@safetnsr/vet 1.0.0 → 1.2.0

package/dist/checks/deps.js

@@ -57,18 +57,18 @@ export function levenshtein(a, b) {
 // ── Import extraction ────────────────────────────────────────────────────────
 export function extractImports(source) {
     const imports = new Set();
-    // import ... from 'pkg'
+    // static import: import X from <specifier>
     const importFrom = /import\s+(?:[\s\S]*?\s+from\s+)?['"]([^'"]+)['"]/g;
     let match;
     while ((match = importFrom.exec(source)) !== null) {
         imports.add(match[1]);
     }
-    // require('pkg')
+    // CommonJS require
     const requirePat = /require\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
     while ((match = requirePat.exec(source)) !== null) {
         imports.add(match[1]);
     }
-    // import('pkg')
+    // dynamic import()
     const dynamicImport = /import\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
     while ((match = dynamicImport.exec(source)) !== null) {
         imports.add(match[1]);
@@ -204,9 +204,11 @@ export async function checkDeps(cwd) {
     // ── 3 & 4. Dead deps + phantom imports ─────────────────────────────────────
     const sourceExts = new Set(['.ts', '.js', '.tsx', '.jsx', '.mts', '.mjs', '.cts', '.cjs']);
     const allFiles = walkFiles(cwd);
+    const isTestFile = (f) => /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || /^test[/\\]/.test(f);
     const sourceFiles = allFiles.filter(f => {
         const ext = f.substring(f.lastIndexOf('.'));
-        return sourceExts.has(ext);
+        // Skip test files — they contain import strings as test fixtures, not real imports
+        return sourceExts.has(ext) && !isTestFile(f);
     });
     const importedPackages = new Set();
     for (const file of sourceFiles) {

package/dist/checks/integrity.js

@@ -36,25 +36,68 @@ function resolveRelativeImport(importPath, fromFile, cwd) {
     }
     return false;
 }
+function isInsideStringLiteral(line, matchIndex) {
+    // Check if the match position is inside a string literal (template literal, quote)
+    // by counting unescaped quotes before the match
+    let inSingle = false;
+    let inDouble = false;
+    let inTemplate = false;
+    for (let i = 0; i < matchIndex && i < line.length; i++) {
+        const ch = line[i];
+        if (ch === '\\') {
+            i++;
+            continue;
+        }
+        if (ch === "'" && !inDouble && !inTemplate)
+            inSingle = !inSingle;
+        else if (ch === '"' && !inSingle && !inTemplate)
+            inDouble = !inDouble;
+        else if (ch === '`' && !inSingle && !inDouble)
+            inTemplate = !inTemplate;
+    }
+    // If we're inside a string context AND the line itself is not an import/require statement,
+    // then this is likely a string literal containing import-like text
+    return inSingle || inDouble || inTemplate;
+}
+function isCommentLine(line) {
+    const trimmed = line.trim();
+    return trimmed.startsWith('//') || trimmed.startsWith('*') || trimmed.startsWith('/*');
+}
 function extractRelativeImports(source) {
     const imports = [];
     const lines = source.split('\n');
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
-        // import ... from './foo' or '../bar'
-        const fromMatch = line.match(/from\s+['"](\.[^'"]+)['"]/);
-        if (fromMatch) {
-            imports.push({ path: fromMatch[1], line: i + 1 });
+        // Skip comment lines
+        if (isCommentLine(line))
+            continue;
+        const trimmed = line.trim();
+        // import ... from './foo' or '../bar' — must be an actual import statement
+        if (/^\s*(?:import|export)\s/.test(line)) {
+            const fromMatch = line.match(/from\s+['"](\.[^'"]+)['"]/);
+            if (fromMatch) {
+                imports.push({ path: fromMatch[1], line: i + 1 });
+            }
         }
-        // require('./foo')
+        // require('./foo') — must be at statement level, not inside a string
         const reqMatch = line.match(/require\s*\(\s*['"](\.[^'"]+)['"]\s*\)/);
-        if (reqMatch) {
-            imports.push({ path: reqMatch[1], line: i + 1 });
+        if (reqMatch && !isInsideStringLiteral(line, line.indexOf(reqMatch[0]))) {
+            // Skip if the require is inside a string literal (test fixtures)
+            const beforeReq = line.substring(0, line.indexOf(reqMatch[0]));
+            if (!/['"`]/.test(beforeReq.slice(-1))) {
+                imports.push({ path: reqMatch[1], line: i + 1 });
+            }
         }
-        // import('./foo')
-        const dynMatch = line.match(/import\s*\(\s*['"](\.[^'"]+)['"]\s*\)/);
-        if (dynMatch) {
-            imports.push({ path: dynMatch[1], line: i + 1 });
+        // Dynamic import('./foo') — actual import() call, not in string
+        if (/^\s*(?:const|let|var|await|return)?\s*/.test(line)) {
+            const dynMatch = line.match(/import\s*\(\s*['"](\.[^'"]+)['"]\s*\)/);
+            if (dynMatch && !isCommentLine(line)) {
+                // Make sure it's not inside a string literal (e.g. a test describing imports)
+                const matchIdx = line.indexOf(dynMatch[0]);
+                if (!isInsideStringLiteral(line, matchIdx)) {
+                    imports.push({ path: dynMatch[1], line: i + 1 });
+                }
+            }
         }
     }
     return imports;
@@ -89,19 +132,25 @@ function checkHallucinatedImports(cwd, files) {
     return issues;
 }
 // ── Empty catch blocks ───────────────────────────────────────────────────────
+function isTestFile(file) {
+    return /\.(test|spec)\.[jt]sx?$/.test(file) || file.includes('__tests__') || /^test[/\\]/.test(file);
+}
 function checkEmptyCatch(cwd, files) {
     const issues = [];
     const sourceExts = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
     for (const file of files) {
         if (!sourceExts.has(extname(file)))
             continue;
+        // Skip test files — empty catches in tests are usually intentional (testing error paths)
+        if (isTestFile(file))
+            continue;
         const content = readFile(join(cwd, file));
         if (!content)
             continue;
         const lines = content.split('\n');
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
-            // catch(e) {} or catch(err) {} — empty catch
+            // single-line catch with param and empty body — error silently swallowed
             if (/catch\s*\([^)]*\)\s*\{\s*\}/.test(line)) {
                 issues.push({
                     severity: 'error',
@@ -113,7 +162,7 @@ function checkEmptyCatch(cwd, files) {
                 });
                 continue;
             }
-            // catch {} (no param)
+            // single-line catch without param and empty body
             if (/catch\s*\{\s*\}/.test(line)) {
                 issues.push({
                     severity: 'error',
@@ -234,6 +283,9 @@ function checkUnhandledAsync(cwd, files) {
     for (const file of files) {
         if (!sourceExts.has(extname(file)))
             continue;
+        // Skip test files — test runners handle errors at the framework level
+        if (isTestFile(file))
+            continue;
         const content = readFile(join(cwd, file));
         if (!content)
             continue;

package/dist/checks/memory.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkMemory(cwd: string): CheckResult;

package/dist/checks/memory.js

@@ -0,0 +1,275 @@
+import { join, resolve } from 'node:path';
+import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+// ── Memory file targets ──────────────────────────────────────────────────────
+const ROOT_FILES = ['CLAUDE.md', 'AGENTS.md', 'SOUL.md', '.cursorrules', 'codex.md'];
+const MEMORY_DIR = 'memory';
+const DAILY_DIR = join(MEMORY_DIR, 'daily');
+const MAX_DAILY_FILES = 30;
+// ── Tool categories for contradiction detection ─────────────────────────────
+const TOOL_CATEGORIES = {
+    'test framework': [/\bvitest\b/i, /\bjest\b/i, /\bmocha\b/i, /\bnode:test\b/i, /\bava\b/i],
+    'package manager': [/\bnpm\b/, /\byarn\b/, /\bpnpm\b/, /\bbun\b/],
+};
+// ── Helpers ──────────────────────────────────────────────────────────────────
+function safeRead(path) {
+    try {
+        return readFileSync(path, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+function collectMemoryFiles(cwd) {
+    const files = [];
+    // Root-level memory files
+    for (const name of ROOT_FILES) {
+        const full = join(cwd, name);
+        if (existsSync(full))
+            files.push(full);
+    }
+    // memory/*.md
+    const memDir = join(cwd, MEMORY_DIR);
+    if (existsSync(memDir) && statSync(memDir).isDirectory()) {
+        try {
+            for (const entry of readdirSync(memDir)) {
+                if (!entry.endsWith('.md'))
+                    continue;
+                const full = join(memDir, entry);
+                try {
+                    if (statSync(full).isFile())
+                        files.push(full);
+                }
+                catch { /* skip */ }
+            }
+        }
+        catch { /* skip */ }
+    }
+    // memory/daily/*.md (capped)
+    const dailyDir = join(cwd, DAILY_DIR);
+    if (existsSync(dailyDir) && statSync(dailyDir).isDirectory()) {
+        try {
+            const entries = readdirSync(dailyDir).filter(e => e.endsWith('.md')).sort().reverse();
+            for (const entry of entries.slice(0, MAX_DAILY_FILES)) {
+                const full = join(dailyDir, entry);
+                try {
+                    if (statSync(full).isFile())
+                        files.push(full);
+                }
+                catch { /* skip */ }
+            }
+        }
+        catch { /* skip */ }
+    }
+    return files;
+}
+/** Extract @scope/package references */
+function extractScopedPackages(content) {
+    const results = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const matches = lines[i].matchAll(/@[a-zA-Z0-9_-]+\/[a-zA-Z0-9._-]+/g);
+        for (const m of matches) {
+            results.push({ pkg: m[0], line: i + 1 });
+        }
+    }
+    return results;
+}
+/** Extract file/dir path references */
+function extractPaths(content) {
+    const results = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        // Skip lines that are purely URLs
+        // Match absolute paths
+        const absMatches = line.matchAll(/(?:^|\s|["`'(])(\/((?:var|home|usr|etc|opt|tmp|root|srv|mnt)[^\s"'`),;]*))(?=[\s"'`),;]|$)/g);
+        for (const m of absMatches) {
+            const p = m[1].replace(/[.,:;)]+$/, '');
+            if (p.startsWith('//') || p.includes('://'))
+                continue;
+            if (p.length < 4)
+                continue;
+            results.push({ path: p, line: i + 1 });
+        }
+        // Match relative paths starting with ./ or ../
+        const relMatches = line.matchAll(/(?:^|\s|["`'(])(\.\.?\/[^\s"'`),;]+)/g);
+        for (const m of relMatches) {
+            const p = m[1].replace(/[.,:;)]+$/, '');
+            if (p.includes('://'))
+                continue;
+            results.push({ path: p, line: i + 1 });
+        }
+    }
+    return results;
+}
+/** Extract tool mentions per category */
+function extractToolMentions(content, fileName) {
+    const mentions = new Map();
+    const lines = content.split('\n');
+    for (const [category, patterns] of Object.entries(TOOL_CATEGORIES)) {
+        for (let i = 0; i < lines.length; i++) {
+            for (const regex of patterns) {
+                if (regex.test(lines[i])) {
+                    const toolMatch = lines[i].match(regex);
+                    if (toolMatch) {
+                        const existing = mentions.get(category) || [];
+                        existing.push({ tool: toolMatch[0].toLowerCase(), file: fileName, line: i + 1 });
+                        mentions.set(category, existing);
+                    }
+                }
+            }
+        }
+    }
+    return mentions;
+}
+/** Count meaningful fact claims in a file */
+function countFacts(content) {
+    let count = 0;
+    const lines = content.split('\n');
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith('---') || trimmed.startsWith('```'))
+            continue;
+        // A "fact" is a line with at least some substantive content
+        if (trimmed.length > 15 && /[a-zA-Z]/.test(trimmed)) {
+            // Contains a keyword-like pattern (assignment, instruction, reference)
+            if (/[:=→\->]|use |stack|requires?|install|run |npm |config|version|path|file|dir|tool/i.test(trimmed)) {
+                count++;
+            }
+        }
+    }
+    return count;
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export function checkMemory(cwd) {
+    const memoryFiles = collectMemoryFiles(cwd);
+    const issues = [];
+    let deductions = 0;
+    if (memoryFiles.length === 0) {
+        return {
+            name: 'memory',
+            score: 100,
+            maxScore: 100,
+            issues: [],
+            summary: 'no agent memory files found',
+        };
+    }
+    // Load package.json deps
+    const pkgPath = join(cwd, 'package.json');
+    const allDeps = new Set();
+    if (existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+            for (const key of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
+                if (pkg[key]) {
+                    for (const name of Object.keys(pkg[key])) {
+                        allDeps.add(name);
+                    }
+                }
+            }
+        }
+        catch { /* skip */ }
+    }
+    // Collect all tool mentions across files for contradiction detection
+    const globalToolMentions = new Map();
+    for (const filePath of memoryFiles) {
+        const content = safeRead(filePath);
+        if (!content)
+            continue;
+        const relPath = filePath.startsWith(cwd) ? filePath.slice(cwd.length + 1) : filePath;
+        // 1. Stale package references
+        if (allDeps.size > 0) {
+            const pkgRefs = extractScopedPackages(content);
+            for (const { pkg, line } of pkgRefs) {
+                if (!allDeps.has(pkg)) {
+                    issues.push({
+                        severity: 'warning',
+                        message: `Stale package: ${pkg} not in package.json`,
+                        file: relPath,
+                        line,
+                        fixable: false,
+                        fixHint: 'Remove or update this reference',
+                    });
+                    deductions += 10;
+                }
+            }
+        }
+        // 2. Broken path references
+        const pathRefs = extractPaths(content);
+        for (const { path: p, line } of pathRefs) {
+            const resolved = p.startsWith('/') ? p : resolve(cwd, p);
+            if (!existsSync(resolved)) {
+                issues.push({
+                    severity: 'error',
+                    message: `Broken path reference: ${p}`,
+                    file: relPath,
+                    line,
+                    fixable: false,
+                    fixHint: 'Remove or update this path reference',
+                });
+                deductions += 15;
+            }
+        }
+        // 3. Collect tool mentions for contradiction check
+        const toolMentions = extractToolMentions(content, relPath);
+        for (const [category, mentions] of toolMentions) {
+            const existing = globalToolMentions.get(category) || [];
+            existing.push(...mentions);
+            globalToolMentions.set(category, existing);
+        }
+        // 4. Bloat check
+        if (content.length > 5000) {
+            const factCount = countFacts(content);
+            if (factCount < 3) {
+                issues.push({
+                    severity: 'info',
+                    message: `Bloated memory file: ${content.length} chars but only ${factCount} fact claims`,
+                    file: relPath,
+                    line: 1,
+                    fixable: false,
+                    fixHint: 'Trim this file to only essential facts',
+                });
+                deductions += 5;
+            }
+        }
+    }
+    // 3. Contradiction detection
+    for (const [category, mentions] of globalToolMentions) {
+        const uniqueTools = new Map();
+        for (const m of mentions) {
+            if (!uniqueTools.has(m.tool)) {
+                uniqueTools.set(m.tool, { file: m.file, line: m.line });
+            }
+        }
+        if (uniqueTools.size > 1) {
+            const tools = [...uniqueTools.entries()];
+            for (let i = 0; i < tools.length; i++) {
+                for (let j = i + 1; j < tools.length; j++) {
+                    // Only flag if they're in different files
+                    if (tools[i][1].file !== tools[j][1].file) {
+                        issues.push({
+                            severity: 'warning',
+                            message: `Contradiction in ${category}: "${tools[i][0]}" in ${tools[i][1].file} vs "${tools[j][0]}" in ${tools[j][1].file}`,
+                            file: tools[i][1].file,
+                            line: tools[i][1].line,
+                            fixable: false,
+                            fixHint: `Standardize on one ${category} across memory files`,
+                        });
+                        deductions += 10;
+                    }
+                }
+            }
+        }
+    }
+    const finalScore = Math.max(0, 100 - deductions);
+    const issueCount = issues.length;
+    return {
+        name: 'memory',
+        score: finalScore,
+        maxScore: 100,
+        issues,
+        summary: issueCount === 0
+            ? `${memoryFiles.length} memory file${memoryFiles.length !== 1 ? 's' : ''} scanned, clean`
+            : `${issueCount} stale fact${issueCount !== 1 ? 's' : ''} found in agent memory files`,
+    };
+}

package/dist/checks/models.js

@@ -8,9 +8,14 @@ async function tryModelGraveyard(cwd) {
             return null;
         const report = await mod.scan(cwd);
         const issues = [];
+        // Files that define deprecated model registries should not be flagged
+        const SELF_FILES = ['models.ts', 'models.js', 'model-graveyard', 'model-registry', 'sunset', 'fix/models'];
         for (const match of report.matches) {
             if (!match.model)
                 continue;
+            // Skip self-referencing files (model definition/fix files)
+            if (match.file && SELF_FILES.some(s => match.file.toLowerCase().includes(s)))
+                continue;
             if (match.model.status === 'deprecated' || match.model.status === 'eol') {
                 issues.push({
                     severity: 'error',

package/dist/checks/owasp-checks.d.ts

@@ -0,0 +1,51 @@
+export declare function collectAgentConfigFiles(cwd: string): string[];
+export declare function collectMcpConfigFiles(cwd: string): string[];
+export declare function readTextFile(filePath: string): string | null;
+export interface OwaspFinding {
+    asiId: string;
+    severity: 'error' | 'warning' | 'info';
+    message: string;
+    file?: string;
+    line?: number;
+    fixHint?: string;
+}
+export declare function checkASI01(cwd: string, configFiles: string[]): {
+    findings: OwaspFinding[];
+    deduction: number;
+};
+export declare function checkASI02(cwd: string, mcpFiles: string[]): {
+    findings: OwaspFinding[];
+    deduction: number;
+};
+export declare function checkASI03(cwd: string, configFiles: string[]): {
+    findings: OwaspFinding[];
+    deduction: number;
+};
+export declare function checkASI04(cwd: string, mcpFiles: string[], agentConfigFiles: string[]): {
+    findings: OwaspFinding[];
+    deduction: number;
+};
+export declare function checkASI05(cwd: string, configFiles: string[]): {
+    findings: OwaspFinding[];
+    deduction: number;
+};
+export declare function checkASI06(cwd: string): {
+    findings: OwaspFinding[];
+    deduction: number;
+};
+export declare function checkASI07(cwd: string, configFiles: string[]): {
+    findings: OwaspFinding[];
+    deduction: number;
+};
+export declare function checkASI08(cwd: string, configFiles: string[]): {
+    findings: OwaspFinding[];
+    deduction: number;
+};
+export declare function checkASI09(cwd: string, configFiles: string[]): {
+    findings: OwaspFinding[];
+    deduction: number;
+};
+export declare function checkASI10(cwd: string, configFiles: string[]): {
+    findings: OwaspFinding[];
+    deduction: number;
+};