Source note
Software Supply Chains are Dead: Use-Case-Oriented Regeneration
Code IntelligenceAutomated Software ProductionSoftware Supply ChainAgentic CodingDependency Regeneration
Summary
The paper proposes use-case-oriented regeneration: an agent locally reimplements only the dependency behavior a repository actually uses. Across 180 JavaScript/TypeScript repository–dependency pairs, the approach preserved nearly all repository-observed validation behavior while sharply reducing the exposed API surface, but it does not establish full semantic equivalence.
Problem
- Package reuse forces repositories to inherit unused code, transitive dependencies, maintenance obligations, compatibility constraints, and supply-chain risk for narrow functionality.
- Generative coding agents reduce the cost of local implementation, making it important to reassess when dependency reuse is preferable to repository-owned code.
- The problem matters because dependency removal can reduce external trust and attack exposure, but regenerated code must still be validated for correctness and maintainability.
Approach
- Treat the repository–dependency pair, rather than the upstream package, as the unit of replacement.
- Give an agent repository context and validation artifacts; have it identify dependency call sites, generate local replacements, update callers, remove the dependency, and iterate on validation failures.
- Target repository-observed equivalence: the replacement must preserve behaviors exercised by the repository, not every behavior supported by the original package.
- Evaluate 20 repositories for each of nine JavaScript/TypeScript dependencies, including nanoid, chalk, express, semver, lodash, axios, postcss, change-case, and zod.
Results
- Across 180 pairs, regenerated code achieved a reported 99.8% aggregate validation pass rate; 166 of 180 pairs preserved all baseline validation checks.
- Generated replacements reduced the exported API surface by an average of 93.1%, from 82.1 original exports to 5.6 regenerated exports, with 6.9% of the original surface retained on average.
- Results were strongest for bounded uses: nanoid and zod had 20/20 pairs with perfect preservation, while lodash had 16/20 and accounted for the largest reported failure count, 104.
- The paper describes 14 failed regeneration attempts, involving semantic and edge-case mismatches, class-identity problems, and deep framework integrations such as express middleware and axios mock interceptors.
- The evidence is limited to existing repository validation artifacts and selected public repositories; passing those checks does not prove full semantic equivalence or coverage of future use cases.