@fanalis/repo

source-pass modules. read the user's filesystem; analyse without rendering.

what's here

13 deterministic scanners, all bounded + sandboxed (no reads outside repoRoot):

• framework.ts — detect next/vite/astro/sveltekit/remix/nuxt + package manager + lockfile + dev port
• routes.ts — enumerate page + api routes per framework
• deps.ts — unused deps, runtime-vs-dev mislisting, missing deps
• secrets.ts — 21 patterns: github tokens, openai keys, aws keys, .env leaks
• npm-audit.ts — shells out to user's pm (pnpm/npm/yarn) for vulns
• bundle.ts — chunk-size analysis from .next / dist
• ast.ts — 99 regex+guard rules over .ts/.tsx/.js/.jsx; brace-balanced scanner for useEffect/await-in-loop
• ts-strictness.ts — JSONC parser for tsconfig; flags missing noUncheckedIndexedAccess etc
• unused-exports.ts — collects exports + import sites across the tree, surfaces dead exports
• images.ts — public/, static/, assets/: oversized/wrong-format
• css.ts — !important density, vendor-prefix overuse, tailwind dynamic-class JIT breaks
• dep-graph.ts — Tarjan SCC over the import graph (with tsconfig path alias resolution); cycles + hot files + god files
• design-system.ts — tailwind theme.extend coverage vs arbitrary-value hotspots; CSS-var inventory
• supply-chain.ts — package.json policy + lockfile sanity (~35% of Socket-style coverage)
• package-inspect.ts — walks node_modules/<pkg>/, runs Amalfi 2022 triad detection (install + env + network); flags eval/dyn-require/obfuscation/native binaries/trivial-with-power (~12 of Socket's 70 alerts)

perf

source pass on the fanalis repo itself: ~280 ms cold, ~110 ms warm (mtime cache on ast + dep-graph). pkg-inspect is the heaviest at ~200 ms.

caveats

• safeRead() refuses to resolve outside repoRoot. counted in the file-read audit surfaced by the CLI.
• ast.ts and dep-graph.ts share scan-cache.ts — invalidated by mtime + rule-hash. delete ~/.cache/fanalis/scan-cache/ to force cold scan.
• analysePackageInspect requires node_modules/ to exist. if the user hasn't installed, returns an empty result silently.
• analyseSupplyChain is reframed honest: "package.json policy + lockfile sanity check", NOT full supply-chain detection. typosquat heuristic uses trigram-jaccard ≥ 0.55 against a 3,491-name corpus from npm's search api; misses distant-position swaps like lodahs→lodash. SOTA is Socket.dev / Phylum.

not in scope

• tarball inspection (would need to fetch from registry)
• registry cross-ref (online-only signals: recently-published, unstable-ownership, new-author)
• behavioural diff between published versions

post-v1.