跪拜 Guibai
← All articles
Frontend · Command-line

The CLI Toolkit for Developers Who Sweat the Invisible Mess in Their Projects

By 驳是 ·
Read original on juejin.cn ↗ Google Translate ↗ Alt translation

Phantom dependencies and version drift cause production failures that linters never catch. These tools make dependency hygiene and codebase size as checkable as lint rules, so a monorepo stops silently accumulating dead weight and hidden breakage.

Summary

Code linters and formatters only clean the surface. The real rot sits in outdated, redundant, or missing dependencies, version mismatches across monorepo packages, and codebases that grow without anyone measuring them. A handful of single-purpose CLI tools now tackle each of these problems directly.

taze and ncu check every workspace package and bump dependency versions, with taze winning on speed and interactive defaults. knip replaces the dormant depcheck to surface unused dependencies, phantom imports that package hoisting silently permits, and dead files and exports. syncpack audits an entire monorepo for version inconsistencies—the same package declared at three different semver ranges across packages—and can fix them. tokei and cloc count lines of code, but tokei respects .gitignore out of the box, separates TS from TSX, and finishes before you can reach for a coffee.

Each tool installs globally or as a dev dependency, ships with a config file, and slots into a CI pipeline or a morning ritual. Together they turn dependency health and project volume from a gut feeling into a set of fast, machine-readable checks.

Takeaways
taze scans an entire pnpm workspace and updates dependency versions faster than ncu, especially when run via `pnpm -r exec`.
knip detects unused dependencies, phantom imports, dead files, and unused exports in one command; it replaced the now-dormant depcheck.
syncpack lists every dependency across a monorepo and flags version mismatches—the same package pinned to different ranges in different packages.
tokei counts lines of code, respects .gitignore automatically, and distinguishes TypeScript from TSX, unlike cloc.
All four tools can be installed globally, added as dev dependencies, and configured with a single config file in the project root.
Conclusions

Package hoisting lets code import packages that were never declared, creating phantom dependencies that pass local builds but break consumers of published packages.

Daily dependency updates shrink the blast radius of a bad release: when a minor version breaks something, the window of affected versions is narrow enough to bisect quickly.

knip’s `--strict` flag limits scanning to production code only, which aligns with pnpm’s strict phantom-dependency checks but deliberately ignores tests and config files.

tokei’s speed advantage over cloc comes partly from Rust and partly from automatically skipping everything listed in .gitignore, so it never wastes time on node_modules or build output.

Concepts & terms
Phantom dependency (幽灵依赖)
A package that code can import and use even though it is not declared in package.json, made possible by package managers hoisting all dependencies to a flat node_modules structure.
Package hoisting
The behavior of pnpm, npm, and Yarn where all dependencies are flattened into a single top-level node_modules directory, making indirect dependencies directly accessible to any package in the workspace.
Monorepo workspace
A repository containing multiple packages managed together, where a root package.json and workspace configuration allow shared scripts, dependencies, and tooling across all packages.
Source: juejin.cn ↗ Google Translate ↗ Backup ↗