@safetnsr/vet 1.10.1 → 1.11.0

package/dist/checks/debt.js

@@ -38,27 +38,93 @@ function simpleHash(s) {
     }
     return h.toString(36);
 }
+/** Levenshtein distance (optimized single-row DP, with early exit) */
+function levenshtein(a, b, maxDist) {
+    if (a === b)
+        return 0;
+    if (a.length === 0)
+        return b.length;
+    if (b.length === 0)
+        return a.length;
+    // Ensure a is shorter for memory efficiency
+    if (a.length > b.length) {
+        const t = a;
+        a = b;
+        b = t;
+    }
+    const aLen = a.length;
+    const bLen = b.length;
+    // For very long strings, use sampled comparison instead of full DP
+    if (aLen > 500) {
+        return sampledDistance(a, b, maxDist);
+    }
+    const row = new Uint32Array(aLen + 1);
+    for (let i = 0; i <= aLen; i++)
+        row[i] = i;
+    for (let j = 1; j <= bLen; j++) {
+        let prev = row[0];
+        row[0] = j;
+        let rowMin = j;
+        for (let i = 1; i <= aLen; i++) {
+            const cur = row[i];
+            if (a[i - 1] === b[j - 1]) {
+                row[i] = prev;
+            }
+            else {
+                row[i] = 1 + Math.min(prev, row[i], row[i - 1]);
+            }
+            prev = cur;
+            if (row[i] < rowMin)
+                rowMin = row[i];
+        }
+        // Early exit if minimum in this row already exceeds threshold
+        if (rowMin > maxDist)
+            return rowMin;
+    }
+    return row[aLen];
+}
+/** Fast sampled distance for long strings — compare chunks instead of full DP */
+function sampledDistance(a, b, maxDist) {
+    const maxLen = Math.max(a.length, b.length);
+    // Sample 5 chunks of 80 chars each from evenly spaced positions
+    const chunkSize = 80;
+    const samples = 5;
+    let totalDiff = 0;
+    let totalSampled = 0;
+    for (let s = 0; s < samples; s++) {
+        const pos = Math.floor((s / samples) * (Math.min(a.length, b.length) - chunkSize));
+        if (pos < 0)
+            continue;
+        const ca = a.substring(pos, pos + chunkSize);
+        const cb = b.substring(pos, pos + chunkSize);
+        let diff = 0;
+        for (let i = 0; i < chunkSize; i++) {
+            if (ca[i] !== cb[i])
+                diff++;
+        }
+        totalDiff += diff;
+        totalSampled += chunkSize;
+    }
+    if (totalSampled === 0)
+        return maxLen;
+    // Extrapolate
+    const estDist = Math.round((totalDiff / totalSampled) * maxLen);
+    return estDist;
+}
 /** Similarity ratio between two strings (0-1) */
 function similarity(a, b) {
     if (a === b)
         return 1;
-    const longer = a.length >= b.length ? a : b;
-    const shorter = a.length >= b.length ? b : a;
-    if (longer.length === 0)
+    const maxLen = Math.max(a.length, b.length);
+    if (maxLen === 0)
         return 1;
-    // Count matching characters in sequence
-    let matches = 0;
-    const used = new Array(longer.length).fill(false);
-    for (let i = 0; i < shorter.length; i++) {
-        for (let j = 0; j < longer.length; j++) {
-            if (!used[j] && shorter[i] === longer[j]) {
-                matches++;
-                used[j] = true;
-                break;
-            }
-        }
-    }
-    return matches / longer.length;
+    // Quick reject: if length diff alone makes similarity impossible
+    const lenDiff = Math.abs(a.length - b.length);
+    if (1 - lenDiff / maxLen < 0.92)
+        return 0;
+    const maxDist = Math.floor(maxLen * 0.08); // 92% similarity = 8% max distance
+    const dist = levenshtein(a, b, maxDist);
+    return 1 - dist / maxLen;
 }
 /** Extract function bodies with brace matching */
 function extractBraceBody(source, startIdx) {
@@ -175,20 +241,26 @@ function findDuplicates(allFuncs) {
             fixHint: 'extract shared logic into a single function',
         });
     }
-    // Similarity check for non-exact matches (capped to avoid O(n²) explosion on large repos)
+    // Similarity check for non-exact matches — length-bucketed to avoid O(n²) explosion
+    // Only consider functions with substantial normalized bodies (>= 65 chars)
     const singles = allFuncs.filter(fn => {
         const g = groups.get(fn.hash);
-        return !g || g.length < 2;
+        return (!g || g.length < 2) && fn.normalized.length >= 65;
     });
-    // Cap at 500 functions for similarity — O(n²) with levenshtein is too expensive above that
-    const singlesCapped = singles.length > 500 ? singles.slice(0, 500) : singles;
-    for (let i = 0; i < singlesCapped.length; i++) {
-        for (let j = i + 1; j < singlesCapped.length; j++) {
-            const a = singles[i];
+    // Sort by normalized length so we can break early when lengths diverge
+    singles.sort((a, b) => a.normalized.length - b.normalized.length);
+    let comparisons = 0;
+    const MAX_COMPARISONS = 200_000; // safety cap
+    for (let i = 0; i < singles.length && comparisons < MAX_COMPARISONS; i++) {
+        const a = singles[i];
+        for (let j = i + 1; j < singles.length; j++) {
             const b = singles[j];
-            // Skip very short normalized bodies
-            if (a.normalized.length < 30 || b.normalized.length < 30)
-                continue;
+            // If b is >25% longer than a, skip rest (sorted, so all further are longer)
+            if (b.normalized.length > a.normalized.length * 1.25)
+                break;
+            comparisons++;
+            if (comparisons > MAX_COMPARISONS)
+                break;
             const sim = similarity(a.normalized, b.normalized);
             if (sim > 0.92) {
                 const key = [a.file + ':' + a.name, b.file + ':' + b.name].sort().join('|');
@@ -261,20 +333,33 @@ function findOrphanedExports(cwd, files) {
             }
         }
     }
-    // Scan all files for imports of each name
-    const allContent = [];
+    // Scan all files for import names — collect all imported identifiers into a Set
+    const importedNames = new Set();
+    const importRe = /import\s+(?:type\s+)?(?:\{([^}]+)\}|([a-zA-Z_$][a-zA-Z0-9_$]*)(?:\s*,\s*\{([^}]+)\})?)\s+from\s+/g;
     for (const file of sourceFiles) {
         const content = readFile(join(cwd, file));
-        if (content)
-            allContent.push(content);
+        if (!content)
+            continue;
+        let match;
+        importRe.lastIndex = 0;
+        while ((match = importRe.exec(content)) !== null) {
+            // Named imports: { a, b as c }
+            const namedParts = [match[1], match[3]].filter(Boolean);
+            for (const part of namedParts) {
+                for (const name of part.split(',')) {
+                    const trimmed = name.trim().split(/\s+as\s+/)[0].trim();
+                    if (trimmed)
+                        importedNames.add(trimmed);
+                }
+            }
+            // Default import
+            if (match[2])
+                importedNames.add(match[2]);
+        }
     }
-    const allText = allContent.join('\n');
     const lib = isLibrary(cwd);
     for (const exp of exports) {
-        // Check if name appears in import statements across all files
-        // import { name } from or import { x, name } from or import { name as y }
-        const importPattern = new RegExp(`import\\s+[^;]*\\b${exp.name}\\b[^;]*from\\s+`, 'm');
-        if (!importPattern.test(allText)) {
+        if (!importedNames.has(exp.name)) {
             issues.push({
                 severity: lib ? 'info' : 'warning',
                 message: `orphaned export: "${exp.name}" is exported but never imported${lib ? ' (library detected — exports may be consumed externally)' : ''}`,

package/dist/checks/deps.js

@@ -1,6 +1,7 @@
 import { join } from 'node:path';
-import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { walkFiles, readFile } from '../util.js';
+import { cachedRead } from '../file-cache.js';
 // ── Top packages list (~150 popular npm packages) ────────────────────────────
 const TOP_PACKAGES = [
     'react', 'react-dom', 'next', 'vue', 'angular', 'express', 'koa', 'fastify', 'hono',
@@ -367,7 +368,7 @@ export async function checkDeps(cwd) {
         const importedPackages = new Set();
         for (const file of sourceFiles) {
             try {
-                const content = readFileSync(join(cwd, file), 'utf-8');
+                const content = cachedRead(join(cwd, file));
                 const rawImports = extractImports(content);
                 for (const imp of rawImports) {
                     if (isBuiltin(imp))

package/dist/checks/memory.js

@@ -1,6 +1,7 @@
 import { join, resolve } from 'node:path';
-import { existsSync, readdirSync, statSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { readFile } from '../util.js';
+import { cachedRead } from '../file-cache.js';
 import { detectWorkspacePackages } from './deps.js';
 // ── Memory file targets ──────────────────────────────────────────────────────
 const ROOT_FILES = ['CLAUDE.md', 'AGENTS.md', 'SOUL.md', '.cursorrules', 'codex.md'];
@@ -153,7 +154,7 @@ export function checkMemory(cwd) {
     const allDeps = new Set();
     if (existsSync(pkgPath)) {
         try {
-            const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+            const pkg = JSON.parse(cachedRead(pkgPath));
             // Include the package's own name
             if (pkg.name)
                 allDeps.add(pkg.name);

package/dist/checks/owasp/asi06-memory-poisoning.js

@@ -1,6 +1,7 @@
 import { join } from 'node:path';
-import { readFileSync, existsSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { readTextFile } from './shared.js';
+import { cachedRead } from '../../file-cache.js';
 // ── ASI06 — Memory and Context Poisoning ─────────────────────────────────────
 export function checkASI06(cwd) {
     const findings = [];
@@ -17,7 +18,7 @@ export function checkASI06(cwd) {
     const gitignorePath = join(cwd, '.gitignore');
     let gitignoreContent = '';
     try {
-        gitignoreContent = readFileSync(gitignorePath, 'utf-8');
+        gitignoreContent = cachedRead(gitignorePath);
     }
     catch { /* intentional: .gitignore may not exist */ }
     for (const memPath of memoryPaths) {

package/dist/checks/owasp/shared.js

@@ -1,6 +1,7 @@
 import { join } from 'node:path';
-import { readFileSync, statSync, existsSync } from 'node:fs';
+import { statSync, existsSync } from 'node:fs';
 import { isTextFile, collectDirFiles } from '../../util.js';
+import { cachedRead } from '../../file-cache.js';
 // ── Agent config file targets ─────────────────────────────────────────────────
 const AGENT_CONFIG_TARGETS = [
     '.claude',
@@ -54,7 +55,7 @@ export function readTextFile(filePath) {
     if (!isTextFile(filePath))
         return null;
     try {
-        return readFileSync(filePath, 'utf-8');
+        return cachedRead(filePath);
     }
     catch { /* intentional: resolver may fail on unreadable files */ }
     return null;

package/dist/checks/scan.js

@@ -1,6 +1,7 @@
 import { join, relative } from 'node:path';
-import { readFileSync, statSync, existsSync } from 'node:fs';
+import { statSync, existsSync } from 'node:fs';
 import { isTextFile as utilIsTextFile, collectDirFiles as utilCollectDirFiles } from '../util.js';
+import { cachedRead } from '../file-cache.js';
 const CRITICAL_PATTERNS = [
     {
         id: 'base64-url',
@@ -215,7 +216,7 @@ export function checkScan(cwd) {
         if (!isTextFile(filePath))
             continue;
         try {
-            const content = readFileSync(filePath, 'utf-8');
+            const content = cachedRead(filePath);
             const relPath = relative(cwd, filePath);
             filesScanned++;
             findings.push(...scanContent(content, relPath));

package/dist/checks/secrets.js

@@ -1,9 +1,10 @@
-import { existsSync, readdirSync, readFileSync, statSync, createReadStream } from 'node:fs';
+import { existsSync, readdirSync, statSync, createReadStream } from 'node:fs';
 import { join, relative, extname, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { execSync } from 'node:child_process';
 import { createInterface } from 'node:readline';
 import { collectDirFiles } from '../util.js';
+import { cachedRead } from '../file-cache.js';
 // ── Shannon entropy ──────────────────────────────────────────────────────────
 function calculateEntropy(str) {
     if (str.length === 0)
@@ -176,7 +177,7 @@ function findEnvFiles(dir, maxDepth = 3, depth = 0) {
 function scanEnvFile(filePath) {
     const findings = [];
     try {
-        const lines = readFileSync(filePath, 'utf-8').split('\n');
+        const lines = cachedRead(filePath).split('\n');
         const gitTracked = isGitTracked(filePath);
         for (const line of lines) {
             if (line.trimStart().startsWith('#'))

package/dist/checks/tests.js

@@ -1,6 +1,6 @@
 import { join } from 'node:path';
-import { readFileSync } from 'node:fs';
 import { walkFiles } from '../util.js';
+import { cachedRead } from '../file-cache.js';
 const TEST_FILE_RE = /\.(test|spec)\.(ts|js|tsx|jsx)$/;
 const TEST_DIR_RE = /(?:^|[/\\])(__tests__|tests?)[/\\]/;
 function isTestFile(relPath) {
@@ -205,7 +205,7 @@ export function checkTests(cwd, ignore) {
     for (const rel of testFiles) {
         let content;
         try {
-            content = readFileSync(join(cwd, rel), 'utf-8');
+            content = cachedRead(join(cwd, rel));
         }
         catch {
             continue;

package/dist/checks/verify.js

@@ -1,6 +1,7 @@
 import { join, basename, extname } from 'node:path';
-import { readFileSync, existsSync, statSync } from 'node:fs';
+import { existsSync, statSync } from 'node:fs';
 import { execSync } from 'node:child_process';
+import { cachedRead } from '../file-cache.js';
 // ── Helpers ──────────────────────────────────────────────────────────────────
 function safeExec(cmd, cwd) {
     try {
@@ -288,7 +289,7 @@ export function checkVerify(cwd, since) {
                 verified++;
                 continue;
             }
-            content = readFileSync(absPath, 'utf-8');
+            content = cachedRead(absPath);
         }
         catch {
             continue;

package/dist/cli.js

@@ -22,6 +22,7 @@ import { checkPermissions } from './checks/permissions.js';
 import { checkCompact, runCompactCommand } from './checks/compact.js';
 import { score } from './scorer.js';
 import { reportPretty, reportJSON, reportBadge } from './reporter.js';
+import { clearCache } from './file-cache.js';
 const args = process.argv.slice(2);
 const flags = new Set(args.filter(a => a.startsWith('-') && !a.startsWith('--since')));
 const flagMap = new Map();
@@ -79,7 +80,7 @@ if (flags.has('--help') || flags.has('-h')) {
     --watch       re-run on file changes
     --json        JSON output
     --pretty      force pretty output (even in pipes)
-    --max-files N limit file scanning (default: 2000)
+    --max-files N limit file scanning (default: unlimited)
     -h, --help    show this help
     -v, --version show version
 `);
@@ -105,7 +106,7 @@ const isWatch = flags.has('--watch');
 const isBadge = flags.has('--badge');
 const isJSON = flags.has('--json') || (!process.stdout.isTTY && !flags.has('--pretty') && !isBadge);
 const since = flagMap.get('since');
-const maxFiles = parseInt(flagMap.get('max-files') || '2000', 10) || 2000;
+const maxFiles = flagMap.has('max-files') ? (parseInt(flagMap.get('max-files'), 10) || 0) : 0;
 // Load config
 let config = {};
 const configContent = readFile(resolve(cwd, '.vetrc'));
@@ -232,53 +233,39 @@ async function runChecks() {
     const GLOBAL_TIMEOUT = 120_000;
     try {
         // Check file count and warn if large
-        const { walkFiles: wf } = await import('./util.js');
-        const allProjectFiles = wf(cwd, [], maxFiles);
-        if (allProjectFiles.length >= maxFiles) {
-            if (!isJSON)
-                console.log(`  ${c.yellow}Large project (${allProjectFiles.length}+ files) — scanning first ${maxFiles} files. Use --max-files to increase.${c.reset}\n`);
+        if (maxFiles > 0) {
+            const { walkFiles: wf } = await import('./util.js');
+            const allProjectFiles = wf(cwd, [], maxFiles);
+            if (allProjectFiles.length >= maxFiles) {
+                if (!isJSON)
+                    console.log(`  ${c.yellow}Large project (${allProjectFiles.length}+ files) — scanning first ${maxFiles} files. Use --max-files to increase.${c.reset}\n`);
+            }
         }
-        // Run all checks, grouped into categories
-        // Security: scan, secrets, config, models, owasp, permissions
-        const [scanResult, secretsResult, configResult, modelsResult, owaspResult] = await Promise.all([
+        // Run ALL independent checks in parallel
+        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, memoryResult, verifyResult, testsResult,] = await Promise.all([
             withTimeout('scan', () => checkScan(cwd)),
             withTimeout('secrets', () => checkSecrets(cwd)),
             withTimeout('config', () => checkConfig(cwd, ignore)),
             withTimeout('models', () => checkModels(cwd, ignore)),
             withTimeout('owasp', () => checkOwasp(cwd)),
-        ]);
-        const permissionsResult = await withTimeout('permissions', () => checkPermissions(cwd));
-        if (Date.now() - globalStart > GLOBAL_TIMEOUT) {
-            if (!isJSON)
-                console.error(`  ${c.yellow}⚠ global timeout (${GLOBAL_TIMEOUT / 1000}s) reached — returning partial results${c.reset}`);
-            return score(cwd, { security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult], integrity: [], debt: [], deps: [] });
-        }
-        // Integrity: diff, integrity checks
-        const diffResult = await withTimeout('diff', () => checkDiff(cwd, { since }));
-        const integrityResult = await withTimeout('integrity', () => checkIntegrity(cwd, ignore));
-        // Debt: ready, history, debt
-        const [readyResult, debtResult] = await Promise.all([
+            withTimeout('permissions', () => checkPermissions(cwd)),
+            withTimeout('integrity', () => checkIntegrity(cwd, ignore)),
             withTimeout('ready', () => checkReady(cwd, ignore)),
             withTimeout('debt', () => checkDebt(cwd, ignore)),
+            withTimeout('deps', () => checkDeps(cwd)),
+            withTimeout('receipt', () => checkReceipt(cwd)),
+            withTimeout('compact', () => checkCompact(cwd)),
+            withTimeout('memory', () => checkMemory(cwd)),
+            withTimeout('verify', () => checkVerify(cwd, since)),
+            withTimeout('tests', () => checkTests(cwd, ignore)),
         ]);
-        const historyResult = await withTimeout('history', () => checkHistory(cwd));
-        if (Date.now() - globalStart > GLOBAL_TIMEOUT) {
-            if (!isJSON)
-                console.error(`  ${c.yellow}⚠ global timeout (${GLOBAL_TIMEOUT / 1000}s) reached — returning partial results${c.reset}`);
-            return score(cwd, { security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult], integrity: [diffResult, integrityResult], debt: [readyResult, historyResult, debtResult], deps: [] });
-        }
-        // Deps: deps
-        const depsResult = await withTimeout('deps', () => checkDeps(cwd));
-        // Receipt is informational — fold into integrity category but keep low weight
-        const receiptResult = await withTimeout('receipt', () => checkReceipt(cwd));
-        // Compact: compaction forensics
-        const compactResult = await withTimeout('compact', () => checkCompact(cwd));
-        // Memory: stale facts in agent memory files
-        const memoryResult = await withTimeout('memory', () => checkMemory(cwd));
-        // Verify: agent claim validation
-        const verifyResult = await withTimeout('verify', () => checkVerify(cwd, since));
-        // Tests: test theater detection
-        const testsResult = await withTimeout('tests', () => checkTests(cwd, ignore));
+        // Git-dependent checks (diff + history) — parallel with each other
+        const [diffResult, historyResult] = await Promise.all([
+            withTimeout('diff', () => checkDiff(cwd, { since })),
+            withTimeout('history', () => checkHistory(cwd)),
+        ]);
+        // Clear file cache after all checks complete
+        clearCache();
         return score(cwd, {
             security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult],
             integrity: [diffResult, integrityResult, receiptResult, compactResult, memoryResult, verifyResult, testsResult],

package/dist/file-cache.d.ts

@@ -0,0 +1,4 @@
+export declare function cachedRead(path: string): string;
+/** Cached readFile that returns null on error (matches util.readFile signature) */
+export declare function cachedReadFile(path: string): string | null;
+export declare function clearCache(): void;

package/dist/file-cache.js

@@ -0,0 +1,22 @@
+import { readFileSync } from 'node:fs';
+// Singleton file cache — read once, share across all checks
+const cache = new Map();
+export function cachedRead(path) {
+    if (cache.has(path))
+        return cache.get(path);
+    const content = readFileSync(path, 'utf-8');
+    cache.set(path, content);
+    return content;
+}
+/** Cached readFile that returns null on error (matches util.readFile signature) */
+export function cachedReadFile(path) {
+    try {
+        return cachedRead(path);
+    }
+    catch {
+        return null;
+    }
+}
+export function clearCache() {
+    cache.clear();
+}

package/dist/util.js

@@ -1,6 +1,7 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
+import { cachedReadFile } from './file-cache.js';
 // ANSI colors — zero deps
 export const c = {
     reset: '\x1b[0m',
@@ -30,18 +31,13 @@ export function isGitRepo(cwd) {
     return git('rev-parse --is-inside-work-tree', cwd) === 'true';
 }
 export function readFile(path) {
-    try {
-        return readFileSync(path, 'utf-8');
-    }
-    catch {
-        return null;
-    }
+    return cachedReadFile(path);
 }
 /** Returns true if the path exists (file or directory). Convenience alias for existsSync. */
 export function fileExists(path) {
     return existsSync(path);
 }
-export function walkFiles(dir, ignore = [], maxFiles = 2000) {
+export function walkFiles(dir, ignore = [], maxFiles = 0) {
     const results = [];
     const defaultIgnore = ['node_modules', '.git', 'dist', 'build', '.next', 'coverage', 'vendor', '__pycache__', '.venv', 'venv'];
     const allIgnore = [...defaultIgnore, ...ignore];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.10.1",
+  "version": "1.11.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {