DEV Community: Rocco

AI as a Pair Programmer: How I Built depx in One Day

Rocco — Sun, 14 Dec 2025 04:12:39 +0000

The debate is wrong

Most discussions about AI in programming are binary: either "AI will replace developers" or "AI is garbage and always fails." Both miss the point.

AI is a tool. Like a compiler, an IDE, or Stack Overflow. The question isn't whether to use it, but how to use it effectively.

What I actually did

Yesterday I built depx, a CLI tool in Rust that analyzes JavaScript/TypeScript projects to understand what's really in your node_modules:

Find packages installed but never imported
Explain why any transitive dependency exists
Check vulnerabilities that actually affect your versions
List deprecated packages

I shipped it to crates.io, posted on Reddit, got feedback from a user with 25k packages saying my audit command would make 25,000 API requests. Within hours, I implemented batch queries (v0.2.0) reducing it to ~25 requests.

How AI fit into this

I used Claude throughout the process. Here's what that actually looked like:

What I did:

Identified the problem (node_modules chaos)
Defined the architecture (analyzer, graph, lockfile parser, vulnerability checker)
Made technical decisions (use oxc_parser, petgraph, OSV API)
Evaluated the output and caught edge cases (@types packages, build tools)
Tested on real projects
Responded to user feedback and prioritized the fix

What Claude did:

Wrote code faster than I could type
Implemented the structure I defined
Helped debug issues
Generated boilerplate I would have written anyway

The key insight

People who say "AI writes bad code" are often asking it to replace them. They prompt "build me an app" and get garbage.

People who use AI effectively treat it as a pair programmer. You drive, AI accelerates. You still need to:

Understand the problem deeply
Know what good code looks like
Evaluate if the solution is correct
Take responsibility for the result

Transparency

If you look at depx's GitHub, you'll see Claude listed as a contributor. That's intentional. I'm not hiding that I used AI — I'm showing that using AI doesn't mean you didn't build something real.

The tool works. It solves a real problem. Users are giving feedback and I'm shipping improvements. That's what matters.

The real question

Stop asking "should developers use AI?"

Start asking "what can I build now that I have this leverage?"

depx on GitHub | depx on crates.io

Introducing Prism — a modern TS-first, ESM-only package registry (early stage)

Rocco — Sat, 22 Nov 2025 02:17:46 +0000

Prism is a modern, TypeScript-first, ESM-only package registry I’m building from scratch — clean architecture, no legacy baggage.

What’s working now

real publish pipeline

metadata extraction (exports, types, file tree)

storage drivers (Memory / FS / S3-stub)

lightweight web UI

partial npm compatibility
(npm/pnpm/Yarn/Bun can already install from Prism)

What Prism aims to become

A modern superset of the npm protocol — typed, deterministic, storage-pluggable, and actually pleasant to work with.

Why I’m sharing

It’s early, but the foundation is solid.
Looking for feedback and contributors who enjoy dev-infra, registries, or TS architecture.

Repo: https://github.com/ruidosujeira/prism

Why are registries and node_modules still black boxes in 2025?

Rocco — Fri, 21 Nov 2025 03:33:36 +0000

Let’s be real: JavaScript package installation hasn’t fundamentally changed since 2014. We just stacked tools on top of the same old foundation.

node_modules is still a black hole, only faster depending on your PM.
Same idea, same problems, same blind trust.

The bigger issue isn’t npm or pnpm themselves.
It’s that we still have no real visibility into what we install.

Registries today are black boxes:

you can’t see a real file-tree

there’s no true version diff

metadata is minimal and inconsistent

no clear runtime compatibility (Node/Bun/Deno/Workers)

export-maps break unpredictably

packages can change massively between versions and you only find out later

Everyone keeps arguing “pnpm is faster”, “npm is stable”, “bun is aggressive” — but it’s all the same model.

The ecosystem has normalized no inspection.
We install millions of packages blindly.

That’s not engineering.
That’s hope.

I’m building something to fix this, but the discussion is bigger than my project.

Why did such a huge ecosystem never prioritize transparency?

Curious to hear honest thoughts.