Merge pull request #91 from CodeDeficient/claude/project-thread-36cl1x-compiled-js

Ship compiled JavaScript instead of running TypeScript through tsx

Author: CodeDeficient

.github/workflows/ci.yml

@@ -22,3 +22,16 @@ jobs:
       - run: npm ci
       - run: npm run typecheck
       - run: npm test
+      - name: Build and run the packaged CLI
+        run: |
+          npm pack
+          mkdir -p /tmp/smoke && cd /tmp/smoke && npm init -y >/dev/null
+          npm install "$GITHUB_WORKSPACE"/karpeslop-*.tgz
+          echo 'export const v = 1 as any;' > a.ts
+          # `as any` is high severity, so a working CLI reports it and exits 1.
+          # A crash also exits 1, so check the finding is in the output too.
+          status=0
+          KARPESLOP_OFFLINE=1 npx karpeslop --no-report a.ts > out.txt 2>&1 || status=$?
+          cat out.txt
+          test "$status" -eq 1
+          grep -q 'unsafe_type_assertion' out.txt

.gitignore

@@ -14,4 +14,5 @@ detector_output.txt
 CLAUDE.md
 .claude/
 .qwen/
-QWEN.md
+QWEN.md
+karpeslop-*.tgz

CHANGELOG.md

@@ -9,6 +9,7 @@ All notable changes will be documented in this file.
 - `swallowed_error` (medium): a `catch` block whose only statements are `console` calls. The error is logged and the code carries on as if the operation succeeded. A comment in the block explaining why that is safe, a rethrow, or any other statement (such as `setError(e)`) means it is not reported, and so does a fallback after the `try`, as for `empty_catch`.
 
 ### Changed
+- The package ships compiled JavaScript (`dist/`) and runs it directly with Node. It used to run the TypeScript sources through `tsx` on every call: `karpeslop --version` took 1.5 s and an install was 43 MB. It now takes 0.6 s and 31 MB, most of it the TypeScript compiler the rules use to parse code. `tsx` is no longer a runtime dependency.
 - `fresh_package_version` skips packages the scanned workspace publishes itself (any `name` in a scanned package.json) and lockfile entries that link a workspace folder. TanStack Query got 184 warnings for `@tanstack/*` versions it had just released.
 - Folders named `build`, `out` or `temp` are skipped only at the scan root or next to a package.json, where they hold build output. Deeper ones are often source: Next.js keeps its build pipeline in `packages/next/src/build/`, which was never scanned.
 - A run whose paths are all missing, ignored or unsupported ends with a one-line error instead of a stack trace.

ai-slop-detector.ts

@@ -1111,7 +1111,8 @@ turn it off, with severityOverrides in .karpesloprc.json.
 `);
 }
 
-async function runIfMain() {
+/** The command-line entry point, used by karpeslop-cli.js and by `tsx ai-slop-detector.ts`. */
+export async function main(): Promise<void> {
   const rootDir = process.cwd();
 
   const args = process.argv.slice(2);
@@ -1181,7 +1182,7 @@ async function runIfMain() {
 
 // Execute only when run as the main module, not when imported by tests.
 if (process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])) {
-  runIfMain().catch(error => {
+  main().catch(error => {
     console.error('KarpeSlop failed:', error);
     process.exit(1);
   });

imports.ts

@@ -636,15 +636,14 @@ function missingExportFinding(
   };
 }
 
-/** This package's version from package.json, or 'unknown'. */
+/** This package's version from package.json (next to this file, or one level up from dist/), or 'unknown'. */
 export function ownVersion(): string {
-  try {
-    const packagePath = path.join(path.dirname(fileURLToPath(import.meta.url)), 'package.json');
-    const version: unknown = JSON.parse(fs.readFileSync(packagePath, 'utf8')).version;
-    return typeof version === 'string' ? version : 'unknown';
-  } catch {
-    return 'unknown';
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  for (const dir of [here, path.dirname(here)]) {
+    const version = readJsonObject(path.join(dir, 'package.json'))?.version;
+    if (typeof version === 'string') return version;
   }
+  return 'unknown';
 }
 
 /** Sent with every npm registry request, as the registry asks of programmatic clients. */

karpeslop-cli.js

@@ -1,51 +1,8 @@
 #!/usr/bin/env node
-// This is an ES module wrapper for the KarpeSlop CLI tool
+// The published entry point. The prepare script (run by npm install, npm link and npm pack) compiles the TypeScript sources to dist/.
+import { main } from './dist/ai-slop-detector.js';
 
-import { spawn } from 'child_process';
-import { createRequire } from 'module';
-import { fileURLToPath } from 'url';
-import { dirname, join } from 'path';
-
-const require = createRequire(import.meta.url);
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-
-// Resolve the tsx loader from this package's dependencies so published
-// installs do not depend on a specific node_modules/.bin layout.
-const detectorPath = join(__dirname, 'ai-slop-detector.ts');
-const tsxLoaderPath = require.resolve('tsx');
-
-function exitCodeForSignal(signal) {
-  const signalExitCodes = {
-    SIGINT: 130,
-    SIGTERM: 143,
-    SIGHUP: 129,
-    SIGQUIT: 131
-  };
-
-  return signalExitCodes[signal] || 1;
-}
-
-function handleChildExit(code, signal) {
-  if (signal) {
-    process.exit(exitCodeForSignal(signal));
-  }
-  process.exit(code ?? 0);
-}
-
-// Get command line arguments, excluding the first two (node and script path)
-const args = process.argv.slice(2);
-
-// Run the detector through Node with the resolved tsx loader.
-const child = spawn(
-  process.execPath,
-  ['--import', tsxLoaderPath, detectorPath, ...args],
-  { stdio: 'inherit', cwd: process.cwd() }
-);
-
-child.on('error', (err) => {
-  console.error('Failed to start karpeslop:', err.message);
+main().catch(error => {
+  console.error('KarpeSlop failed:', error);
   process.exit(1);
 });
-
-child.on('exit', handleChildExit);