-lock.json (v2/v3 or nested dependencies tree).
• Query registry.npmjs.org for each package’s last publish date, deprecation text, and maintainers.
• Score packages as quiet if unpublished, deprecated, silent for ≥730 days, or have no maintainers.
• Render an altar UI with a candle for each quiet package.
• On candle click, invoke local Gemma (via Ollama) to generate a remembrance slip.
• Ground the generated text against the registry facts; if it contains invented data, discard and show clerk copy.
• Allow user to snuff a candle to suppress future reminders in the session.

证据

The app parses npm lockfile v2/v3 (and the older nested dependencies tree), asks registry.npmjs.org for last publish, deprecation text, and maintainers, then lights a marigold candle for anything unpublished, deprecated, silent for 730 days, or listed with no maintainers.

来源

If Gemma is offline or fails that check, you get a clerk’s copy of the registry fields instead, labeled as such.

来源

The system prompt is a clerk of a death register, not a poet with a search engine.

来源