feat(enrichment): add package-health analyzer

.env.example

@@ -65,25 +65,26 @@ GITTENSORY_REVIEW_ENRICHMENT=false
 # Current analyzer names:
 # dependency,lockfileDrift,secret,license,installScript,heavyDependency,actionPin,eol,redos
 # provenance,codeowners,secretLog,assetWeight,typosquat,commitSignature,iacMisconfig,nativeBuild
-# history,docCommentDrift,duplication,churnHotspot,blameLink,approvalIntegrity,ciCheckSignals
-# undocumentedExport,staleBranch,commitHygiene,pendingReviewRequests,testRatio,migrationSafety
-# looseRange,terminology,todoMarker,magicNumber,conflictMarker,commitLint
+# packageHealth,history,docCommentDrift,duplication,churnHotspot,blameLink,approvalIntegrity
+# ciCheckSignals,undocumentedExport,staleBranch,commitHygiene,pendingReviewRequests,testRatio
+# migrationSafety,looseRange,terminology,todoMarker,magicNumber,conflictMarker,commitLint
 #
 # Profile defaults:
 # fast: dependency,lockfileDrift,secret,license,installScript,heavyDependency,actionPin,eol
-# redos,provenance,secretLog,typosquat,iacMisconfig,nativeBuild,testRatio,migrationSafety
-# looseRange,terminology,todoMarker,magicNumber,conflictMarker
+# redos,provenance,secretLog,typosquat,iacMisconfig,nativeBuild,packageHealth,testRatio
+# migrationSafety,looseRange,terminology,todoMarker,magicNumber,conflictMarker
 # balanced (default): dependency,lockfileDrift,secret,license,installScript,heavyDependency
 # actionPin,eol,redos,provenance,codeowners,secretLog,assetWeight,typosquat,commitSignature
-# iacMisconfig,nativeBuild,history,docCommentDrift,duplication,churnHotspot,blameLink
-# approvalIntegrity,ciCheckSignals,undocumentedExport,staleBranch,commitHygiene
+# iacMisconfig,nativeBuild,packageHealth,history,docCommentDrift,duplication,churnHotspot
+# blameLink,approvalIntegrity,ciCheckSignals,undocumentedExport,staleBranch,commitHygiene
 # pendingReviewRequests,testRatio,migrationSafety,looseRange,terminology,todoMarker,magicNumber
 # conflictMarker,commitLint
 # deep: dependency,lockfileDrift,secret,license,installScript,heavyDependency,actionPin,eol
 # redos,provenance,codeowners,secretLog,assetWeight,typosquat,commitSignature,iacMisconfig
-# nativeBuild,history,docCommentDrift,duplication,churnHotspot,blameLink,approvalIntegrity
-# ciCheckSignals,undocumentedExport,staleBranch,commitHygiene,pendingReviewRequests,testRatio
-# migrationSafety,looseRange,terminology,todoMarker,magicNumber,conflictMarker,commitLint
+# nativeBuild,packageHealth,history,docCommentDrift,duplication,churnHotspot,blameLink
+# approvalIntegrity,ciCheckSignals,undocumentedExport,staleBranch,commitHygiene
+# pendingReviewRequests,testRatio,migrationSafety,looseRange,terminology,todoMarker,magicNumber
+# conflictMarker,commitLint
 # END GENERATED REES ANALYZERS
 
 # Submitter-reputation spend control (internal-only): downgrades new/burst/low-rep

apps/gittensory-ui/src/lib/rees-analyzers.ts

@@ -455,6 +455,31 @@ export const REES_ANALYZERS = [
       notes: "Registry JSON is capped so large package metadata cannot monopolize REES memory.",
     },
   },
+  {
+    name: "packageHealth",
+    title: "Package maintenance health",
+    category: "supply-chain",
+    cost: "registry",
+    defaultEnabled: true,
+    profiles: ["fast", "balanced", "deep"],
+    requires: ["files", "public-network"],
+    limits: {
+      maxQueries: 25,
+      maxFindings: 25,
+      staleDays: 730,
+    },
+    docs: {
+      summary:
+        "Flags newly-added or upgraded npm/PyPI dependencies with maintenance-health risk signals.",
+      looksAt:
+        "Direct dependency changes in package.json and requirements.txt, then package registry metadata.",
+      reports:
+        "Package, version, ecosystem, direction, and public-safe maintenance signal details.",
+      network: "Calls npm, PyPI, and ecosyste.ms package APIs. No GitHub token required.",
+      notes:
+        "Fail-safe and bounded: unsupported ecosystems, invalid names, failed calls, and oversized responses stay silent.",
+    },
+  },
   {
     name: "history",
     title: "Author and change-area history",

review-enrichment/README.md

@@ -48,6 +48,7 @@ inside the operator's trust boundary. The engine prefers a short-lived installat
 | `commitSignature` | Head commit signature/author provenance worth checking.                    | Calls GitHub API; needs headSha and token for private repos. |
 | `iacMisconfig`  | Risky IaC/config changes like public buckets, open ingress, or insecure CORS. | Pure local.                                                 |
 | `nativeBuild`   | Newly-added dependencies that compile native code or ship sdist-only builds. | Calls npm/PyPI registries.                                  |
+| `packageHealth` | Maintenance-health signals for newly-added or upgraded npm/PyPI packages.   | Calls npm, PyPI, and ecosyste.ms package APIs.              |
 | `history`       | Author track record, same-file PR history, and linked-issue alignment.       | Calls GitHub API with bounded fanout; needs author/token for private repos. |
 | `magicNumber`   | Non-trivial numeric literals newly added in non-test source.                 | Pure local.                                                  |
 
@@ -77,6 +78,25 @@ classes, per-analyzer limits, and self-host configuration. When adding or migrat
 - Make external-call analyzers fail open and respect the orchestrator abort signal when the scanner supports it.
 - Prefer a focused analyzer test file instead of expanding the shared `enrichment.test.ts` mega-test.
 
+### Package-health analyzer
+
+`packageHealth` checks direct npm and PyPI dependency additions/upgrades for factual package-maintenance signals:
+deprecated npm versions, yanked PyPI releases, packages whose latest release is older than the analyzer threshold,
+archived upstream repositories, and packages with a single listed maintainer.
+
+The analyzer reuses the shared dependency-diff parser, so it only inspects dependencies newly present after the PR.
+Unsupported ecosystems, invalid package names, failed registry calls, oversized responses, and missing metadata stay
+silent. Findings report only package metadata: ecosystem, package, version, direction, signal kind, and a short
+public-safe detail. They never include manifest lines, registry response bodies, install scripts, or repository
+content.
+
+The scanner is intentionally additive with sibling supply-chain analyzers:
+
+- `dependency` reports known vulnerabilities.
+- `license` reports compatibility-sensitive licenses.
+- `nativeBuild` reports install-time build cost.
+- `packageHealth` reports maintainability and stewardship signals.
+
 ### Magic-number analyzer
 
 `magicNumber` is a precision-first local analyzer for unexplained numeric literals added by a PR. It is intended to

review-enrichment/analyzer-metadata.json

@@ -524,6 +524,34 @@
         "notes": "Registry JSON is capped so large package metadata cannot monopolize REES memory."
       }
     },
+    {
+      "name": "packageHealth",
+      "title": "Package maintenance health",
+      "category": "supply-chain",
+      "cost": "registry",
+      "defaultEnabled": true,
+      "profiles": [
+        "fast",
+        "balanced",
+        "deep"
+      ],
+      "requires": [
+        "files",
+        "public-network"
+      ],
+      "limits": {
+        "maxQueries": 25,
+        "maxFindings": 25,
+        "staleDays": 730
+      },
+      "docs": {
+        "summary": "Flags newly-added or upgraded npm/PyPI dependencies with maintenance-health risk signals.",
+        "looksAt": "Direct dependency changes in package.json and requirements.txt, then package registry metadata.",
+        "reports": "Package, version, ecosystem, direction, and public-safe maintenance signal details.",
+        "network": "Calls npm, PyPI, and ecosyste.ms package APIs. No GitHub token required.",
+        "notes": "Fail-safe and bounded: unsupported ecosystems, invalid names, failed calls, and oversized responses stay silent."
+      }
+    },
     {
       "name": "history",
       "title": "Author and change-area history",