@safetnsr/vet 0.4.0 → 0.6.0

package/dist/checks/debt.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkDebt(cwd: string, ignore: string[]): Promise<CheckResult>;

package/dist/checks/debt.js

@@ -0,0 +1,373 @@
+import { join, basename } from 'node:path';
+import { walkFiles, readFile } from '../util.js';
+// ── Helpers ──────────────────────────────────────────────────────────────────
+const SOURCE_EXTS = new Set(['.ts', '.js', '.tsx', '.jsx']);
+function isSourceFile(f) {
+    const dot = f.lastIndexOf('.');
+    return dot !== -1 && SOURCE_EXTS.has(f.substring(dot));
+}
+function isTestFile(f) {
+    return /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || f.startsWith('test/') || f.startsWith('test\\');
+}
+function isEntryFile(f) {
+    const b = basename(f);
+    return /^(cli|main|index)\.[jt]sx?$/.test(b);
+}
+function isBarrelFile(f) {
+    const b = basename(f);
+    return /^index\.[jt]sx?$/.test(b);
+}
+/** Normalize a function body for comparison */
+function normalize(body) {
+    let s = body;
+    // Replace string literals
+    s = s.replace(/(["'`])(?:(?!\1|\\).|\\.)*\1/g, '"S"');
+    // Replace number literals (but not in identifiers)
+    s = s.replace(/\b\d+\.?\d*\b/g, '0');
+    // Strip whitespace
+    s = s.replace(/\s+/g, '');
+    // Collapse variable names to single char (simple: replace camelCase identifiers)
+    s = s.replace(/\b[a-z][a-zA-Z0-9]{3,}\b/g, 'V');
+    return s;
+}
+/** Simple string hash */
+function simpleHash(s) {
+    let h = 0;
+    for (let i = 0; i < s.length; i++) {
+        h = ((h << 5) - h + s.charCodeAt(i)) | 0;
+    }
+    return h.toString(36);
+}
+/** Similarity ratio between two strings (0-1) */
+function similarity(a, b) {
+    if (a === b)
+        return 1;
+    const longer = a.length >= b.length ? a : b;
+    const shorter = a.length >= b.length ? b : a;
+    if (longer.length === 0)
+        return 1;
+    // Count matching characters in sequence
+    let matches = 0;
+    const used = new Array(longer.length).fill(false);
+    for (let i = 0; i < shorter.length; i++) {
+        for (let j = 0; j < longer.length; j++) {
+            if (!used[j] && shorter[i] === longer[j]) {
+                matches++;
+                used[j] = true;
+                break;
+            }
+        }
+    }
+    return matches / longer.length;
+}
+/** Extract function bodies with brace matching */
+function extractBraceBody(source, startIdx) {
+    let idx = source.indexOf('{', startIdx);
+    if (idx === -1)
+        return null;
+    let depth = 0;
+    const start = idx;
+    for (let i = idx; i < source.length; i++) {
+        if (source[i] === '{')
+            depth++;
+        else if (source[i] === '}') {
+            depth--;
+            if (depth === 0)
+                return source.substring(start + 1, i);
+        }
+    }
+    return null;
+}
+/** Get line number for a character index */
+function lineAt(source, idx) {
+    let line = 1;
+    for (let i = 0; i < idx && i < source.length; i++) {
+        if (source[i] === '\n')
+            line++;
+    }
+    return line;
+}
+/** Extract all named functions from source */
+function extractFunctions(source, file) {
+    const fns = [];
+    // Named function declarations: function name(...)
+    const funcDeclRe = /\bfunction\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\([^)]*\)[^{]*/g;
+    let match;
+    while ((match = funcDeclRe.exec(source)) !== null) {
+        const body = extractBraceBody(source, match.index + match[0].length - 1);
+        if (body && body.trim().length > 10) {
+            const norm = normalize(body);
+            fns.push({
+                name: match[1],
+                body,
+                normalized: norm,
+                hash: simpleHash(norm),
+                file,
+                line: lineAt(source, match.index),
+            });
+        }
+    }
+    // Arrow function assignments: const/let/var name = (...) => { ... }
+    // Also: export const name = (...) => { ... }
+    const arrowRe = /\b(?:export\s+)?(?:const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*=\s*(?:\([^)]*\)|[a-zA-Z_$][a-zA-Z0-9_$]*)\s*(?::\s*[^=]*?)?\s*=>\s*\{/g;
+    while ((match = arrowRe.exec(source)) !== null) {
+        const braceStart = source.indexOf('{', match.index + match[0].length - 1);
+        const body = extractBraceBody(source, braceStart);
+        if (body && body.trim().length > 10) {
+            const norm = normalize(body);
+            fns.push({
+                name: match[1],
+                body,
+                normalized: norm,
+                hash: simpleHash(norm),
+                file,
+                line: lineAt(source, match.index),
+            });
+        }
+    }
+    return fns;
+}
+// ── A) Near-duplicate detection ──────────────────────────────────────────────
+function findDuplicates(allFuncs) {
+    const issues = [];
+    const groups = new Map();
+    // Group by hash first (exact normalized match)
+    for (const fn of allFuncs) {
+        const existing = groups.get(fn.hash) || [];
+        existing.push(fn);
+        groups.set(fn.hash, existing);
+    }
+    const reported = new Set();
+    // Exact duplicates
+    for (const [, group] of groups) {
+        if (group.length < 2)
+            continue;
+        // Deduplicate by name+file
+        const key = group.map(f => `${f.file}:${f.name}`).sort().join('|');
+        if (reported.has(key))
+            continue;
+        reported.add(key);
+        const locations = group.map(f => `${f.name} (${f.file}:${f.line})`).join(', ');
+        issues.push({
+            severity: 'warning',
+            message: `near-duplicate functions: ${locations}`,
+            file: group[0].file,
+            line: group[0].line,
+            fixable: true,
+            fixHint: 'extract shared logic into a single function',
+        });
+    }
+    // Similarity check for non-exact matches
+    const singles = allFuncs.filter(fn => {
+        const g = groups.get(fn.hash);
+        return !g || g.length < 2;
+    });
+    for (let i = 0; i < singles.length; i++) {
+        for (let j = i + 1; j < singles.length; j++) {
+            const a = singles[i];
+            const b = singles[j];
+            // Skip very short normalized bodies
+            if (a.normalized.length < 30 || b.normalized.length < 30)
+                continue;
+            const sim = similarity(a.normalized, b.normalized);
+            if (sim > 0.85) {
+                const key = [a.file + ':' + a.name, b.file + ':' + b.name].sort().join('|');
+                if (reported.has(key))
+                    continue;
+                reported.add(key);
+                issues.push({
+                    severity: 'warning',
+                    message: `similar functions (${Math.round(sim * 100)}%): ${a.name} (${a.file}:${a.line}) and ${b.name} (${b.file}:${b.line})`,
+                    file: a.file,
+                    line: a.line,
+                    fixable: true,
+                    fixHint: 'consider merging or extracting shared logic',
+                });
+            }
+        }
+    }
+    return issues;
+}
+// ── B) Orphaned exports ──────────────────────────────────────────────────────
+function findOrphanedExports(cwd, files) {
+    const issues = [];
+    const sourceFiles = files.filter(f => isSourceFile(f) && !isTestFile(f));
+    // Collect all named exports
+    const exports = [];
+    for (const file of sourceFiles) {
+        if (isBarrelFile(file) || isEntryFile(file))
+            continue;
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // export function name
+            const funcMatch = line.match(/^export\s+(?:async\s+)?function\s+([a-zA-Z_$][a-zA-Z0-9_$]*)/);
+            if (funcMatch) {
+                exports.push({ name: funcMatch[1], file, line: i + 1 });
+                continue;
+            }
+            // export const/let/var name
+            const constMatch = line.match(/^export\s+(?:const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)/);
+            if (constMatch) {
+                exports.push({ name: constMatch[1], file, line: i + 1 });
+                continue;
+            }
+            // export { name, name2 } — but skip type exports
+            if (/^export\s+type\s/.test(line))
+                continue;
+            const braceMatch = line.match(/^export\s*\{([^}]+)\}/);
+            if (braceMatch) {
+                const names = braceMatch[1].split(',').map(n => n.trim().split(/\s+as\s+/)[0].trim()).filter(Boolean);
+                for (const name of names) {
+                    if (name === 'default' || name === 'type')
+                        continue;
+                    exports.push({ name, file, line: i + 1 });
+                }
+            }
+        }
+    }
+    // Scan all files for imports of each name
+    const allContent = [];
+    for (const file of sourceFiles) {
+        const content = readFile(join(cwd, file));
+        if (content)
+            allContent.push(content);
+    }
+    const allText = allContent.join('\n');
+    for (const exp of exports) {
+        // Check if name appears in import statements across all files
+        // import { name } from or import { x, name } from or import { name as y }
+        const importPattern = new RegExp(`import\\s+[^;]*\\b${exp.name}\\b[^;]*from\\s+`, 'm');
+        if (!importPattern.test(allText)) {
+            issues.push({
+                severity: 'warning',
+                message: `orphaned export: "${exp.name}" is exported but never imported`,
+                file: exp.file,
+                line: exp.line,
+                fixable: true,
+                fixHint: 'remove the export keyword or delete the function',
+            });
+        }
+    }
+    return issues;
+}
+// ── C) Wrapper pass-throughs ─────────────────────────────────────────────────
+function findWrappers(allFuncs) {
+    const issues = [];
+    for (const fn of allFuncs) {
+        const trimmed = fn.body.trim();
+        // return someFn(args) or return someFn(...args)
+        if (/^return\s+[a-zA-Z_$][a-zA-Z0-9_$.]*\s*\([^)]*\)\s*;?\s*$/.test(trimmed)) {
+            issues.push({
+                severity: 'info',
+                message: `wrapper pass-through: ${fn.name} just delegates to another function`,
+                file: fn.file,
+                line: fn.line,
+                fixable: true,
+                fixHint: 'call the inner function directly instead',
+            });
+        }
+    }
+    return issues;
+}
+// ── D) Naming drift ─────────────────────────────────────────────────────────
+function findNamingDrift(allFuncs) {
+    const issues = [];
+    // Common prefixes that indicate the same action
+    const actionPrefixes = ['get', 'fetch', 'load', 'retrieve', 'find', 'query', 'read', 'create', 'make', 'build', 'generate', 'set', 'update', 'save', 'write', 'delete', 'remove', 'destroy', 'handle', 'process', 'parse', 'format', 'validate', 'check', 'verify', 'is', 'has', 'can', 'should', 'init', 'setup', 'configure', 'start', 'stop', 'enable', 'disable', 'show', 'hide', 'render', 'display', 'transform', 'convert', 'map', 'filter', 'reduce', 'sort', 'merge', 'split', 'join', 'send', 'emit', 'dispatch', 'trigger', 'on', 'listen', 'subscribe', 'publish', 'notify', 'log', 'print', 'debug', 'warn', 'error'];
+    // Extract suffix groups: for each function name, find its suffix after stripping known prefixes
+    const suffixMap = new Map();
+    for (const fn of allFuncs) {
+        const name = fn.name;
+        for (const prefix of actionPrefixes) {
+            if (name.length > prefix.length && name.startsWith(prefix) && name[prefix.length] === name[prefix.length].toUpperCase()) {
+                const suffix = name.substring(prefix.length);
+                const existing = suffixMap.get(suffix) || [];
+                // Avoid duplicate entries
+                if (!existing.some(e => e.name === name)) {
+                    existing.push({ prefix, name, file: fn.file });
+                    suffixMap.set(suffix, existing);
+                }
+                break;
+            }
+        }
+    }
+    for (const [suffix, entries] of suffixMap) {
+        const uniquePrefixes = new Set(entries.map(e => e.prefix));
+        if (uniquePrefixes.size >= 3) {
+            const names = entries.map(e => e.name).join(', ');
+            issues.push({
+                severity: 'info',
+                message: `naming drift: ${uniquePrefixes.size} prefixes for "${suffix}": ${names}`,
+                fixable: false,
+                fixHint: 'standardize on one prefix pattern',
+            });
+        }
+    }
+    return issues;
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkDebt(cwd, ignore) {
+    const allFiles = walkFiles(cwd, ignore);
+    const sourceFiles = allFiles.filter(f => isSourceFile(f) && !isTestFile(f));
+    if (sourceFiles.length === 0) {
+        return {
+            name: 'debt',
+            score: 10,
+            maxScore: 10,
+            issues: [],
+            summary: 'no source files to analyze',
+        };
+    }
+    // Extract all functions
+    const allFuncs = [];
+    for (const file of sourceFiles) {
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        allFuncs.push(...extractFunctions(content, file));
+    }
+    const issues = [];
+    // A) Duplicates
+    const dupIssues = findDuplicates(allFuncs);
+    issues.push(...dupIssues);
+    // B) Orphaned exports
+    const orphanIssues = findOrphanedExports(cwd, allFiles);
+    issues.push(...orphanIssues);
+    // C) Wrappers
+    const wrapperIssues = findWrappers(allFuncs);
+    issues.push(...wrapperIssues);
+    // D) Naming drift
+    const driftIssues = findNamingDrift(allFuncs);
+    issues.push(...driftIssues);
+    // ── Scoring ──────────────────────────────────────────────────────────────
+    const dupPenalty = Math.min(6, dupIssues.length * 1.5);
+    const orphanPenalty = Math.min(3, orphanIssues.length * 0.5);
+    const wrapperPenalty = Math.min(1.5, wrapperIssues.length * 0.3);
+    const driftPenalty = Math.min(1, driftIssues.length * 0.2);
+    const rawScore = 10 - dupPenalty - orphanPenalty - wrapperPenalty - driftPenalty;
+    const finalScore = Math.max(0, Math.round(rawScore * 10) / 10);
+    // ── Summary ──────────────────────────────────────────────────────────────
+    const parts = [];
+    if (dupIssues.length > 0)
+        parts.push(`${dupIssues.length} duplicate${dupIssues.length !== 1 ? 's' : ''}`);
+    if (orphanIssues.length > 0)
+        parts.push(`${orphanIssues.length} orphaned export${orphanIssues.length !== 1 ? 's' : ''}`);
+    if (wrapperIssues.length > 0)
+        parts.push(`${wrapperIssues.length} wrapper${wrapperIssues.length !== 1 ? 's' : ''}`);
+    if (driftIssues.length > 0)
+        parts.push(`${driftIssues.length} naming drift`);
+    const summary = parts.length === 0
+        ? `${sourceFiles.length} files analyzed, no technical debt found`
+        : `${sourceFiles.length} files: ${parts.join(', ')}`;
+    return {
+        name: 'debt',
+        score: finalScore,
+        maxScore: 10,
+        issues,
+        summary,
+    };
+}

package/dist/checks/deps.d.ts

@@ -0,0 +1,6 @@
+import type { CheckResult } from '../types.js';
+export declare function levenshtein(a: string, b: string): number;
+export declare function extractImports(source: string): string[];
+export declare function extractPackageName(specifier: string): string | null;
+export declare function isBuiltin(specifier: string): boolean;
+export declare function checkDeps(cwd: string): Promise<CheckResult>;

package/dist/checks/deps.js

@@ -0,0 +1,276 @@
+import { join } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { walkFiles, readFile } from '../util.js';
+// ── Top packages list (~150 popular npm packages) ────────────────────────────
+const TOP_PACKAGES = [
+    'react', 'react-dom', 'next', 'vue', 'angular', 'express', 'koa', 'fastify', 'hono',
+    'axios', 'node-fetch', 'chalk', 'commander', 'yargs', 'inquirer', 'lodash', 'underscore',
+    'ramda', 'moment', 'dayjs', 'date-fns', 'uuid', 'nanoid', 'dotenv', 'cors', 'helmet',
+    'morgan', 'winston', 'pino', 'debug', 'zod', 'joi', 'yup', 'ajv', 'prettier', 'eslint',
+    'typescript', 'webpack', 'vite', 'rollup', 'esbuild', 'swc', 'babel', 'jest', 'vitest',
+    'mocha', 'chai', 'sinon', 'supertest', 'playwright', 'puppeteer', 'cypress', 'mongoose',
+    'prisma', 'drizzle-orm', 'knex', 'sequelize', 'pg', 'mysql2', 'better-sqlite3', 'redis',
+    'ioredis', 'bullmq', 'sharp', 'jimp', 'multer', 'formidable', 'nodemailer', 'socket.io',
+    'ws', 'mqtt', 'graphql', 'apollo-server', 'trpc', 'stripe', 'aws-sdk', 'firebase',
+    'supabase', 'openai', 'langchain', 'oclif', 'glob', 'minimatch', 'micromatch', 'semver',
+    'minimist', 'cross-env', 'concurrently', 'tsx', 'ts-node', 'rimraf', 'mkdirp', 'fs-extra',
+    'chokidar', 'ora', 'listr2', 'boxen', 'figlet', 'gradient-string', 'conf', 'cosmiconfig',
+    'execa', 'got', 'ky', 'undici', 'cheerio', 'jsdom', 'marked', 'gray-matter', 'unified',
+    'rehype', 'remark', 'mdast', 'hast', 'three', 'd3', 'chart.js', 'tailwindcss', 'postcss',
+    'sass', 'less', 'styled-components', 'emotion',
+];
+// ── Node.js builtins ─────────────────────────────────────────────────────────
+const NODE_BUILTINS = new Set([
+    'assert', 'async_hooks', 'buffer', 'child_process', 'cluster', 'console', 'constants',
+    'crypto', 'dgram', 'diagnostics_channel', 'dns', 'domain', 'events', 'fs', 'http',
+    'http2', 'https', 'inspector', 'module', 'net', 'os', 'path', 'perf_hooks',
+    'process', 'punycode', 'querystring', 'readline', 'repl', 'stream', 'string_decoder',
+    'sys', 'timers', 'tls', 'trace_events', 'tty', 'url', 'util', 'v8', 'vm', 'wasi',
+    'worker_threads', 'zlib', 'test',
+    // also with node: prefix variants handled separately
+    'fs/promises', 'stream/promises', 'timers/promises', 'dns/promises',
+    'stream/web', 'stream/consumers', 'readline/promises', 'util/types',
+]);
+// ── Levenshtein distance ─────────────────────────────────────────────────────
+export function levenshtein(a, b) {
+    const m = a.length;
+    const n = b.length;
+    if (m === 0)
+        return n;
+    if (n === 0)
+        return m;
+    const dp = [];
+    for (let i = 0; i <= m; i++) {
+        dp[i] = [i];
+    }
+    for (let j = 1; j <= n; j++) {
+        dp[0][j] = j;
+    }
+    for (let i = 1; i <= m; i++) {
+        for (let j = 1; j <= n; j++) {
+            const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+            dp[i][j] = Math.min(dp[i - 1][j] + 1, dp[i][j - 1] + 1, dp[i - 1][j - 1] + cost);
+        }
+    }
+    return dp[m][n];
+}
+// ── Import extraction ────────────────────────────────────────────────────────
+export function extractImports(source) {
+    const imports = new Set();
+    // import ... from 'pkg'
+    const importFrom = /import\s+(?:[\s\S]*?\s+from\s+)?['"]([^'"]+)['"]/g;
+    let match;
+    while ((match = importFrom.exec(source)) !== null) {
+        imports.add(match[1]);
+    }
+    // require('pkg')
+    const requirePat = /require\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((match = requirePat.exec(source)) !== null) {
+        imports.add(match[1]);
+    }
+    // import('pkg')
+    const dynamicImport = /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    while ((match = dynamicImport.exec(source)) !== null) {
+        imports.add(match[1]);
+    }
+    return [...imports];
+}
+// ── Package name extraction ──────────────────────────────────────────────────
+export function extractPackageName(specifier) {
+    // Skip relative imports
+    if (specifier.startsWith('.') || specifier.startsWith('/'))
+        return null;
+    // Skip node: builtins
+    if (specifier.startsWith('node:'))
+        return null;
+    // Scoped packages: @scope/name or @scope/name/sub
+    if (specifier.startsWith('@')) {
+        const parts = specifier.split('/');
+        if (parts.length < 2)
+            return null;
+        return `${parts[0]}/${parts[1]}`;
+    }
+    // Regular package: name or name/sub
+    return specifier.split('/')[0];
+}
+// ── Builtin check ────────────────────────────────────────────────────────────
+export function isBuiltin(specifier) {
+    if (specifier.startsWith('node:'))
+        return true;
+    const name = specifier.split('/')[0];
+    if (NODE_BUILTINS.has(name))
+        return true;
+    // Also check full specifier for subpath builtins
+    if (NODE_BUILTINS.has(specifier))
+        return true;
+    return false;
+}
+// ── Registry check with concurrency limit ────────────────────────────────────
+async function checkRegistry(packages) {
+    const results = new Map();
+    const queue = [...packages];
+    let networkError = false;
+    async function checkOne(pkg) {
+        try {
+            const controller = new AbortController();
+            const timeout = setTimeout(() => controller.abort(), 5000);
+            const res = await fetch(`https://registry.npmjs.org/${pkg}`, {
+                method: 'HEAD',
+                signal: controller.signal,
+            });
+            clearTimeout(timeout);
+            results.set(pkg, res.status !== 404);
+        }
+        catch {
+            networkError = true;
+            results.set(pkg, true); // assume exists on error
+        }
+    }
+    // Process in batches of 5
+    const concurrency = 5;
+    for (let i = 0; i < queue.length; i += concurrency) {
+        const batch = queue.slice(i, i + concurrency);
+        await Promise.all(batch.map(checkOne));
+    }
+    if (networkError) {
+        results.set('__network_error__', true);
+    }
+    return results;
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkDeps(cwd) {
+    const issues = [];
+    // Read package.json
+    let declaredDeps = {};
+    let hasPkgJson = false;
+    try {
+        const pkgRaw = readFile(join(cwd, 'package.json'));
+        if (pkgRaw) {
+            const pkg = JSON.parse(pkgRaw);
+            hasPkgJson = true;
+            declaredDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+        }
+    }
+    catch { /* skip */ }
+    if (!hasPkgJson) {
+        return {
+            name: 'deps',
+            score: 10,
+            maxScore: 10,
+            issues: [],
+            summary: 'no package.json found',
+        };
+    }
+    const declaredNames = Object.keys(declaredDeps);
+    // ── 1. Registry check (nonexistent packages) ──────────────────────────────
+    const registryResults = await checkRegistry(declaredNames);
+    if (registryResults.get('__network_error__')) {
+        issues.push({
+            severity: 'info',
+            message: 'could not reach npm registry — skipping existence checks',
+            fixable: false,
+        });
+    }
+    for (const pkg of declaredNames) {
+        if (registryResults.get(pkg) === false) {
+            issues.push({
+                severity: 'error',
+                message: `phantom dependency: "${pkg}" does not exist on npm`,
+                file: 'package.json',
+                fixable: true,
+                fixHint: 'remove from package.json',
+            });
+        }
+    }
+    // ── 2. Typosquat detection ─────────────────────────────────────────────────
+    const topSet = new Set(TOP_PACKAGES);
+    for (const pkg of declaredNames) {
+        if (topSet.has(pkg))
+            continue; // it IS the popular package
+        for (const top of TOP_PACKAGES) {
+            const dist = levenshtein(pkg, top);
+            if (dist >= 1 && dist <= 2) {
+                issues.push({
+                    severity: 'error',
+                    message: `possible typosquat: "${pkg}" is ${dist} edit${dist > 1 ? 's' : ''} from "${top}"`,
+                    file: 'package.json',
+                    fixable: true,
+                    fixHint: `did you mean "${top}"?`,
+                });
+                break; // one match is enough
+            }
+        }
+    }
+    // ── 3 & 4. Dead deps + phantom imports ─────────────────────────────────────
+    const sourceExts = new Set(['.ts', '.js', '.tsx', '.jsx', '.mts', '.mjs', '.cts', '.cjs']);
+    const allFiles = walkFiles(cwd);
+    const sourceFiles = allFiles.filter(f => {
+        const ext = f.substring(f.lastIndexOf('.'));
+        return sourceExts.has(ext);
+    });
+    const importedPackages = new Set();
+    for (const file of sourceFiles) {
+        try {
+            const content = readFileSync(join(cwd, file), 'utf-8');
+            const rawImports = extractImports(content);
+            for (const imp of rawImports) {
+                if (isBuiltin(imp))
+                    continue;
+                const pkg = extractPackageName(imp);
+                if (pkg)
+                    importedPackages.add(pkg);
+            }
+        }
+        catch { /* skip unreadable files */ }
+    }
+    // Dead deps: declared but never imported
+    const declaredSet = new Set(declaredNames);
+    for (const pkg of declaredNames) {
+        if (!importedPackages.has(pkg)) {
+            // Check if it's a CLI tool / plugin / type package (common false positives)
+            // Still flag it, but as info
+            issues.push({
+                severity: 'info',
+                message: `unused dependency: "${pkg}" is declared but never imported`,
+                file: 'package.json',
+                fixable: true,
+                fixHint: 'remove from package.json',
+            });
+        }
+    }
+    // Phantom imports: imported but not declared
+    for (const pkg of importedPackages) {
+        if (!declaredSet.has(pkg)) {
+            issues.push({
+                severity: 'warning',
+                message: `phantom import: "${pkg}" is imported but not in package.json`,
+                fixable: true,
+                fixHint: `run: npm install ${pkg}`,
+            });
+        }
+    }
+    // ── Scoring ────────────────────────────────────────────────────────────────
+    const errors = issues.filter(i => i.severity === 'error').length;
+    const warnings = issues.filter(i => i.severity === 'warning').length;
+    const rawScore = 10 - (errors * 3) - (warnings * 1);
+    const finalScore = Math.max(0, Math.min(10, rawScore));
+    // ── Summary ────────────────────────────────────────────────────────────────
+    const parts = [];
+    if (errors > 0)
+        parts.push(`${errors} error${errors !== 1 ? 's' : ''}`);
+    if (warnings > 0)
+        parts.push(`${warnings} warning${warnings !== 1 ? 's' : ''}`);
+    const infos = issues.filter(i => i.severity === 'info').length;
+    if (infos > 0)
+        parts.push(`${infos} info`);
+    const summary = parts.length === 0
+        ? `${declaredNames.length} dependencies checked, all clean`
+        : `${declaredNames.length} dependencies: ${parts.join(', ')}`;
+    return {
+        name: 'deps',
+        score: finalScore,
+        maxScore: 10,
+        issues,
+        summary,
+    };
+}

package/dist/cli.js

@@ -9,6 +9,8 @@ import { checkConfig } from './checks/config.js';
 import { checkHistory } from './checks/history.js';
 import { checkScan } from './checks/scan.js';
 import { checkSecrets } from './checks/secrets.js';
+import { checkDeps } from './checks/deps.js';
+import { checkDebt } from './checks/debt.js';
 import { checkReceipt, runReceiptCommand } from './checks/receipt.js';
 import { score } from './scorer.js';
 import { reportPretty, reportJSON } from './reporter.js';
@@ -48,6 +50,8 @@ if (flags.has('--help') || flags.has('-h')) {
     scan      malicious patterns in agent config files
     secrets   leaked secrets in build output and .env files
     receipt   last agent session audit (informational)
+    deps      phantom/hallucinated dependency detection
+    debt      AI-generated technical debt patterns
 
   ${c.dim}options:${c.reset}
     --ci          CI mode (exit 1 if score < threshold)
@@ -120,7 +124,7 @@ if (isFix) {
     process.exit(0);
 }
 async function runChecks() {
-    const allChecks = ['ready', 'diff', 'models', 'config', 'history', 'scan', 'secrets', 'receipt'];
+    const allChecks = ['ready', 'diff', 'models', 'config', 'history', 'scan', 'secrets', 'receipt', 'deps', 'debt'];
     const enabledChecks = config.checks || allChecks;
     const results = [];
     // ready and models are async (try rich subpackages first, fallback to built-in)
@@ -140,6 +144,10 @@ async function runChecks() {
         results.push(await checkSecrets(cwd));
     if (enabledChecks.includes('receipt'))
         results.push(await checkReceipt(cwd));
+    if (enabledChecks.includes('deps'))
+        results.push(await checkDeps(cwd));
+    if (enabledChecks.includes('debt'))
+        results.push(await checkDebt(cwd, ignore));
     return score(cwd, results);
 }
 // --watch mode

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "vet your AI-generated code — one command, six checks, zero config",
   "type": "module",
   "bin": {