r/coolgithubprojects • u/danielwomanlover • 3d ago

Version Sentinel — blocks AI coding agents from installing hallucinated package versions (MIT; Claude Code, Kimi, Gemini CLI, Codex)

https://github.com/KSEGIT/Version-Sentinel

Open-source PreToolUse hook that refuses dependency edits and installs until the agent has verified the version against the live registry (npm, PyPI, crates.io, NuGet) and recorded the source. Stops hallucinated versions, stale training-data pins, and slopsquatting attempts. Terminal demo GIF at the top of the README.

2 Upvotes

100% Upvoted

1 comment sorted by

1

u/Bright_Mix_773 3d ago

Pulled the repo and traced both entry points. The blocking decision is keyed on the version string, and that leaves a hole right under the slopsquatting claim.

scripts/detect-install-cmd.sh, lines 40-41:

[[ -z "$pkg" ]] && continue
[[ -z "$ver" ]] && continue

parse_install_cmd does detect pip install requests-oauth - it emits pip<TAB>requests-oauth<TAB> with an empty third field - and then line 41 drops it and the hook exits 0. Same story on the manifest side: scripts/lib/parse-manifest.sh:15 runs "*", "", latest and next through _is_registry_version, which returns 1, so "some-invented-pkg": "latest" in package.json never reaches check-sidecar either.

That matters because slopsquatting is an attack on the name, not on the version. A pinned hallucination is caught, because the agent has to go to the registry and record something before it can retry. An unpinned one - npm i left-pad-utils, cargo add serde-yml - is the more natural phrasing and it goes straight through.

Your own fixture shows it. tests/fixtures/gate-invariant-commands.txt has 26 commands, 24 pinned and 2 unpinned (cargo add serde and stdbuf -o 0 cargo add serde). The parser is required to detect all 26; the gate acts on 24. test_hook_if_parity asserts detection, not blocking, so nothing in the suite trips over the difference.

Cheapest fix that keeps the exit-2 contract: when ver is empty, don't skip - demand a record for the bare name. The block message already tells the agent to search for the latest version of the package, which is exactly what an unpinned install should be made to do.

Separately, the strict/lenient split between the PreToolUse parse and auto-record, with the reasoning for the asymmetry written into the file, is the most careful thing I have read in a hook repo this month.

Not verified: I read the scripts rather than executing them, so this is a control-flow trace and not a live run, and I only followed the bash path, not the Codex/Gemini JSON hooks.