PreviousNext
AI-assisted engineering/Verifying AI output

Fix the pre-merge audit for an agent-added package

Review the AI's codeEasy10 min

Your task

An AI agent fixed a date bug in your TypeScript project by adding @temporal-utils/parse, a package nobody on the team knew, and the build went green. A green build says nothing about where a package came from or what it costs you. Your team now audits every dependency an agent adds before it is merged.

An assistant wrote audit_new_dependency(registry_names, candidate, weekly_downloads, days_since_publish, transitive_count, license_id). It is in the editor. It has a bug. Find it and fix it.

Input and output:

  • registry_names: the package names that really exist on npm.
  • candidate: the package the agent added.
  • weekly_downloads: its downloads per week.
  • days_since_publish: days since its last release.
  • transitive_count: how many other packages it pulls in.
  • license_id: its license, such as MIT, or "" when it declares none.
  • Return the flags found, sorted by plain character order.

Rules the tests check:

  • If candidate is not exactly one of registry_names (case matters), return only ["not-in-registry"]. The other numbers then describe some other package, or none.
  • Otherwise add each flag that applies:
    • "low-adoption": fewer than 1000 weekly downloads.
    • "unmaintained": more than 365 days since the last release.
    • "large-transitive-tree": more than 10 transitive packages.
    • "restricted-license": the license is not exactly MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause or ISC. An empty license counts, because code with no license gives you no right to use it.

Examples

audit_new_dependency(registry_names: list[str], candidate: str, weekly_downloads: int, days_since_publish: int, transitive_count: int, license_id: str) -> list[str]
Example 1
Inputaudit_new_dependency(["left-pad", "date-fns", "lodash"], "date-fns", 12000000, 30, 3, "MIT")
Output[]
Example 2
Inputaudit_new_dependency(["left-pad", "date-fns"], "@temporal-utils/parse", 500, 20, 2, "MIT")
Output["not-in-registry"]
Example 3
Inputaudit_new_dependency(["parse-ms", "tiny-date"], "tiny-date", 800, 900, 42, "GPL-3.0")
Output["large-transitive-tree", "low-adoption", "restricted-license", "unmaintained"]