
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
@heypal/magnet-cli
Advanced tools
Install:
pnpm i -g @heypal/magnet-cli@latest
How to run:
# In your project directory
OPENAI_API_KEY=<key> magnet run
# Also reads OPENAI_API_KEY from .env file if it exists in the directory
magnet run
How to run locally:
pnpm install
pnpm build && pnpm link --global
# Reads OPENAI_API_KEY from .env file if it exists in the directory
magnet run
This creates a .magnet/magnet.json
file in the current directory if it doesn't exist already.
magnet run
Runs the plugins specified in index.ts
passed to the run
command. So far, we have the following plugins:
magnet.json
file up to date.llm.isApiRoute=true
, passes the file contents to OpenAI to generate an OpenAPI schema that's saved to openaiSchema.json
under the file's sub-directory in .magnet
magnet clean
Cleans up the .magnet/magnet.json
metadata file.
magnet clean
was calledignorePatterns
Plugins get passed the full metadata
object, which is the entire magnet.json
file. They can then choose what to operate on themselves and update the magnet.json
file arbitrarily.
Most of the time, the plugin will read files
, which should be a map of file paths to file metadata, generated by the built-in FilePlugin
. Other plugins are expected to add their output to files[<filepath>][<pluginKey>]
, so it doesn't conflict with the metadata generated by other plugins.
For example, the init.ts
file has the following entry. Notice the LLM Plugin saves its output inside the llm
key.
{
"files": {
"/Users/dev/magnet-cli/commands/init.ts": {
"notesPath": "/Users/dev/magnet-cli/.magnet/notes/magnet-cli/commands/init.ts",
"lastChanged": "2023-08-18T16:05:55.211Z",
"path": "/Users/dev/magnet-cli/commands/init.ts",
"llm": {
"lastAnalyzed": "2023-08-21T00:07:01.257Z",
"needsAnalysis": false,
"output": "{\n \"summary\": \"This file is responsible for initializing the application. It has an 'init' method which is used to log the directory root of the application context.\",\n \"keywords\": [\"import\", \"zod\", \"BaseCtx\", \"InitCtx\", \"async function\", \"console.log\"],\n \"description\": \"This script is used to initialize an app using a provided context.\",\n \"isApiRoute\": false,\n \"apiRouteDescription\": null,\n \"isWebappPage\": false,\n \"webAppPageDescription\": null\n}",
"summary": "This file is responsible for initializing the application. It has an 'init' method which is used to log the directory root of the application context.",
"description": "This script is used to initialize an app using a provided context.",
"keywords": [
"import",
"zod",
"BaseCtx",
"InitCtx",
"async function",
"console.log"
],
"isApiRoute": false,
"apiRouteDescription": false
}
}
}
}
This only runs on files whose llm.lastAnalyzed
is null, or llm.needsAnalysis
is explicitly set to true
, or llm.lastAnalyzed
is further in the past than lastChanged
.
This only runs on files whose llm.isApiRoute=true
.
New Github releases are published in the publish.yaml
workflow. These releases are created when new semver tags are pushed. See the release.yaml
workflow.
To bump the version and push a release, run pnpm release:patch
.
This builds the project, runs tests, bumps the version number and creates a new commit for the new version, and creates then pushes a new tag for the version number to Github.
It is suggested to title commits according to Conventional Commits, so the release workflow will pick up changes and put them in the changelog.
This means prefixing titles with feat:
or fix:
, e.g. fix: properly handle timeout errors
.
See the full list of prefixes in the changelogithub.js
file.
If a commit title isn't prefixed, it will not be picked up.
See DEVELOPMENT.md
FAQs
Install:
We found that @heypal/magnet-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 8 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.