@safetnsr/vet 0.5.0 → 1.0.0

package/dist/checks/integrity.js

@@ -0,0 +1,317 @@
+import { join, resolve, dirname, extname } from 'node:path';
+import { existsSync } from 'node:fs';
+import { walkFiles, readFile } from '../util.js';
+// ── Hallucinated imports ─────────────────────────────────────────────────────
+const RESOLVE_EXTS = ['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs', '.cts', '.cjs', '.json'];
+function resolveRelativeImport(importPath, fromFile, cwd) {
+    // fromFile is relative to cwd
+    const fromDir = dirname(join(cwd, fromFile));
+    const base = resolve(fromDir, importPath);
+    // Try as-is
+    if (existsSync(base))
+        return true;
+    // Try with extensions appended
+    for (const ext of RESOLVE_EXTS) {
+        if (existsSync(base + ext))
+            return true;
+    }
+    // Try as directory with index
+    for (const ext of RESOLVE_EXTS) {
+        if (existsSync(join(base, 'index' + ext)))
+            return true;
+    }
+    // Handle ESM TypeScript pattern: ./foo.js → ./foo.ts (strip .js, try .ts/.tsx etc)
+    const baseExt = extname(base);
+    if (baseExt) {
+        const withoutExt = base.slice(0, -baseExt.length);
+        for (const ext of RESOLVE_EXTS) {
+            if (existsSync(withoutExt + ext))
+                return true;
+        }
+        // Also try as directory index
+        for (const ext of RESOLVE_EXTS) {
+            if (existsSync(join(withoutExt, 'index' + ext)))
+                return true;
+        }
+    }
+    return false;
+}
+function extractRelativeImports(source) {
+    const imports = [];
+    const lines = source.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // import ... from './foo' or '../bar'
+        const fromMatch = line.match(/from\s+['"](\.[^'"]+)['"]/);
+        if (fromMatch) {
+            imports.push({ path: fromMatch[1], line: i + 1 });
+        }
+        // require('./foo')
+        const reqMatch = line.match(/require\s*\(\s*['"](\.[^'"]+)['"]\s*\)/);
+        if (reqMatch) {
+            imports.push({ path: reqMatch[1], line: i + 1 });
+        }
+        // import('./foo')
+        const dynMatch = line.match(/import\s*\(\s*['"](\.[^'"]+)['"]\s*\)/);
+        if (dynMatch) {
+            imports.push({ path: dynMatch[1], line: i + 1 });
+        }
+    }
+    return imports;
+}
+function checkHallucinatedImports(cwd, files) {
+    const issues = [];
+    const sourceExts = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs', '.cts', '.cjs']);
+    for (const file of files) {
+        const ext = extname(file);
+        if (!sourceExts.has(ext))
+            continue;
+        if (file.includes('node_modules'))
+            continue;
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        const relImports = extractRelativeImports(content);
+        for (const imp of relImports) {
+            // Skip .js extensions pointing to .ts files (common in ESM TypeScript)
+            // The resolver already handles this
+            if (!resolveRelativeImport(imp.path, file, cwd)) {
+                issues.push({
+                    severity: 'error',
+                    message: `hallucinated import: "${imp.path}" does not resolve to any file`,
+                    file,
+                    line: imp.line,
+                    fixable: false,
+                });
+            }
+        }
+    }
+    return issues;
+}
+// ── Empty catch blocks ───────────────────────────────────────────────────────
+function checkEmptyCatch(cwd, files) {
+    const issues = [];
+    const sourceExts = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
+    for (const file of files) {
+        if (!sourceExts.has(extname(file)))
+            continue;
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // catch(e) {} or catch(err) {} — empty catch
+            if (/catch\s*\([^)]*\)\s*\{\s*\}/.test(line)) {
+                issues.push({
+                    severity: 'error',
+                    message: 'empty catch block — error silently swallowed',
+                    file,
+                    line: i + 1,
+                    fixable: false,
+                    fixHint: 'log or handle the error, or add a comment explaining why it is intentional',
+                });
+                continue;
+            }
+            // catch {} (no param)
+            if (/catch\s*\{\s*\}/.test(line)) {
+                issues.push({
+                    severity: 'error',
+                    message: 'empty catch block — error silently swallowed',
+                    file,
+                    line: i + 1,
+                    fixable: false,
+                    fixHint: 'log or handle the error, or add a comment explaining why it is intentional',
+                });
+                continue;
+            }
+            // Multi-line: catch block that starts on this line — check if it's comment-only
+            const catchStart = line.match(/catch\s*(?:\([^)]*\))?\s*\{/);
+            if (catchStart) {
+                // Collect lines until matching }
+                let depth = 0;
+                let blockStart = -1;
+                for (let ci = line.indexOf('{'); ci < line.length; ci++) {
+                    if (line[ci] === '{') {
+                        depth++;
+                        blockStart = ci;
+                        break;
+                    }
+                }
+                if (depth > 0) {
+                    const blockLines = [line.slice(blockStart + 1)];
+                    let j = i + 1;
+                    while (j < lines.length && depth > 0) {
+                        const l = lines[j];
+                        for (const ch of l) {
+                            if (ch === '{')
+                                depth++;
+                            else if (ch === '}')
+                                depth--;
+                        }
+                        blockLines.push(l);
+                        j++;
+                    }
+                    // Check if block body is only comments
+                    const bodyText = blockLines.join('\n').replace(/\}$/, '').trim();
+                    if (bodyText.length > 0 && /^(\s*(\/\/[^\n]*|\/\*[\s\S]*?\*\/)\s*)*$/.test(bodyText)) {
+                        issues.push({
+                            severity: 'warning',
+                            message: 'catch block contains only comments — consider proper error handling',
+                            file,
+                            line: i + 1,
+                            fixable: false,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return issues;
+}
+// ── Stubbed tests ────────────────────────────────────────────────────────────
+function checkStubbedTests(cwd, files) {
+    const issues = [];
+    const testExts = /\.(test|spec)\.[jt]sx?$/;
+    for (const file of files) {
+        if (!testExts.test(file))
+            continue;
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // Trivial assertions
+            if (/expect\s*\(\s*true\s*\)\s*\.toBe\s*\(\s*true\s*\)/.test(line)) {
+                issues.push({
+                    severity: 'error',
+                    message: 'stubbed test: trivial assertion expect(true).toBe(true)',
+                    file,
+                    line: i + 1,
+                    fixable: false,
+                });
+            }
+            if (/expect\s*\(\s*1\s*\)\s*\.toBe\s*\(\s*1\s*\)/.test(line)) {
+                issues.push({
+                    severity: 'error',
+                    message: 'stubbed test: trivial assertion expect(1).toBe(1)',
+                    file,
+                    line: i + 1,
+                    fixable: false,
+                });
+            }
+            // Empty test body: test('...', () => {}) or it('...', () => {})
+            if (/(?:test|it)\s*\(\s*['"`][^'"]+['"`]\s*,\s*(?:async\s*)?\(\s*\)\s*=>\s*\{\s*\}\s*\)/.test(line)) {
+                issues.push({
+                    severity: 'error',
+                    message: 'stubbed test: empty test body',
+                    file,
+                    line: i + 1,
+                    fixable: false,
+                    fixHint: 'add assertions or mark as test.todo()',
+                });
+            }
+            // it.skip without .todo — skipped test (always check regardless of other matches on this line)
+            if (/(?:it|test)\.skip\s*\(/.test(line) && !/\.todo\s*\(/.test(line)) {
+                issues.push({
+                    severity: 'warning',
+                    message: 'skipped test: use test.todo() instead of .skip for unimplemented tests',
+                    file,
+                    line: i + 1,
+                    fixable: true,
+                    fixHint: 'change .skip to .todo if not yet implemented',
+                });
+            }
+        }
+    }
+    return issues;
+}
+// ── Unhandled async (removed error handling) ─────────────────────────────────
+function checkUnhandledAsync(cwd, files) {
+    const issues = [];
+    const sourceExts = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
+    for (const file of files) {
+        if (!sourceExts.has(extname(file)))
+            continue;
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        const lines = content.split('\n');
+        let unhandledCount = 0;
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // await without try/catch context — detect standalone awaits
+            // We look for: const/let/var x = await or just await on its own, not inside try
+            const hasAwait = /^\s*(?:const|let|var)\s+\w.*=\s*await\s+/.test(line) || /^\s*await\s+/.test(line);
+            if (!hasAwait)
+                continue;
+            // Check context window — look for try { in surrounding lines
+            const contextStart = Math.max(0, i - 15);
+            const contextEnd = Math.min(lines.length - 1, i + 5);
+            const contextLines = lines.slice(contextStart, contextEnd + 1);
+            const contextText = contextLines.join('\n');
+            // Count try/catch blocks in context
+            const tryCount = (contextText.match(/\btry\s*\{/g) || []).length;
+            const catchCount = (contextText.match(/\bcatch\s*(?:\([^)]*\))?\s*\{/g) || []).length;
+            if (tryCount === 0 || catchCount === 0) {
+                // Also check for .catch() chained
+                const hasCatch = /\.catch\s*\(/.test(line) || (i + 1 < lines.length && /\.catch\s*\(/.test(lines[i + 1]));
+                if (!hasCatch) {
+                    unhandledCount++;
+                    if (unhandledCount <= 10) {
+                        issues.push({
+                            severity: 'warning',
+                            message: 'unhandled async: await without try/catch',
+                            file,
+                            line: i + 1,
+                            fixable: false,
+                            fixHint: 'wrap in try/catch or chain .catch()',
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return issues;
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkIntegrity(cwd, ignore) {
+    const files = walkFiles(cwd, ignore);
+    const hallucinatedIssues = checkHallucinatedImports(cwd, files);
+    const emptyCatchIssues = checkEmptyCatch(cwd, files);
+    const stubbedTestIssues = checkStubbedTests(cwd, files);
+    const unhandledAsyncIssues = checkUnhandledAsync(cwd, files);
+    const allIssues = [
+        ...hallucinatedIssues,
+        ...emptyCatchIssues,
+        ...stubbedTestIssues,
+        ...unhandledAsyncIssues,
+    ];
+    // Scoring: start at 100, penalize per issue type
+    let score = 100;
+    score -= hallucinatedIssues.length * 10;
+    score -= emptyCatchIssues.filter(i => i.severity === 'error').length * 8;
+    score -= stubbedTestIssues.filter(i => i.severity === 'error').length * 5;
+    // Unhandled async capped at -30
+    const unhandledErrors = unhandledAsyncIssues.length;
+    score -= Math.min(30, unhandledErrors * 3);
+    score = Math.max(0, Math.round(score));
+    // Summary parts
+    const parts = [];
+    if (hallucinatedIssues.length > 0)
+        parts.push(`${hallucinatedIssues.length} hallucinated import${hallucinatedIssues.length !== 1 ? 's' : ''}`);
+    if (emptyCatchIssues.length > 0)
+        parts.push(`${emptyCatchIssues.length} empty catch${emptyCatchIssues.length !== 1 ? 'es' : ''}`);
+    if (stubbedTestIssues.length > 0)
+        parts.push(`${stubbedTestIssues.length} stubbed test${stubbedTestIssues.length !== 1 ? 's' : ''}`);
+    if (unhandledAsyncIssues.length > 0)
+        parts.push(`${unhandledAsyncIssues.length} unhandled async`);
+    return {
+        name: 'integrity',
+        score,
+        maxScore: 100,
+        issues: allIssues,
+        summary: parts.length === 0 ? 'no integrity issues found' : parts.join(', '),
+    };
+}

package/dist/checks/map.d.ts

@@ -0,0 +1,25 @@
+import type { CheckResult } from '../types.js';
+export declare const AGENT_CONFIG_FILES: string[];
+export declare function parseAgentConfigs(cwd: string): string[];
+export declare function extractRefs(content: string, cwd: string): string[];
+export type VisibilityTier = 'config' | 'visible' | 'invisible';
+export interface ClassifiedFile {
+    path: string;
+    tier: VisibilityTier;
+}
+export declare function classifyFiles(cwd: string, configPaths: string[], refs: string[]): ClassifiedFile[];
+export interface MapResult {
+    config: string[];
+    visible: string[];
+    invisible: string[];
+    stats: {
+        total: number;
+        visible_pct: number;
+    };
+}
+export declare function checkMap(cwd: string): Promise<CheckResult & {
+    mapData: MapResult;
+}>;
+export declare function renderMapReport(result: CheckResult & {
+    mapData: MapResult;
+}, asJson: boolean): string;

package/dist/checks/map.js

@@ -0,0 +1,256 @@
+import { join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { walkFiles, readFile, c } from '../util.js';
+// ── Agent config filenames to discover ───────────────────────────────────────
+export const AGENT_CONFIG_FILES = [
+    'CLAUDE.md',
+    'AGENTS.md',
+    '.cursorrules',
+    'codex.md',
+    '.github/copilot-instructions.md',
+    'cursor.json',
+    '.cursor/rules',
+    'copilot-instructions.md',
+];
+// ── Parse all agent config files present in cwd ──────────────────────────────
+export function parseAgentConfigs(cwd) {
+    const found = [];
+    for (const name of AGENT_CONFIG_FILES) {
+        const full = join(cwd, name);
+        if (existsSync(full)) {
+            found.push(name);
+        }
+    }
+    return found;
+}
+// ── Extract file/dir references from config file content ─────────────────────
+export function extractRefs(content, cwd) {
+    const refs = new Set();
+    // Patterns to extract:
+    // 1. Backtick paths: `path/to/file.ts` or `./path`
+    const backtickPat = /`([^`\s]+)`/g;
+    // 2. Inline code in markdown: single-line code with path-like content
+    const codePat = /`([./][^`\s]+)`/g;
+    // 3. Explicit path patterns in text: word/word or ./word or ~/word
+    const pathPat = /(?:^|\s)((?:\.\/|\.\.\/|~\/)?(?:[a-zA-Z0-9_-]+\/)+[a-zA-Z0-9_.-]*[a-zA-Z0-9_-])/gm;
+    // 4. Absolute paths starting with /
+    const absPat = /(?:^|\s)(\/(?:[a-zA-Z0-9_.-]+\/)*[a-zA-Z0-9_.-]+)/gm;
+    const extractFromPattern = (pat) => {
+        let match;
+        pat.lastIndex = 0;
+        while ((match = pat.exec(content)) !== null) {
+            const raw = match[1].trim();
+            // Skip URLs
+            if (raw.startsWith('http://') || raw.startsWith('https://') || raw.includes('://'))
+                continue;
+            // Skip if looks like a domain
+            if (/^[a-z]+\.[a-z]{2,}/.test(raw) && !raw.includes('/'))
+                continue;
+            refs.add(raw);
+        }
+    };
+    extractFromPattern(backtickPat);
+    extractFromPattern(codePat);
+    extractFromPattern(pathPat);
+    extractFromPattern(absPat);
+    // Filter to only refs that actually exist on disk (relative to cwd)
+    const resolved = [];
+    for (const ref of refs) {
+        let resolvedPath;
+        if (ref.startsWith('/')) {
+            resolvedPath = ref;
+        }
+        else if (ref.startsWith('~/')) {
+            resolvedPath = join(process.env.HOME || '/root', ref.slice(2));
+        }
+        else {
+            resolvedPath = join(cwd, ref);
+        }
+        if (existsSync(resolvedPath)) {
+            // Store as relative to cwd
+            const rel = ref.startsWith('/') ? ref : ref;
+            resolved.push(rel.replace(/^\.\//, ''));
+        }
+    }
+    return [...new Set(resolved)];
+}
+// ── Classify all codebase files ───────────────────────────────────────────────
+export function classifyFiles(cwd, configPaths, refs) {
+    const allFiles = walkFiles(cwd);
+    const configSet = new Set(configPaths);
+    // Build a set of ref prefixes for directory matching
+    const refSet = new Set(refs);
+    // Also include files whose parent directory is referenced
+    function isReferencedByRef(file) {
+        if (refSet.has(file))
+            return true;
+        // Check if any ref is a directory prefix of this file
+        for (const ref of refSet) {
+            if (file.startsWith(ref + '/') || file.startsWith(ref.replace(/\/$/, '') + '/')) {
+                return true;
+            }
+        }
+        return false;
+    }
+    const classified = [];
+    for (const file of allFiles) {
+        let tier;
+        if (configSet.has(file)) {
+            tier = 'config';
+        }
+        else if (isReferencedByRef(file)) {
+            tier = 'visible';
+        }
+        else {
+            tier = 'invisible';
+        }
+        classified.push({ path: file, tier });
+    }
+    // Also add config files that walkFiles might have missed (e.g. .github/copilot-instructions.md)
+    for (const cp of configPaths) {
+        if (!classified.find(f => f.path === cp)) {
+            classified.push({ path: cp, tier: 'config' });
+        }
+    }
+    return classified;
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkMap(cwd) {
+    const issues = [];
+    // Discover agent configs
+    const configPaths = parseAgentConfigs(cwd);
+    // Extract all refs from all config files
+    const allRefs = [];
+    for (const cp of configPaths) {
+        const content = readFile(join(cwd, cp));
+        if (content) {
+            const refs = extractRefs(content, cwd);
+            allRefs.push(...refs);
+        }
+    }
+    const uniqueRefs = [...new Set(allRefs)];
+    // Classify files
+    const classified = classifyFiles(cwd, configPaths, uniqueRefs);
+    const configFiles = classified.filter(f => f.tier === 'config').map(f => f.path);
+    const visibleFiles = classified.filter(f => f.tier === 'visible').map(f => f.path);
+    const invisibleFiles = classified.filter(f => f.tier === 'invisible').map(f => f.path);
+    const total = classified.length;
+    const visible = visibleFiles.length + configFiles.length;
+    const visible_pct = total > 0 ? Math.round((visible / total) * 100) : 0;
+    // Issues
+    if (configPaths.length === 0) {
+        issues.push({
+            severity: 'warning',
+            message: 'no agent config files found (CLAUDE.md, .cursorrules, etc.) — agent has no guided context',
+            fixable: true,
+            fixHint: 'run: npx @safetnsr/vet init',
+        });
+    }
+    if (visible_pct < 20 && total > 0) {
+        issues.push({
+            severity: 'warning',
+            message: `agent is mostly blind: only ${visible_pct}% of codebase is referenced in agent configs`,
+            fixable: false,
+        });
+    }
+    // Surface top invisible dirs as info
+    const invisibleDirs = new Set();
+    for (const f of invisibleFiles) {
+        const parts = f.split('/');
+        if (parts.length > 1)
+            invisibleDirs.add(parts[0]);
+    }
+    const topInvisibleDirs = [...invisibleDirs].slice(0, 5);
+    if (topInvisibleDirs.length > 0 && invisibleFiles.length > 0) {
+        issues.push({
+            severity: 'info',
+            message: `top invisible directories: ${topInvisibleDirs.join(', ')}`,
+            fixable: false,
+        });
+    }
+    const mapData = {
+        config: configFiles,
+        visible: visibleFiles,
+        invisible: invisibleFiles,
+        stats: { total, visible_pct },
+    };
+    const summary = configPaths.length === 0
+        ? `no agent config files — all ${total} files invisible`
+        : `${visible_pct}% visible to agent (${visible}/${total} files)`;
+    return {
+        name: 'map',
+        score: visible_pct,
+        maxScore: 100,
+        issues,
+        summary,
+        mapData,
+    };
+}
+// ── Terminal renderer ─────────────────────────────────────────────────────────
+export function renderMapReport(result, asJson) {
+    const { mapData } = result;
+    if (asJson) {
+        return JSON.stringify({
+            config: mapData.config,
+            visible: mapData.visible,
+            invisible: mapData.invisible,
+            stats: mapData.stats,
+        }, null, 2);
+    }
+    const lines = [];
+    lines.push('');
+    lines.push(`  ${c.bold}vet map${c.reset} — agent visibility\n`);
+    lines.push(`  ${c.dim}score:${c.reset}   ${c.bold}${mapData.stats.visible_pct}%${c.reset} visible to agent`);
+    lines.push(`  ${c.dim}total:${c.reset}   ${mapData.stats.total} files`);
+    lines.push('');
+    // Config files tier
+    if (mapData.config.length > 0) {
+        lines.push(`  ${c.yellow}${c.bold}config files${c.reset} ${c.dim}(${mapData.config.length})${c.reset}`);
+        for (const f of mapData.config.slice(0, 10)) {
+            lines.push(`  ${c.yellow}●${c.reset} ${c.dim}${f}${c.reset}`);
+        }
+        if (mapData.config.length > 10) {
+            lines.push(`  ${c.dim}  ... and ${mapData.config.length - 10} more${c.reset}`);
+        }
+        lines.push('');
+    }
+    // Visible files tier
+    if (mapData.visible.length > 0) {
+        lines.push(`  ${c.green}${c.bold}visible to agent${c.reset} ${c.dim}(${mapData.visible.length})${c.reset}`);
+        for (const f of mapData.visible.slice(0, 15)) {
+            lines.push(`  ${c.green}●${c.reset} ${f}`);
+        }
+        if (mapData.visible.length > 15) {
+            lines.push(`  ${c.dim}  ... and ${mapData.visible.length - 15} more${c.reset}`);
+        }
+        lines.push('');
+    }
+    // Invisible dirs summary
+    if (mapData.invisible.length > 0) {
+        const invisibleDirs = new Map();
+        for (const f of mapData.invisible) {
+            const parts = f.split('/');
+            const dir = parts.length > 1 ? parts[0] : '(root)';
+            invisibleDirs.set(dir, (invisibleDirs.get(dir) || 0) + 1);
+        }
+        const sortedDirs = [...invisibleDirs.entries()].sort((a, b) => b[1] - a[1]);
+        lines.push(`  ${c.dim}${c.bold}invisible to agent${c.reset} ${c.dim}(${mapData.invisible.length} files)${c.reset}`);
+        for (const [dir, count] of sortedDirs.slice(0, 8)) {
+            lines.push(`  ${c.dim}○ ${dir}/ (${count} files)${c.reset}`);
+        }
+        if (sortedDirs.length > 8) {
+            lines.push(`  ${c.dim}  ... and ${sortedDirs.length - 8} more directories${c.reset}`);
+        }
+        lines.push('');
+    }
+    // Issues
+    for (const issue of result.issues) {
+        const icon = issue.severity === 'warning' ? c.yellow + '⚠' : c.dim + 'ℹ';
+        lines.push(`  ${icon}${c.reset} ${issue.message}`);
+        if (issue.fixHint)
+            lines.push(`    ${c.dim}→ ${issue.fixHint}${c.reset}`);
+    }
+    if (result.issues.length > 0)
+        lines.push('');
+    return lines.join('\n');
+}

package/dist/checks/models.js

@@ -22,11 +22,11 @@ async function tryModelGraveyard(cwd) {
                 });
             }
         }
-        const score = Math.max(0, 10 - issues.length * 2);
+        const score = Math.max(0, 100 - issues.length * 20);
         return {
             name: 'models',
-            score: Math.min(10, score),
-            maxScore: 10,
+            score: Math.min(100, score),
+            maxScore: 100,
             issues,
             summary: issues.length === 0
                 ? `${report.filesScanned} files scanned (via model-graveyard) — all current`
@@ -111,11 +111,11 @@ function builtinModels(cwd, ignore) {
             fixHint: `replace "${model}" with "${info.replacement}"`,
         });
     }
-    const score = Math.max(0, 10 - issues.length * 2);
+    const score = Math.max(0, 100 - issues.length * 20);
     return {
         name: 'models',
-        score: Math.min(10, score),
-        maxScore: 10,
+        score: Math.min(100, score),
+        maxScore: 100,
         issues,
         summary: issues.length === 0 ? 'all model references current' : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} found`,
     };

package/dist/checks/owasp.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkOwasp(cwd: string): CheckResult;