@safetnsr/vet 0.2.0 → 0.3.0

package/README.md

@@ -1,6 +1,6 @@
 # vet
 
-vet your AI-generated code. one command, six checks, zero config.
+vet your AI-generated code. one command, ten checks, zero config.
 
 ```bash
 npx @safetnsr/vet
@@ -18,6 +18,10 @@ works with Claude Code, Cursor, Copilot, Codex, Aider, Windsurf, Cline — anyth
 | **links** | broken markdown links? | validates relative links and wikilinks |
 | **config** | agent configs in place? | deep analysis of CLAUDE.md, .cursorrules, copilot-instructions — checks completeness, consistency, and specificity against your actual codebase |
 | **history** | git patterns healthy? | analyzes commit churn, AI attribution, large changes |
+| **scan** | malicious patterns in agent configs? | scans .claude/, .cursorrules, CLAUDE.md, .mcp/ for prompt injection, shell injection, exfiltration endpoints |
+| **secrets** | leaked secrets in build output? | scans dist/, build/, .next/ + .env files for API keys, tokens, connection strings using pattern + entropy analysis |
+| **receipt** | what did the last agent session do? | parses ~/.claude/projects/ JSONL session logs — files changed, commands run, packages installed, SHA256 integrity hash |
+| **edge** | how replaceable is your git history? | classifies commits by human-edge score: architecture (90) → debugging (85) → integration (80) → feature (60) → boilerplate (20) → cosmetic (10) |
 
 ## usage
 
@@ -45,6 +49,14 @@ npx @safetnsr/vet --json
 
 # generate configs + pre-commit hook
 npx @safetnsr/vet init
+
+# show last agent session receipt (ASCII or JSON)
+npx @safetnsr/vet receipt
+npx @safetnsr/vet receipt --json
+
+# show human-edge score for git history
+npx @safetnsr/vet edge
+npx @safetnsr/vet edge --explain
 ```
 
 ## output
@@ -109,13 +121,57 @@ config score breakdown:
   specificity:   3/10 — generic rules, nothing project-specific
 ```
 
+## subcommands
+
+### `vet receipt`
+
+Shows a receipt for the last Claude Code agent session — what files it touched, what commands it ran, what packages it installed, plus a SHA256 integrity hash:
+
+```
+╔══════════════════════════════════════════════╗
+║          AGENT SESSION RECEIPT               ║
+╠══════════════════════════════════════════════╣
+║ Session:  abc123def456                       ║
+║ Date:     2024-01-15 14:32:11 UTC            ║
+║ Duration: 12m 34s                            ║
+╠══════════════════════════════════════════════╣
+║ FILES CREATED (3)                            ║
+║   src/checks/scan.ts                         ║
+║   src/checks/secrets.ts                      ║
+║   test/scan.test.mjs                         ║
+╠══════════════════════════════════════════════╣
+║ SHA256: 3a7f9c2e...                          ║
+╚══════════════════════════════════════════════╝
+```
+
+### `vet edge`
+
+Analyzes git history and scores how AI-replaceable your contributions are:
+
+```
+  Human Edge Report  72/100
+
+  🏗️ Architecture     12  (28%) ████████████
+  🔍 Debugging         8  (19%) ████████
+  🔗 Integration       6  (14%) ██████
+  ⚡ Feature          10  (24%) ██████████
+  📋 Boilerplate       5  (12%) █████
+  🎨 Cosmetic          1   (2%) █
+
+  Top commits
+  90  a3f2b1c  refactor: extract auth middleware across all routes
+  85  7e8d9f1  fix: resolve race condition in session cleanup
+
+  → Strong position. Your work is deeply contextual and hard to automate.
+```
+
 ## config
 
 create `.vetrc` in your project root (optional):
 
 ```json
 {
-  "checks": ["ready", "diff", "models", "links", "config", "history"],
+  "checks": ["ready", "diff", "models", "links", "config", "history", "scan", "secrets", "receipt", "edge"],
   "ignore": ["vendor/", "generated/"],
   "thresholds": { "min": 6 }
 }

package/dist/checks/edge.d.ts

@@ -0,0 +1,30 @@
+import type { CheckResult } from '../types.js';
+type CommitCategory = 'architecture' | 'debugging' | 'integration' | 'feature' | 'boilerplate' | 'cosmetic';
+interface DiffStats {
+    filesChanged: number;
+    insertions: number;
+    deletions: number;
+    dirsChanged: number;
+    files: string[];
+}
+interface ClassifiedCommit {
+    hash: string;
+    date: string;
+    message: string;
+    author: string;
+    category: CommitCategory;
+    score: number;
+    reasoning: string;
+    stats: DiffStats;
+}
+export interface EdgeAnalysis {
+    score: number;
+    totalCommits: number;
+    distribution: Record<CommitCategory, number>;
+    topCommits: ClassifiedCommit[];
+    recommendation: string;
+}
+export declare function analyzeEdge(cwd: string, maxCommits?: number): EdgeAnalysis;
+export declare function checkEdge(cwd: string): CheckResult;
+export declare function runEdgeCommand(cwd: string, explain?: boolean): void;
+export {};

package/dist/checks/edge.js

@@ -0,0 +1,230 @@
+import { execFileSync } from 'node:child_process';
+const CATEGORY_SCORES = {
+    architecture: 90,
+    debugging: 85,
+    integration: 80,
+    feature: 60,
+    boilerplate: 20,
+    cosmetic: 10,
+};
+const BOILERPLATE_RE = [/\bcrud\b/i, /\bscaffold/i, /\bgenerat(e|ed|ing)\b/i, /\binit(ial)?\b/i, /\bboilerplate\b/i, /\btemplate\b/i, /\bsetup\b/i];
+const COSMETIC_RE = [/\brenam(e|ed|ing)\b/i, /\bformat(ting)?\b/i, /\blint(ing)?\b/i, /\bprettier\b/i, /\bstyle\b/i, /\bwhitespace\b/i, /\btypo\b/i];
+const DEBUG_RE = [/\bfix(e[ds])?\b/i, /\bbug\b/i, /\bdebug/i, /\bpatch\b/i, /\bhotfix\b/i, /\bresolv(e|ed|ing)\b/i, /\berror\b/i, /\bissue\b/i];
+const INTEGRATION_RE = [/\bintegrat(e|ion|ing)\b/i, /\bapi\b/i, /\bwebhook\b/i, /\bmigrat(e|ion|ing)\b/i, /\bdatabase\b/i, /\bqueue\b/i, /\bconnect/i, /\bpipeline\b/i, /\bauth(entication|orization)?\b/i];
+function getUniqueDirs(files) {
+    const dirs = new Set();
+    for (const f of files) {
+        const parts = f.split('/');
+        dirs.add(parts.length > 1 ? parts.slice(0, -1).join('/') : '.');
+    }
+    return [...dirs];
+}
+function hasMultiSystemFiles(files) {
+    const layers = new Set();
+    for (const f of files) {
+        const lower = f.toLowerCase();
+        if (/route|controller|handler/.test(lower))
+            layers.add('api');
+        if (/model|schema|migration|db/.test(lower))
+            layers.add('db');
+        if (/test|spec/.test(lower))
+            layers.add('test');
+        if (/config|\.env|yaml|yml/.test(lower))
+            layers.add('config');
+        if (/middleware|auth/.test(lower))
+            layers.add('middleware');
+        if (/service|worker/.test(lower))
+            layers.add('service');
+    }
+    return layers.size >= 2;
+}
+function isCosmetic(stats, message) {
+    const total = stats.insertions + stats.deletions;
+    if (total < 10 && COSMETIC_RE.some(p => p.test(message)))
+        return true;
+    if (stats.insertions > 0 && stats.deletions > 0 &&
+        Math.abs(stats.insertions - stats.deletions) <= 2 &&
+        total < 20 && COSMETIC_RE.some(p => p.test(message)))
+        return true;
+    return false;
+}
+function classifyCommit(hash, date, message, author, stats) {
+    const { filesChanged, insertions, deletions, dirsChanged } = stats;
+    const total = insertions + deletions;
+    let category;
+    let reasoning;
+    if (isCosmetic(stats, message)) {
+        category = 'cosmetic';
+        reasoning = `Small change (${total} lines) matching cosmetic patterns`;
+    }
+    else if (BOILERPLATE_RE.some(p => p.test(message)) && (insertions > deletions * 3 || deletions === 0)) {
+        category = 'boilerplate';
+        reasoning = `Scaffolding pattern in commit message (${insertions} insertions, ${deletions} deletions)`;
+    }
+    else if (dirsChanged >= 3 && filesChanged >= 4) {
+        category = 'architecture';
+        reasoning = `Cross-directory changes (${dirsChanged} dirs, ${filesChanged} files) — structural refactoring`;
+    }
+    else if (filesChanged <= 2 && total <= 30 && DEBUG_RE.some(p => p.test(message))) {
+        category = 'debugging';
+        reasoning = `Targeted fix (${total} lines in ${filesChanged} file${filesChanged > 1 ? 's' : ''}) — context-heavy debugging`;
+    }
+    else if (INTEGRATION_RE.some(p => p.test(message)) || (dirsChanged >= 2 && hasMultiSystemFiles(stats.files))) {
+        category = 'integration';
+        reasoning = 'Multi-system wiring — connecting different parts of the stack';
+    }
+    else if (insertions > 100 && deletions < 10 && filesChanged >= 3 && deletions < insertions * 0.1) {
+        category = 'boilerplate';
+        reasoning = `Uniform additions (${insertions} insertions, ${deletions} deletions)`;
+    }
+    else if (total > 0) {
+        if (dirsChanged >= 2 && filesChanged >= 3 && total > 50) {
+            category = 'architecture';
+            reasoning = `Multi-directory changes (${dirsChanged} dirs, ${filesChanged} files, ${total} lines)`;
+        }
+        else if (DEBUG_RE.some(p => p.test(message)) && filesChanged <= 3) {
+            category = 'debugging';
+            reasoning = `Bug fix across ${filesChanged} file${filesChanged > 1 ? 's' : ''}`;
+        }
+        else {
+            category = 'feature';
+            reasoning = `Feature work (${filesChanged} file${filesChanged > 1 ? 's' : ''}, ${total} lines)`;
+        }
+    }
+    else {
+        category = 'cosmetic';
+        reasoning = 'Empty or metadata-only commit';
+    }
+    return { hash: hash.slice(0, 8), date, message: message.slice(0, 80), author, category, score: CATEGORY_SCORES[category], reasoning, stats };
+}
+// ── Git log parsing (no simple-git, uses execSync) ───────────────────────────
+function gitRaw(args, cwd) {
+    try {
+        return execFileSync('git', args, { cwd, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+function getCommitStats(hash, cwd) {
+    let raw = gitRaw(['diff', '--numstat', `${hash}^`, hash, '--'], cwd);
+    if (!raw) {
+        raw = gitRaw(['diff-tree', '--numstat', '--root', hash, '--'], cwd);
+    }
+    const files = [];
+    let insertions = 0;
+    let deletions = 0;
+    for (const line of raw.split('\n').filter(Boolean)) {
+        const parts = line.split('\t');
+        if (parts.length >= 3) {
+            insertions += parts[0] === '-' ? 0 : (parseInt(parts[0] ?? '0', 10) || 0);
+            deletions += parts[1] === '-' ? 0 : (parseInt(parts[1] ?? '0', 10) || 0);
+            if (parts[2])
+                files.push(parts[2]);
+        }
+    }
+    return { filesChanged: files.length, insertions, deletions, dirsChanged: getUniqueDirs(files).length, files };
+}
+function getRecommendation(dist, total) {
+    if (total === 0)
+        return 'no commits to analyze';
+    const boilerPct = ((dist.boilerplate + dist.cosmetic) / total) * 100;
+    const archPct = ((dist.architecture + dist.integration) / total) * 100;
+    if (boilerPct > 40)
+        return 'Focus more on cross-system architecture and targeted debugging. Delegate scaffolding to AI.';
+    if (archPct > 50)
+        return 'Strong position. Your work is deeply contextual and hard to automate.';
+    if (dist.debugging > dist.architecture)
+        return 'Good debugging instinct. Level up by taking on more cross-system architecture.';
+    return 'Balanced mix. Push toward more integration and architecture work to increase your irreplaceability.';
+}
+export function analyzeEdge(cwd, maxCommits = 50) {
+    const raw = gitRaw(['log', '--format=%H|%aI|%an|%s', '--no-merges', `-n`, String(maxCommits)], cwd);
+    const lines = raw.split('\n').filter(Boolean);
+    const commits = [];
+    for (const line of lines) {
+        const pipeIdx = line.indexOf('|');
+        const rest = line.slice(pipeIdx + 1);
+        const hash = line.slice(0, pipeIdx);
+        const [date, author, ...msgParts] = rest.split('|');
+        const message = msgParts.join('|');
+        if (!hash)
+            continue;
+        const stats = getCommitStats(hash, cwd);
+        commits.push(classifyCommit(hash, date ?? '', message ?? '', author ?? '', stats));
+    }
+    const dist = { architecture: 0, debugging: 0, integration: 0, feature: 0, boilerplate: 0, cosmetic: 0 };
+    for (const c of commits)
+        dist[c.category]++;
+    const overallScore = commits.length > 0
+        ? Math.round(commits.reduce((s, c) => s + c.score, 0) / commits.length)
+        : 0;
+    const topCommits = [...commits].sort((a, b) => b.score - a.score).slice(0, 3);
+    return { score: overallScore, totalCommits: commits.length, distribution: dist, topCommits, recommendation: getRecommendation(dist, commits.length) };
+}
+// ── CheckResult adapter ──────────────────────────────────────────────────────
+export function checkEdge(cwd) {
+    const analysis = analyzeEdge(cwd);
+    const issues = [];
+    if (analysis.totalCommits === 0) {
+        return { name: 'edge', score: 5, maxScore: 10, issues: [{ severity: 'info', message: 'no commits to analyze', fixable: false }], summary: 'no git history' };
+    }
+    const { distribution: dist, totalCommits: total } = analysis;
+    const boilerPct = Math.round(((dist.boilerplate + dist.cosmetic) / total) * 100);
+    const archPct = Math.round(((dist.architecture + dist.integration) / total) * 100);
+    if (boilerPct > 50) {
+        issues.push({ severity: 'warning', message: `${boilerPct}% of commits are boilerplate/cosmetic — high automation risk`, fixable: false });
+    }
+    if (archPct > 40) {
+        issues.push({ severity: 'info', message: `${archPct}% architecture/integration work — strong human edge`, fixable: false });
+    }
+    if (analysis.topCommits.length > 0) {
+        const top = analysis.topCommits[0];
+        issues.push({ severity: 'info', message: `top commit: ${top.hash} (${top.category}, ${top.score}/100) — ${top.message.slice(0, 50)}`, fixable: false });
+    }
+    // Map 0-100 score to 0-10
+    const vetScore = Math.round(analysis.score / 10);
+    return {
+        name: 'edge',
+        score: vetScore,
+        maxScore: 10,
+        issues,
+        summary: `${total} commits — human edge score ${analysis.score}/100 — ${analysis.recommendation.slice(0, 60)}`,
+    };
+}
+// ── Standalone subcommand output ─────────────────────────────────────────────
+export function runEdgeCommand(cwd, explain = false) {
+    const analysis = analyzeEdge(cwd, explain ? 100 : 50);
+    if (analysis.totalCommits === 0) {
+        console.log('\n  no commits to analyze\n');
+        return;
+    }
+    const { distribution: dist, totalCommits: total, score, topCommits, recommendation } = analysis;
+    const scoreColor = score >= 70 ? '\x1b[32m' : score >= 40 ? '\x1b[33m' : '\x1b[31m';
+    const RESET = '\x1b[0m';
+    const BOLD = '\x1b[1m';
+    const DIM = '\x1b[2m';
+    console.log('');
+    console.log(`  ${BOLD}Human Edge Report${RESET}  ${scoreColor}${score}/100${RESET}`);
+    console.log(`  ${DIM}${total} commits analyzed${RESET}`);
+    console.log('');
+    const cats = ['architecture', 'debugging', 'integration', 'feature', 'boilerplate', 'cosmetic'];
+    const catEmoji = { architecture: '🏗️', debugging: '🔍', integration: '🔗', feature: '⚡', boilerplate: '📋', cosmetic: '🎨' };
+    for (const cat of cats) {
+        if (dist[cat] === 0)
+            continue;
+        const pct = Math.round((dist[cat] / total) * 100);
+        const bar = '█'.repeat(Math.max(1, Math.round(pct / 5)));
+        const catScore = CATEGORY_SCORES[cat];
+        const color = catScore >= 70 ? '\x1b[32m' : catScore >= 40 ? '\x1b[33m' : '\x1b[31m';
+        console.log(`  ${catEmoji[cat]} ${cat.padEnd(14)} ${color}${String(dist[cat]).padStart(3)}${RESET} ${DIM}(${String(pct).padStart(2)}%)${RESET} ${color}${bar}${RESET}`);
+    }
+    console.log('');
+    console.log(`  ${BOLD}Top commits${RESET}`);
+    for (const c of topCommits) {
+        console.log(`  ${scoreColor}${c.score}${RESET}  ${c.hash}  ${c.message.slice(0, 55)}`);
+    }
+    console.log('');
+    console.log(`  → ${recommendation}`);
+    console.log('');
+}

package/dist/checks/models.d.ts

@@ -1,2 +1,2 @@
 import type { CheckResult } from '../types.js';
-export declare function checkModels(cwd: string, ignore: string[]): CheckResult;
+export declare function checkModels(cwd: string, ignore: string[]): Promise<CheckResult>;

package/dist/checks/models.js

@@ -1,8 +1,44 @@
 import { join } from 'node:path';
 import { readFile, walkFiles } from '../util.js';
-// Model sunset/deprecation registry — kept inline for zero deps
+// Try to use @safetnsr/model-graveyard if installed (248 models, alias matching, YAML registry)
+async function tryModelGraveyard(cwd) {
+    try {
+        const mod = await import(/* webpackIgnore: true */ '@safetnsr/model-graveyard');
+        if (typeof mod.scan !== 'function')
+            return null;
+        const report = await mod.scan(cwd);
+        const issues = [];
+        for (const match of report.matches) {
+            if (!match.model)
+                continue;
+            if (match.model.status === 'deprecated' || match.model.status === 'eol') {
+                issues.push({
+                    severity: 'error',
+                    message: `${match.model.status} model "${match.raw}" in ${match.file}:${match.line}${match.model.successor ? ` — use "${match.model.successor}"` : ''}`,
+                    file: match.file,
+                    line: match.line,
+                    fixable: !!match.model.successor,
+                    fixHint: match.model.successor ? `replace "${match.raw}" with "${match.model.successor}"` : undefined,
+                });
+            }
+        }
+        const score = Math.max(0, 10 - issues.length * 2);
+        return {
+            name: 'models',
+            score: Math.min(10, score),
+            maxScore: 10,
+            issues,
+            summary: issues.length === 0
+                ? `${report.filesScanned} files scanned (via model-graveyard) — all current`
+                : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} (via model-graveyard)`,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// Built-in fallback: inline registry, basic string matching
 const SUNSET_MODELS = {
-    // OpenAI
     'gpt-3.5-turbo': { replacement: 'gpt-4o-mini', sunset: '2025-06' },
     'gpt-4-turbo': { replacement: 'gpt-4o', sunset: '2025-04' },
     'gpt-4-turbo-preview': { replacement: 'gpt-4o', sunset: '2025-04' },
@@ -12,7 +48,6 @@ const SUNSET_MODELS = {
     'text-davinci-003': { replacement: 'gpt-4o-mini', sunset: '2024-01' },
     'code-davinci-002': { replacement: 'gpt-4o', sunset: '2024-01' },
     'text-embedding-ada-002': { replacement: 'text-embedding-3-small', sunset: '2025-04' },
-    // Anthropic
     'claude-instant-1': { replacement: 'claude-sonnet-4-5', sunset: '2024-08' },
     'claude-2': { replacement: 'claude-sonnet-4-5', sunset: '2024-08' },
     'claude-2.0': { replacement: 'claude-sonnet-4-5', sunset: '2024-08' },
@@ -20,43 +55,36 @@ const SUNSET_MODELS = {
     'claude-3-haiku-20240307': { replacement: 'claude-haiku-3-5', sunset: '2025-06' },
     'claude-3-sonnet-20240229': { replacement: 'claude-sonnet-4-5', sunset: '2025-03' },
     'claude-3-opus-20240229': { replacement: 'claude-opus-4-0', sunset: '2025-09' },
-    // Google
     'gemini-pro': { replacement: 'gemini-2.0-flash', sunset: '2025-02' },
     'gemini-1.0-pro': { replacement: 'gemini-2.0-flash', sunset: '2025-02' },
     'gemini-1.5-pro': { replacement: 'gemini-2.5-pro', sunset: '2025-09' },
     'gemini-1.5-flash': { replacement: 'gemini-2.0-flash', sunset: '2025-09' },
     'text-bison': { replacement: 'gemini-2.0-flash', sunset: '2024-04' },
     'chat-bison': { replacement: 'gemini-2.0-flash', sunset: '2024-04' },
-    // Cohere
-    'command': { replacement: 'command-r-plus', sunset: '2025-03' },
     'command-light': { replacement: 'command-r', sunset: '2025-03' },
     'command-nightly': { replacement: 'command-r-plus', sunset: '2025-03' },
 };
 const SCAN_EXTS = ['.ts', '.js', '.tsx', '.jsx', '.py', '.rs', '.go', '.java', '.rb', '.php',
     '.yaml', '.yml', '.json', '.toml', '.env', '.env.example', '.env.local', '.cfg', '.ini', '.conf'];
-// Files that contain model registries should not trigger false positives
 const SELF_IGNORE = ['models.ts', 'models.js', 'model-graveyard', 'model-registry', 'sunset'];
-// Short model names that need context to avoid false positives (e.g. npm "command" field)
 const CONTEXT_REQUIRED = new Set(['command', 'command-light', 'command-nightly']);
 function hasModelContext(content, model) {
-    // Require the model name to appear in a string-like context: quotes, assignment, or near "model"/"engine"
     const escaped = model.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
     const contextPatterns = [
-        new RegExp(`['"\`]${escaped}['"\`]`), // quoted
-        new RegExp(`model[_\\s]*[:=].*${escaped}`, 'i'), // model assignment
-        new RegExp(`engine[_\\s]*[:=].*${escaped}`, 'i'), // engine assignment
-        new RegExp(`${escaped}.*(?:api|llm|chat|completion)`, 'i'), // near API terms
+        new RegExp(`['"\`]${escaped}['"\`]`),
+        new RegExp(`model[_\\s]*[:=].*${escaped}`, 'i'),
+        new RegExp(`engine[_\\s]*[:=].*${escaped}`, 'i'),
+        new RegExp(`${escaped}.*(?:api|llm|chat|completion)`, 'i'),
     ];
     return contextPatterns.some(p => p.test(content));
 }
-export function checkModels(cwd, ignore) {
+function builtinModels(cwd, ignore) {
     const issues = [];
     const files = walkFiles(cwd, ignore);
     const found = new Map();
     for (const f of files) {
         if (!SCAN_EXTS.some(ext => f.endsWith(ext)))
             continue;
-        // Skip files that are model registries themselves
         if (SELF_IGNORE.some(s => f.toLowerCase().includes(s)))
             continue;
         const content = readFile(join(cwd, f));
@@ -65,7 +93,6 @@ export function checkModels(cwd, ignore) {
         for (const [model, info] of Object.entries(SUNSET_MODELS)) {
             if (!content.includes(model))
                 continue;
-            // For short/ambiguous names, require contextual evidence
             if (CONTEXT_REQUIRED.has(model) && !hasModelContext(content, model))
                 continue;
             const existing = found.get(model) || [];
@@ -93,3 +120,9 @@ export function checkModels(cwd, ignore) {
         summary: issues.length === 0 ? 'all model references current' : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} found`,
     };
 }
+export async function checkModels(cwd, ignore) {
+    const rich = await tryModelGraveyard(cwd);
+    if (rich)
+        return rich;
+    return builtinModels(cwd, ignore);
+}

package/dist/checks/ready.d.ts

@@ -1,2 +1,2 @@
 import type { CheckResult } from '../types.js';
-export declare function checkReady(cwd: string, ignore: string[]): CheckResult;
+export declare function checkReady(cwd: string, ignore: string[]): Promise<CheckResult>;

package/dist/checks/ready.js

@@ -1,28 +1,64 @@
 import { join } from 'node:path';
 import { readFile, walkFiles } from '../util.js';
-// Codebase AI-readiness: structure, complexity, documentation
-export function checkReady(cwd, ignore) {
+// Try to use @safetnsr/ai-ready if installed (richer per-file analysis)
+async function tryAiReady(cwd) {
+    try {
+        const mod = await import(/* webpackIgnore: true */ '@safetnsr/ai-ready');
+        if (typeof mod.main !== 'function')
+            return null;
+        const result = mod.main(['--json', cwd]);
+        if (!result || result.exitCode !== 0)
+            return null;
+        const data = JSON.parse(result.output);
+        const issues = [];
+        // Convert ai-ready's per-file results to vet issues
+        if (data.files) {
+            const lowScoreFiles = data.files.filter((f) => f.score < 5);
+            for (const f of lowScoreFiles.slice(0, 5)) {
+                issues.push({
+                    severity: 'warning',
+                    message: `${f.file}: readiness ${f.score}/10 — ${f.reasons?.join(', ') || 'low score'}`,
+                    file: f.file,
+                    fixable: false,
+                });
+            }
+            if (lowScoreFiles.length > 5) {
+                issues.push({ severity: 'info', message: `...and ${lowScoreFiles.length - 5} more low-readiness files`, fixable: false });
+            }
+        }
+        // Map ai-ready score to vet format
+        const score = typeof data.score === 'number' ? data.score : 5;
+        return {
+            name: 'ready',
+            score: Math.round(Math.min(10, score) * 10) / 10,
+            maxScore: 10,
+            issues,
+            summary: `${data.files?.length || 0} files analyzed (via ai-ready) — ${issues.length} issues`,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+// Built-in fallback: simpler project-level checks
+function builtinReady(cwd, ignore) {
     const issues = [];
     const files = walkFiles(cwd, ignore);
-    // 1. README exists — critical for AI context
     const hasReadme = files.some(f => /^readme\.(md|txt|rst)$/i.test(f));
     if (!hasReadme) {
         issues.push({ severity: 'error', message: 'no README — AI agents have no project context', fixable: true, fixHint: 'create a README.md' });
     }
-    // 2. Project manifest
     const manifests = ['package.json', 'pyproject.toml', 'Cargo.toml', 'go.mod', 'pom.xml', 'build.gradle', 'Gemfile', 'composer.json'];
     const hasManifest = manifests.some(m => files.includes(m));
     if (!hasManifest) {
         issues.push({ severity: 'error', message: 'no package manifest — agents can\'t resolve dependencies', fixable: false });
     }
-    // 3. Test coverage
     const codeExts = ['.ts', '.js', '.tsx', '.jsx', '.py', '.rs', '.go', '.java', '.rb', '.php', '.cs', '.swift', '.kt'];
     const testFiles = files.filter(f => /\.(test|spec)\.(ts|js|tsx|jsx|py)$/.test(f) || f.includes('__tests__/') || f.startsWith('tests/') || f.startsWith('test/'));
     const codeFiles = files.filter(f => codeExts.some(ext => f.endsWith(ext)));
     if (codeFiles.length > 5 && testFiles.length === 0) {
         issues.push({ severity: 'error', message: 'no tests — AI agents produce better code when tests exist to validate against', fixable: false });
     }
-    // 4. Overly large files (>500 lines)
     let largeFileCount = 0;
     for (const f of files) {
         if (!codeExts.some(ext => f.endsWith(ext)))
@@ -38,19 +74,16 @@ export function checkReady(cwd, ignore) {
     if (largeFileCount > 3) {
         issues.push({ severity: 'warning', message: `...and ${largeFileCount - 3} more large files`, fixable: false });
     }
-    // 5. .env without .env.example
     const hasEnv = files.some(f => f === '.env' || f === '.env.local');
     const hasEnvExample = files.some(f => f === '.env.example' || f === '.env.template');
     if (hasEnv && !hasEnvExample) {
         issues.push({ severity: 'warning', message: '.env exists but no .env.example — AI agents can\'t see env structure', fixable: false });
     }
-    // 6. No types in JS-heavy project
     const tsFiles = files.filter(f => f.endsWith('.ts') || f.endsWith('.tsx'));
     const jsFiles = files.filter(f => f.endsWith('.js') || f.endsWith('.jsx'));
     if (jsFiles.length > 10 && tsFiles.length === 0 && files.includes('package.json')) {
         issues.push({ severity: 'info', message: `${jsFiles.length} JS files, no TypeScript — typed code gives agents better context`, fixable: false });
     }
-    // Recalibrated scoring: errors = -3, warnings = -1.5, info = -0.3
     const errors = issues.filter(i => i.severity === 'error').length;
     const warnings = issues.filter(i => i.severity === 'warning').length;
     const infos = issues.filter(i => i.severity === 'info').length;
@@ -63,3 +96,9 @@ export function checkReady(cwd, ignore) {
         summary: issues.length === 0 ? 'codebase is well-structured for AI' : `${issues.length} readiness issues`,
     };
 }
+export async function checkReady(cwd, ignore) {
+    const rich = await tryAiReady(cwd);
+    if (rich)
+        return rich;
+    return builtinReady(cwd, ignore);
+}

package/dist/checks/receipt.d.ts

@@ -0,0 +1,48 @@
+import type { CheckResult } from '../types.js';
+interface ToolUseBlock {
+    type: 'tool_use';
+    id: string;
+    name: string;
+    input: Record<string, unknown>;
+}
+interface SessionEntry {
+    type?: string;
+    role?: string;
+    content?: unknown;
+    timestamp?: string;
+    message?: {
+        role?: string;
+        content?: unknown;
+    };
+    [key: string]: unknown;
+}
+export interface GroupedActions {
+    session_id: string;
+    start_time: string | null;
+    end_time: string | null;
+    duration_seconds: number | null;
+    files_modified: string[];
+    files_deleted: string[];
+    files_created: string[];
+    commands_run: string[];
+    urls_fetched: string[];
+    packages_installed: string[];
+}
+export interface SessionReceipt {
+    actions: GroupedActions;
+    sha256: string;
+    generated_at: string;
+}
+export declare function findSessionFiles(baseDir?: string): string[];
+export declare function findLatestSession(baseDir?: string): string | null;
+export declare function parseSessionFile(filePath: string): Promise<{
+    toolUses: ToolUseBlock[];
+    entries: SessionEntry[];
+}>;
+export declare function groupActions(toolUses: ToolUseBlock[], entries: SessionEntry[], sessionPath: string): GroupedActions;
+export declare function computeSha256(content: string): string;
+export declare function renderReceiptText(actions: GroupedActions): string;
+export declare function renderReceiptJson(actions: GroupedActions): SessionReceipt;
+export declare function checkReceipt(cwd: string): Promise<CheckResult>;
+export declare function runReceiptCommand(format?: 'ascii' | 'json'): Promise<void>;
+export {};