[algomaster99]

When a package's registry answers 404 (or 410 from the Go proxy) and the ecosyste.ms fallback doesn't know the package either, the hook now blocks the write and tells the agent the name is likely hallucinated. Before, an unknown package made pins.Diff error out and the hook failed open, so a made-up name went through silently. Network errors, rate limits and 5xx responses still fail open.

Writing requirements.txt with requests==2.34.2 and huggingface-cli-utils==0.3.1, before:

hook: resolving huggingface-cli-utils: no latest version found
exit=0

After:

these dependencies don't exist on their registry, so they're likely hallucinated; use a real package instead:
  huggingface-cli-utils  0.3.1
exit=2

The same check applies to pins made through npm install/pip install/cargo add/go get on Bash, and yul scan lists such dependencies in their own group. go.mod modules with a replace directive (e.g. a local ../lib) are skipped, since they're expected to be missing upstream. A newly added Maven -SNAPSHOT that's missing on Central is blocked like any other missing dependency. Scoped npm packages are unaffected because npm answers 401, not 404, for a missing scope, and GitHub Actions aren't covered.

One known gap: an unscoped package hosted only on a private registry (an .npmrc registry, a private pip index, an internal Nexus) also 404s on the public one, so it gets blocked too.

None of the final manifests in the DeepSeek V4.1 Flash and Opus 5.5 benchmark runs trip the new check.

🤖 Generated with Claude Code