
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@shipispec/tsfix
Advanced tools
Reusable TypeScript error-recovery agent. Validates LLM-generated TS code, auto-fixes deterministic error classes via the TS Language Service, and exposes hooks for LLM-driven repair.
@shipispec/tsfixStandalone npm package implementing Layers 0–1 of the TypeScript error-recovery stack: in-process tsc validation + deterministic LSP auto-fix. Layers 2–4 (LLM mend) currently live in spectoship2/src/pipeline/ and will move to a sister package @shipispec/tsmend per the roadmap.
Read first:
STATUS.md — what's working, what's planned, current gapsARCHITECTURE.md — why the package is shaped the way it istsc-defense-roadmap.md — phased plan with open decisionsCLAUDE.md — working principles (small allowlist, fixture-pinned trust model)This package owns its TypeScript-error handling code outright. The shims in spectoship2/ re-export from here, not the reverse.
| Path | Role |
|---|---|
src/index.ts | Public API (runValidationLoop, runInProcessTsc, runLSPFixerPass, discoverTsFiles) |
src/validatorInProcess.ts | In-process tsc with lib-path workaround (Layer 0) |
src/tsLanguageServiceFixer.ts | LSP auto-fixer using getCodeFixesAtPosition (Layer 1) |
cli/run-stack.ts | CLI: tsx cli/run-stack.ts --workspace <path> |
benchmark/run-benchmark.ts | Fixture harness (auto-discovers fixtures/*/) |
fixtures/ | 14 hand-authored synthetic fixtures across 3 tiers |
spectoship2/src/pipeline/validatorInProcess.ts | Re-export shim → @shipispec/tsfix |
spectoship2/src/pipeline/tsLanguageServiceFixer.ts | Re-export shim → @shipispec/tsfix |
Per ARCHITECTURE.md, a TSC error has up to four chances to die before reaching a user. Layers -1 (prevention) and 2-4 (mend) live outside this package.
┌─────────────────────────────────────────────────┐
│ Layer -1: PREVENTION (in spectoship2/, not here)│
│ packageGotchas, installedExports, priorExports│
│ codeGenPrompts (rules injected into prompt) │
└────────────────────┬────────────────────────────┘
│ files written to disk
▼
┌────── @shipispec/tsfix ───────┴──────────────────────────┐
│ │
│ ┌─────────────────────────────────────────────┐ │
│ │ Layer 0: src/validatorInProcess.ts │ │
│ │ in-process tsc → structured diagnostics │ │
│ │ workspace lib-path override │ │
│ └─────────────────────┬───────────────────────┘ │
│ │ if errors │
│ ▼ │
│ ┌─────────────────────────────────────────────┐ │
│ │ Layer 1: src/tsLanguageServiceFixer.ts │ │
│ │ getCodeFixesAtPosition (5 SAFE codes) │ │
│ │ signature-set progress check, max 5 iters │ │
│ └─────────────────────┬───────────────────────┘ │
│ │ re-validate; if errors remain │
└─────────────────────────┼─────────────────────────────────────────┘
▼
┌─────────────────────────────────┐
│ Layers 2-4: LLM MEND │
│ mendAgent / mendArchitect / │
│ multiFileMend / repairAgent │
│ (in spectoship2/, not here; │
│ moves to @shipispec/tsmend│
│ in v0.2 per roadmap) │
└─────────────────────────────────┘
STATUS.md — current state, fixture catalog, recent fixesARCHITECTURE.md — why the package is shaped the way it is (12 sections)tsc-defense-roadmap.md — phased plan with open decisionssrc/index.ts — public API entry point (runValidationLoop)src/tsLanguageServiceFixer.ts — Layer 1 fixer; understand SAFE_FIXABLE_CODES, the signature-set progress check, and the iteration loopsrc/validatorInProcess.ts — in-process tsc with the lib-path workaround that makes the package work inside the VS Code Extension Hostcli/run-stack.ts # CLI: run stack on any workspace
benchmark/run-benchmark.ts # benchmark across all fixtures
fixtures/ # 14 hand-authored synthetic workspaces
_shared/ # shared node_modules symlink target
clean-baseline/ # regression check (must stay green)
synthetic-*/ # 9 LSP-behavior fixtures (positive + negative)
api-drift-*/ # 4 version-drift fixtures (Zod 3 vs 4, React 18 vs 19, etc.)
cd /Users/ogg/Documents/microservices/Meta/spectoship2
./node_modules/.bin/tsx ../tsc-defense-stack/cli/run-stack.ts --workspace <path>
Flags: --json, --no-lsp, --verbose, --files <comma-list>. Exit 0 = clean, 1 = errors remain, 2 = bad args.
Note: per Phase 0c of
tsc-defense-roadmap.md, this package will gain its own localnode_modulesso commands run from inside the package directory. Today it sharesspectoship2/node_modules.
cd /Users/ogg/Documents/microservices/Meta/spectoship2
./node_modules/.bin/tsx ../tsc-defense-stack/benchmark/run-benchmark.ts
--fixture <name> to run a single fixture in isolation.
14/14 synthetic fixtures pass. LSP fixer auto-resolves 14/25 errors (56%). The remaining errors are intentional non-fixes — TS7006 implicit-any, TS2741 missing prop, API-drift errors that need the mend layer. See STATUS.md § Fixture catalog for the full list.
Phase 3b in the roadmap. When a real spec-pipeline run produces a TSC error Layer 0-1 doesn't fix, snapshot the broken .ts(x) files into fixtures/real-<timestamp>-<hash>/ with an expected.json. The fixture set then grows from production failures, not just synthetic ones.
FAQs
TypeScript error-recovery for LLM-generated code. Layer 0/1 deterministic auto-fix via the TS Language Service + Layer 2 LLM mend (Vercel AI SDK + Anthropic) in one package.
The npm package @shipispec/tsfix receives a total of 6 weekly downloads. As such, @shipispec/tsfix popularity was classified as not popular.
We found that @shipispec/tsfix demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.