@safetnsr/vet 0.6.0 → 1.1.0

package/README.md

@@ -1,6 +1,6 @@
 # vet
 
-vet your AI-generated code. one command, eight checks, zero config.
+vet your AI-generated code. one command, nine checks, zero config.
 
 ```bash
 npx @safetnsr/vet
@@ -20,6 +20,7 @@ works with Claude Code, Cursor, Copilot, Codex, Aider, Windsurf, Cline — anyth
 | **scan** | malicious patterns in agent configs? | scans .claude/, .cursorrules, CLAUDE.md, .mcp/ for prompt injection, shell injection, exfiltration endpoints |
 | **secrets** | leaked secrets in build output? | scans dist/, build/, .next/ + .env files for API keys, tokens, connection strings using pattern + entropy analysis |
 | **receipt** | what did the last agent session do? | parses ~/.claude/projects/ JSONL session logs — files changed, commands run, packages installed, SHA256 integrity hash |
+| **debt** | AI-generated technical debt (duplicates, orphans, wrappers) | detects near-duplicate functions, orphaned exports, wrapper pass-throughs, naming drift |
 
 ## usage
 

package/dist/categories.d.ts

@@ -0,0 +1,9 @@
+import type { CheckResult, CategoryResult, VetResult } from './types.js';
+export declare function toGrade(score: number): string;
+export declare function buildCategories(checkMap: {
+    security: CheckResult[];
+    integrity: CheckResult[];
+    debt: CheckResult[];
+    deps: CheckResult[];
+}): CategoryResult[];
+export declare function buildVetResult(project: string, categories: CategoryResult[]): VetResult;

package/dist/categories.js

@@ -0,0 +1,79 @@
+import { basename } from 'node:path';
+import { readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { dirname, join } from 'node:path';
+// ── Grade thresholds ─────────────────────────────────────────────────────────
+export function toGrade(score) {
+    if (score >= 90)
+        return 'A';
+    if (score >= 75)
+        return 'B';
+    if (score >= 60)
+        return 'C';
+    if (score >= 40)
+        return 'D';
+    return 'F';
+}
+// ── Category weights ─────────────────────────────────────────────────────────
+const WEIGHTS = {
+    security: 0.30,
+    integrity: 0.30,
+    debt: 0.25,
+    deps: 0.15,
+};
+// ── Average scores within a category ────────────────────────────────────────
+function averageScore(checks) {
+    if (checks.length === 0)
+        return 100;
+    const total = checks.reduce((sum, c) => sum + c.score, 0);
+    return Math.round(total / checks.length);
+}
+// ── Group checks into categories ─────────────────────────────────────────────
+export function buildCategories(checkMap) {
+    const categories = [];
+    for (const name of ['security', 'integrity', 'debt', 'deps']) {
+        const checks = checkMap[name];
+        const score = averageScore(checks);
+        const issues = checks.flatMap(c => c.issues);
+        categories.push({
+            name,
+            score,
+            weight: WEIGHTS[name],
+            checks,
+            issues,
+        });
+    }
+    return categories;
+}
+// ── Build VetResult from categories ─────────────────────────────────────────
+export function buildVetResult(project, categories) {
+    // Weighted average
+    let weightedSum = 0;
+    let totalWeight = 0;
+    for (const cat of categories) {
+        weightedSum += cat.score * cat.weight;
+        totalWeight += cat.weight;
+    }
+    const overallScore = totalWeight > 0 ? Math.round(weightedSum / totalWeight) : 0;
+    const grade = toGrade(overallScore);
+    const allIssues = categories.flatMap(c => c.issues);
+    // Read version from package.json
+    let version = '1.0.0';
+    try {
+        const __filename = fileURLToPath(import.meta.url);
+        const __dirname = dirname(__filename);
+        const pkg = JSON.parse(readFileSync(join(__dirname, '../package.json'), 'utf-8'));
+        version = pkg.version || version;
+    }
+    catch { /* use default */ }
+    return {
+        project: basename(project),
+        version,
+        score: overallScore,
+        grade,
+        categories,
+        totalIssues: allIssues.length,
+        fixableIssues: allIssues.filter(i => i.fixable).length,
+        timestamp: new Date().toISOString(),
+    };
+}

package/dist/checks/config.js

@@ -162,8 +162,8 @@ export function checkConfig(cwd, ignore) {
         });
         return {
             name: 'config',
-            score: 1,
-            maxScore: 10,
+            score: 10,
+            maxScore: 100,
             issues,
             summary: 'no agent configs — critically under-configured',
         };
@@ -190,16 +190,16 @@ export function checkConfig(cwd, ignore) {
     if (!fileExists(join(cwd, '.gitignore'))) {
         issues.push({ severity: 'warning', message: 'no .gitignore — agents may write to wrong directories', fixable: false });
     }
-    // Score: weighted average of sub-scores
-    const subScore = (best.existence * 0.2 + best.completeness * 0.3 + best.consistency * 0.25 + best.specificity * 0.25);
-    const gitignorePenalty = fileExists(join(cwd, '.gitignore')) ? 0 : 1;
-    const finalScore = Math.max(0, Math.min(10, subScore - gitignorePenalty));
+    // Score: weighted average of sub-scores (sub-scores are 0-10, multiply by 10 → 0-100)
+    const subScore = (best.existence * 0.2 + best.completeness * 0.3 + best.consistency * 0.25 + best.specificity * 0.25) * 10;
+    const gitignorePenalty = fileExists(join(cwd, '.gitignore')) ? 0 : 10;
+    const finalScore = Math.max(0, Math.min(100, subScore - gitignorePenalty));
     const agents = analyses.map(a => a.agent);
     const uniqueAgents = [...new Set(agents)];
     return {
         name: 'config',
-        score: Math.round(finalScore * 10) / 10,
-        maxScore: 10,
+        score: Math.round(finalScore),
+        maxScore: 100,
         issues,
         summary: `${uniqueAgents.join(', ')} — ${best.completeness >= 7 && best.specificity >= 7 ? 'well configured' : `needs work (${Math.round(finalScore)}/10)`}`,
     };

package/dist/checks/debt.js

@@ -316,8 +316,8 @@ export async function checkDebt(cwd, ignore) {
     if (sourceFiles.length === 0) {
         return {
             name: 'debt',
-            score: 10,
-            maxScore: 10,
+            score: 100,
+            maxScore: 100,
             issues: [],
             summary: 'no source files to analyze',
         };
@@ -344,12 +344,12 @@ export async function checkDebt(cwd, ignore) {
     const driftIssues = findNamingDrift(allFuncs);
     issues.push(...driftIssues);
     // ── Scoring ──────────────────────────────────────────────────────────────
-    const dupPenalty = Math.min(6, dupIssues.length * 1.5);
-    const orphanPenalty = Math.min(3, orphanIssues.length * 0.5);
-    const wrapperPenalty = Math.min(1.5, wrapperIssues.length * 0.3);
-    const driftPenalty = Math.min(1, driftIssues.length * 0.2);
-    const rawScore = 10 - dupPenalty - orphanPenalty - wrapperPenalty - driftPenalty;
-    const finalScore = Math.max(0, Math.round(rawScore * 10) / 10);
+    const dupPenalty = Math.min(60, dupIssues.length * 15);
+    const orphanPenalty = Math.min(30, orphanIssues.length * 5);
+    const wrapperPenalty = Math.min(15, wrapperIssues.length * 3);
+    const driftPenalty = Math.min(10, driftIssues.length * 2);
+    const rawScore = 100 - dupPenalty - orphanPenalty - wrapperPenalty - driftPenalty;
+    const finalScore = Math.max(0, Math.round(rawScore));
     // ── Summary ──────────────────────────────────────────────────────────────
     const parts = [];
     if (dupIssues.length > 0)
@@ -366,7 +366,7 @@ export async function checkDebt(cwd, ignore) {
     return {
         name: 'debt',
         score: finalScore,
-        maxScore: 10,
+        maxScore: 100,
         issues,
         summary,
     };

package/dist/checks/deps.js

@@ -57,18 +57,18 @@ export function levenshtein(a, b) {
 // ── Import extraction ────────────────────────────────────────────────────────
 export function extractImports(source) {
     const imports = new Set();
-    // import ... from 'pkg'
+    // static import: import X from <specifier>
     const importFrom = /import\s+(?:[\s\S]*?\s+from\s+)?['"]([^'"]+)['"]/g;
     let match;
     while ((match = importFrom.exec(source)) !== null) {
         imports.add(match[1]);
     }
-    // require('pkg')
+    // CommonJS require
     const requirePat = /require\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
     while ((match = requirePat.exec(source)) !== null) {
         imports.add(match[1]);
     }
-    // import('pkg')
+    // dynamic import()
     const dynamicImport = /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
     while ((match = dynamicImport.exec(source)) !== null) {
         imports.add(match[1]);
@@ -155,8 +155,8 @@ export async function checkDeps(cwd) {
     if (!hasPkgJson) {
         return {
             name: 'deps',
-            score: 10,
-            maxScore: 10,
+            score: 100,
+            maxScore: 100,
             issues: [],
             summary: 'no package.json found',
         };
@@ -204,9 +204,11 @@ export async function checkDeps(cwd) {
     // ── 3 & 4. Dead deps + phantom imports ─────────────────────────────────────
     const sourceExts = new Set(['.ts', '.js', '.tsx', '.jsx', '.mts', '.mjs', '.cts', '.cjs']);
     const allFiles = walkFiles(cwd);
+    const isTestFile = (f) => /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || /^test[/\\]/.test(f);
     const sourceFiles = allFiles.filter(f => {
         const ext = f.substring(f.lastIndexOf('.'));
-        return sourceExts.has(ext);
+        // Skip test files — they contain import strings as test fixtures, not real imports
+        return sourceExts.has(ext) && !isTestFile(f);
     });
     const importedPackages = new Set();
     for (const file of sourceFiles) {
@@ -252,8 +254,8 @@ export async function checkDeps(cwd) {
     // ── Scoring ────────────────────────────────────────────────────────────────
     const errors = issues.filter(i => i.severity === 'error').length;
     const warnings = issues.filter(i => i.severity === 'warning').length;
-    const rawScore = 10 - (errors * 3) - (warnings * 1);
-    const finalScore = Math.max(0, Math.min(10, rawScore));
+    const rawScore = 100 - (errors * 30) - (warnings * 10);
+    const finalScore = Math.max(0, Math.min(100, rawScore));
     // ── Summary ────────────────────────────────────────────────────────────────
     const parts = [];
     if (errors > 0)
@@ -269,7 +271,7 @@ export async function checkDeps(cwd) {
     return {
         name: 'deps',
         score: finalScore,
-        maxScore: 10,
+        maxScore: 100,
         issues,
         summary,
     };

package/dist/checks/diff.js

@@ -77,7 +77,7 @@ export function checkDiff(cwd, opts = {}) {
     const issues = [];
     const diff = getDiff(cwd, opts);
     if (!diff) {
-        return { name: 'diff', score: 10, maxScore: 10, issues: [], summary: 'no changes to check' };
+        return { name: 'diff', score: 100, maxScore: 100, issues: [], summary: 'no changes to check' };
     }
     const files = parseDiff(diff);
     const allPatterns = [...GENERIC_PATTERNS, ...AI_PATTERNS];
@@ -162,13 +162,13 @@ export function checkDiff(cwd, opts = {}) {
     // Recalibrated scoring
     const errors = issues.filter(i => i.severity === 'error').length;
     const warnings = issues.filter(i => i.severity === 'warning').length;
-    const score = Math.max(0, Math.min(10, 10 - errors * 2 - warnings * 0.75));
+    const score = Math.max(0, Math.min(100, 100 - errors * 20 - warnings * 7.5));
     const aiIssues = issues.filter(i => i.message.startsWith('[ai]')).length;
     const totalFiles = files.length;
     return {
         name: 'diff',
-        score: Math.round(score * 10) / 10,
-        maxScore: 10,
+        score: Math.round(score),
+        maxScore: 100,
         issues,
         summary: issues.length === 0
             ? `${totalFiles} file${totalFiles !== 1 ? 's' : ''} changed, clean`

package/dist/checks/history.js

@@ -5,7 +5,7 @@ export function checkHistory(cwd) {
     // Get recent commits (last 50) — use execFileSync to avoid shell pipe interpretation
     const log = gitExec(['log', '--oneline', '-50', '--format=%H|%an|%s'], cwd);
     if (!log) {
-        return { name: 'history', score: 10, maxScore: 10, issues: [], summary: 'no git history to analyze' };
+        return { name: 'history', score: 100, maxScore: 100, issues: [], summary: 'no git history to analyze' };
     }
     const commits = log.split('\n').filter(Boolean).map(line => {
         const parts = line.split('|');
@@ -66,11 +66,11 @@ export function checkHistory(cwd) {
     const aiPct = commits.length > 0 ? Math.round((aiCommits / commits.length) * 100) : 0;
     const infos = issues.filter(i => i.severity === 'info').length;
     const warnings = issues.filter(i => i.severity === 'warning').length;
-    const score = Math.max(0, Math.min(10, 10 - warnings * 1 - infos * 0.2));
+    const score = Math.max(0, Math.min(100, 100 - warnings * 10 - infos * 2));
     return {
         name: 'history',
-        score: Math.round(score * 10) / 10,
-        maxScore: 10,
+        score: Math.round(score),
+        maxScore: 100,
         issues,
         summary: `${commits.length} recent commits${aiPct > 0 ? ` (~${aiPct}% AI-attributed)` : ''}, ${issues.length} observation${issues.length !== 1 ? 's' : ''}`,
     };

package/dist/checks/integrity.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkIntegrity(cwd: string, ignore: string[]): Promise<CheckResult>;

package/dist/checks/integrity.js

@@ -0,0 +1,369 @@
+import { join, resolve, dirname, extname } from 'node:path';
+import { existsSync } from 'node:fs';
+import { walkFiles, readFile } from '../util.js';
+// ── Hallucinated imports ─────────────────────────────────────────────────────
+const RESOLVE_EXTS = ['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs', '.cts', '.cjs', '.json'];
+function resolveRelativeImport(importPath, fromFile, cwd) {
+    // fromFile is relative to cwd
+    const fromDir = dirname(join(cwd, fromFile));
+    const base = resolve(fromDir, importPath);
+    // Try as-is
+    if (existsSync(base))
+        return true;
+    // Try with extensions appended
+    for (const ext of RESOLVE_EXTS) {
+        if (existsSync(base + ext))
+            return true;
+    }
+    // Try as directory with index
+    for (const ext of RESOLVE_EXTS) {
+        if (existsSync(join(base, 'index' + ext)))
+            return true;
+    }
+    // Handle ESM TypeScript pattern: ./foo.js → ./foo.ts (strip .js, try .ts/.tsx etc)
+    const baseExt = extname(base);
+    if (baseExt) {
+        const withoutExt = base.slice(0, -baseExt.length);
+        for (const ext of RESOLVE_EXTS) {
+            if (existsSync(withoutExt + ext))
+                return true;
+        }
+        // Also try as directory index
+        for (const ext of RESOLVE_EXTS) {
+            if (existsSync(join(withoutExt, 'index' + ext)))
+                return true;
+        }
+    }
+    return false;
+}
+function isInsideStringLiteral(line, matchIndex) {
+    // Check if the match position is inside a string literal (template literal, quote)
+    // by counting unescaped quotes before the match
+    let inSingle = false;
+    let inDouble = false;
+    let inTemplate = false;
+    for (let i = 0; i < matchIndex && i < line.length; i++) {
+        const ch = line[i];
+        if (ch === '\\') {
+            i++;
+            continue;
+        }
+        if (ch === "'" && !inDouble && !inTemplate)
+            inSingle = !inSingle;
+        else if (ch === '"' && !inSingle && !inTemplate)
+            inDouble = !inDouble;
+        else if (ch === '`' && !inSingle && !inDouble)
+            inTemplate = !inTemplate;
+    }
+    // If we're inside a string context AND the line itself is not an import/require statement,
+    // then this is likely a string literal containing import-like text
+    return inSingle || inDouble || inTemplate;
+}
+function isCommentLine(line) {
+    const trimmed = line.trim();
+    return trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*');
+}
+function extractRelativeImports(source) {
+    const imports = [];
+    const lines = source.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Skip comment lines
+        if (isCommentLine(line))
+            continue;
+        const trimmed = line.trim();
+        // import ... from './foo' or '../bar' — must be an actual import statement
+        if (/^\s*(?:import|export)\s/.test(line)) {
+            const fromMatch = line.match(/from\s+['"](\.[^'"]+)['"]/);
+            if (fromMatch) {
+                imports.push({ path: fromMatch[1], line: i + 1 });
+            }
+        }
+        // require('./foo') — must be at statement level, not inside a string
+        const reqMatch = line.match(/require\s*\(\s*['"](\.[^'"]+)['"]\s*\)/);
+        if (reqMatch && !isInsideStringLiteral(line, line.indexOf(reqMatch[0]))) {
+            // Skip if the require is inside a string literal (test fixtures)
+            const beforeReq = line.substring(0, line.indexOf(reqMatch[0]));
+            if (!/['"`]/.test(beforeReq.slice(-1))) {
+                imports.push({ path: reqMatch[1], line: i + 1 });
+            }
+        }
+        // Dynamic import('./foo') — actual import() call, not in string
+        if (/^\s*(?:const|let|var|await|return)?\s*/.test(line)) {
+            const dynMatch = line.match(/import\s*\(\s*['"](\.[^'"]+)['"]\s*\)/);
+            if (dynMatch && !isCommentLine(line)) {
+                // Make sure it's not inside a string literal (e.g. a test describing imports)
+                const matchIdx = line.indexOf(dynMatch[0]);
+                if (!isInsideStringLiteral(line, matchIdx)) {
+                    imports.push({ path: dynMatch[1], line: i + 1 });
+                }
+            }
+        }
+    }
+    return imports;
+}
+function checkHallucinatedImports(cwd, files) {
+    const issues = [];
+    const sourceExts = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs', '.cts', '.cjs']);
+    for (const file of files) {
+        const ext = extname(file);
+        if (!sourceExts.has(ext))
+            continue;
+        if (file.includes('node_modules'))
+            continue;
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        const relImports = extractRelativeImports(content);
+        for (const imp of relImports) {
+            // Skip .js extensions pointing to .ts files (common in ESM TypeScript)
+            // The resolver already handles this
+            if (!resolveRelativeImport(imp.path, file, cwd)) {
+                issues.push({
+                    severity: 'error',
+                    message: `hallucinated import: "${imp.path}" does not resolve to any file`,
+                    file,
+                    line: imp.line,
+                    fixable: false,
+                });
+            }
+        }
+    }
+    return issues;
+}
+// ── Empty catch blocks ───────────────────────────────────────────────────────
+function isTestFile(file) {
+    return /\.(test|spec)\.[jt]sx?$/.test(file) || file.includes('__tests__') || /^test[/\\]/.test(file);
+}
+function checkEmptyCatch(cwd, files) {
+    const issues = [];
+    const sourceExts = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
+    for (const file of files) {
+        if (!sourceExts.has(extname(file)))
+            continue;
+        // Skip test files — empty catches in tests are usually intentional (testing error paths)
+        if (isTestFile(file))
+            continue;
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // single-line catch with param and empty body — error silently swallowed
+            if (/catch\s*\([^)]*\)\s*\{\s*\}/.test(line)) {
+                issues.push({
+                    severity: 'error',
+                    message: 'empty catch block — error silently swallowed',
+                    file,
+                    line: i + 1,
+                    fixable: false,
+                    fixHint: 'log or handle the error, or add a comment explaining why it is intentional',
+                });
+                continue;
+            }
+            // single-line catch without param and empty body
+            if (/catch\s*\{\s*\}/.test(line)) {
+                issues.push({
+                    severity: 'error',
+                    message: 'empty catch block — error silently swallowed',
+                    file,
+                    line: i + 1,
+                    fixable: false,
+                    fixHint: 'log or handle the error, or add a comment explaining why it is intentional',
+                });
+                continue;
+            }
+            // Multi-line: catch block that starts on this line — check if it's comment-only
+            const catchStart = line.match(/catch\s*(?:\([^)]*\))?\s*\{/);
+            if (catchStart) {
+                // Collect lines until matching }
+                let depth = 0;
+                let blockStart = -1;
+                for (let ci = line.indexOf('{'); ci < line.length; ci++) {
+                    if (line[ci] === '{') {
+                        depth++;
+                        blockStart = ci;
+                        break;
+                    }
+                }
+                if (depth > 0) {
+                    const blockLines = [line.slice(blockStart + 1)];
+                    let j = i + 1;
+                    while (j < lines.length && depth > 0) {
+                        const l = lines[j];
+                        for (const ch of l) {
+                            if (ch === '{')
+                                depth++;
+                            else if (ch === '}')
+                                depth--;
+                        }
+                        blockLines.push(l);
+                        j++;
+                    }
+                    // Check if block body is only comments
+                    const bodyText = blockLines.join('\n').replace(/\}$/, '').trim();
+                    if (bodyText.length > 0 && /^(\s*(\/\/[^\n]*|\/\*[\s\S]*?\*\/)\s*)*$/.test(bodyText)) {
+                        issues.push({
+                            severity: 'warning',
+                            message: 'catch block contains only comments — consider proper error handling',
+                            file,
+                            line: i + 1,
+                            fixable: false,
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return issues;
+}
+// ── Stubbed tests ────────────────────────────────────────────────────────────
+function checkStubbedTests(cwd, files) {
+    const issues = [];
+    const testExts = /\.(test|spec)\.[jt]sx?$/;
+    for (const file of files) {
+        if (!testExts.test(file))
+            continue;
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        const lines = content.split('\n');
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // Trivial assertions
+            if (/expect\s*\(\s*true\s*\)\s*\.toBe\s*\(\s*true\s*\)/.test(line)) {
+                issues.push({
+                    severity: 'error',
+                    message: 'stubbed test: trivial assertion expect(true).toBe(true)',
+                    file,
+                    line: i + 1,
+                    fixable: false,
+                });
+            }
+            if (/expect\s*\(\s*1\s*\)\s*\.toBe\s*\(\s*1\s*\)/.test(line)) {
+                issues.push({
+                    severity: 'error',
+                    message: 'stubbed test: trivial assertion expect(1).toBe(1)',
+                    file,
+                    line: i + 1,
+                    fixable: false,
+                });
+            }
+            // Empty test body: test('...', () => {}) or it('...', () => {})
+            if (/(?:test|it)\s*\(\s*['"`][^'"]+['"`]\s*,\s*(?:async\s*)?\(\s*\)\s*=>\s*\{\s*\}\s*\)/.test(line)) {
+                issues.push({
+                    severity: 'error',
+                    message: 'stubbed test: empty test body',
+                    file,
+                    line: i + 1,
+                    fixable: false,
+                    fixHint: 'add assertions or mark as test.todo()',
+                });
+            }
+            // it.skip without .todo — skipped test (always check regardless of other matches on this line)
+            if (/(?:it|test)\.skip\s*\(/.test(line) && !/\.todo\s*\(/.test(line)) {
+                issues.push({
+                    severity: 'warning',
+                    message: 'skipped test: use test.todo() instead of .skip for unimplemented tests',
+                    file,
+                    line: i + 1,
+                    fixable: true,
+                    fixHint: 'change .skip to .todo if not yet implemented',
+                });
+            }
+        }
+    }
+    return issues;
+}
+// ── Unhandled async (removed error handling) ─────────────────────────────────
+function checkUnhandledAsync(cwd, files) {
+    const issues = [];
+    const sourceExts = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
+    for (const file of files) {
+        if (!sourceExts.has(extname(file)))
+            continue;
+        // Skip test files — test runners handle errors at the framework level
+        if (isTestFile(file))
+            continue;
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        const lines = content.split('\n');
+        let unhandledCount = 0;
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // await without try/catch context — detect standalone awaits
+            // We look for: const/let/var x = await or just await on its own, not inside try
+            const hasAwait = /^\s*(?:const|let|var)\s+\w.*=\s*await\s+/.test(line) || /^\s*await\s+/.test(line);
+            if (!hasAwait)
+                continue;
+            // Check context window — look for try { in surrounding lines
+            const contextStart = Math.max(0, i - 15);
+            const contextEnd = Math.min(lines.length - 1, i + 5);
+            const contextLines = lines.slice(contextStart, contextEnd + 1);
+            const contextText = contextLines.join('\n');
+            // Count try/catch blocks in context
+            const tryCount = (contextText.match(/\btry\s*\{/g) || []).length;
+            const catchCount = (contextText.match(/\bcatch\s*(?:\([^)]*\))?\s*\{/g) || []).length;
+            if (tryCount === 0 || catchCount === 0) {
+                // Also check for .catch() chained
+                const hasCatch = /\.catch\s*\(/.test(line) || (i + 1 < lines.length && /\.catch\s*\(/.test(lines[i + 1]));
+                if (!hasCatch) {
+                    unhandledCount++;
+                    if (unhandledCount <= 10) {
+                        issues.push({
+                            severity: 'warning',
+                            message: 'unhandled async: await without try/catch',
+                            file,
+                            line: i + 1,
+                            fixable: false,
+                            fixHint: 'wrap in try/catch or chain .catch()',
+                        });
+                    }
+                }
+            }
+        }
+    }
+    return issues;
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkIntegrity(cwd, ignore) {
+    const files = walkFiles(cwd, ignore);
+    const hallucinatedIssues = checkHallucinatedImports(cwd, files);
+    const emptyCatchIssues = checkEmptyCatch(cwd, files);
+    const stubbedTestIssues = checkStubbedTests(cwd, files);
+    const unhandledAsyncIssues = checkUnhandledAsync(cwd, files);
+    const allIssues = [
+        ...hallucinatedIssues,
+        ...emptyCatchIssues,
+        ...stubbedTestIssues,
+        ...unhandledAsyncIssues,
+    ];
+    // Scoring: start at 100, penalize per issue type
+    let score = 100;
+    score -= hallucinatedIssues.length * 10;
+    score -= emptyCatchIssues.filter(i => i.severity === 'error').length * 8;
+    score -= stubbedTestIssues.filter(i => i.severity === 'error').length * 5;
+    // Unhandled async capped at -30
+    const unhandledErrors = unhandledAsyncIssues.length;
+    score -= Math.min(30, unhandledErrors * 3);
+    score = Math.max(0, Math.round(score));
+    // Summary parts
+    const parts = [];
+    if (hallucinatedIssues.length > 0)
+        parts.push(`${hallucinatedIssues.length} hallucinated import${hallucinatedIssues.length !== 1 ? 's' : ''}`);
+    if (emptyCatchIssues.length > 0)
+        parts.push(`${emptyCatchIssues.length} empty catch${emptyCatchIssues.length !== 1 ? 'es' : ''}`);
+    if (stubbedTestIssues.length > 0)
+        parts.push(`${stubbedTestIssues.length} stubbed test${stubbedTestIssues.length !== 1 ? 's' : ''}`);
+    if (unhandledAsyncIssues.length > 0)
+        parts.push(`${unhandledAsyncIssues.length} unhandled async`);
+    return {
+        name: 'integrity',
+        score,
+        maxScore: 100,
+        issues: allIssues,
+        summary: parts.length === 0 ? 'no integrity issues found' : parts.join(', '),
+    };
+}