@safetnsr/vet 1.10.1 → 1.11.1

package/dist/checks/debt.js

@@ -1,4 +1,5 @@
-import { join, basename } from 'node:path';
+import { join, basename, dirname } from 'node:path';
+import { existsSync } from 'node:fs';
 import { walkFiles, readFile } from '../util.js';
 // ── Helpers ──────────────────────────────────────────────────────────────────
 const SOURCE_EXTS = new Set(['.ts', '.js', '.tsx', '.jsx']);
@@ -38,27 +39,93 @@ function simpleHash(s) {
     }
     return h.toString(36);
 }
+/** Levenshtein distance (optimized single-row DP, with early exit) */
+function levenshtein(a, b, maxDist) {
+    if (a === b)
+        return 0;
+    if (a.length === 0)
+        return b.length;
+    if (b.length === 0)
+        return a.length;
+    // Ensure a is shorter for memory efficiency
+    if (a.length > b.length) {
+        const t = a;
+        a = b;
+        b = t;
+    }
+    const aLen = a.length;
+    const bLen = b.length;
+    // For very long strings, use sampled comparison instead of full DP
+    if (aLen > 500) {
+        return sampledDistance(a, b, maxDist);
+    }
+    const row = new Uint32Array(aLen + 1);
+    for (let i = 0; i <= aLen; i++)
+        row[i] = i;
+    for (let j = 1; j <= bLen; j++) {
+        let prev = row[0];
+        row[0] = j;
+        let rowMin = j;
+        for (let i = 1; i <= aLen; i++) {
+            const cur = row[i];
+            if (a[i - 1] === b[j - 1]) {
+                row[i] = prev;
+            }
+            else {
+                row[i] = 1 + Math.min(prev, row[i], row[i - 1]);
+            }
+            prev = cur;
+            if (row[i] < rowMin)
+                rowMin = row[i];
+        }
+        // Early exit if minimum in this row already exceeds threshold
+        if (rowMin > maxDist)
+            return rowMin;
+    }
+    return row[aLen];
+}
+/** Fast sampled distance for long strings — compare chunks instead of full DP */
+function sampledDistance(a, b, maxDist) {
+    const maxLen = Math.max(a.length, b.length);
+    // Sample 5 chunks of 80 chars each from evenly spaced positions
+    const chunkSize = 80;
+    const samples = 5;
+    let totalDiff = 0;
+    let totalSampled = 0;
+    for (let s = 0; s < samples; s++) {
+        const pos = Math.floor((s / samples) * (Math.min(a.length, b.length) - chunkSize));
+        if (pos < 0)
+            continue;
+        const ca = a.substring(pos, pos + chunkSize);
+        const cb = b.substring(pos, pos + chunkSize);
+        let diff = 0;
+        for (let i = 0; i < chunkSize; i++) {
+            if (ca[i] !== cb[i])
+                diff++;
+        }
+        totalDiff += diff;
+        totalSampled += chunkSize;
+    }
+    if (totalSampled === 0)
+        return maxLen;
+    // Extrapolate
+    const estDist = Math.round((totalDiff / totalSampled) * maxLen);
+    return estDist;
+}
 /** Similarity ratio between two strings (0-1) */
 function similarity(a, b) {
     if (a === b)
         return 1;
-    const longer = a.length >= b.length ? a : b;
-    const shorter = a.length >= b.length ? b : a;
-    if (longer.length === 0)
+    const maxLen = Math.max(a.length, b.length);
+    if (maxLen === 0)
         return 1;
-    // Count matching characters in sequence
-    let matches = 0;
-    const used = new Array(longer.length).fill(false);
-    for (let i = 0; i < shorter.length; i++) {
-        for (let j = 0; j < longer.length; j++) {
-            if (!used[j] && shorter[i] === longer[j]) {
-                matches++;
-                used[j] = true;
-                break;
-            }
-        }
-    }
-    return matches / longer.length;
+    // Quick reject: if length diff alone makes similarity impossible
+    const lenDiff = Math.abs(a.length - b.length);
+    if (1 - lenDiff / maxLen < 0.92)
+        return 0;
+    const maxDist = Math.floor(maxLen * 0.08); // 92% similarity = 8% max distance
+    const dist = levenshtein(a, b, maxDist);
+    return 1 - dist / maxLen;
 }
 /** Extract function bodies with brace matching */
 function extractBraceBody(source, startIdx) {
@@ -166,8 +233,12 @@ function findDuplicates(allFuncs) {
         if (isSpecPattern(group))
             continue;
         const locations = group.map(f => `${f.name} (${f.file}:${f.line})`).join(', ');
+        // Downgrade to info if all functions in the group are in test directories
+        // or if any function is in an examples/demo directory
+        const allInTest = group.every(f => isInTestDir(f.file));
+        const anyInExample = group.some(f => /(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(f.file));
         issues.push({
-            severity: 'warning',
+            severity: (allInTest || anyInExample) ? 'info' : 'warning',
             message: `near-duplicate functions: ${locations}`,
             file: group[0].file,
             line: group[0].line,
@@ -175,28 +246,38 @@ function findDuplicates(allFuncs) {
             fixHint: 'extract shared logic into a single function',
         });
     }
-    // Similarity check for non-exact matches (capped to avoid O(n²) explosion on large repos)
+    // Similarity check for non-exact matches — length-bucketed to avoid O(n²) explosion
+    // Only consider functions with substantial normalized bodies (>= 65 chars)
     const singles = allFuncs.filter(fn => {
         const g = groups.get(fn.hash);
-        return !g || g.length < 2;
+        return (!g || g.length < 2) && fn.normalized.length >= 65;
     });
-    // Cap at 500 functions for similarity — O(n²) with levenshtein is too expensive above that
-    const singlesCapped = singles.length > 500 ? singles.slice(0, 500) : singles;
-    for (let i = 0; i < singlesCapped.length; i++) {
-        for (let j = i + 1; j < singlesCapped.length; j++) {
-            const a = singles[i];
+    // Sort by normalized length so we can break early when lengths diverge
+    singles.sort((a, b) => a.normalized.length - b.normalized.length);
+    let comparisons = 0;
+    const MAX_COMPARISONS = 200_000; // safety cap
+    for (let i = 0; i < singles.length && comparisons < MAX_COMPARISONS; i++) {
+        const a = singles[i];
+        for (let j = i + 1; j < singles.length; j++) {
             const b = singles[j];
-            // Skip very short normalized bodies
-            if (a.normalized.length < 30 || b.normalized.length < 30)
-                continue;
+            // If b is >25% longer than a, skip rest (sorted, so all further are longer)
+            if (b.normalized.length > a.normalized.length * 1.25)
+                break;
+            comparisons++;
+            if (comparisons > MAX_COMPARISONS)
+                break;
             const sim = similarity(a.normalized, b.normalized);
             if (sim > 0.92) {
                 const key = [a.file + ':' + a.name, b.file + ':' + b.name].sort().join('|');
                 if (reported.has(key))
                     continue;
                 reported.add(key);
+                // Downgrade to info if both functions are in test directories
+                // or if either is in an examples/demo directory
+                const bothInTest = isInTestDir(a.file) && isInTestDir(b.file);
+                const anyInExample = /(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(a.file) || /(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(b.file);
                 issues.push({
-                    severity: 'warning',
+                    severity: (bothInTest || anyInExample) ? 'info' : 'warning',
                     message: `similar functions (${Math.round(sim * 100)}%): ${a.name} (${a.file}:${a.line}) and ${b.name} (${b.file}:${b.line})`,
                     file: a.file,
                     line: a.line,
@@ -221,6 +302,46 @@ function isLibrary(cwd) {
         return false;
     }
 }
+function isMonorepo(cwd) {
+    try {
+        const pkgRaw = readFile(join(cwd, 'package.json'));
+        if (pkgRaw) {
+            const pkg = JSON.parse(pkgRaw);
+            if (Array.isArray(pkg.workspaces) || pkg.workspaces?.packages)
+                return true;
+        }
+    }
+    catch { /* skip */ }
+    if (existsSync(join(cwd, 'pnpm-workspace.yaml')))
+        return true;
+    if (existsSync(join(cwd, 'lerna.json')))
+        return true;
+    return false;
+}
+/** Find nearest package.json upward from a file path, check if it's a library */
+function isFileInLibraryPackage(cwd, filePath) {
+    let dir = dirname(join(cwd, filePath));
+    const root = cwd;
+    while (dir.length >= root.length) {
+        const pkgPath = join(dir, 'package.json');
+        try {
+            const raw = readFile(pkgPath);
+            if (raw) {
+                // Don't count the root package.json — we already check that via isLibrary
+                if (dir === root)
+                    return false;
+                const pkg = JSON.parse(raw);
+                return !!(pkg.main || pkg.exports || pkg.module || pkg.types || pkg.bin);
+            }
+        }
+        catch { /* skip */ }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return false;
+}
 function findOrphanedExports(cwd, files) {
     const issues = [];
     const sourceFiles = files.filter(f => isSourceFile(f) && !isTestFile(f));
@@ -261,27 +382,43 @@ function findOrphanedExports(cwd, files) {
             }
         }
     }
-    // Scan all files for imports of each name
-    const allContent = [];
+    // Scan all files for import names — collect all imported identifiers into a Set
+    const importedNames = new Set();
+    const importRe = /import\s+(?:type\s+)?(?:\{([^}]+)\}|([a-zA-Z_$][a-zA-Z0-9_$]*)(?:\s*,\s*\{([^}]+)\})?)\s+from\s+/g;
     for (const file of sourceFiles) {
         const content = readFile(join(cwd, file));
-        if (content)
-            allContent.push(content);
+        if (!content)
+            continue;
+        let match;
+        importRe.lastIndex = 0;
+        while ((match = importRe.exec(content)) !== null) {
+            // Named imports: { a, b as c }
+            const namedParts = [match[1], match[3]].filter(Boolean);
+            for (const part of namedParts) {
+                for (const name of part.split(',')) {
+                    const trimmed = name.trim().split(/\s+as\s+/)[0].trim();
+                    if (trimmed)
+                        importedNames.add(trimmed);
+                }
+            }
+            // Default import
+            if (match[2])
+                importedNames.add(match[2]);
+        }
     }
-    const allText = allContent.join('\n');
     const lib = isLibrary(cwd);
+    const mono = isMonorepo(cwd);
     for (const exp of exports) {
-        // Check if name appears in import statements across all files
-        // import { name } from or import { x, name } from or import { name as y }
-        const importPattern = new RegExp(`import\\s+[^;]*\\b${exp.name}\\b[^;]*from\\s+`, 'm');
-        if (!importPattern.test(allText)) {
+        if (!importedNames.has(exp.name)) {
+            // In monorepos, check if the export's file is inside a workspace package that is a library
+            const isLib = lib || (mono && isFileInLibraryPackage(cwd, exp.file));
             issues.push({
-                severity: lib ? 'info' : 'warning',
-                message: `orphaned export: "${exp.name}" is exported but never imported${lib ? ' (library detected — exports may be consumed externally)' : ''}`,
+                severity: isLib ? 'info' : 'warning',
+                message: `orphaned export: "${exp.name}" is exported but never imported${isLib ? ' (library detected — exports may be consumed externally)' : ''}`,
                 file: exp.file,
                 line: exp.line,
                 fixable: true,
-                fixHint: lib ? 'may be public API — verify if still needed' : 'remove the export keyword or delete the function',
+                fixHint: isLib ? 'may be public API — verify if still needed' : 'remove the export keyword or delete the function',
             });
         }
     }
@@ -343,6 +480,10 @@ function findNamingDrift(allFuncs) {
     return issues;
 }
 // ── Main check ───────────────────────────────────────────────────────────────
+/** Check if a file path is in a test directory or is a test file */
+function isInTestDir(file) {
+    return /(?:^|[/\\])(?:test|tests|__tests__)[/\\]/.test(file) || /\.(?:test|spec)\.[jt]sx?$/.test(file);
+}
 export async function checkDebt(cwd, ignore) {
     const allFiles = walkFiles(cwd, ignore);
     const sourceFiles = allFiles.filter(f => isSourceFile(f) && !isTestFile(f));

package/dist/checks/deps.d.ts

@@ -5,4 +5,5 @@ export declare function extractPackageName(specifier: string): string | null;
 export declare function isBuiltin(specifier: string): boolean;
 export declare function detectWorkspacePackages(cwd: string): Set<string>;
 export declare function detectProvidedDeps(cwd: string): Set<string>;
+export declare function collectWorkspaceDeps(cwd: string): Set<string>;
 export declare function checkDeps(cwd: string): Promise<CheckResult>;

package/dist/checks/deps.js

@@ -1,6 +1,7 @@
 import { join } from 'node:path';
-import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { walkFiles, readFile } from '../util.js';
+import { cachedRead } from '../file-cache.js';
 // ── Top packages list (~150 popular npm packages) ────────────────────────────
 const TOP_PACKAGES = [
     'react', 'react-dom', 'next', 'vue', 'angular', 'express', 'koa', 'fastify', 'hono',
@@ -81,6 +82,9 @@ export function extractPackageName(specifier) {
     // Skip relative imports
     if (specifier.startsWith('.') || specifier.startsWith('/'))
         return null;
+    // Skip URL imports
+    if (specifier.startsWith('http://') || specifier.startsWith('https://'))
+        return null;
     // Skip node: builtins
     if (specifier.startsWith('node:'))
         return null;
@@ -240,7 +244,7 @@ export function detectProvidedDeps(cwd) {
         if (!pkgRaw)
             return provided;
         const pkg = JSON.parse(pkgRaw);
-        const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+        const allDeps = { ...pkg.dependencies, ...pkg.devDependencies, ...pkg.optionalDependencies, ...pkg.peerDependencies };
         // Obsidian plugin
         const hasObsidian = 'obsidian' in (allDeps || {});
         const manifestPath = join(cwd, 'manifest.json');
@@ -280,19 +284,111 @@ function isProvidedPackage(pkg, provided) {
         return true;
     return false;
 }
+// ── Tooling packages (CLI-only, never imported in source) ────────────────────
+const TOOLING_PACKAGES = new Set([
+    'typescript', '@types/node', '@biomejs/biome', 'biome', 'prettier', 'eslint',
+    'husky', 'lint-staged', 'tsx', 'ts-node', 'concurrently', 'npm-run-all',
+    'shx', 'rimraf', 'cross-env', 'nodemon', 'jest', 'vitest', 'mocha',
+    'c8', 'nyc', 'turbo', 'lerna', 'changesets', '@changesets/cli',
+    'webpack', 'webpack-cli', 'vite', 'rollup', 'esbuild', 'swc',
+    'tailwindcss', 'postcss', 'autoprefixer', 'sass', 'less',
+    'commitizen', 'cz-conventional-changelog', 'semantic-release',
+    '@typescript/native-preview',
+]);
+// ── Collect all deps declared in workspace sub-packages ──────────────────────
+export function collectWorkspaceDeps(cwd) {
+    const allDeps = new Set();
+    const globs = [];
+    try {
+        const pkgRaw = readFile(join(cwd, 'package.json'));
+        if (pkgRaw) {
+            const pkg = JSON.parse(pkgRaw);
+            if (Array.isArray(pkg.workspaces))
+                globs.push(...pkg.workspaces);
+            else if (pkg.workspaces?.packages)
+                globs.push(...pkg.workspaces.packages);
+        }
+    }
+    catch { /* skip */ }
+    try {
+        const pnpmWs = readFile(join(cwd, 'pnpm-workspace.yaml'));
+        if (pnpmWs) {
+            const matches = pnpmWs.matchAll(/['"]?([^'":\n]+\*[^'":\n]*)['"]?/g);
+            for (const m of matches)
+                globs.push(m[1].trim());
+        }
+    }
+    catch { /* skip */ }
+    try {
+        const lernaRaw = readFile(join(cwd, 'lerna.json'));
+        if (lernaRaw) {
+            const lerna = JSON.parse(lernaRaw);
+            if (Array.isArray(lerna.packages))
+                globs.push(...lerna.packages);
+        }
+    }
+    catch { /* skip */ }
+    function addDepsFromPkg(pkgPath) {
+        try {
+            const raw = readFile(pkgPath);
+            if (!raw)
+                return;
+            const pkg = JSON.parse(raw);
+            for (const key of Object.keys(pkg.dependencies || {}))
+                allDeps.add(key);
+            for (const key of Object.keys(pkg.devDependencies || {}))
+                allDeps.add(key);
+            for (const key of Object.keys(pkg.optionalDependencies || {}))
+                allDeps.add(key);
+            for (const key of Object.keys(pkg.peerDependencies || {}))
+                allDeps.add(key);
+        }
+        catch { /* skip */ }
+    }
+    for (const glob of globs) {
+        const parts = glob.replace(/\/$/, '').split('/');
+        const starIdx = parts.indexOf('*');
+        if (starIdx === -1) {
+            addDepsFromPkg(join(cwd, glob, 'package.json'));
+        }
+        else {
+            const prefix = parts.slice(0, starIdx).join('/');
+            const prefixDir = join(cwd, prefix);
+            try {
+                if (existsSync(prefixDir) && statSync(prefixDir).isDirectory()) {
+                    for (const entry of readdirSync(prefixDir)) {
+                        const entryDir = join(prefixDir, entry);
+                        try {
+                            if (!statSync(entryDir).isDirectory())
+                                continue;
+                            const suffix = parts.slice(starIdx + 1);
+                            const pkgDir = suffix.length > 0 ? join(entryDir, ...suffix) : entryDir;
+                            addDepsFromPkg(join(pkgDir, 'package.json'));
+                        }
+                        catch { /* skip */ }
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+    }
+    return allDeps;
+}
 // ── Main check ───────────────────────────────────────────────────────────────
 export async function checkDeps(cwd) {
     try {
         const issues = [];
         // Read package.json
         let declaredDeps = {};
+        let devDeps = {};
         let hasPkgJson = false;
         try {
             const pkgRaw = readFile(join(cwd, 'package.json'));
             if (pkgRaw) {
                 const pkg = JSON.parse(pkgRaw);
                 hasPkgJson = true;
-                declaredDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+                devDeps = pkg.devDependencies || {};
+                declaredDeps = { ...pkg.dependencies, ...devDeps, ...pkg.optionalDependencies, ...pkg.peerDependencies };
             }
         }
         catch { /* skip */ }
@@ -367,7 +463,7 @@ export async function checkDeps(cwd) {
         const importedPackages = new Set();
         for (const file of sourceFiles) {
             try {
-                const content = readFileSync(join(cwd, file), 'utf-8');
+                const content = cachedRead(join(cwd, file));
                 const rawImports = extractImports(content);
                 for (const imp of rawImports) {
                     if (isBuiltin(imp))
@@ -381,8 +477,12 @@ export async function checkDeps(cwd) {
         }
         // Dead deps: declared but never imported
         const declaredSet = new Set(declaredNames);
+        const devDepNames = new Set(Object.keys(devDeps));
         for (const pkg of declaredNames) {
             if (!importedPackages.has(pkg)) {
+                // Skip known tooling packages that are devDependencies (used via CLI scripts, not imports)
+                if (TOOLING_PACKAGES.has(pkg) && devDepNames.has(pkg))
+                    continue;
                 // Check if it's a CLI tool / plugin / type package (common false positives)
                 // Still flag it, but as info
                 issues.push({
@@ -396,13 +496,17 @@ export async function checkDeps(cwd) {
         }
         // Detect workspace packages and host-provided deps
         const workspacePackages = detectWorkspacePackages(cwd);
+        const workspaceDeps = collectWorkspaceDeps(cwd);
         const providedDeps = detectProvidedDeps(cwd);
         // Phantom imports: imported but not declared
         for (const pkg of importedPackages) {
             if (!declaredSet.has(pkg)) {
-                // Skip workspace packages
+                // Skip workspace packages (local packages in the monorepo)
                 if (workspacePackages.has(pkg))
                     continue;
+                // Skip deps declared in any workspace sub-package
+                if (workspaceDeps.has(pkg))
+                    continue;
                 // Skip host-provided deps
                 if (isProvidedPackage(pkg, providedDeps))
                     continue;

package/dist/checks/integrity.js

@@ -66,8 +66,22 @@ function isCommentLine(line) {
 function extractRelativeImports(source) {
     const imports = [];
     const lines = source.split('\n');
+    let inTemplateLiteral = false;
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
+        // Track template literal context — check state at start of line, then update
+        const wasInTemplate = inTemplateLiteral;
+        for (let ci = 0; ci < line.length; ci++) {
+            if (line[ci] === '\\') {
+                ci++;
+                continue;
+            }
+            if (line[ci] === '`')
+                inTemplateLiteral = !inTemplateLiteral;
+        }
+        // Skip lines that start inside a template literal — they contain generated code, not real imports
+        if (wasInTemplate)
+            continue;
         // Skip comment lines
         if (isCommentLine(line))
             continue;
@@ -153,16 +167,19 @@ function checkEmptyCatch(cwd, files) {
         // Skip test files — empty catches in tests are usually intentional (testing error paths)
         if (isTestFile(file))
             continue;
+        // Skip example/demo directories — example code doesn't need production error handling
+        if (/(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(file))
+            continue;
         const content = readFile(join(cwd, file));
         if (!content)
             continue;
         const lines = content.split('\n');
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
-            // single-line catch with param and empty body — error silently swallowed
+            // single-line catch with param and empty body — warning (was error, too harsh)
             if (/catch\s*\([^)]*\)\s*\{\s*\}/.test(line)) {
                 issues.push({
-                    severity: 'error',
+                    severity: 'warning',
                     message: 'empty catch block — error silently swallowed',
                     file,
                     line: i + 1,
@@ -174,7 +191,7 @@ function checkEmptyCatch(cwd, files) {
             // single-line catch without param and empty body
             if (/catch\s*\{\s*\}/.test(line)) {
                 issues.push({
-                    severity: 'error',
+                    severity: 'warning',
                     message: 'empty catch block — error silently swallowed',
                     file,
                     line: i + 1,
@@ -213,9 +230,16 @@ function checkEmptyCatch(cwd, files) {
                     // Check if block body is only comments
                     const bodyText = blockLines.join('\n').replace(/\}$/, '').trim();
                     if (bodyText.length > 0 && /^(\s*(\/\/[^\n]*|\/\*[\s\S]*?\*\/)\s*)*$/.test(bodyText)) {
+                        // If the comment contains TODO/FIXME/HACK/XXX/WIP/implement, keep as warning (unfinished work)
+                        // TEMP only as standalone marker (not "temporary" used as adjective)
+                        // Otherwise, any comment text means someone documented why it's empty → downgrade to info
+                        const unfinishedRe = /\b(TODO|FIXME|HACK|XXX|WIP|implement)\b|\bTEMP\b(?!orar)/i;
+                        const sev = unfinishedRe.test(bodyText) ? 'warning' : 'info';
                         issues.push({
-                            severity: 'warning',
-                            message: 'catch block contains only comments — consider proper error handling',
+                            severity: sev,
+                            message: sev === 'info'
+                                ? 'catch block with intentional comment — acknowledged'
+                                : 'catch block contains only comments — consider proper error handling',
                             file,
                             line: i + 1,
                             fixable: false,
@@ -337,6 +361,63 @@ function hasGlobalErrorHandling(content) {
         return true;
     return false;
 }
+function buildFuncScopes(lines) {
+    const scopes = [];
+    // Find function start lines
+    const funcStarts = [];
+    for (let i = 0; i < lines.length; i++) {
+        const l = lines[i];
+        // function declarations and arrow functions
+        const isFuncDecl = /(?:async\s+)?function\s+\w/.test(l) && /\{/.test(l);
+        const isArrow = /=>\s*\{/.test(l);
+        const isMethod = /^\s+(?:async\s+)?\w+\s*\([^)]*\)\s*(?::\s*\S+)?\s*\{/.test(l) && !/\b(?:if|for|while|switch|catch)\b/.test(l);
+        if (isFuncDecl || isArrow || isMethod) {
+            const isExported = /^\s*export\s/.test(l) || (i > 0 && /^\s*export\s/.test(lines[i - 1]));
+            funcStarts.push({ line: i, isExported });
+        }
+    }
+    for (const fs of funcStarts) {
+        // Find the opening brace on the start line
+        let braceIdx = lines[fs.line].indexOf('{');
+        if (braceIdx === -1)
+            continue;
+        let depth = 0;
+        let endLine = fs.line;
+        let hasTry = false;
+        for (let i = fs.line; i < lines.length; i++) {
+            const startJ = i === fs.line ? braceIdx : 0;
+            for (let j = startJ; j < lines[i].length; j++) {
+                if (lines[i][j] === '{')
+                    depth++;
+                if (lines[i][j] === '}') {
+                    depth--;
+                    if (depth === 0) {
+                        endLine = i;
+                        break;
+                    }
+                }
+            }
+            if (/\btry\s*\{/.test(lines[i]))
+                hasTry = true;
+            if (depth === 0)
+                break;
+        }
+        scopes.push({ startLine: fs.line, endLine, hasTryCatch: hasTry, isExported: fs.isExported });
+    }
+    return scopes;
+}
+function findEnclosingFunc(scopes, lineIdx) {
+    // Find the tightest (smallest range) enclosing function
+    let best = null;
+    for (const s of scopes) {
+        if (lineIdx >= s.startLine && lineIdx <= s.endLine) {
+            if (!best || (s.endLine - s.startLine) < (best.endLine - best.startLine)) {
+                best = s;
+            }
+        }
+    }
+    return best;
+}
 function checkUnhandledAsync(cwd, files) {
     const issues = [];
     const sourceExts = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
@@ -349,6 +430,9 @@ function checkUnhandledAsync(cwd, files) {
         // Skip error boundary files — they ARE the error handlers
         if (isErrorBoundaryFile(file))
             continue;
+        // Skip example/demo directories — example code doesn't need production error handling
+        if (/(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(file))
+            continue;
         const content = readFile(join(cwd, file));
         if (!content)
             continue;
@@ -383,6 +467,8 @@ function checkUnhandledAsync(cwd, files) {
                 insideTry.add(i);
             }
         }
+        // Build function scope info for severity decisions
+        const funcScopes = buildFuncScopes(lines);
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
             // await without try/catch context — detect standalone awaits
@@ -399,11 +485,27 @@ function checkUnhandledAsync(cwd, files) {
                 const hasThenError = /\.then\s*\([^,]+,\s*\w+/.test(line) || (i + 1 < lines.length && /\.then\s*\([^,]+,\s*\w+/.test(lines[i + 1]));
                 if (!hasCatch && !hasThenError) {
                     unhandledCount++;
-                    // Downgrade Next.js server components to info (framework handles errors)
+                    // Determine severity:
+                    // - 'info' for Next.js server components, or functions that have try/catch elsewhere in their body
+                    // - 'warning' only for exported functions with NO try/catch anywhere
+                    // - 'info' for everything else (non-exported, internal functions)
                     const isServerComp = isNextjsServerComponent(file);
+                    const enclosing = findEnclosingFunc(funcScopes, i);
+                    const hasFuncTryCatch = enclosing?.hasTryCatch ?? false;
+                    const isExported = enclosing?.isExported ?? false;
+                    let severity;
+                    if (isServerComp || hasFuncTryCatch) {
+                        severity = 'info';
+                    }
+                    else if (isExported) {
+                        severity = 'warning';
+                    }
+                    else {
+                        severity = 'info';
+                    }
                     if (unhandledCount <= 10) {
                         issues.push({
-                            severity: isServerComp ? 'info' : 'warning',
+                            severity,
                             message: isServerComp
                                 ? 'unhandled async: await without try/catch (Next.js server component — framework-managed)'
                                 : 'unhandled async: await without try/catch',
@@ -436,10 +538,11 @@ export async function checkIntegrity(cwd, ignore) {
     let score = 100;
     score -= hallucinatedIssues.length * 10;
     score -= emptyCatchIssues.filter(i => i.severity === 'error').length * 8;
+    score -= emptyCatchIssues.filter(i => i.severity === 'warning').length * 3;
     score -= stubbedTestIssues.filter(i => i.severity === 'error').length * 5;
-    // Unhandled async capped at -30 (only count warnings, not info-downgraded ones)
-    const unhandledErrors = unhandledAsyncIssues.filter(i => i.severity === 'warning').length;
-    score -= Math.min(30, unhandledErrors * 3);
+    // Unhandled async capped at -15 (only count warnings, not info-downgraded ones)
+    const unhandledWarnings = unhandledAsyncIssues.filter(i => i.severity === 'warning').length;
+    score -= Math.min(15, unhandledWarnings * 3);
     score = Math.max(0, Math.round(score));
     // Summary parts
     const parts = [];

package/dist/checks/memory.js

@@ -1,6 +1,7 @@
 import { join, resolve } from 'node:path';
-import { existsSync, readdirSync, statSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, statSync } from 'node:fs';
 import { readFile } from '../util.js';
+import { cachedRead } from '../file-cache.js';
 import { detectWorkspacePackages } from './deps.js';
 // ── Memory file targets ──────────────────────────────────────────────────────
 const ROOT_FILES = ['CLAUDE.md', 'AGENTS.md', 'SOUL.md', '.cursorrules', 'codex.md'];
@@ -153,7 +154,7 @@ export function checkMemory(cwd) {
     const allDeps = new Set();
     if (existsSync(pkgPath)) {
         try {
-            const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+            const pkg = JSON.parse(cachedRead(pkgPath));
             // Include the package's own name
             if (pkg.name)
                 allDeps.add(pkg.name);
@@ -201,6 +202,20 @@ export function checkMemory(cwd) {
             // Skip ../  references — they point to sibling repos and can't be validated locally
             if (p.startsWith('../'))
                 continue;
+            // Skip relative paths that appear inside inline code (`...`) in markdown files
+            if (relPath.endsWith('.md') || relPath.endsWith('.mdx')) {
+                const lineText = content.split('\n')[line - 1] || '';
+                // Check if this path is inside backtick code spans (inline code examples)
+                const pathIdx = lineText.indexOf(p);
+                if (pathIdx >= 0) {
+                    const before = lineText.substring(0, pathIdx);
+                    const after = lineText.substring(pathIdx + p.length);
+                    // Count backticks before — odd means inside inline code
+                    const ticksBefore = (before.match(/`/g) || []).length;
+                    if (ticksBefore % 2 === 1)
+                        continue;
+                }
+            }
             const resolved = p.startsWith('/') ? p : resolve(cwd, p);
             if (!existsSync(resolved)) {
                 issues.push({

package/dist/checks/models.js

@@ -102,12 +102,16 @@ async function tryModelGraveyard(cwd) {
         const aiFramework = isAiFramework(cwd);
         // Files that define deprecated model registries should not be flagged
         const SELF_FILES = ['models.ts', 'models.js', 'model-graveyard', 'model-registry', 'sunset', 'fix/models'];
+        const GENERATED_PATTERNS = ['.generated.', '.gen.'];
         for (const match of report.matches) {
             if (!match.model)
                 continue;
             // Skip self-referencing files (model definition/fix files)
             if (match.file && SELF_FILES.some(s => match.file.toLowerCase().includes(s)))
                 continue;
+            // Skip auto-generated model registries
+            if (match.file && GENERATED_PATTERNS.some(p => match.file.includes(p)))
+                continue;
             if (match.model.status === 'deprecated' || match.model.status === 'eol') {
                 const inTestDocs = match.file && isTestOrDocsFile(match.file);
                 const severity = (aiFramework || inTestDocs) ? 'info' : 'error';

package/dist/checks/owasp/asi03-identity-abuse.js

@@ -21,6 +21,8 @@ export function checkASI03(cwd, configFiles) {
             continue;
         const contentLower = content.toLowerCase();
         const relPath = relative(cwd, filePath);
+        const normalizedPath = relPath.replace(/\\/g, '/');
+        const isCiFile = normalizedPath.startsWith('.github/workflows/') || normalizedPath.startsWith('.circleci/') || normalizedPath.startsWith('.gitlab-ci');
         if (leastPrivKeywords.some(kw => new RegExp(kw, 'i').test(content))) {
             hasLeastPrivMention = true;
         }
@@ -55,7 +57,7 @@ export function checkASI03(cwd, configFiles) {
                     deduction = Math.min(deduction + 15, 30);
                 }
             }
-            if (sudoPattern.test(line)) {
+            if (!isCiFile && sudoPattern.test(line)) {
                 findings.push({
                     asiId: 'ASI03',
                     severity: 'warning',

package/dist/checks/owasp/asi06-memory-poisoning.js

@@ -1,6 +1,7 @@
 import { join } from 'node:path';
-import { readFileSync, existsSync } from 'node:fs';
+import { existsSync } from 'node:fs';
 import { readTextFile } from './shared.js';
+import { cachedRead } from '../../file-cache.js';
 // ── ASI06 — Memory and Context Poisoning ─────────────────────────────────────
 export function checkASI06(cwd) {
     const findings = [];
@@ -17,7 +18,7 @@ export function checkASI06(cwd) {
     const gitignorePath = join(cwd, '.gitignore');
     let gitignoreContent = '';
     try {
-        gitignoreContent = readFileSync(gitignorePath, 'utf-8');
+        gitignoreContent = cachedRead(gitignorePath);
     }
     catch { /* intentional: .gitignore may not exist */ }
     for (const memPath of memoryPaths) {

package/dist/checks/owasp/shared.js

@@ -1,6 +1,7 @@
 import { join } from 'node:path';
-import { readFileSync, statSync, existsSync } from 'node:fs';
+import { statSync, existsSync } from 'node:fs';
 import { isTextFile, collectDirFiles } from '../../util.js';
+import { cachedRead } from '../../file-cache.js';
 // ── Agent config file targets ─────────────────────────────────────────────────
 const AGENT_CONFIG_TARGETS = [
     '.claude',
@@ -54,7 +55,7 @@ export function readTextFile(filePath) {
     if (!isTextFile(filePath))
         return null;
     try {
-        return readFileSync(filePath, 'utf-8');
+        return cachedRead(filePath);
     }
     catch { /* intentional: resolver may fail on unreadable files */ }
     return null;

package/dist/checks/ready.js

@@ -87,19 +87,46 @@ function builtinReady(cwd, ignore) {
         issues.push({ severity: 'error', message: 'no tests — AI agents produce better code when tests exist to validate against', fixable: false });
     }
     let largeFileCount = 0;
+    const generatedFileRe = /(?:\.generated\.[jt]sx?$|\.gen\.[jt]s$|\.min\.[jt]s$|\.min\.css$|(?:^|[/\\])(?:generated|vendor|__generated__)[/\\])/;
+    const exampleDirRe = /(?:^|[/\\])(?:examples?|demos?|scripts?)[/\\]/;
+    const testFileRe = /(?:\.(?:test|spec)\.[jt]sx?$|(?:^|[/\\])(?:test|tests|__tests__)[/\\])/;
+    const largeFileIssues = [];
     for (const f of files) {
         if (!codeExts.some(ext => f.endsWith(ext)))
             continue;
+        // Skip generated/vendored/minified files
+        if (generatedFileRe.test(f))
+            continue;
+        // Bug 5: Skip files in examples/demo directories
+        if (exampleDirRe.test(f))
+            continue;
         const content = readFile(join(cwd, f));
-        if (content && content.split('\n').length > 500) {
+        if (!content)
+            continue;
+        const lineCount = content.split('\n').length;
+        // Bug 3: Higher threshold for test files (1000 vs 500)
+        const threshold = testFileRe.test(f) ? 1000 : 500;
+        if (lineCount > threshold) {
             largeFileCount++;
-            if (largeFileCount <= 3) {
-                issues.push({ severity: 'warning', message: `${f} is ${content.split('\n').length} lines — split for better AI comprehension`, fixable: false });
-            }
+            largeFileIssues.push({ severity: 'warning', message: `${f} is ${lineCount} lines — split for better AI comprehension`, fixable: false });
         }
     }
-    if (largeFileCount > 3) {
-        issues.push({ severity: 'warning', message: `...and ${largeFileCount - 3} more large files`, fixable: false });
+    // Bug 4: Cap large file penalty for monorepos
+    if (isMonorepo && largeFileIssues.length > 10) {
+        // First 10 stay as warnings, rest downgraded to info
+        for (let i = 10; i < largeFileIssues.length; i++) {
+            largeFileIssues[i].severity = 'info';
+        }
+    }
+    // Add issues (show first 3 inline, rest as summary)
+    for (let i = 0; i < Math.min(3, largeFileIssues.length); i++) {
+        issues.push(largeFileIssues[i]);
+    }
+    if (largeFileIssues.length > 3) {
+        // Add remaining issues individually (for JSON output) but summarize in display
+        for (let i = 3; i < largeFileIssues.length; i++) {
+            issues.push(largeFileIssues[i]);
+        }
     }
     const hasEnv = files.some(f => f === '.env' || f === '.env.local');
     const hasEnvExample = files.some(f => f === '.env.example' || f === '.env.template');

package/dist/checks/scan.js

@@ -1,6 +1,7 @@
 import { join, relative } from 'node:path';
-import { readFileSync, statSync, existsSync } from 'node:fs';
+import { statSync, existsSync } from 'node:fs';
 import { isTextFile as utilIsTextFile, collectDirFiles as utilCollectDirFiles } from '../util.js';
+import { cachedRead } from '../file-cache.js';
 const CRITICAL_PATTERNS = [
     {
         id: 'base64-url',
@@ -169,6 +170,9 @@ function scanContent(content, relPath) {
             // Skip command-substitution checks in workflow files (shell commands are expected)
             if (pattern.id === 'command-substitution' && isWorkflow)
                 continue;
+            // Skip permission-escalation in CI workflow files (sudo apt-get etc. is standard)
+            if (pattern.id === 'permission-escalation' && isWorkflow)
+                continue;
             // Skip command-substitution in markdown code contexts
             if (pattern.id === 'command-substitution' && relPath.endsWith('.md') && isInCodeContext(lines, i))
                 continue;
@@ -215,7 +219,7 @@ export function checkScan(cwd) {
         if (!isTextFile(filePath))
             continue;
         try {
-            const content = readFileSync(filePath, 'utf-8');
+            const content = cachedRead(filePath);
             const relPath = relative(cwd, filePath);
             filesScanned++;
             findings.push(...scanContent(content, relPath));

package/dist/checks/secrets.js

@@ -1,9 +1,10 @@
-import { existsSync, readdirSync, readFileSync, statSync, createReadStream } from 'node:fs';
+import { existsSync, readdirSync, statSync, createReadStream } from 'node:fs';
 import { join, relative, extname, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { execSync } from 'node:child_process';
 import { createInterface } from 'node:readline';
 import { collectDirFiles } from '../util.js';
+import { cachedRead } from '../file-cache.js';
 // ── Shannon entropy ──────────────────────────────────────────────────────────
 function calculateEntropy(str) {
     if (str.length === 0)
@@ -176,7 +177,7 @@ function findEnvFiles(dir, maxDepth = 3, depth = 0) {
 function scanEnvFile(filePath) {
     const findings = [];
     try {
-        const lines = readFileSync(filePath, 'utf-8').split('\n');
+        const lines = cachedRead(filePath).split('\n');
         const gitTracked = isGitTracked(filePath);
         for (const line of lines) {
             if (line.trimStart().startsWith('#'))

package/dist/checks/tests.js

@@ -1,11 +1,27 @@
-import { join } from 'node:path';
-import { readFileSync } from 'node:fs';
+import { join, basename } from 'node:path';
 import { walkFiles } from '../util.js';
+import { cachedRead } from '../file-cache.js';
 const TEST_FILE_RE = /\.(test|spec)\.(ts|js|tsx|jsx)$/;
 const TEST_DIR_RE = /(?:^|[/\\])(__tests__|tests?)[/\\]/;
 function isTestFile(relPath) {
     return TEST_FILE_RE.test(relPath) || TEST_DIR_RE.test(relPath);
 }
+/** Test utility/helper file patterns — these export helpers, not actual tests */
+const TEST_UTILITY_NAMES = /(?:^|[/\\])(?:util(?:itie)?s?|helpers?|fixtures?|mocks?|setup|factor(?:y|ies)|themes?|test-(?:utils?|helpers?|setup|fixtures?|mocks?|themes?))\.[jt]sx?$/i;
+function isTestUtilityFile(relPath, content) {
+    const hasTestCalls = /\b(?:test|it|describe|Deno\.test)\s*\(/.test(content);
+    // Check filename pattern — but only if no test runner calls present
+    const base = basename(relPath);
+    if (TEST_UTILITY_NAMES.test(base) && !hasTestCalls)
+        return true;
+    // If in a test dir, has exports, but no test runner calls — it's a utility
+    if (TEST_DIR_RE.test(relPath)) {
+        const hasExports = /\bexport\s+(function|const|let|var|class|default|{)/.test(content);
+        if (hasExports && !hasTestCalls)
+            return true;
+    }
+    return false;
+}
 // Pattern 1: Tautological assertions
 function findTautological(lines, file) {
     const issues = [];
@@ -119,6 +135,11 @@ function findZeroAssertionTests(content, file) {
         // Check for assertion calls
         const assertionRe = /(?:expect\s*\(|assert\.|\.should\.|toBe\s*\(|toEqual\s*\(|toMatch\s*\(|toThrow\s*\()/;
         if (!assertionRe.test(body)) {
+            // If every non-empty, non-comment statement is a function call, it's delegating to a helper
+            const stmts = stripped.split(/;\s*|\n/).map(s => s.trim()).filter(s => s && !s.startsWith('//'));
+            const delegatingRe = /^(await\s+)?[a-zA-Z_$][a-zA-Z0-9_$.]*\s*\(/;
+            if (stmts.length > 0 && stmts.length <= 3 && stmts.every(s => delegatingRe.test(s)))
+                continue;
             const line = content.substring(0, m.index).split('\n').length;
             issues.push({
                 severity: 'warning',
@@ -205,7 +226,7 @@ export function checkTests(cwd, ignore) {
     for (const rel of testFiles) {
         let content;
         try {
-            content = readFileSync(join(cwd, rel), 'utf-8');
+            content = cachedRead(join(cwd, rel));
         }
         catch {
             continue;
@@ -213,6 +234,9 @@ export function checkTests(cwd, ignore) {
         // Skip files with vet-ignore: tests directive
         if (hasVetIgnore(content, 'tests'))
             continue;
+        // Skip test utility/helper files — they export helpers, not tests
+        if (isTestUtilityFile(rel, content))
+            continue;
         const lines = content.split('\n');
         issues.push(...findTautological(lines, rel));
         issues.push(...findEmptyBodies(content, rel));

package/dist/checks/verify.js

@@ -1,6 +1,7 @@
 import { join, basename, extname } from 'node:path';
-import { readFileSync, existsSync, statSync } from 'node:fs';
+import { existsSync, statSync } from 'node:fs';
 import { execSync } from 'node:child_process';
+import { cachedRead } from '../file-cache.js';
 // ── Helpers ──────────────────────────────────────────────────────────────────
 function safeExec(cmd, cwd) {
     try {
@@ -93,6 +94,31 @@ function isTestFile(filePath) {
         return true;
     return false;
 }
+/** Test utility/helper file patterns — these export helpers, not actual tests */
+const TEST_UTILITY_NAMES = /(?:^|[/\\])(?:util(?:itie)?s?|helpers?|fixtures?|mocks?|setup|factor(?:y|ies)|themes?|test-(?:utils?|helpers?|setup|fixtures?|mocks?|themes?))\.[jt]sx?$/i;
+const TEST_DIR_PATTERN = /(?:^|[/\\])(__tests__|tests?)[/\\]/;
+function isTestUtilityFile(filePath, content) {
+    const hasTestCalls = /\b(?:test|it|describe|Deno\.test)\s*\(/.test(content);
+    const base = basename(filePath);
+    if (TEST_UTILITY_NAMES.test(base) && !hasTestCalls)
+        return true;
+    const normalized = filePath.replace(/\\/g, '/');
+    if (TEST_DIR_PATTERN.test(normalized) || normalized.startsWith('test/') || normalized.startsWith('tests/')) {
+        const hasExports = /\bexport\s+(function|const|let|var|class|default|{)/.test(content);
+        // Files with exports but no test calls are utilities
+        if (hasExports && !hasTestCalls)
+            return true;
+        // Files with no exports AND no test calls but with actual code (imports, function defs)
+        // are standalone scripts (debug, examples, repros) — not test files
+        if (!hasExports && !hasTestCalls) {
+            const hasImports = /\bimport\s/.test(content);
+            const hasFunctions = /\b(?:function|class|const\s+\w+\s*=\s*(?:async\s+)?(?:\(|[a-z]))/i.test(content);
+            if (hasImports || hasFunctions)
+                return true;
+        }
+    }
+    return false;
+}
 function hasAssertions(content) {
     return /\b(assert|expect\s*\(|it\s*\(|test\s*\(|describe\s*\(|should\.|toBe\(|toEqual\(|assertEqual|assertStrictEqual)\b/i.test(content);
 }
@@ -288,7 +314,7 @@ export function checkVerify(cwd, since) {
                 verified++;
                 continue;
             }
-            content = readFileSync(absPath, 'utf-8');
+            content = cachedRead(absPath);
         }
         catch {
             continue;
@@ -321,6 +347,32 @@ export function checkVerify(cwd, since) {
             verified++;
             continue;
         }
+        // Skip vendor, minified, dist, and build files
+        if (/(?:^|[/\\])vendor[/\\]/.test(relPath) || /\.min\.(js|css|mjs)$/.test(relPath) || /(?:^|[/\\])(?:dist|build)[/\\]/.test(relPath)) {
+            verified++;
+            continue;
+        }
+        // Skip re-export barrel files (all non-empty lines are re-exports or wrappers)
+        if (lineCount > 0 && lineCount < 10) {
+            const nonEmptyLines = content.split('\n').filter((l) => l.trim() && !l.trim().startsWith('//') && !l.trim().startsWith('/*') && !l.trim().startsWith('*'));
+            const reExportRe = /^\s*(?:export\s+\*\s+from\s|export\s*\{[^}]*\}\s*from\s|module\.exports\s*=\s*require\s*\()/;
+            if (nonEmptyLines.length > 0 && nonEmptyLines.every((l) => reExportRe.test(l))) {
+                verified++;
+                continue;
+            }
+            // Also skip import-and-reexport wrappers: files with only imports, exports, and simple identifiers/braces
+            const wrapperRe = /^\s*(?:import\s|export\s|[a-zA-Z_$][a-zA-Z0-9_$]*\s*,?\s*$|\}\s*;?\s*$|\};?\s*$)/;
+            if (nonEmptyLines.length > 0 && nonEmptyLines.some((l) => /^\s*import\s/.test(l)) && nonEmptyLines.some((l) => /^\s*export\s/.test(l)) && nonEmptyLines.every((l) => wrapperRe.test(l))) {
+                verified++;
+                continue;
+            }
+        }
+        // Skip thin file check for entry point scripts in scripts/ directory
+        const normalizedForScripts = relPath.replace(/\\/g, '/');
+        if (/(?:^|[/\\])scripts[/\\]/.test(relPath) || normalizedForScripts.startsWith('scripts/') || normalizedForScripts.includes('/scripts/')) {
+            verified++;
+            continue;
+        }
         if (lineCount < 10 && lineCount > 0) {
             issues.push({
                 severity: 'warning',
@@ -345,8 +397,8 @@ export function checkVerify(cwd, since) {
             failed++;
             continue;
         }
-        // 3. Test files must have actual assertions (but not config files)
-        if (isTestFile(relPath) && !isConfigFile(relPath)) {
+        // 3. Test files must have actual assertions (but not config files, not utility files)
+        if (isTestFile(relPath) && !isConfigFile(relPath) && !isTestUtilityFile(relPath, content)) {
             if (!hasAssertions(content)) {
                 issues.push({
                     severity: 'error',

package/dist/cli.js

@@ -22,6 +22,7 @@ import { checkPermissions } from './checks/permissions.js';
 import { checkCompact, runCompactCommand } from './checks/compact.js';
 import { score } from './scorer.js';
 import { reportPretty, reportJSON, reportBadge } from './reporter.js';
+import { clearCache } from './file-cache.js';
 const args = process.argv.slice(2);
 const flags = new Set(args.filter(a => a.startsWith('-') && !a.startsWith('--since')));
 const flagMap = new Map();
@@ -79,7 +80,7 @@ if (flags.has('--help') || flags.has('-h')) {
     --watch       re-run on file changes
     --json        JSON output
     --pretty      force pretty output (even in pipes)
-    --max-files N limit file scanning (default: 2000)
+    --max-files N limit file scanning (default: unlimited)
     -h, --help    show this help
     -v, --version show version
 `);
@@ -105,7 +106,7 @@ const isWatch = flags.has('--watch');
 const isBadge = flags.has('--badge');
 const isJSON = flags.has('--json') || (!process.stdout.isTTY && !flags.has('--pretty') && !isBadge);
 const since = flagMap.get('since');
-const maxFiles = parseInt(flagMap.get('max-files') || '2000', 10) || 2000;
+const maxFiles = flagMap.has('max-files') ? (parseInt(flagMap.get('max-files'), 10) || 0) : 0;
 // Load config
 let config = {};
 const configContent = readFile(resolve(cwd, '.vetrc'));
@@ -232,53 +233,39 @@ async function runChecks() {
     const GLOBAL_TIMEOUT = 120_000;
     try {
         // Check file count and warn if large
-        const { walkFiles: wf } = await import('./util.js');
-        const allProjectFiles = wf(cwd, [], maxFiles);
-        if (allProjectFiles.length >= maxFiles) {
-            if (!isJSON)
-                console.log(`  ${c.yellow}Large project (${allProjectFiles.length}+ files) — scanning first ${maxFiles} files. Use --max-files to increase.${c.reset}\n`);
+        if (maxFiles > 0) {
+            const { walkFiles: wf } = await import('./util.js');
+            const allProjectFiles = wf(cwd, [], maxFiles);
+            if (allProjectFiles.length >= maxFiles) {
+                if (!isJSON)
+                    console.log(`  ${c.yellow}Large project (${allProjectFiles.length}+ files) — scanning first ${maxFiles} files. Use --max-files to increase.${c.reset}\n`);
+            }
         }
-        // Run all checks, grouped into categories
-        // Security: scan, secrets, config, models, owasp, permissions
-        const [scanResult, secretsResult, configResult, modelsResult, owaspResult] = await Promise.all([
+        // Run ALL independent checks in parallel
+        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, memoryResult, verifyResult, testsResult,] = await Promise.all([
             withTimeout('scan', () => checkScan(cwd)),
             withTimeout('secrets', () => checkSecrets(cwd)),
             withTimeout('config', () => checkConfig(cwd, ignore)),
             withTimeout('models', () => checkModels(cwd, ignore)),
             withTimeout('owasp', () => checkOwasp(cwd)),
-        ]);
-        const permissionsResult = await withTimeout('permissions', () => checkPermissions(cwd));
-        if (Date.now() - globalStart > GLOBAL_TIMEOUT) {
-            if (!isJSON)
-                console.error(`  ${c.yellow}⚠ global timeout (${GLOBAL_TIMEOUT / 1000}s) reached — returning partial results${c.reset}`);
-            return score(cwd, { security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult], integrity: [], debt: [], deps: [] });
-        }
-        // Integrity: diff, integrity checks
-        const diffResult = await withTimeout('diff', () => checkDiff(cwd, { since }));
-        const integrityResult = await withTimeout('integrity', () => checkIntegrity(cwd, ignore));
-        // Debt: ready, history, debt
-        const [readyResult, debtResult] = await Promise.all([
+            withTimeout('permissions', () => checkPermissions(cwd)),
+            withTimeout('integrity', () => checkIntegrity(cwd, ignore)),
             withTimeout('ready', () => checkReady(cwd, ignore)),
             withTimeout('debt', () => checkDebt(cwd, ignore)),
+            withTimeout('deps', () => checkDeps(cwd)),
+            withTimeout('receipt', () => checkReceipt(cwd)),
+            withTimeout('compact', () => checkCompact(cwd)),
+            withTimeout('memory', () => checkMemory(cwd)),
+            withTimeout('verify', () => checkVerify(cwd, since)),
+            withTimeout('tests', () => checkTests(cwd, ignore)),
         ]);
-        const historyResult = await withTimeout('history', () => checkHistory(cwd));
-        if (Date.now() - globalStart > GLOBAL_TIMEOUT) {
-            if (!isJSON)
-                console.error(`  ${c.yellow}⚠ global timeout (${GLOBAL_TIMEOUT / 1000}s) reached — returning partial results${c.reset}`);
-            return score(cwd, { security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult], integrity: [diffResult, integrityResult], debt: [readyResult, historyResult, debtResult], deps: [] });
-        }
-        // Deps: deps
-        const depsResult = await withTimeout('deps', () => checkDeps(cwd));
-        // Receipt is informational — fold into integrity category but keep low weight
-        const receiptResult = await withTimeout('receipt', () => checkReceipt(cwd));
-        // Compact: compaction forensics
-        const compactResult = await withTimeout('compact', () => checkCompact(cwd));
-        // Memory: stale facts in agent memory files
-        const memoryResult = await withTimeout('memory', () => checkMemory(cwd));
-        // Verify: agent claim validation
-        const verifyResult = await withTimeout('verify', () => checkVerify(cwd, since));
-        // Tests: test theater detection
-        const testsResult = await withTimeout('tests', () => checkTests(cwd, ignore));
+        // Git-dependent checks (diff + history) — parallel with each other
+        const [diffResult, historyResult] = await Promise.all([
+            withTimeout('diff', () => checkDiff(cwd, { since })),
+            withTimeout('history', () => checkHistory(cwd)),
+        ]);
+        // Clear file cache after all checks complete
+        clearCache();
         return score(cwd, {
             security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult],
             integrity: [diffResult, integrityResult, receiptResult, compactResult, memoryResult, verifyResult, testsResult],

package/dist/file-cache.d.ts

@@ -0,0 +1,4 @@
+export declare function cachedRead(path: string): string;
+/** Cached readFile that returns null on error (matches util.readFile signature) */
+export declare function cachedReadFile(path: string): string | null;
+export declare function clearCache(): void;

package/dist/file-cache.js

@@ -0,0 +1,22 @@
+import { readFileSync } from 'node:fs';
+// Singleton file cache — read once, share across all checks
+const cache = new Map();
+export function cachedRead(path) {
+    if (cache.has(path))
+        return cache.get(path);
+    const content = readFileSync(path, 'utf-8');
+    cache.set(path, content);
+    return content;
+}
+/** Cached readFile that returns null on error (matches util.readFile signature) */
+export function cachedReadFile(path) {
+    try {
+        return cachedRead(path);
+    }
+    catch {
+        return null;
+    }
+}
+export function clearCache() {
+    cache.clear();
+}

package/dist/util.js

@@ -1,6 +1,7 @@
 import { execFileSync } from 'node:child_process';
 import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
 import { join, relative } from 'node:path';
+import { cachedReadFile } from './file-cache.js';
 // ANSI colors — zero deps
 export const c = {
     reset: '\x1b[0m',
@@ -30,18 +31,13 @@ export function isGitRepo(cwd) {
     return git('rev-parse --is-inside-work-tree', cwd) === 'true';
 }
 export function readFile(path) {
-    try {
-        return readFileSync(path, 'utf-8');
-    }
-    catch {
-        return null;
-    }
+    return cachedReadFile(path);
 }
 /** Returns true if the path exists (file or directory). Convenience alias for existsSync. */
 export function fileExists(path) {
     return existsSync(path);
 }
-export function walkFiles(dir, ignore = [], maxFiles = 2000) {
+export function walkFiles(dir, ignore = [], maxFiles = 0) {
     const results = [];
     const defaultIgnore = ['node_modules', '.git', 'dist', 'build', '.next', 'coverage', 'vendor', '__pycache__', '.venv', 'venv'];
     const allIgnore = [...defaultIgnore, ...ignore];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.10.1",
+  "version": "1.11.1",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {