@safetnsr/vet 1.11.0 → 1.11.1

package/dist/checks/debt.js

@@ -1,4 +1,5 @@
-import { join, basename } from 'node:path';
+import { join, basename, dirname } from 'node:path';
+import { existsSync } from 'node:fs';
 import { walkFiles, readFile } from '../util.js';
 // ── Helpers ──────────────────────────────────────────────────────────────────
 const SOURCE_EXTS = new Set(['.ts', '.js', '.tsx', '.jsx']);
@@ -232,8 +233,12 @@ function findDuplicates(allFuncs) {
         if (isSpecPattern(group))
             continue;
         const locations = group.map(f => `${f.name} (${f.file}:${f.line})`).join(', ');
+        // Downgrade to info if all functions in the group are in test directories
+        // or if any function is in an examples/demo directory
+        const allInTest = group.every(f => isInTestDir(f.file));
+        const anyInExample = group.some(f => /(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(f.file));
         issues.push({
-            severity: 'warning',
+            severity: (allInTest || anyInExample) ? 'info' : 'warning',
             message: `near-duplicate functions: ${locations}`,
             file: group[0].file,
             line: group[0].line,
@@ -267,8 +272,12 @@ function findDuplicates(allFuncs) {
                 if (reported.has(key))
                     continue;
                 reported.add(key);
+                // Downgrade to info if both functions are in test directories
+                // or if either is in an examples/demo directory
+                const bothInTest = isInTestDir(a.file) && isInTestDir(b.file);
+                const anyInExample = /(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(a.file) || /(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(b.file);
                 issues.push({
-                    severity: 'warning',
+                    severity: (bothInTest || anyInExample) ? 'info' : 'warning',
                     message: `similar functions (${Math.round(sim * 100)}%): ${a.name} (${a.file}:${a.line}) and ${b.name} (${b.file}:${b.line})`,
                     file: a.file,
                     line: a.line,
@@ -293,6 +302,46 @@ function isLibrary(cwd) {
         return false;
     }
 }
+function isMonorepo(cwd) {
+    try {
+        const pkgRaw = readFile(join(cwd, 'package.json'));
+        if (pkgRaw) {
+            const pkg = JSON.parse(pkgRaw);
+            if (Array.isArray(pkg.workspaces) || pkg.workspaces?.packages)
+                return true;
+        }
+    }
+    catch { /* skip */ }
+    if (existsSync(join(cwd, 'pnpm-workspace.yaml')))
+        return true;
+    if (existsSync(join(cwd, 'lerna.json')))
+        return true;
+    return false;
+}
+/** Find nearest package.json upward from a file path, check if it's a library */
+function isFileInLibraryPackage(cwd, filePath) {
+    let dir = dirname(join(cwd, filePath));
+    const root = cwd;
+    while (dir.length >= root.length) {
+        const pkgPath = join(dir, 'package.json');
+        try {
+            const raw = readFile(pkgPath);
+            if (raw) {
+                // Don't count the root package.json — we already check that via isLibrary
+                if (dir === root)
+                    return false;
+                const pkg = JSON.parse(raw);
+                return !!(pkg.main || pkg.exports || pkg.module || pkg.types || pkg.bin);
+            }
+        }
+        catch { /* skip */ }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return false;
+}
 function findOrphanedExports(cwd, files) {
     const issues = [];
     const sourceFiles = files.filter(f => isSourceFile(f) && !isTestFile(f));
@@ -358,15 +407,18 @@ function findOrphanedExports(cwd, files) {
         }
     }
     const lib = isLibrary(cwd);
+    const mono = isMonorepo(cwd);
     for (const exp of exports) {
         if (!importedNames.has(exp.name)) {
+            // In monorepos, check if the export's file is inside a workspace package that is a library
+            const isLib = lib || (mono && isFileInLibraryPackage(cwd, exp.file));
             issues.push({
-                severity: lib ? 'info' : 'warning',
-                message: `orphaned export: "${exp.name}" is exported but never imported${lib ? ' (library detected — exports may be consumed externally)' : ''}`,
+                severity: isLib ? 'info' : 'warning',
+                message: `orphaned export: "${exp.name}" is exported but never imported${isLib ? ' (library detected — exports may be consumed externally)' : ''}`,
                 file: exp.file,
                 line: exp.line,
                 fixable: true,
-                fixHint: lib ? 'may be public API — verify if still needed' : 'remove the export keyword or delete the function',
+                fixHint: isLib ? 'may be public API — verify if still needed' : 'remove the export keyword or delete the function',
             });
         }
     }
@@ -428,6 +480,10 @@ function findNamingDrift(allFuncs) {
     return issues;
 }
 // ── Main check ───────────────────────────────────────────────────────────────
+/** Check if a file path is in a test directory or is a test file */
+function isInTestDir(file) {
+    return /(?:^|[/\\])(?:test|tests|__tests__)[/\\]/.test(file) || /\.(?:test|spec)\.[jt]sx?$/.test(file);
+}
 export async function checkDebt(cwd, ignore) {
     const allFiles = walkFiles(cwd, ignore);
     const sourceFiles = allFiles.filter(f => isSourceFile(f) && !isTestFile(f));

package/dist/checks/deps.d.ts

@@ -5,4 +5,5 @@ export declare function extractPackageName(specifier: string): string | null;
 export declare function isBuiltin(specifier: string): boolean;
 export declare function detectWorkspacePackages(cwd: string): Set<string>;
 export declare function detectProvidedDeps(cwd: string): Set<string>;
+export declare function collectWorkspaceDeps(cwd: string): Set<string>;
 export declare function checkDeps(cwd: string): Promise<CheckResult>;

package/dist/checks/deps.js

@@ -82,6 +82,9 @@ export function extractPackageName(specifier) {
     // Skip relative imports
     if (specifier.startsWith('.') || specifier.startsWith('/'))
         return null;
+    // Skip URL imports
+    if (specifier.startsWith('http://') || specifier.startsWith('https://'))
+        return null;
     // Skip node: builtins
     if (specifier.startsWith('node:'))
         return null;
@@ -241,7 +244,7 @@ export function detectProvidedDeps(cwd) {
         if (!pkgRaw)
             return provided;
         const pkg = JSON.parse(pkgRaw);
-        const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+        const allDeps = { ...pkg.dependencies, ...pkg.devDependencies, ...pkg.optionalDependencies, ...pkg.peerDependencies };
         // Obsidian plugin
         const hasObsidian = 'obsidian' in (allDeps || {});
         const manifestPath = join(cwd, 'manifest.json');
@@ -281,19 +284,111 @@ function isProvidedPackage(pkg, provided) {
         return true;
     return false;
 }
+// ── Tooling packages (CLI-only, never imported in source) ────────────────────
+const TOOLING_PACKAGES = new Set([
+    'typescript', '@types/node', '@biomejs/biome', 'biome', 'prettier', 'eslint',
+    'husky', 'lint-staged', 'tsx', 'ts-node', 'concurrently', 'npm-run-all',
+    'shx', 'rimraf', 'cross-env', 'nodemon', 'jest', 'vitest', 'mocha',
+    'c8', 'nyc', 'turbo', 'lerna', 'changesets', '@changesets/cli',
+    'webpack', 'webpack-cli', 'vite', 'rollup', 'esbuild', 'swc',
+    'tailwindcss', 'postcss', 'autoprefixer', 'sass', 'less',
+    'commitizen', 'cz-conventional-changelog', 'semantic-release',
+    '@typescript/native-preview',
+]);
+// ── Collect all deps declared in workspace sub-packages ──────────────────────
+export function collectWorkspaceDeps(cwd) {
+    const allDeps = new Set();
+    const globs = [];
+    try {
+        const pkgRaw = readFile(join(cwd, 'package.json'));
+        if (pkgRaw) {
+            const pkg = JSON.parse(pkgRaw);
+            if (Array.isArray(pkg.workspaces))
+                globs.push(...pkg.workspaces);
+            else if (pkg.workspaces?.packages)
+                globs.push(...pkg.workspaces.packages);
+        }
+    }
+    catch { /* skip */ }
+    try {
+        const pnpmWs = readFile(join(cwd, 'pnpm-workspace.yaml'));
+        if (pnpmWs) {
+            const matches = pnpmWs.matchAll(/['"]?([^'":\n]+\*[^'":\n]*)['"]?/g);
+            for (const m of matches)
+                globs.push(m[1].trim());
+        }
+    }
+    catch { /* skip */ }
+    try {
+        const lernaRaw = readFile(join(cwd, 'lerna.json'));
+        if (lernaRaw) {
+            const lerna = JSON.parse(lernaRaw);
+            if (Array.isArray(lerna.packages))
+                globs.push(...lerna.packages);
+        }
+    }
+    catch { /* skip */ }
+    function addDepsFromPkg(pkgPath) {
+        try {
+            const raw = readFile(pkgPath);
+            if (!raw)
+                return;
+            const pkg = JSON.parse(raw);
+            for (const key of Object.keys(pkg.dependencies || {}))
+                allDeps.add(key);
+            for (const key of Object.keys(pkg.devDependencies || {}))
+                allDeps.add(key);
+            for (const key of Object.keys(pkg.optionalDependencies || {}))
+                allDeps.add(key);
+            for (const key of Object.keys(pkg.peerDependencies || {}))
+                allDeps.add(key);
+        }
+        catch { /* skip */ }
+    }
+    for (const glob of globs) {
+        const parts = glob.replace(/\/$/, '').split('/');
+        const starIdx = parts.indexOf('*');
+        if (starIdx === -1) {
+            addDepsFromPkg(join(cwd, glob, 'package.json'));
+        }
+        else {
+            const prefix = parts.slice(0, starIdx).join('/');
+            const prefixDir = join(cwd, prefix);
+            try {
+                if (existsSync(prefixDir) && statSync(prefixDir).isDirectory()) {
+                    for (const entry of readdirSync(prefixDir)) {
+                        const entryDir = join(prefixDir, entry);
+                        try {
+                            if (!statSync(entryDir).isDirectory())
+                                continue;
+                            const suffix = parts.slice(starIdx + 1);
+                            const pkgDir = suffix.length > 0 ? join(entryDir, ...suffix) : entryDir;
+                            addDepsFromPkg(join(pkgDir, 'package.json'));
+                        }
+                        catch { /* skip */ }
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+    }
+    return allDeps;
+}
 // ── Main check ───────────────────────────────────────────────────────────────
 export async function checkDeps(cwd) {
     try {
         const issues = [];
         // Read package.json
         let declaredDeps = {};
+        let devDeps = {};
         let hasPkgJson = false;
         try {
             const pkgRaw = readFile(join(cwd, 'package.json'));
             if (pkgRaw) {
                 const pkg = JSON.parse(pkgRaw);
                 hasPkgJson = true;
-                declaredDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+                devDeps = pkg.devDependencies || {};
+                declaredDeps = { ...pkg.dependencies, ...devDeps, ...pkg.optionalDependencies, ...pkg.peerDependencies };
             }
         }
         catch { /* skip */ }
@@ -382,8 +477,12 @@ export async function checkDeps(cwd) {
         }
         // Dead deps: declared but never imported
         const declaredSet = new Set(declaredNames);
+        const devDepNames = new Set(Object.keys(devDeps));
         for (const pkg of declaredNames) {
             if (!importedPackages.has(pkg)) {
+                // Skip known tooling packages that are devDependencies (used via CLI scripts, not imports)
+                if (TOOLING_PACKAGES.has(pkg) && devDepNames.has(pkg))
+                    continue;
                 // Check if it's a CLI tool / plugin / type package (common false positives)
                 // Still flag it, but as info
                 issues.push({
@@ -397,13 +496,17 @@ export async function checkDeps(cwd) {
         }
         // Detect workspace packages and host-provided deps
         const workspacePackages = detectWorkspacePackages(cwd);
+        const workspaceDeps = collectWorkspaceDeps(cwd);
         const providedDeps = detectProvidedDeps(cwd);
         // Phantom imports: imported but not declared
         for (const pkg of importedPackages) {
             if (!declaredSet.has(pkg)) {
-                // Skip workspace packages
+                // Skip workspace packages (local packages in the monorepo)
                 if (workspacePackages.has(pkg))
                     continue;
+                // Skip deps declared in any workspace sub-package
+                if (workspaceDeps.has(pkg))
+                    continue;
                 // Skip host-provided deps
                 if (isProvidedPackage(pkg, providedDeps))
                     continue;

package/dist/checks/integrity.js

@@ -66,8 +66,22 @@ function isCommentLine(line) {
 function extractRelativeImports(source) {
     const imports = [];
     const lines = source.split('\n');
+    let inTemplateLiteral = false;
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
+        // Track template literal context — check state at start of line, then update
+        const wasInTemplate = inTemplateLiteral;
+        for (let ci = 0; ci < line.length; ci++) {
+            if (line[ci] === '\\') {
+                ci++;
+                continue;
+            }
+            if (line[ci] === '`')
+                inTemplateLiteral = !inTemplateLiteral;
+        }
+        // Skip lines that start inside a template literal — they contain generated code, not real imports
+        if (wasInTemplate)
+            continue;
         // Skip comment lines
         if (isCommentLine(line))
             continue;
@@ -153,16 +167,19 @@ function checkEmptyCatch(cwd, files) {
         // Skip test files — empty catches in tests are usually intentional (testing error paths)
         if (isTestFile(file))
             continue;
+        // Skip example/demo directories — example code doesn't need production error handling
+        if (/(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(file))
+            continue;
         const content = readFile(join(cwd, file));
         if (!content)
             continue;
         const lines = content.split('\n');
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
-            // single-line catch with param and empty body — error silently swallowed
+            // single-line catch with param and empty body — warning (was error, too harsh)
             if (/catch\s*\([^)]*\)\s*\{\s*\}/.test(line)) {
                 issues.push({
-                    severity: 'error',
+                    severity: 'warning',
                     message: 'empty catch block — error silently swallowed',
                     file,
                     line: i + 1,
@@ -174,7 +191,7 @@ function checkEmptyCatch(cwd, files) {
             // single-line catch without param and empty body
             if (/catch\s*\{\s*\}/.test(line)) {
                 issues.push({
-                    severity: 'error',
+                    severity: 'warning',
                     message: 'empty catch block — error silently swallowed',
                     file,
                     line: i + 1,
@@ -213,9 +230,16 @@ function checkEmptyCatch(cwd, files) {
                     // Check if block body is only comments
                     const bodyText = blockLines.join('\n').replace(/\}$/, '').trim();
                     if (bodyText.length > 0 && /^(\s*(\/\/[^\n]*|\/\*[\s\S]*?\*\/)\s*)*$/.test(bodyText)) {
+                        // If the comment contains TODO/FIXME/HACK/XXX/WIP/implement, keep as warning (unfinished work)
+                        // TEMP only as standalone marker (not "temporary" used as adjective)
+                        // Otherwise, any comment text means someone documented why it's empty → downgrade to info
+                        const unfinishedRe = /\b(TODO|FIXME|HACK|XXX|WIP|implement)\b|\bTEMP\b(?!orar)/i;
+                        const sev = unfinishedRe.test(bodyText) ? 'warning' : 'info';
                         issues.push({
-                            severity: 'warning',
-                            message: 'catch block contains only comments — consider proper error handling',
+                            severity: sev,
+                            message: sev === 'info'
+                                ? 'catch block with intentional comment — acknowledged'
+                                : 'catch block contains only comments — consider proper error handling',
                             file,
                             line: i + 1,
                             fixable: false,
@@ -337,6 +361,63 @@ function hasGlobalErrorHandling(content) {
         return true;
     return false;
 }
+function buildFuncScopes(lines) {
+    const scopes = [];
+    // Find function start lines
+    const funcStarts = [];
+    for (let i = 0; i < lines.length; i++) {
+        const l = lines[i];
+        // function declarations and arrow functions
+        const isFuncDecl = /(?:async\s+)?function\s+\w/.test(l) && /\{/.test(l);
+        const isArrow = /=>\s*\{/.test(l);
+        const isMethod = /^\s+(?:async\s+)?\w+\s*\([^)]*\)\s*(?::\s*\S+)?\s*\{/.test(l) && !/\b(?:if|for|while|switch|catch)\b/.test(l);
+        if (isFuncDecl || isArrow || isMethod) {
+            const isExported = /^\s*export\s/.test(l) || (i > 0 && /^\s*export\s/.test(lines[i - 1]));
+            funcStarts.push({ line: i, isExported });
+        }
+    }
+    for (const fs of funcStarts) {
+        // Find the opening brace on the start line
+        let braceIdx = lines[fs.line].indexOf('{');
+        if (braceIdx === -1)
+            continue;
+        let depth = 0;
+        let endLine = fs.line;
+        let hasTry = false;
+        for (let i = fs.line; i < lines.length; i++) {
+            const startJ = i === fs.line ? braceIdx : 0;
+            for (let j = startJ; j < lines[i].length; j++) {
+                if (lines[i][j] === '{')
+                    depth++;
+                if (lines[i][j] === '}') {
+                    depth--;
+                    if (depth === 0) {
+                        endLine = i;
+                        break;
+                    }
+                }
+            }
+            if (/\btry\s*\{/.test(lines[i]))
+                hasTry = true;
+            if (depth === 0)
+                break;
+        }
+        scopes.push({ startLine: fs.line, endLine, hasTryCatch: hasTry, isExported: fs.isExported });
+    }
+    return scopes;
+}
+function findEnclosingFunc(scopes, lineIdx) {
+    // Find the tightest (smallest range) enclosing function
+    let best = null;
+    for (const s of scopes) {
+        if (lineIdx >= s.startLine && lineIdx <= s.endLine) {
+            if (!best || (s.endLine - s.startLine) < (best.endLine - best.startLine)) {
+                best = s;
+            }
+        }
+    }
+    return best;
+}
 function checkUnhandledAsync(cwd, files) {
     const issues = [];
     const sourceExts = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
@@ -349,6 +430,9 @@ function checkUnhandledAsync(cwd, files) {
         // Skip error boundary files — they ARE the error handlers
         if (isErrorBoundaryFile(file))
             continue;
+        // Skip example/demo directories — example code doesn't need production error handling
+        if (/(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(file))
+            continue;
         const content = readFile(join(cwd, file));
         if (!content)
             continue;
@@ -383,6 +467,8 @@ function checkUnhandledAsync(cwd, files) {
                 insideTry.add(i);
             }
         }
+        // Build function scope info for severity decisions
+        const funcScopes = buildFuncScopes(lines);
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
             // await without try/catch context — detect standalone awaits
@@ -399,11 +485,27 @@ function checkUnhandledAsync(cwd, files) {
                 const hasThenError = /\.then\s*\([^,]+,\s*\w+/.test(line) || (i + 1 < lines.length && /\.then\s*\([^,]+,\s*\w+/.test(lines[i + 1]));
                 if (!hasCatch && !hasThenError) {
                     unhandledCount++;
-                    // Downgrade Next.js server components to info (framework handles errors)
+                    // Determine severity:
+                    // - 'info' for Next.js server components, or functions that have try/catch elsewhere in their body
+                    // - 'warning' only for exported functions with NO try/catch anywhere
+                    // - 'info' for everything else (non-exported, internal functions)
                     const isServerComp = isNextjsServerComponent(file);
+                    const enclosing = findEnclosingFunc(funcScopes, i);
+                    const hasFuncTryCatch = enclosing?.hasTryCatch ?? false;
+                    const isExported = enclosing?.isExported ?? false;
+                    let severity;
+                    if (isServerComp || hasFuncTryCatch) {
+                        severity = 'info';
+                    }
+                    else if (isExported) {
+                        severity = 'warning';
+                    }
+                    else {
+                        severity = 'info';
+                    }
                     if (unhandledCount <= 10) {
                         issues.push({
-                            severity: isServerComp ? 'info' : 'warning',
+                            severity,
                             message: isServerComp
                                 ? 'unhandled async: await without try/catch (Next.js server component — framework-managed)'
                                 : 'unhandled async: await without try/catch',
@@ -436,10 +538,11 @@ export async function checkIntegrity(cwd, ignore) {
     let score = 100;
     score -= hallucinatedIssues.length * 10;
     score -= emptyCatchIssues.filter(i => i.severity === 'error').length * 8;
+    score -= emptyCatchIssues.filter(i => i.severity === 'warning').length * 3;
     score -= stubbedTestIssues.filter(i => i.severity === 'error').length * 5;
-    // Unhandled async capped at -30 (only count warnings, not info-downgraded ones)
-    const unhandledErrors = unhandledAsyncIssues.filter(i => i.severity === 'warning').length;
-    score -= Math.min(30, unhandledErrors * 3);
+    // Unhandled async capped at -15 (only count warnings, not info-downgraded ones)
+    const unhandledWarnings = unhandledAsyncIssues.filter(i => i.severity === 'warning').length;
+    score -= Math.min(15, unhandledWarnings * 3);
     score = Math.max(0, Math.round(score));
     // Summary parts
     const parts = [];

package/dist/checks/memory.js

@@ -202,6 +202,20 @@ export function checkMemory(cwd) {
             // Skip ../  references — they point to sibling repos and can't be validated locally
             if (p.startsWith('../'))
                 continue;
+            // Skip relative paths that appear inside inline code (`...`) in markdown files
+            if (relPath.endsWith('.md') || relPath.endsWith('.mdx')) {
+                const lineText = content.split('\n')[line - 1] || '';
+                // Check if this path is inside backtick code spans (inline code examples)
+                const pathIdx = lineText.indexOf(p);
+                if (pathIdx >= 0) {
+                    const before = lineText.substring(0, pathIdx);
+                    const after = lineText.substring(pathIdx + p.length);
+                    // Count backticks before — odd means inside inline code
+                    const ticksBefore = (before.match(/`/g) || []).length;
+                    if (ticksBefore % 2 === 1)
+                        continue;
+                }
+            }
             const resolved = p.startsWith('/') ? p : resolve(cwd, p);
             if (!existsSync(resolved)) {
                 issues.push({

package/dist/checks/models.js

@@ -102,12 +102,16 @@ async function tryModelGraveyard(cwd) {
         const aiFramework = isAiFramework(cwd);
         // Files that define deprecated model registries should not be flagged
         const SELF_FILES = ['models.ts', 'models.js', 'model-graveyard', 'model-registry', 'sunset', 'fix/models'];
+        const GENERATED_PATTERNS = ['.generated.', '.gen.'];
         for (const match of report.matches) {
             if (!match.model)
                 continue;
             // Skip self-referencing files (model definition/fix files)
             if (match.file && SELF_FILES.some(s => match.file.toLowerCase().includes(s)))
                 continue;
+            // Skip auto-generated model registries
+            if (match.file && GENERATED_PATTERNS.some(p => match.file.includes(p)))
+                continue;
             if (match.model.status === 'deprecated' || match.model.status === 'eol') {
                 const inTestDocs = match.file && isTestOrDocsFile(match.file);
                 const severity = (aiFramework || inTestDocs) ? 'info' : 'error';

package/dist/checks/owasp/asi03-identity-abuse.js

@@ -21,6 +21,8 @@ export function checkASI03(cwd, configFiles) {
             continue;
         const contentLower = content.toLowerCase();
         const relPath = relative(cwd, filePath);
+        const normalizedPath = relPath.replace(/\\/g, '/');
+        const isCiFile = normalizedPath.startsWith('.github/workflows/') || normalizedPath.startsWith('.circleci/') || normalizedPath.startsWith('.gitlab-ci');
         if (leastPrivKeywords.some(kw => new RegExp(kw, 'i').test(content))) {
             hasLeastPrivMention = true;
         }
@@ -55,7 +57,7 @@ export function checkASI03(cwd, configFiles) {
                     deduction = Math.min(deduction + 15, 30);
                 }
             }
-            if (sudoPattern.test(line)) {
+            if (!isCiFile && sudoPattern.test(line)) {
                 findings.push({
                     asiId: 'ASI03',
                     severity: 'warning',

package/dist/checks/ready.js

@@ -87,19 +87,46 @@ function builtinReady(cwd, ignore) {
         issues.push({ severity: 'error', message: 'no tests — AI agents produce better code when tests exist to validate against', fixable: false });
     }
     let largeFileCount = 0;
+    const generatedFileRe = /(?:\.generated\.[jt]sx?$|\.gen\.[jt]s$|\.min\.[jt]s$|\.min\.css$|(?:^|[/\\])(?:generated|vendor|__generated__)[/\\])/;
+    const exampleDirRe = /(?:^|[/\\])(?:examples?|demos?|scripts?)[/\\]/;
+    const testFileRe = /(?:\.(?:test|spec)\.[jt]sx?$|(?:^|[/\\])(?:test|tests|__tests__)[/\\])/;
+    const largeFileIssues = [];
     for (const f of files) {
         if (!codeExts.some(ext => f.endsWith(ext)))
             continue;
+        // Skip generated/vendored/minified files
+        if (generatedFileRe.test(f))
+            continue;
+        // Bug 5: Skip files in examples/demo directories
+        if (exampleDirRe.test(f))
+            continue;
         const content = readFile(join(cwd, f));
-        if (content && content.split('\n').length > 500) {
+        if (!content)
+            continue;
+        const lineCount = content.split('\n').length;
+        // Bug 3: Higher threshold for test files (1000 vs 500)
+        const threshold = testFileRe.test(f) ? 1000 : 500;
+        if (lineCount > threshold) {
             largeFileCount++;
-            if (largeFileCount <= 3) {
-                issues.push({ severity: 'warning', message: `${f} is ${content.split('\n').length} lines — split for better AI comprehension`, fixable: false });
-            }
+            largeFileIssues.push({ severity: 'warning', message: `${f} is ${lineCount} lines — split for better AI comprehension`, fixable: false });
         }
     }
-    if (largeFileCount > 3) {
-        issues.push({ severity: 'warning', message: `...and ${largeFileCount - 3} more large files`, fixable: false });
+    // Bug 4: Cap large file penalty for monorepos
+    if (isMonorepo && largeFileIssues.length > 10) {
+        // First 10 stay as warnings, rest downgraded to info
+        for (let i = 10; i < largeFileIssues.length; i++) {
+            largeFileIssues[i].severity = 'info';
+        }
+    }
+    // Add issues (show first 3 inline, rest as summary)
+    for (let i = 0; i < Math.min(3, largeFileIssues.length); i++) {
+        issues.push(largeFileIssues[i]);
+    }
+    if (largeFileIssues.length > 3) {
+        // Add remaining issues individually (for JSON output) but summarize in display
+        for (let i = 3; i < largeFileIssues.length; i++) {
+            issues.push(largeFileIssues[i]);
+        }
     }
     const hasEnv = files.some(f => f === '.env' || f === '.env.local');
     const hasEnvExample = files.some(f => f === '.env.example' || f === '.env.template');

package/dist/checks/scan.js

@@ -170,6 +170,9 @@ function scanContent(content, relPath) {
             // Skip command-substitution checks in workflow files (shell commands are expected)
             if (pattern.id === 'command-substitution' && isWorkflow)
                 continue;
+            // Skip permission-escalation in CI workflow files (sudo apt-get etc. is standard)
+            if (pattern.id === 'permission-escalation' && isWorkflow)
+                continue;
             // Skip command-substitution in markdown code contexts
             if (pattern.id === 'command-substitution' && relPath.endsWith('.md') && isInCodeContext(lines, i))
                 continue;

package/dist/checks/tests.js

@@ -1,4 +1,4 @@
-import { join } from 'node:path';
+import { join, basename } from 'node:path';
 import { walkFiles } from '../util.js';
 import { cachedRead } from '../file-cache.js';
 const TEST_FILE_RE = /\.(test|spec)\.(ts|js|tsx|jsx)$/;
@@ -6,6 +6,22 @@ const TEST_DIR_RE = /(?:^|[/\\])(__tests__|tests?)[/\\]/;
 function isTestFile(relPath) {
     return TEST_FILE_RE.test(relPath) || TEST_DIR_RE.test(relPath);
 }
+/** Test utility/helper file patterns — these export helpers, not actual tests */
+const TEST_UTILITY_NAMES = /(?:^|[/\\])(?:util(?:itie)?s?|helpers?|fixtures?|mocks?|setup|factor(?:y|ies)|themes?|test-(?:utils?|helpers?|setup|fixtures?|mocks?|themes?))\.[jt]sx?$/i;
+function isTestUtilityFile(relPath, content) {
+    const hasTestCalls = /\b(?:test|it|describe|Deno\.test)\s*\(/.test(content);
+    // Check filename pattern — but only if no test runner calls present
+    const base = basename(relPath);
+    if (TEST_UTILITY_NAMES.test(base) && !hasTestCalls)
+        return true;
+    // If in a test dir, has exports, but no test runner calls — it's a utility
+    if (TEST_DIR_RE.test(relPath)) {
+        const hasExports = /\bexport\s+(function|const|let|var|class|default|{)/.test(content);
+        if (hasExports && !hasTestCalls)
+            return true;
+    }
+    return false;
+}
 // Pattern 1: Tautological assertions
 function findTautological(lines, file) {
     const issues = [];
@@ -119,6 +135,11 @@ function findZeroAssertionTests(content, file) {
         // Check for assertion calls
         const assertionRe = /(?:expect\s*\(|assert\.|\.should\.|toBe\s*\(|toEqual\s*\(|toMatch\s*\(|toThrow\s*\()/;
         if (!assertionRe.test(body)) {
+            // If every non-empty, non-comment statement is a function call, it's delegating to a helper
+            const stmts = stripped.split(/;\s*|\n/).map(s => s.trim()).filter(s => s && !s.startsWith('//'));
+            const delegatingRe = /^(await\s+)?[a-zA-Z_$][a-zA-Z0-9_$.]*\s*\(/;
+            if (stmts.length > 0 && stmts.length <= 3 && stmts.every(s => delegatingRe.test(s)))
+                continue;
             const line = content.substring(0, m.index).split('\n').length;
             issues.push({
                 severity: 'warning',
@@ -213,6 +234,9 @@ export function checkTests(cwd, ignore) {
         // Skip files with vet-ignore: tests directive
         if (hasVetIgnore(content, 'tests'))
             continue;
+        // Skip test utility/helper files — they export helpers, not tests
+        if (isTestUtilityFile(rel, content))
+            continue;
         const lines = content.split('\n');
         issues.push(...findTautological(lines, rel));
         issues.push(...findEmptyBodies(content, rel));

package/dist/checks/verify.js

@@ -94,6 +94,31 @@ function isTestFile(filePath) {
         return true;
     return false;
 }
+/** Test utility/helper file patterns — these export helpers, not actual tests */
+const TEST_UTILITY_NAMES = /(?:^|[/\\])(?:util(?:itie)?s?|helpers?|fixtures?|mocks?|setup|factor(?:y|ies)|themes?|test-(?:utils?|helpers?|setup|fixtures?|mocks?|themes?))\.[jt]sx?$/i;
+const TEST_DIR_PATTERN = /(?:^|[/\\])(__tests__|tests?)[/\\]/;
+function isTestUtilityFile(filePath, content) {
+    const hasTestCalls = /\b(?:test|it|describe|Deno\.test)\s*\(/.test(content);
+    const base = basename(filePath);
+    if (TEST_UTILITY_NAMES.test(base) && !hasTestCalls)
+        return true;
+    const normalized = filePath.replace(/\\/g, '/');
+    if (TEST_DIR_PATTERN.test(normalized) || normalized.startsWith('test/') || normalized.startsWith('tests/')) {
+        const hasExports = /\bexport\s+(function|const|let|var|class|default|{)/.test(content);
+        // Files with exports but no test calls are utilities
+        if (hasExports && !hasTestCalls)
+            return true;
+        // Files with no exports AND no test calls but with actual code (imports, function defs)
+        // are standalone scripts (debug, examples, repros) — not test files
+        if (!hasExports && !hasTestCalls) {
+            const hasImports = /\bimport\s/.test(content);
+            const hasFunctions = /\b(?:function|class|const\s+\w+\s*=\s*(?:async\s+)?(?:\(|[a-z]))/i.test(content);
+            if (hasImports || hasFunctions)
+                return true;
+        }
+    }
+    return false;
+}
 function hasAssertions(content) {
     return /\b(assert|expect\s*\(|it\s*\(|test\s*\(|describe\s*\(|should\.|toBe\(|toEqual\(|assertEqual|assertStrictEqual)\b/i.test(content);
 }
@@ -322,6 +347,32 @@ export function checkVerify(cwd, since) {
             verified++;
             continue;
         }
+        // Skip vendor, minified, dist, and build files
+        if (/(?:^|[/\\])vendor[/\\]/.test(relPath) || /\.min\.(js|css|mjs)$/.test(relPath) || /(?:^|[/\\])(?:dist|build)[/\\]/.test(relPath)) {
+            verified++;
+            continue;
+        }
+        // Skip re-export barrel files (all non-empty lines are re-exports or wrappers)
+        if (lineCount > 0 && lineCount < 10) {
+            const nonEmptyLines = content.split('\n').filter((l) => l.trim() && !l.trim().startsWith('//') && !l.trim().startsWith('/*') && !l.trim().startsWith('*'));
+            const reExportRe = /^\s*(?:export\s+\*\s+from\s|export\s*\{[^}]*\}\s*from\s|module\.exports\s*=\s*require\s*\()/;
+            if (nonEmptyLines.length > 0 && nonEmptyLines.every((l) => reExportRe.test(l))) {
+                verified++;
+                continue;
+            }
+            // Also skip import-and-reexport wrappers: files with only imports, exports, and simple identifiers/braces
+            const wrapperRe = /^\s*(?:import\s|export\s|[a-zA-Z_$][a-zA-Z0-9_$]*\s*,?\s*$|\}\s*;?\s*$|\};?\s*$)/;
+            if (nonEmptyLines.length > 0 && nonEmptyLines.some((l) => /^\s*import\s/.test(l)) && nonEmptyLines.some((l) => /^\s*export\s/.test(l)) && nonEmptyLines.every((l) => wrapperRe.test(l))) {
+                verified++;
+                continue;
+            }
+        }
+        // Skip thin file check for entry point scripts in scripts/ directory
+        const normalizedForScripts = relPath.replace(/\\/g, '/');
+        if (/(?:^|[/\\])scripts[/\\]/.test(relPath) || normalizedForScripts.startsWith('scripts/') || normalizedForScripts.includes('/scripts/')) {
+            verified++;
+            continue;
+        }
         if (lineCount < 10 && lineCount > 0) {
             issues.push({
                 severity: 'warning',
@@ -346,8 +397,8 @@ export function checkVerify(cwd, since) {
             failed++;
             continue;
         }
-        // 3. Test files must have actual assertions (but not config files)
-        if (isTestFile(relPath) && !isConfigFile(relPath)) {
+        // 3. Test files must have actual assertions (but not config files, not utility files)
+        if (isTestFile(relPath) && !isConfigFile(relPath) && !isTestUtilityFile(relPath, content)) {
             if (!hasAssertions(content)) {
                 issues.push({
                     severity: 'error',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.11.0",
+  "version": "1.11.1",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {