@safetnsr/vet 0.3.0 → 0.5.0

package/README.md

@@ -1,6 +1,6 @@
 # vet
 
-vet your AI-generated code. one command, ten checks, zero config.
+vet your AI-generated code. one command, eight checks, zero config.
 
 ```bash
 npx @safetnsr/vet
@@ -15,13 +15,11 @@ works with Claude Code, Cursor, Copilot, Codex, Aider, Windsurf, Cline — anyth
 | **ready** | is your codebase AI-friendly? | scans structure, docs, types, tests |
 | **diff** | did the AI leave anti-patterns? | AI-specific patterns: wholesale rewrites, orphaned imports, catch-alls, over-commenting, plus secrets & stubs |
 | **models** | using deprecated AI models? | scans code for sunset model strings across OpenAI, Anthropic, Google, Cohere |
-| **links** | broken markdown links? | validates relative links and wikilinks |
 | **config** | agent configs in place? | deep analysis of CLAUDE.md, .cursorrules, copilot-instructions — checks completeness, consistency, and specificity against your actual codebase |
 | **history** | git patterns healthy? | analyzes commit churn, AI attribution, large changes |
 | **scan** | malicious patterns in agent configs? | scans .claude/, .cursorrules, CLAUDE.md, .mcp/ for prompt injection, shell injection, exfiltration endpoints |
 | **secrets** | leaked secrets in build output? | scans dist/, build/, .next/ + .env files for API keys, tokens, connection strings using pattern + entropy analysis |
 | **receipt** | what did the last agent session do? | parses ~/.claude/projects/ JSONL session logs — files changed, commands run, packages installed, SHA256 integrity hash |
-| **edge** | how replaceable is your git history? | classifies commits by human-edge score: architecture (90) → debugging (85) → integration (80) → feature (60) → boilerplate (20) → cosmetic (10) |
 
 ## usage
 
@@ -53,23 +51,21 @@ npx @safetnsr/vet init
 # show last agent session receipt (ASCII or JSON)
 npx @safetnsr/vet receipt
 npx @safetnsr/vet receipt --json
-
-# show human-edge score for git history
-npx @safetnsr/vet edge
-npx @safetnsr/vet edge --explain
 ```
 
 ## output
 
 ```
-  my-project  6.2/10
+  my-project  7.5/10
 
   ready       ████░░░░░░   4    3 readiness issues
   diff        ████████░░   8    3 issues (2 AI-specific) in 5 files
   models      ██████████  10    all models current
-  links       ██████░░░░   6    3 broken links in docs/
   config      ███░░░░░░░   3    Cursor — needs work (3/10)
   history     █████████░   9    41 commits (~15% AI-attributed)
+  scan        ██████████  10    no malicious patterns found
+  secrets     ██████████  10    no leaked secrets
+  receipt     ██████████  10    last session: 3 files, 2 commands
 
   ✗ no README — AI agents have no project context
   ✗ no tests — AI agents produce better code when tests exist
@@ -81,7 +77,7 @@ npx @safetnsr/vet edge --explain
 
 ## --fix
 
-`vet --fix` doesn't just scaffold — it analyzes your codebase and generates project-specific configs:
+`vet --fix` analyzes your codebase and generates project-specific configs:
 
 ```bash
 $ npx @safetnsr/vet --fix
@@ -95,12 +91,10 @@ $ npx @safetnsr/vet --fix
   fixed 3 issues
 ```
 
-the generated CLAUDE.md includes your actual stack, directory structure, and framework-specific rules — not generic boilerplate.
+the generated CLAUDE.md includes your actual stack, directory structure, and framework-specific rules.
 
 ## AI-specific diff patterns
 
-vet catches things that are specific to AI-generated code:
-
 | pattern | what it catches |
 |---------|----------------|
 | `[ai] wholesale rewrite` | AI rewrote an entire function when a small edit would suffice |
@@ -144,34 +138,13 @@ Shows a receipt for the last Claude Code agent session — what files it touched
 ╚══════════════════════════════════════════════╝
 ```
 
-### `vet edge`
-
-Analyzes git history and scores how AI-replaceable your contributions are:
-
-```
-  Human Edge Report  72/100
-
-  🏗️ Architecture     12  (28%) ████████████
-  🔍 Debugging         8  (19%) ████████
-  🔗 Integration       6  (14%) ██████
-  ⚡ Feature          10  (24%) ██████████
-  📋 Boilerplate       5  (12%) █████
-  🎨 Cosmetic          1   (2%) █
-
-  Top commits
-  90  a3f2b1c  refactor: extract auth middleware across all routes
-  85  7e8d9f1  fix: resolve race condition in session cleanup
-
-  → Strong position. Your work is deeply contextual and hard to automate.
-```
-
 ## config
 
 create `.vetrc` in your project root (optional):
 
 ```json
 {
-  "checks": ["ready", "diff", "models", "links", "config", "history", "scan", "secrets", "receipt", "edge"],
+  "checks": ["ready", "diff", "models", "config", "history", "scan", "secrets", "receipt"],
   "ignore": ["vendor/", "generated/"],
   "thresholds": { "min": 6 }
 }

package/dist/checks/deps.d.ts

@@ -0,0 +1,6 @@
+import type { CheckResult } from '../types.js';
+export declare function levenshtein(a: string, b: string): number;
+export declare function extractImports(source: string): string[];
+export declare function extractPackageName(specifier: string): string | null;
+export declare function isBuiltin(specifier: string): boolean;
+export declare function checkDeps(cwd: string): Promise<CheckResult>;

package/dist/checks/deps.js

@@ -0,0 +1,276 @@
+import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { walkFiles, readFile } from '../util.js';
+// ── Top packages list (~150 popular npm packages) ────────────────────────────
+const TOP_PACKAGES = [
+    'react', 'react-dom', 'next', 'vue', 'angular', 'express', 'koa', 'fastify', 'hono',
+    'axios', 'node-fetch', 'chalk', 'commander', 'yargs', 'inquirer', 'lodash', 'underscore',
+    'ramda', 'moment', 'dayjs', 'date-fns', 'uuid', 'nanoid', 'dotenv', 'cors', 'helmet',
+    'morgan', 'winston', 'pino', 'debug', 'zod', 'joi', 'yup', 'ajv', 'prettier', 'eslint',
+    'typescript', 'webpack', 'vite', 'rollup', 'esbuild', 'swc', 'babel', 'jest', 'vitest',
+    'mocha', 'chai', 'sinon', 'supertest', 'playwright', 'puppeteer', 'cypress', 'mongoose',
+    'prisma', 'drizzle-orm', 'knex', 'sequelize', 'pg', 'mysql2', 'better-sqlite3', 'redis',
+    'ioredis', 'bullmq', 'sharp', 'jimp', 'multer', 'formidable', 'nodemailer', 'socket.io',
+    'ws', 'mqtt', 'graphql', 'apollo-server', 'trpc', 'stripe', 'aws-sdk', 'firebase',
+    'supabase', 'openai', 'langchain', 'oclif', 'glob', 'minimatch', 'micromatch', 'semver',
+    'minimist', 'cross-env', 'concurrently', 'tsx', 'ts-node', 'rimraf', 'mkdirp', 'fs-extra',
+    'chokidar', 'ora', 'listr2', 'boxen', 'figlet', 'gradient-string', 'conf', 'cosmiconfig',
+    'execa', 'got', 'ky', 'undici', 'cheerio', 'jsdom', 'marked', 'gray-matter', 'unified',
+    'rehype', 'remark', 'mdast', 'hast', 'three', 'd3', 'chart.js', 'tailwindcss', 'postcss',
+    'sass', 'less', 'styled-components', 'emotion',
+];
+// ── Node.js builtins ─────────────────────────────────────────────────────────
+const NODE_BUILTINS = new Set([
+    'assert', 'async_hooks', 'buffer', 'child_process', 'cluster', 'console', 'constants',
+    'crypto', 'dgram', 'diagnostics_channel', 'dns', 'domain', 'events', 'fs', 'http',
+    'http2', 'https', 'inspector', 'module', 'net', 'os', 'path', 'perf_hooks',
+    'process', 'punycode', 'querystring', 'readline', 'repl', 'stream', 'string_decoder',
+    'sys', 'timers', 'tls', 'trace_events', 'tty', 'url', 'util', 'v8', 'vm', 'wasi',
+    'worker_threads', 'zlib', 'test',
+    // also with node: prefix variants handled separately
+    'fs/promises', 'stream/promises', 'timers/promises', 'dns/promises',
+    'stream/web', 'stream/consumers', 'readline/promises', 'util/types',
+]);
+// ── Levenshtein distance ─────────────────────────────────────────────────────
+export function levenshtein(a, b) {
+    const m = a.length;
+    const n = b.length;
+    if (m === 0)
+        return n;
+    if (n === 0)
+        return m;
+    const dp = [];
+    for (let i = 0; i <= m; i++) {
+        dp[i] = [i];
+    }
+    for (let j = 1; j <= n; j++) {
+        dp[0][j] = j;
+    }
+    for (let i = 1; i <= m; i++) {
+        for (let j = 1; j <= n; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + cost);
+        }
+    }
+    return dp[m][n];
+}
+// ── Import extraction ────────────────────────────────────────────────────────
+export function extractImports(source) {
+    const imports = new Set();
+    // import ... from 'pkg'
+    const importFrom = /import\s+(?:[\s\S]*?\s+from\s+)?['"]([^'"]+)['"]/g;
+    let match;
+    while ((match = importFrom.exec(source)) !== null) {
+        imports.add(match[1]);
+    }
+    // require('pkg')
+    const requirePat = /require\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((match = requirePat.exec(source)) !== null) {
+        imports.add(match[1]);
+    }
+    // import('pkg')
+    const dynamicImport = /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((match = dynamicImport.exec(source)) !== null) {
+        imports.add(match[1]);
+    }
+    return [...imports];
+}
+// ── Package name extraction ──────────────────────────────────────────────────
+export function extractPackageName(specifier) {
+    // Skip relative imports
+    if (specifier.startsWith('.') || specifier.startsWith('/'))
+        return null;
+    // Skip node: builtins
+    if (specifier.startsWith('node:'))
+        return null;
+    // Scoped packages: @scope/name or @scope/name/sub
+    if (specifier.startsWith('@')) {
+        const parts = specifier.split('/');
+        if (parts.length < 2)
+            return null;
+        return `${parts[0]}/${parts[1]}`;
+    }
+    // Regular package: name or name/sub
+    return specifier.split('/')[0];
+}
+// ── Builtin check ────────────────────────────────────────────────────────────
+export function isBuiltin(specifier) {
+    if (specifier.startsWith('node:'))
+        return true;
+    const name = specifier.split('/')[0];
+    if (NODE_BUILTINS.has(name))
+        return true;
+    // Also check full specifier for subpath builtins
+    if (NODE_BUILTINS.has(specifier))
+        return true;
+    return false;
+}
+// ── Registry check with concurrency limit ────────────────────────────────────
+async function checkRegistry(packages) {
+    const results = new Map();
+    const queue = [...packages];
+    let networkError = false;
+    async function checkOne(pkg) {
+        try {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 5000);
+            const res = await fetch(`https://registry.npmjs.org/${pkg}`, {
+                method: 'HEAD',
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            results.set(pkg, res.status !== 404);
+        }
+        catch {
+            networkError = true;
+            results.set(pkg, true); // assume exists on error
+        }
+    }
+    // Process in batches of 5
+    const concurrency = 5;
+    for (let i = 0; i < queue.length; i += concurrency) {
+        const batch = queue.slice(i, i + concurrency);
+        await Promise.all(batch.map(checkOne));
+    }
+    if (networkError) {
+        results.set('__network_error__', true);
+    }
+    return results;
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkDeps(cwd) {
+    const issues = [];
+    // Read package.json
+    let declaredDeps = {};
+    let hasPkgJson = false;
+    try {
+        const pkgRaw = readFile(join(cwd, 'package.json'));
+        if (pkgRaw) {
+            const pkg = JSON.parse(pkgRaw);
+            hasPkgJson = true;
+            declaredDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+        }
+    }
+    catch { /* skip */ }
+    if (!hasPkgJson) {
+        return {
+            name: 'deps',
+            score: 10,
+            maxScore: 10,
+            issues: [],
+            summary: 'no package.json found',
+        };
+    }
+    const declaredNames = Object.keys(declaredDeps);
+    // ── 1. Registry check (nonexistent packages) ──────────────────────────────
+    const registryResults = await checkRegistry(declaredNames);
+    if (registryResults.get('__network_error__')) {
+        issues.push({
+            severity: 'info',
+            message: 'could not reach npm registry — skipping existence checks',
+            fixable: false,
+        });
+    }
+    for (const pkg of declaredNames) {
+        if (registryResults.get(pkg) === false) {
+            issues.push({
+                severity: 'error',
+                message: `phantom dependency: "${pkg}" does not exist on npm`,
+                file: 'package.json',
+                fixable: true,
+                fixHint: 'remove from package.json',
+            });
+        }
+    }
+    // ── 2. Typosquat detection ─────────────────────────────────────────────────
+    const topSet = new Set(TOP_PACKAGES);
+    for (const pkg of declaredNames) {
+        if (topSet.has(pkg))
+            continue; // it IS the popular package
+        for (const top of TOP_PACKAGES) {
+            const dist = levenshtein(pkg, top);
+            if (dist >= 1 && dist <= 2) {
+                issues.push({
+                    severity: 'error',
+                    message: `possible typosquat: "${pkg}" is ${dist} edit${dist > 1 ? 's' : ''} from "${top}"`,
+                    file: 'package.json',
+                    fixable: true,
+                    fixHint: `did you mean "${top}"?`,
+                });
+                break; // one match is enough
+            }
+        }
+    }
+    // ── 3 & 4. Dead deps + phantom imports ─────────────────────────────────────
+    const sourceExts = new Set(['.ts', '.js', '.tsx', '.jsx', '.mts', '.mjs', '.cts', '.cjs']);
+    const allFiles = walkFiles(cwd);
+    const sourceFiles = allFiles.filter(f => {
+        const ext = f.substring(f.lastIndexOf('.'));
+        return sourceExts.has(ext);
+    });
+    const importedPackages = new Set();
+    for (const file of sourceFiles) {
+        try {
+            const content = readFileSync(join(cwd, file), 'utf-8');
+            const rawImports = extractImports(content);
+            for (const imp of rawImports) {
+                if (isBuiltin(imp))
+                    continue;
+                const pkg = extractPackageName(imp);
+                if (pkg)
+                    importedPackages.add(pkg);
+            }
+        }
+        catch { /* skip unreadable files */ }
+    }
+    // Dead deps: declared but never imported
+    const declaredSet = new Set(declaredNames);
+    for (const pkg of declaredNames) {
+        if (!importedPackages.has(pkg)) {
+            // Check if it's a CLI tool / plugin / type package (common false positives)
+            // Still flag it, but as info
+            issues.push({
+                severity: 'info',
+                message: `unused dependency: "${pkg}" is declared but never imported`,
+                file: 'package.json',
+                fixable: true,
+                fixHint: 'remove from package.json',
+            });
+        }
+    }
+    // Phantom imports: imported but not declared
+    for (const pkg of importedPackages) {
+        if (!declaredSet.has(pkg)) {
+            issues.push({
+                severity: 'warning',
+                message: `phantom import: "${pkg}" is imported but not in package.json`,
+                fixable: true,
+                fixHint: `run: npm install ${pkg}`,
+            });
+        }
+    }
+    // ── Scoring ────────────────────────────────────────────────────────────────
+    const errors = issues.filter(i => i.severity === 'error').length;
+    const warnings = issues.filter(i => i.severity === 'warning').length;
+    const rawScore = 10 - (errors * 3) - (warnings * 1);
+    const finalScore = Math.max(0, Math.min(10, rawScore));
+    // ── Summary ────────────────────────────────────────────────────────────────
+    const parts = [];
+    if (errors > 0)
+        parts.push(`${errors} error${errors !== 1 ? 's' : ''}`);
+    if (warnings > 0)
+        parts.push(`${warnings} warning${warnings !== 1 ? 's' : ''}`);
+    const infos = issues.filter(i => i.severity === 'info').length;
+    if (infos > 0)
+        parts.push(`${infos} info`);
+    const summary = parts.length === 0
+        ? `${declaredNames.length} dependencies checked, all clean`
+        : `${declaredNames.length} dependencies: ${parts.join(', ')}`;
+    return {
+        name: 'deps',
+        score: finalScore,
+        maxScore: 10,
+        issues,
+        summary,
+    };
+}

package/dist/cli.js

@@ -5,13 +5,12 @@ import { isGitRepo, readFile, c } from './util.js';
 import { checkReady } from './checks/ready.js';
 import { checkDiff } from './checks/diff.js';
 import { checkModels } from './checks/models.js';
-import { checkLinks } from './checks/links.js';
 import { checkConfig } from './checks/config.js';
 import { checkHistory } from './checks/history.js';
 import { checkScan } from './checks/scan.js';
 import { checkSecrets } from './checks/secrets.js';
+import { checkDeps } from './checks/deps.js';
 import { checkReceipt, runReceiptCommand } from './checks/receipt.js';
-import { checkEdge, runEdgeCommand } from './checks/edge.js';
 import { score } from './scorer.js';
 import { reportPretty, reportJSON } from './reporter.js';
 const args = process.argv.slice(2);
@@ -40,28 +39,25 @@ if (flags.has('--help') || flags.has('-h')) {
     npx @safetnsr/vet --watch            live monitoring during AI sessions
     npx @safetnsr/vet init               generate configs + hooks
     npx @safetnsr/vet receipt            show last agent session receipt
-    npx @safetnsr/vet edge               show human-edge score for git history
 
   ${c.dim}checks:${c.reset}
     ready     codebase readiness for AI agents
     diff      AI-specific anti-patterns in recent changes
     models    deprecated/risky model usage
-    links     dead markdown links
     config    agent config hygiene
     history   git history quality
     scan      malicious patterns in agent config files
     secrets   leaked secrets in build output and .env files
     receipt   last agent session audit (informational)
-    edge      human replaceability score from git history
+    deps      phantom/hallucinated dependency detection
 
   ${c.dim}options:${c.reset}
     --ci          CI mode (exit 1 if score < threshold)
-    --fix         auto-fix configs, models, links
+    --fix         auto-fix configs, models
     --since REF   diff against specific commit/range
     --watch       re-run on file changes
     --json        JSON output
     --pretty      force pretty output (even in pipes)
-    --explain     show detailed reasoning (edge subcommand)
     -h, --help    show this help
     -v, --version show version
 `);
@@ -77,7 +73,7 @@ if (flags.has('--version') || flags.has('-v')) {
     }
     process.exit(0);
 }
-const COMMANDS = ['init', 'receipt', 'edge'];
+const COMMANDS = ['init', 'receipt'];
 const command = COMMANDS.includes(positional[0]) ? positional[0] : undefined;
 const cwd = resolve(positional.find(p => !COMMANDS.includes(p)) || '.');
 const isCI = flags.has('--ci');
@@ -105,11 +101,6 @@ if (command === 'receipt') {
     await runReceiptCommand(format);
     process.exit(0);
 }
-if (command === 'edge') {
-    const explain = flags.has('--explain');
-    runEdgeCommand(cwd, explain);
-    process.exit(0);
-}
 if (!isGitRepo(cwd)) {
     console.error(`${c.red}not a git repository${c.reset}. vet operates on git repos.`);
     process.exit(1);
@@ -119,12 +110,10 @@ if (isFix) {
     console.log(`\n  ${c.bold}vet --fix${c.reset}\n`);
     const { fixConfig } = await import('./fix/config.js');
     const { fixModels } = await import('./fix/models.js');
-    const { fixLinks } = await import('./fix/links.js');
     const configResult = fixConfig(cwd);
     const modelsResult = fixModels(cwd, ignore);
-    const linksResult = fixLinks(cwd, ignore);
-    const allMessages = [...configResult.messages, ...modelsResult.messages, ...linksResult.messages];
-    const totalFixed = configResult.fixed + modelsResult.fixed + linksResult.fixed;
+    const allMessages = [...configResult.messages, ...modelsResult.messages];
+    const totalFixed = configResult.fixed + modelsResult.fixed;
     if (allMessages.length > 0) {
         for (const msg of allMessages)
             console.log(msg);
@@ -133,7 +122,7 @@ if (isFix) {
     process.exit(0);
 }
 async function runChecks() {
-    const allChecks = ['ready', 'diff', 'models', 'links', 'config', 'history', 'scan', 'secrets', 'receipt', 'edge'];
+    const allChecks = ['ready', 'diff', 'models', 'config', 'history', 'scan', 'secrets', 'receipt', 'deps'];
     const enabledChecks = config.checks || allChecks;
     const results = [];
     // ready and models are async (try rich subpackages first, fallback to built-in)
@@ -143,8 +132,6 @@ async function runChecks() {
         results.push(checkDiff(cwd, { since }));
     if (enabledChecks.includes('models'))
         results.push(await checkModels(cwd, ignore));
-    if (enabledChecks.includes('links'))
-        results.push(checkLinks(cwd, ignore));
     if (enabledChecks.includes('config'))
         results.push(checkConfig(cwd, ignore));
     if (enabledChecks.includes('history'))
@@ -155,8 +142,8 @@ async function runChecks() {
         results.push(await checkSecrets(cwd));
     if (enabledChecks.includes('receipt'))
         results.push(await checkReceipt(cwd));
-    if (enabledChecks.includes('edge'))
-        results.push(checkEdge(cwd));
+    if (enabledChecks.includes('deps'))
+        results.push(await checkDeps(cwd));
     return score(cwd, results);
 }
 // --watch mode

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "vet your AI-generated code — one command, six checks, zero config",
   "type": "module",
   "bin": {