@safetnsr/vet 1.0.0 → 1.2.0

package/dist/checks/scan.js

@@ -1,5 +1,6 @@
 import { join, relative } from 'node:path';
-import { readFileSync, readdirSync, statSync, existsSync } from 'node:fs';
+import { readFileSync, statSync, existsSync } from 'node:fs';
+import { isTextFile as utilIsTextFile, collectDirFiles as utilCollectDirFiles } from '../util.js';
 const CRITICAL_PATTERNS = [
     {
         id: 'base64-url',
@@ -89,38 +90,9 @@ const CONFIG_TARGETS = [
     '.mcp',
     '.roomodes', '.roo',
 ];
-// ── File helpers ─────────────────────────────────────────────────────────────
-function isTextFile(filePath) {
-    try {
-        const buf = readFileSync(filePath);
-        const sampleSize = Math.min(512, buf.length);
-        for (let i = 0; i < sampleSize; i++) {
-            if (buf[i] === 0)
-                return false;
-        }
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-function collectDirFiles(dir) {
-    const files = [];
-    try {
-        const entries = readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            const full = join(dir, entry.name);
-            if (entry.isFile()) {
-                files.push(full);
-            }
-            else if (entry.isDirectory()) {
-                files.push(...collectDirFiles(full));
-            }
-        }
-    }
-    catch { /* skip */ }
-    return files;
-}
+// ── File helpers (delegated to util.ts) ──────────────────────────────────────
+const isTextFile = utilIsTextFile;
+const collectDirFiles = utilCollectDirFiles;
 function collectConfigFiles(cwd) {
     const files = [];
     for (const target of CONFIG_TARGETS) {

package/dist/checks/verify.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkVerify(cwd: string, since?: string): CheckResult;

package/dist/checks/verify.js

@@ -0,0 +1,219 @@
+import { join, basename } from 'node:path';
+import { readFileSync, existsSync, statSync } from 'node:fs';
+import { execSync } from 'node:child_process';
+// ── Helpers ──────────────────────────────────────────────────────────────────
+function safeExec(cmd, cwd) {
+    try {
+        return execSync(cmd, { cwd, encoding: 'utf-8', timeout: 10_000, stdio: ['pipe', 'pipe', 'pipe'] });
+    }
+    catch {
+        return '';
+    }
+}
+function isTestFile(filePath) {
+    const base = basename(filePath);
+    if (/\.(test|spec)\.[a-z]+$/i.test(base))
+        return true;
+    const normalized = filePath.replace(/\\/g, '/');
+    // Match __tests__/ anywhere in path (including at root)
+    if (normalized.includes('__tests__/') || normalized.includes('/__tests__'))
+        return true;
+    if (normalized.includes('/test/') || normalized.startsWith('test/'))
+        return true;
+    if (normalized.includes('/tests/') || normalized.startsWith('tests/'))
+        return true;
+    return false;
+}
+function hasAssertions(content) {
+    return /\b(assert|expect\s*\(|it\s*\(|test\s*\(|describe\s*\(|should\.|toBe\(|toEqual\(|assertEqual|assertStrictEqual)\b/i.test(content);
+}
+function countLines(content) {
+    return content.split('\n').filter(l => l.trim().length > 0).length;
+}
+/** Extract file names mentioned in commit messages as claims */
+function extractClaimsFromMessages(messages) {
+    const claims = [];
+    // All patterns require a file extension (dot in name) to avoid false positives
+    const patterns = [
+        /\b(?:creat\w*|add\w*|implement\w*|wrot\w*|built|generat\w*|scaffold\w*)\s+([\w./\\-]+\.[a-z]{1,5})/gi,
+        /\b(?:fix\w*|resolv\w*|updat\w*|modify|modified)\s+([\w./\\-]+\.[a-z]{1,5})/gi,
+        /\badd\w*\s+tests?\s+(?:for\s+)?([\w./\\-]+\.[a-z]{1,5})/gi,
+    ];
+    for (const msg of messages) {
+        for (const pattern of patterns) {
+            pattern.lastIndex = 0;
+            let m;
+            while ((m = pattern.exec(msg)) !== null) {
+                const candidate = m[1].replace(/[,.:;)]+$/, '');
+                if (candidate && candidate.length > 2 && !candidate.startsWith('-')) {
+                    claims.push(candidate);
+                }
+            }
+        }
+    }
+    return [...new Set(claims)];
+}
+/** Get files changed in recent agent session (git diff against since or HEAD~1) */
+function getChangedFiles(cwd, since) {
+    let raw = '';
+    if (since) {
+        raw = safeExec(`git diff ${since} --name-only`, cwd);
+    }
+    else {
+        // Try HEAD~1 first
+        raw = safeExec(`git diff HEAD~1 --name-only`, cwd);
+        if (!raw.trim()) {
+            // Fall back to last commit's added/modified files
+            raw = safeExec(`git show --name-only --format="" HEAD`, cwd);
+        }
+    }
+    return raw
+        .split('\n')
+        .map(l => l.trim())
+        .filter(l => l.length > 0 && !l.startsWith('diff') && !l.startsWith('index'));
+}
+/** Get recent git log messages */
+function getRecentMessages(cwd, since) {
+    let raw = '';
+    if (since) {
+        raw = safeExec(`git log ${since}..HEAD --oneline`, cwd);
+    }
+    else {
+        raw = safeExec(`git log -10 --oneline`, cwd);
+    }
+    return raw.split('\n').map(l => l.replace(/^[a-f0-9]+\s+/, '').trim()).filter(l => l.length > 0);
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export function checkVerify(cwd, since) {
+    const issues = [];
+    let deductions = 0;
+    // Check if git repo
+    const isGit = safeExec('git rev-parse --is-inside-work-tree', cwd).trim();
+    if (isGit !== 'true') {
+        return {
+            name: 'verify',
+            score: 100,
+            maxScore: 100,
+            issues: [],
+            summary: 'not a git repository — skipped',
+        };
+    }
+    // Check if any commits exist
+    const hasCommits = safeExec('git rev-parse HEAD', cwd).trim();
+    if (!hasCommits) {
+        return {
+            name: 'verify',
+            score: 100,
+            maxScore: 100,
+            issues: [],
+            summary: 'no commits found — skipped',
+        };
+    }
+    // Get changed files from git diff
+    const changedFiles = getChangedFiles(cwd, since);
+    // Get commit messages for claim extraction
+    const messages = getRecentMessages(cwd, since);
+    // Extract explicit claims from commit messages
+    const explicitClaims = extractClaimsFromMessages(messages);
+    // Build unified file list to verify: changed files + explicitly claimed files
+    const toVerify = new Set();
+    for (const f of changedFiles)
+        toVerify.add(f);
+    for (const f of explicitClaims)
+        toVerify.add(f);
+    if (toVerify.size === 0) {
+        return {
+            name: 'verify',
+            score: 100,
+            maxScore: 100,
+            issues: [],
+            summary: 'no agent claims found in recent git history',
+        };
+    }
+    let verified = 0;
+    let failed = 0;
+    for (const relPath of toVerify) {
+        const absPath = join(cwd, relPath);
+        // 1. File must exist
+        if (!existsSync(absPath)) {
+            // Only flag files that were explicitly in claims from messages (not just diff-referenced)
+            // Changed files that don't exist could be deletions — only flag if explicitly claimed
+            if (explicitClaims.includes(relPath)) {
+                issues.push({
+                    severity: 'error',
+                    message: `Claimed file missing: ${relPath}`,
+                    file: relPath,
+                    fixable: false,
+                    fixHint: 'Agent claimed to create this file but it does not exist',
+                });
+                deductions += 15;
+                failed++;
+            }
+            continue;
+        }
+        let content = '';
+        try {
+            const stat = statSync(absPath);
+            if (!stat.isFile()) {
+                verified++;
+                continue;
+            }
+            content = readFileSync(absPath, 'utf-8');
+        }
+        catch {
+            continue;
+        }
+        const lineCount = countLines(content);
+        // 2. File must have meaningful content (>10 non-empty lines)
+        if (lineCount < 10 && lineCount > 0) {
+            issues.push({
+                severity: 'warning',
+                message: `Thin file: ${relPath} (${lineCount} non-empty lines)`,
+                file: relPath,
+                fixable: false,
+                fixHint: 'Agent claimed to create/modify this file but it has minimal content',
+            });
+            deductions += 8;
+            failed++;
+            continue;
+        }
+        if (lineCount === 0) {
+            issues.push({
+                severity: 'error',
+                message: `Empty file: ${relPath}`,
+                file: relPath,
+                fixable: false,
+                fixHint: 'Agent claimed to create this file but it is empty',
+            });
+            deductions += 15;
+            failed++;
+            continue;
+        }
+        // 3. Test files must have actual assertions
+        if (isTestFile(relPath)) {
+            if (!hasAssertions(content)) {
+                issues.push({
+                    severity: 'error',
+                    message: `Test file has no assertions: ${relPath}`,
+                    file: relPath,
+                    fixable: false,
+                    fixHint: 'Test file exists but contains no expect(), assert(), or test() calls',
+                });
+                deductions += 12;
+                failed++;
+                continue;
+            }
+        }
+        verified++;
+    }
+    const finalScore = Math.max(0, 100 - deductions);
+    return {
+        name: 'verify',
+        score: finalScore,
+        maxScore: 100,
+        issues,
+        summary: failed === 0
+            ? `${verified} agent claim${verified !== 1 ? 's' : ''} verified clean`
+            : `${failed} claim${failed !== 1 ? 's' : ''} failed verification (${verified} passed)`,
+    };
+}

package/dist/cli.js

@@ -14,6 +14,8 @@ import { checkDeps } from './checks/deps.js';
 import { checkDebt } from './checks/debt.js';
 import { checkIntegrity } from './checks/integrity.js';
 import { checkReceipt, runReceiptCommand } from './checks/receipt.js';
+import { checkMemory } from './checks/memory.js';
+import { checkVerify } from './checks/verify.js';
 import { checkMap, renderMapReport } from './checks/map.js';
 import { score } from './scorer.js';
 import { reportPretty, reportJSON, reportBadge } from './reporter.js';
@@ -163,9 +165,13 @@ async function runChecks() {
     const depsResult = await checkDeps(cwd);
     // Receipt is informational — fold into integrity category but keep low weight
     const receiptResult = await checkReceipt(cwd);
+    // Memory: stale facts in agent memory files
+    const memoryResult = checkMemory(cwd);
+    // Verify: agent claim validation
+    const verifyResult = checkVerify(cwd, since);
     return score(cwd, {
         security: [scanResult, secretsResult, configResult, modelsResult, owaspResult],
-        integrity: [diffResult, integrityResult, receiptResult],
+        integrity: [diffResult, integrityResult, receiptResult, memoryResult, verifyResult],
         debt: [readyResult, historyResult, debtResult],
         deps: [depsResult],
     });

package/dist/reporter.js

@@ -15,9 +15,6 @@ function gradeColor(grade) {
         default: return c.red;
     }
 }
-function categoryLabel(name) {
-    return name.padEnd(10);
-}
 export function reportPretty(result) {
     const lines = [];
     // Read version from result
@@ -29,7 +26,7 @@ export function reportPretty(result) {
     for (const cat of result.categories) {
         const scoreStr = `${cat.score}/100`;
         const pad = ' '.repeat(Math.max(0, 6 - scoreStr.length));
-        lines.push(`  ${categoryLabel(cat.name)}${scoreStr}${pad}  ${bar(cat.score)}`);
+        lines.push(`  ${cat.name.padEnd(10)}${scoreStr}${pad}  ${bar(cat.score)}`);
     }
     // Overall grade
     const gc = gradeColor(result.grade);
@@ -63,7 +60,14 @@ export function reportPretty(result) {
     return lines.join('\n');
 }
 export function reportJSON(result) {
-    return JSON.stringify(result, null, 2);
+    return JSON.stringify({
+        project: result.project,
+        version: result.version,
+        score: result.score,
+        grade: result.grade,
+        fixableIssues: result.fixableIssues,
+        categories: result.categories,
+    }, null, 2);
 }
 export function reportBadge(result) {
     const grade = result.grade;

package/dist/util.d.ts

@@ -9,10 +9,17 @@ export declare const c: {
     cyan: string;
     gray: string;
 };
-export declare function git(cmd: string, cwd: string): string;
+/** Run git with an array of args (safe, no shell injection). */
 export declare function gitExec(args: string[], cwd: string): string;
+/** Run git with a command string (splits on spaces). Use gitExec for dynamic args. */
+export declare function git(cmd: string, cwd: string): string;
 export declare function isGitRepo(cwd: string): boolean;
 export declare function readFile(path: string): string | null;
+/** Returns true if the path exists (file or directory). Convenience alias for existsSync. */
 export declare function fileExists(path: string): boolean;
 export declare function walkFiles(dir: string, ignore?: string[]): string[];
+/** Check if a file is binary by sampling first 512 bytes for null bytes */
+export declare function isTextFile(filePath: string): boolean;
+/** Recursively collect all file paths under a directory */
+export declare function collectDirFiles(dir: string): string[];
 export declare function matchesAny(file: string, patterns: string[]): boolean;

package/dist/util.js

@@ -1,4 +1,4 @@
-import { execSync, execFileSync } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
 // ANSI colors — zero deps
@@ -13,14 +13,7 @@ export const c = {
     cyan: '\x1b[36m',
     gray: '\x1b[90m',
 };
-export function git(cmd, cwd) {
-    try {
-        return execSync(`git ${cmd}`, { cwd, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
-    }
-    catch {
-        return '';
-    }
-}
+/** Run git with an array of args (safe, no shell injection). */
 export function gitExec(args, cwd) {
     try {
         return execFileSync('git', args, { cwd, encoding: 'utf-8', stdio: ['pipe', 'pipe', 'pipe'] }).trim();
@@ -29,6 +22,10 @@ export function gitExec(args, cwd) {
         return '';
     }
 }
+/** Run git with a command string (splits on spaces). Use gitExec for dynamic args. */
+export function git(cmd, cwd) {
+    return gitExec(cmd.split(/\s+/), cwd);
+}
 export function isGitRepo(cwd) {
     return git('rev-parse --is-inside-work-tree', cwd) === 'true';
 }
@@ -40,6 +37,7 @@ export function readFile(path) {
         return null;
     }
 }
+/** Returns true if the path exists (file or directory). Convenience alias for existsSync. */
 export function fileExists(path) {
     return existsSync(path);
 }
@@ -72,6 +70,39 @@ export function walkFiles(dir, ignore = []) {
     walk(dir);
     return results;
 }
+/** Check if a file is binary by sampling first 512 bytes for null bytes */
+export function isTextFile(filePath) {
+    try {
+        const buf = readFileSync(filePath);
+        const sampleSize = Math.min(512, buf.length);
+        for (let i = 0; i < sampleSize; i++) {
+            if (buf[i] === 0)
+                return false;
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Recursively collect all file paths under a directory */
+export function collectDirFiles(dir) {
+    const files = [];
+    try {
+        const entries = readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            const full = join(dir, entry.name);
+            if (entry.isFile()) {
+                files.push(full);
+            }
+            else if (entry.isDirectory()) {
+                files.push(...collectDirFiles(full));
+            }
+        }
+    }
+    catch { /* skip */ }
+    return files;
+}
 export function matchesAny(file, patterns) {
     return patterns.some(p => {
         if (p.endsWith('/'))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {