
Security News
Scaling Socket from Zero to 10,000+ Organizations
Socket CEO Feross Aboukhadijeh shares lessons from scaling a developer security startup to 10,000+ organizations in this founder interview.
@heypal/magnet-cli
Advanced tools
Install:
pnpm i -g @heypal/magnet-cli@latest
How to run:
# In your project directory
OPENAI_API_KEY=<key> magnet run
# Also reads OPENAI_API_KEY from .env file if it exists in the directory
magnet run
How to run locally:
pnpm install
pnpm build && pnpm link --global
# Reads OPENAI_API_KEY from .env file if it exists in the directory
magnet run
This creates a .magnet/magnet.json file in the current directory if it doesn't exist already.
magnet run
Runs the plugins specified in index.ts passed to the run command. So far, we have the following plugins:
magnet.json file up to date.llm.isApiRoute=true, passes the file contents to OpenAI to generate an OpenAPI schema that's saved to openaiSchema.json under the file's sub-directory in .magnetmagnet clean
Cleans up the .magnet/magnet.json metadata file.
magnet clean was calledignorePatternsPlugins get passed the full metadata object, which is the entire magnet.json file. They can then choose what to operate on themselves and update the magnet.json file arbitrarily.
Most of the time, the plugin will read files, which should be a map of file paths to file metadata, generated by the built-in FilePlugin. Other plugins are expected to add their output to files[<filepath>][<pluginKey>], so it doesn't conflict with the metadata generated by other plugins.
For example, the init.ts file has the following entry. Notice the LLM Plugin saves its output inside the llm key.
{
"files": {
"/Users/dev/magnet-cli/commands/init.ts": {
"notesPath": "/Users/dev/magnet-cli/.magnet/notes/magnet-cli/commands/init.ts",
"lastChanged": "2023-08-18T16:05:55.211Z",
"path": "/Users/dev/magnet-cli/commands/init.ts",
"llm": {
"lastAnalyzed": "2023-08-21T00:07:01.257Z",
"needsAnalysis": false,
"output": "{\n \"summary\": \"This file is responsible for initializing the application. It has an 'init' method which is used to log the directory root of the application context.\",\n \"keywords\": [\"import\", \"zod\", \"BaseCtx\", \"InitCtx\", \"async function\", \"console.log\"],\n \"description\": \"This script is used to initialize an app using a provided context.\",\n \"isApiRoute\": false,\n \"apiRouteDescription\": null,\n \"isWebappPage\": false,\n \"webAppPageDescription\": null\n}",
"summary": "This file is responsible for initializing the application. It has an 'init' method which is used to log the directory root of the application context.",
"description": "This script is used to initialize an app using a provided context.",
"keywords": [
"import",
"zod",
"BaseCtx",
"InitCtx",
"async function",
"console.log"
],
"isApiRoute": false,
"apiRouteDescription": false
}
}
}
}
This only runs on files whose llm.lastAnalyzed is null, or llm.needsAnalysis is explicitly set to true, or llm.lastAnalyzed is further in the past than lastChanged.
This only runs on files whose llm.isApiRoute=true.
New Github releases are published in the publish.yaml workflow. These releases are created when new semver tags are pushed. See the release.yaml workflow.
To bump the version and push a release, run pnpm release:patch.
This builds the project, runs tests, bumps the version number and creates a new commit for the new version, and creates then pushes a new tag for the version number to Github.
It is suggested to title commits according to Conventional Commits, so the release workflow will pick up changes and put them in the changelog.
This means prefixing titles with feat: or fix:, e.g. fix: properly handle timeout errors.
See the full list of prefixes in the changelogithub.js file.
If a commit title isn't prefixed, it will not be picked up.
See DEVELOPMENT.md
FAQs
Install:
We found that @heypal/magnet-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh shares lessons from scaling a developer security startup to 10,000+ organizations in this founder interview.

Research
Socket Threat Research maps a rare inside look at OtterCookie’s npm-Vercel-GitHub chain, adding 197 malicious packages and evidence of North Korean operators.

Research
Socket researchers identified a malicious Chrome extension that manipulates Raydium swaps to inject an undisclosed SOL transfer, quietly routing fees to an attacker wallet.