@safetnsr/vet 0.4.0 → 0.5.0

package/dist/checks/deps.d.ts

@@ -0,0 +1,6 @@
+import type { CheckResult } from '../types.js';
+export declare function levenshtein(a: string, b: string): number;
+export declare function extractImports(source: string): string[];
+export declare function extractPackageName(specifier: string): string | null;
+export declare function isBuiltin(specifier: string): boolean;
+export declare function checkDeps(cwd: string): Promise<CheckResult>;

package/dist/checks/deps.js

@@ -0,0 +1,276 @@
+import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { walkFiles, readFile } from '../util.js';
+// ── Top packages list (~150 popular npm packages) ────────────────────────────
+const TOP_PACKAGES = [
+    'react', 'react-dom', 'next', 'vue', 'angular', 'express', 'koa', 'fastify', 'hono',
+    'axios', 'node-fetch', 'chalk', 'commander', 'yargs', 'inquirer', 'lodash', 'underscore',
+    'ramda', 'moment', 'dayjs', 'date-fns', 'uuid', 'nanoid', 'dotenv', 'cors', 'helmet',
+    'morgan', 'winston', 'pino', 'debug', 'zod', 'joi', 'yup', 'ajv', 'prettier', 'eslint',
+    'typescript', 'webpack', 'vite', 'rollup', 'esbuild', 'swc', 'babel', 'jest', 'vitest',
+    'mocha', 'chai', 'sinon', 'supertest', 'playwright', 'puppeteer', 'cypress', 'mongoose',
+    'prisma', 'drizzle-orm', 'knex', 'sequelize', 'pg', 'mysql2', 'better-sqlite3', 'redis',
+    'ioredis', 'bullmq', 'sharp', 'jimp', 'multer', 'formidable', 'nodemailer', 'socket.io',
+    'ws', 'mqtt', 'graphql', 'apollo-server', 'trpc', 'stripe', 'aws-sdk', 'firebase',
+    'supabase', 'openai', 'langchain', 'oclif', 'glob', 'minimatch', 'micromatch', 'semver',
+    'minimist', 'cross-env', 'concurrently', 'tsx', 'ts-node', 'rimraf', 'mkdirp', 'fs-extra',
+    'chokidar', 'ora', 'listr2', 'boxen', 'figlet', 'gradient-string', 'conf', 'cosmiconfig',
+    'execa', 'got', 'ky', 'undici', 'cheerio', 'jsdom', 'marked', 'gray-matter', 'unified',
+    'rehype', 'remark', 'mdast', 'hast', 'three', 'd3', 'chart.js', 'tailwindcss', 'postcss',
+    'sass', 'less', 'styled-components', 'emotion',
+];
+// ── Node.js builtins ─────────────────────────────────────────────────────────
+const NODE_BUILTINS = new Set([
+    'assert', 'async_hooks', 'buffer', 'child_process', 'cluster', 'console', 'constants',
+    'crypto', 'dgram', 'diagnostics_channel', 'dns', 'domain', 'events', 'fs', 'http',
+    'http2', 'https', 'inspector', 'module', 'net', 'os', 'path', 'perf_hooks',
+    'process', 'punycode', 'querystring', 'readline', 'repl', 'stream', 'string_decoder',
+    'sys', 'timers', 'tls', 'trace_events', 'tty', 'url', 'util', 'v8', 'vm', 'wasi',
+    'worker_threads', 'zlib', 'test',
+    // also with node: prefix variants handled separately
+    'fs/promises', 'stream/promises', 'timers/promises', 'dns/promises',
+    'stream/web', 'stream/consumers', 'readline/promises', 'util/types',
+]);
+// ── Levenshtein distance ─────────────────────────────────────────────────────
+export function levenshtein(a, b) {
+    const m = a.length;
+    const n = b.length;
+    if (m === 0)
+        return n;
+    if (n === 0)
+        return m;
+    const dp = [];
+    for (let i = 0; i <= m; i++) {
+        dp[i] = [i];
+    }
+    for (let j = 1; j <= n; j++) {
+        dp[0][j] = j;
+    }
+    for (let i = 1; i <= m; i++) {
+        for (let j = 1; j <= n; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + cost);
+        }
+    }
+    return dp[m][n];
+}
+// ── Import extraction ────────────────────────────────────────────────────────
+export function extractImports(source) {
+    const imports = new Set();
+    // import ... from 'pkg'
+    const importFrom = /import\s+(?:[\s\S]*?\s+from\s+)?['"]([^'"]+)['"]/g;
+    let match;
+    while ((match = importFrom.exec(source)) !== null) {
+        imports.add(match[1]);
+    }
+    // require('pkg')
+    const requirePat = /require\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((match = requirePat.exec(source)) !== null) {
+        imports.add(match[1]);
+    }
+    // import('pkg')
+    const dynamicImport = /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((match = dynamicImport.exec(source)) !== null) {
+        imports.add(match[1]);
+    }
+    return [...imports];
+}
+// ── Package name extraction ──────────────────────────────────────────────────
+export function extractPackageName(specifier) {
+    // Skip relative imports
+    if (specifier.startsWith('.') || specifier.startsWith('/'))
+        return null;
+    // Skip node: builtins
+    if (specifier.startsWith('node:'))
+        return null;
+    // Scoped packages: @scope/name or @scope/name/sub
+    if (specifier.startsWith('@')) {
+        const parts = specifier.split('/');
+        if (parts.length < 2)
+            return null;
+        return `${parts[0]}/${parts[1]}`;
+    }
+    // Regular package: name or name/sub
+    return specifier.split('/')[0];
+}
+// ── Builtin check ────────────────────────────────────────────────────────────
+export function isBuiltin(specifier) {
+    if (specifier.startsWith('node:'))
+        return true;
+    const name = specifier.split('/')[0];
+    if (NODE_BUILTINS.has(name))
+        return true;
+    // Also check full specifier for subpath builtins
+    if (NODE_BUILTINS.has(specifier))
+        return true;
+    return false;
+}
+// ── Registry check with concurrency limit ────────────────────────────────────
+async function checkRegistry(packages) {
+    const results = new Map();
+    const queue = [...packages];
+    let networkError = false;
+    async function checkOne(pkg) {
+        try {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 5000);
+            const res = await fetch(`https://registry.npmjs.org/${pkg}`, {
+                method: 'HEAD',
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            results.set(pkg, res.status !== 404);
+        }
+        catch {
+            networkError = true;
+            results.set(pkg, true); // assume exists on error
+        }
+    }
+    // Process in batches of 5
+    const concurrency = 5;
+    for (let i = 0; i < queue.length; i += concurrency) {
+        const batch = queue.slice(i, i + concurrency);
+        await Promise.all(batch.map(checkOne));
+    }
+    if (networkError) {
+        results.set('__network_error__', true);
+    }
+    return results;
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkDeps(cwd) {
+    const issues = [];
+    // Read package.json
+    let declaredDeps = {};
+    let hasPkgJson = false;
+    try {
+        const pkgRaw = readFile(join(cwd, 'package.json'));
+        if (pkgRaw) {
+            const pkg = JSON.parse(pkgRaw);
+            hasPkgJson = true;
+            declaredDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+        }
+    }
+    catch { /* skip */ }
+    if (!hasPkgJson) {
+        return {
+            name: 'deps',
+            score: 10,
+            maxScore: 10,
+            issues: [],
+            summary: 'no package.json found',
+        };
+    }
+    const declaredNames = Object.keys(declaredDeps);
+    // ── 1. Registry check (nonexistent packages) ──────────────────────────────
+    const registryResults = await checkRegistry(declaredNames);
+    if (registryResults.get('__network_error__')) {
+        issues.push({
+            severity: 'info',
+            message: 'could not reach npm registry — skipping existence checks',
+            fixable: false,
+        });
+    }
+    for (const pkg of declaredNames) {
+        if (registryResults.get(pkg) === false) {
+            issues.push({
+                severity: 'error',
+                message: `phantom dependency: "${pkg}" does not exist on npm`,
+                file: 'package.json',
+                fixable: true,
+                fixHint: 'remove from package.json',
+            });
+        }
+    }
+    // ── 2. Typosquat detection ─────────────────────────────────────────────────
+    const topSet = new Set(TOP_PACKAGES);
+    for (const pkg of declaredNames) {
+        if (topSet.has(pkg))
+            continue; // it IS the popular package
+        for (const top of TOP_PACKAGES) {
+            const dist = levenshtein(pkg, top);
+            if (dist >= 1 && dist <= 2) {
+                issues.push({
+                    severity: 'error',
+                    message: `possible typosquat: "${pkg}" is ${dist} edit${dist > 1 ? 's' : ''} from "${top}"`,
+                    file: 'package.json',
+                    fixable: true,
+                    fixHint: `did you mean "${top}"?`,
+                });
+                break; // one match is enough
+            }
+        }
+    }
+    // ── 3 & 4. Dead deps + phantom imports ─────────────────────────────────────
+    const sourceExts = new Set(['.ts', '.js', '.tsx', '.jsx', '.mts', '.mjs', '.cts', '.cjs']);
+    const allFiles = walkFiles(cwd);
+    const sourceFiles = allFiles.filter(f => {
+        const ext = f.substring(f.lastIndexOf('.'));
+        return sourceExts.has(ext);
+    });
+    const importedPackages = new Set();
+    for (const file of sourceFiles) {
+        try {
+            const content = readFileSync(join(cwd, file), 'utf-8');
+            const rawImports = extractImports(content);
+            for (const imp of rawImports) {
+                if (isBuiltin(imp))
+                    continue;
+                const pkg = extractPackageName(imp);
+                if (pkg)
+                    importedPackages.add(pkg);
+            }
+        }
+        catch { /* skip unreadable files */ }
+    }
+    // Dead deps: declared but never imported
+    const declaredSet = new Set(declaredNames);
+    for (const pkg of declaredNames) {
+        if (!importedPackages.has(pkg)) {
+            // Check if it's a CLI tool / plugin / type package (common false positives)
+            // Still flag it, but as info
+            issues.push({
+                severity: 'info',
+                message: `unused dependency: "${pkg}" is declared but never imported`,
+                file: 'package.json',
+                fixable: true,
+                fixHint: 'remove from package.json',
+            });
+        }
+    }
+    // Phantom imports: imported but not declared
+    for (const pkg of importedPackages) {
+        if (!declaredSet.has(pkg)) {
+            issues.push({
+                severity: 'warning',
+                message: `phantom import: "${pkg}" is imported but not in package.json`,
+                fixable: true,
+                fixHint: `run: npm install ${pkg}`,
+            });
+        }
+    }
+    // ── Scoring ────────────────────────────────────────────────────────────────
+    const errors = issues.filter(i => i.severity === 'error').length;
+    const warnings = issues.filter(i => i.severity === 'warning').length;
+    const rawScore = 10 - (errors * 3) - (warnings * 1);
+    const finalScore = Math.max(0, Math.min(10, rawScore));
+    // ── Summary ────────────────────────────────────────────────────────────────
+    const parts = [];
+    if (errors > 0)
+        parts.push(`${errors} error${errors !== 1 ? 's' : ''}`);
+    if (warnings > 0)
+        parts.push(`${warnings} warning${warnings !== 1 ? 's' : ''}`);
+    const infos = issues.filter(i => i.severity === 'info').length;
+    if (infos > 0)
+        parts.push(`${infos} info`);
+    const summary = parts.length === 0
+        ? `${declaredNames.length} dependencies checked, all clean`
+        : `${declaredNames.length} dependencies: ${parts.join(', ')}`;
+    return {
+        name: 'deps',
+        score: finalScore,
+        maxScore: 10,
+        issues,
+        summary,
+    };
+}

package/dist/cli.js

@@ -9,6 +9,7 @@ import { checkConfig } from './checks/config.js';
 import { checkHistory } from './checks/history.js';
 import { checkScan } from './checks/scan.js';
 import { checkSecrets } from './checks/secrets.js';
+import { checkDeps } from './checks/deps.js';
 import { checkReceipt, runReceiptCommand } from './checks/receipt.js';
 import { score } from './scorer.js';
 import { reportPretty, reportJSON } from './reporter.js';
@@ -48,6 +49,7 @@ if (flags.has('--help') || flags.has('-h')) {
     scan      malicious patterns in agent config files
     secrets   leaked secrets in build output and .env files
     receipt   last agent session audit (informational)
+    deps      phantom/hallucinated dependency detection
 
   ${c.dim}options:${c.reset}
     --ci          CI mode (exit 1 if score < threshold)
@@ -120,7 +122,7 @@ if (isFix) {
     process.exit(0);
 }
 async function runChecks() {
-    const allChecks = ['ready', 'diff', 'models', 'config', 'history', 'scan', 'secrets', 'receipt'];
+    const allChecks = ['ready', 'diff', 'models', 'config', 'history', 'scan', 'secrets', 'receipt', 'deps'];
     const enabledChecks = config.checks || allChecks;
     const results = [];
     // ready and models are async (try rich subpackages first, fallback to built-in)
@@ -140,6 +142,8 @@ async function runChecks() {
         results.push(await checkSecrets(cwd));
     if (enabledChecks.includes('receipt'))
         results.push(await checkReceipt(cwd));
+    if (enabledChecks.includes('deps'))
+        results.push(await checkDeps(cwd));
     return score(cwd, results);
 }
 // --watch mode

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "vet your AI-generated code — one command, six checks, zero config",
   "type": "module",
   "bin": {