@safetnsr/vet 1.12.0 → 1.14.0

package/dist/categories.js

@@ -16,10 +16,10 @@ export function toGrade(score) {
 }
 // ── Category weights ─────────────────────────────────────────────────────────
 const WEIGHTS = {
-    security: 0.30,
-    integrity: 0.30,
-    debt: 0.25,
-    deps: 0.15,
+    security: 0.25,
+    integrity: 0.35,
+    debt: 0.30,
+    deps: 0.10,
 };
 // ── Scoring floor for non-security checks ────────────────────────────────────
 const SECURITY_CHECKS = new Set(['scan', 'secrets', 'permissions', 'owasp']);
@@ -37,6 +37,28 @@ function averageScore(checks) {
     const total = checks.reduce((sum, c) => sum + applyScoreFloor(c), 0);
     return Math.round(total / checks.length);
 }
+// ── Completeness multiplier ─────────────────────────────────────────────────
+/**
+ * Extract completeness score and apply it as a multiplier to the overall score.
+ * A repo with completeness=0 (no JS/TS source) gets heavily penalized.
+ * completeness 0-30 → multiplier 0.3-0.6
+ * completeness 30-70 → multiplier 0.6-0.85
+ * completeness 70-100 → multiplier 0.85-1.0
+ */
+function completenessMultiplier(categories) {
+    const integrity = categories.find(c => c.name === 'integrity');
+    if (!integrity)
+        return 1.0;
+    const comp = integrity.checks.find(c => c.name === 'completeness');
+    if (!comp)
+        return 1.0;
+    const s = comp.score;
+    if (s >= 70)
+        return 0.85 + (s - 70) * (0.15 / 30);
+    if (s >= 30)
+        return 0.6 + (s - 30) * (0.25 / 40);
+    return 0.3 + s * (0.3 / 30);
+}
 // ── Group checks into categories ─────────────────────────────────────────────
 export function buildCategories(checkMap) {
     const categories = [];
@@ -63,7 +85,9 @@ export function buildVetResult(project, categories) {
         weightedSum += cat.score * cat.weight;
         totalWeight += cat.weight;
     }
-    const overallScore = totalWeight > 0 ? Math.round(weightedSum / totalWeight) : 0;
+    const rawScore = totalWeight > 0 ? weightedSum / totalWeight : 0;
+    const compMult = completenessMultiplier(categories);
+    const overallScore = Math.round(rawScore * compMult);
     const grade = toGrade(overallScore);
     const allIssues = categories.flatMap(c => c.issues);
     // Read version from package.json

package/dist/checks/bloat.d.ts

@@ -0,0 +1,3 @@
+import type { CheckResult } from '../types.js';
+export declare function checkBloat(cwd: string): Promise<CheckResult>;
+export declare function runBloatCommand(format: 'ascii' | 'json'): Promise<void>;

package/dist/checks/bloat.js

@@ -0,0 +1,369 @@
+import { join, extname } from 'node:path';
+import { statSync } from 'node:fs';
+import { walkFiles, readFile, gitExec, c } from '../util.js';
+// ── Constants ────────────────────────────────────────────────────────────────
+const AI_PATTERNS = /\b(claude|copilot|ai|agent)\b|\[(claude|ai)\]/i;
+const AI_FILE_MARKERS = ['.claude/', 'CLAUDE.md', 'AGENTS.md'];
+const NON_CODE_EXTS = new Set(['.txt', '.log', '.csv', '.json']);
+const SOURCE_EXTS = new Set(['.ts', '.js', '.tsx', '.jsx']);
+const TEN_MB = 10 * 1024 * 1024;
+const BRANCH_RE = /\b(if|else|switch|case)\b|&&|\|\||\?[^?.:]/g;
+// ── Baseline detection ───────────────────────────────────────────────────────
+function findBaseline(cwd) {
+    // 1. Search git log for AI-pattern commits
+    const log = gitExec(['log', '--oneline', '--all', '--reverse'], cwd);
+    if (!log) {
+        return { sha: '', message: '', method: 'empty' };
+    }
+    const lines = log.split('\n').filter(Boolean);
+    if (lines.length === 0) {
+        return { sha: '', message: '', method: 'empty' };
+    }
+    for (const line of lines) {
+        const spaceIdx = line.indexOf(' ');
+        if (spaceIdx === -1)
+            continue;
+        const msg = line.substring(spaceIdx + 1);
+        if (AI_PATTERNS.test(msg)) {
+            const sha = line.substring(0, spaceIdx);
+            // Use parent of this commit as baseline (the commit before AI started)
+            const parent = gitExec(['rev-parse', `${sha}~1`], cwd);
+            if (parent) {
+                const parentMsg = gitExec(['log', '--oneline', '-1', parent], cwd);
+                return { sha: parent, message: parentMsg.substring(parentMsg.indexOf(' ') + 1) || parent, method: 'ai-commit-parent' };
+            }
+            // If no parent (first commit is AI), use this commit itself
+            return { sha, message: msg, method: 'ai-commit' };
+        }
+    }
+    // 2. Fallback: find first commit adding AI marker files
+    for (const marker of AI_FILE_MARKERS) {
+        const result = gitExec(['log', '--all', '--reverse', '--diff-filter=A', '--', marker], cwd);
+        if (result) {
+            const firstLine = result.split('\n').find(l => l.startsWith('commit '));
+            if (firstLine) {
+                const sha = firstLine.replace('commit ', '').trim();
+                const shortSha = sha.substring(0, 7);
+                const parent = gitExec(['rev-parse', `${sha}~1`], cwd);
+                if (parent) {
+                    const parentLog = gitExec(['log', '--oneline', '-1', parent], cwd);
+                    return { sha: parent, message: parentLog.substring(parentLog.indexOf(' ') + 1) || parent, method: 'marker-file' };
+                }
+            }
+        }
+    }
+    // 3. Fallback: initial commit (everything is baseline)
+    const initial = lines[0];
+    const spaceIdx = initial.indexOf(' ');
+    const sha = spaceIdx !== -1 ? initial.substring(0, spaceIdx) : initial;
+    const msg = spaceIdx !== -1 ? initial.substring(spaceIdx + 1) : sha;
+    return { sha, message: msg, method: 'initial' };
+}
+function analyzeFileGrowth(cwd, baselineSha) {
+    if (!baselineSha) {
+        return { files: [], baselineLOC: 0, currentLOC: 0 };
+    }
+    const numstat = gitExec(['diff', baselineSha, 'HEAD', '--numstat'], cwd);
+    if (!numstat) {
+        return { files: [], baselineLOC: 0, currentLOC: 0 };
+    }
+    const files = [];
+    let totalBaselineLOC = 0;
+    let totalCurrentLOC = 0;
+    for (const line of numstat.split('\n').filter(Boolean)) {
+        const parts = line.split('\t');
+        if (parts.length < 3)
+            continue;
+        const [addStr, delStr, file] = parts;
+        // Binary files show as '-'
+        if (addStr === '-' || delStr === '-')
+            continue;
+        const additions = parseInt(addStr, 10) || 0;
+        const deletions = parseInt(delStr, 10) || 0;
+        // Get baseline line count for this file
+        const baselineContent = gitExec(['show', `${baselineSha}:${file}`], cwd);
+        const baselineLines = baselineContent ? baselineContent.split('\n').length : 0;
+        const isNew = baselineLines === 0;
+        const currentLines = Math.max(0, baselineLines + additions - deletions);
+        const denominator = Math.max(baselineLines, 1);
+        const growthPct = ((currentLines / denominator) - 1) * 100;
+        totalBaselineLOC += baselineLines;
+        totalCurrentLOC += currentLines;
+        files.push({ file, additions, deletions, baselineLines, currentLines, growthPct, isNew });
+    }
+    // If baseline LOC is 0 but we have current LOC, count all current files
+    if (totalBaselineLOC === 0) {
+        // Count current LOC from all tracked files
+        const lsFiles = gitExec(['ls-files'], cwd);
+        if (lsFiles) {
+            for (const f of lsFiles.split('\n').filter(Boolean)) {
+                const content = readFile(join(cwd, f));
+                if (content)
+                    totalCurrentLOC += content.split('\n').length;
+            }
+        }
+    }
+    return { files, baselineLOC: totalBaselineLOC, currentLOC: totalCurrentLOC };
+}
+function findNonCodeBombs(cwd) {
+    const bombs = [];
+    const allFiles = walkFiles(cwd);
+    for (const file of allFiles) {
+        const ext = extname(file).toLowerCase();
+        if (!NON_CODE_EXTS.has(ext))
+            continue;
+        try {
+            const stat = statSync(join(cwd, file));
+            if (stat.size > TEN_MB) {
+                bombs.push({ file, sizeBytes: stat.size });
+            }
+        }
+        catch { /* skip */ }
+    }
+    return bombs;
+}
+function findPaddingFiles(cwd) {
+    const paddings = [];
+    const allFiles = walkFiles(cwd);
+    for (const file of allFiles) {
+        const ext = extname(file).toLowerCase();
+        if (!SOURCE_EXTS.has(ext))
+            continue;
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        const lines = content.split('\n');
+        const loc = lines.length;
+        if (loc <= 1000)
+            continue;
+        // Count branch constructs
+        let branches = 0;
+        for (const line of lines) {
+            const matches = line.match(BRANCH_RE);
+            if (matches)
+                branches += matches.length;
+        }
+        const density = branches / loc;
+        if (density < 0.02) {
+            paddings.push({ file, loc, density });
+        }
+    }
+    return paddings;
+}
+// ── Scoring ──────────────────────────────────────────────────────────────────
+function calculateScore(bloatRatio, bloatedFiles, bombs, paddings) {
+    let s = 100;
+    const penalties = [];
+    // Bloat ratio penalties
+    if (bloatRatio > 20) {
+        s -= 40;
+        penalties.push(`bloat ratio ${bloatRatio.toFixed(1)}x (>20x): -40`);
+    }
+    else if (bloatRatio > 10) {
+        s -= 30;
+        penalties.push(`bloat ratio ${bloatRatio.toFixed(1)}x (>10x): -30`);
+    }
+    else if (bloatRatio > 5) {
+        s -= 20;
+        penalties.push(`bloat ratio ${bloatRatio.toFixed(1)}x (>5x): -20`);
+    }
+    // Per-file growth penalties
+    const growthPenalty = Math.min(30, bloatedFiles.length * 5);
+    if (growthPenalty > 0) {
+        s -= growthPenalty;
+        penalties.push(`${bloatedFiles.length} file(s) >500% growth: -${growthPenalty}`);
+    }
+    // Non-code bomb penalties
+    const bombPenalty = Math.min(20, bombs.length * 10);
+    if (bombPenalty > 0) {
+        s -= bombPenalty;
+        penalties.push(`${bombs.length} non-code bomb(s) >10MB: -${bombPenalty}`);
+    }
+    // Padding penalties
+    const paddingPenalty = Math.min(20, paddings.length * 5);
+    if (paddingPenalty > 0) {
+        s -= paddingPenalty;
+        penalties.push(`${paddings.length} low-complexity padding file(s): -${paddingPenalty}`);
+    }
+    return { score: Math.max(0, s), penalties };
+}
+// ── Format helpers ───────────────────────────────────────────────────────────
+function formatSize(bytes) {
+    if (bytes >= 1024 * 1024 * 1024)
+        return `${(bytes / (1024 * 1024 * 1024)).toFixed(0)}GB`;
+    if (bytes >= 1024 * 1024)
+        return `${(bytes / (1024 * 1024)).toFixed(0)}MB`;
+    if (bytes >= 1024)
+        return `${(bytes / 1024).toFixed(0)}KB`;
+    return `${bytes}B`;
+}
+// ── Main check (for full vet run) ────────────────────────────────────────────
+export async function checkBloat(cwd) {
+    const baseline = findBaseline(cwd);
+    if (!baseline.sha) {
+        return {
+            name: 'bloat',
+            score: 100,
+            maxScore: 100,
+            issues: [{ severity: 'info', message: 'empty repo — no bloat analysis possible', fixable: false }],
+            summary: 'empty repo',
+        };
+    }
+    const { files, baselineLOC, currentLOC } = analyzeFileGrowth(cwd, baseline.sha);
+    // Check if repo has any tracked files
+    const trackedFiles = gitExec(['ls-files'], cwd);
+    if (!trackedFiles || trackedFiles.trim().length === 0) {
+        return {
+            name: 'bloat',
+            score: 100,
+            maxScore: 100,
+            issues: [{ severity: 'info', message: 'empty repo — no files to analyze', fixable: false }],
+            summary: 'empty repo',
+        };
+    }
+    const bloatRatio = baselineLOC > 0 ? currentLOC / baselineLOC : 1;
+    const bloatedFiles = files.filter(f => f.growthPct > 500);
+    const bombs = findNonCodeBombs(cwd);
+    const paddings = findPaddingFiles(cwd);
+    const { score: finalScore, penalties } = calculateScore(bloatRatio, bloatedFiles, bombs, paddings);
+    const issues = [];
+    for (const f of bloatedFiles) {
+        issues.push({
+            severity: 'warning',
+            message: `file growth +${Math.round(f.growthPct)}%: ${f.file} (${f.baselineLines} → ${f.currentLines} lines)`,
+            file: f.file,
+            fixable: false,
+            fixHint: 'review for unnecessary code generation',
+        });
+    }
+    for (const b of bombs) {
+        issues.push({
+            severity: 'warning',
+            message: `non-code bomb: ${b.file} (${formatSize(b.sizeBytes)})`,
+            file: b.file,
+            fixable: true,
+            fixHint: 'add to .gitignore or remove large non-code file',
+        });
+    }
+    for (const p of paddings) {
+        issues.push({
+            severity: 'warning',
+            message: `low-complexity padding: ${p.file} (${p.loc} LOC, density ${p.density.toFixed(3)})`,
+            file: p.file,
+            fixable: false,
+            fixHint: 'review for auto-generated boilerplate',
+        });
+    }
+    if (bloatRatio > 5) {
+        issues.push({
+            severity: bloatRatio > 20 ? 'error' : 'warning',
+            message: `bloat ratio ${bloatRatio.toFixed(1)}x (baseline: ${baselineLOC} LOC → current: ${currentLOC} LOC)`,
+            fixable: false,
+        });
+    }
+    const parts = [];
+    parts.push(`${bloatRatio.toFixed(1)}x bloat ratio`);
+    if (bloatedFiles.length > 0)
+        parts.push(`${bloatedFiles.length} bloated file(s)`);
+    if (bombs.length > 0)
+        parts.push(`${bombs.length} non-code bomb(s)`);
+    if (paddings.length > 0)
+        parts.push(`${paddings.length} padding file(s)`);
+    return {
+        name: 'bloat',
+        score: finalScore,
+        maxScore: 100,
+        issues,
+        summary: parts.join(', '),
+    };
+}
+// ── Standalone subcommand ────────────────────────────────────────────────────
+export async function runBloatCommand(format) {
+    const cwd = process.cwd();
+    const baseline = findBaseline(cwd);
+    if (!baseline.sha) {
+        if (format === 'json') {
+            console.log(JSON.stringify({ baseline: null, bloatRatio: 1, score: 100, files: [], message: 'empty repo' }));
+        }
+        else {
+            console.log(`\n  ${c.bold}vet bloat${c.reset} — agent code bloat detector\n`);
+            console.log(`  ${c.dim}empty repo — no bloat analysis possible${c.reset}\n`);
+            console.log(`  score: 100/100\n`);
+        }
+        return;
+    }
+    const { files, baselineLOC, currentLOC } = analyzeFileGrowth(cwd, baseline.sha);
+    const bloatRatio = baselineLOC > 0 ? currentLOC / baselineLOC : 1;
+    const bloatedFiles = files.filter(f => f.growthPct > 500);
+    const bombs = findNonCodeBombs(cwd);
+    const paddings = findPaddingFiles(cwd);
+    const { score: finalScore } = calculateScore(bloatRatio, bloatedFiles, bombs, paddings);
+    if (format === 'json') {
+        const result = {
+            baseline: { sha: baseline.sha, message: baseline.message, method: baseline.method },
+            bloatRatio: Math.round(bloatRatio * 10) / 10,
+            baselineLOC,
+            currentLOC,
+            score: finalScore,
+            bloatedFiles: bloatedFiles.map(f => ({ file: f.file, growthPct: Math.round(f.growthPct), lines: f.currentLines })),
+            nonCodeBombs: bombs.map(b => ({ file: b.file, size: b.sizeBytes })),
+            paddingFiles: paddings.map(p => ({ file: p.file, loc: p.loc, density: Math.round(p.density * 1000) / 1000 })),
+        };
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    // ASCII output
+    console.log(`\n  ${c.bold}vet bloat${c.reset} — agent code bloat detector\n`);
+    console.log(`  baseline: ${baseline.sha.substring(0, 7)} (${baseline.message})`);
+    console.log(`  bloat ratio: ${bloatRatio.toFixed(1)}x (baseline: ${baselineLOC} LOC → current: ${currentLOC} LOC)\n`);
+    const tableRows = [];
+    for (const f of bloatedFiles) {
+        tableRows.push({
+            file: f.file,
+            growth: f.isNew ? 'new' : `+${Math.round(f.growthPct)}%`,
+            lines: String(f.currentLines),
+            complexity: '',
+        });
+    }
+    for (const b of bombs) {
+        tableRows.push({
+            file: b.file,
+            growth: 'new',
+            lines: formatSize(b.sizeBytes),
+            complexity: 'non-code bomb',
+        });
+    }
+    for (const p of paddings) {
+        // Only add if not already in bloatedFiles
+        if (!bloatedFiles.some(f => f.file === p.file)) {
+            tableRows.push({
+                file: p.file,
+                growth: '',
+                lines: String(p.loc),
+                complexity: 'low (padding)',
+            });
+        }
+        else {
+            // Annotate existing row
+            const row = tableRows.find(r => r.file === p.file);
+            if (row)
+                row.complexity = 'low (padding)';
+        }
+    }
+    if (tableRows.length > 0) {
+        console.log(`  ${c.dim}#  file${' '.repeat(30)}growth    lines      complexity${c.reset}`);
+        for (let i = 0; i < tableRows.length; i++) {
+            const r = tableRows[i];
+            const num = String(i + 1).padStart(2);
+            const file = r.file.padEnd(35).substring(0, 35);
+            const growth = r.growth.padEnd(10);
+            const lines = r.lines.padEnd(11);
+            console.log(`  ${num} ${file}${growth}${lines}${r.complexity}`);
+        }
+        console.log('');
+    }
+    else {
+        console.log(`  ${c.green}no bloat detected${c.reset}\n`);
+    }
+    console.log(`  score: ${finalScore}/100\n`);
+}

package/dist/checks/completeness.d.ts

@@ -0,0 +1,9 @@
+import type { CheckResult } from '../types.js';
+/**
+ * Completeness check — scores repos on presence of good practices.
+ *
+ * Unlike other checks (penalty-based), this is BONUS-based:
+ * starts at 0 and adds points for good signals.
+ * This prevents empty/joke repos from scoring 100.
+ */
+export declare function checkCompleteness(cwd: string, ignore: string[]): Promise<CheckResult>;

package/dist/checks/completeness.js

@@ -0,0 +1,146 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { walkFiles, readFile } from '../util.js';
+/**
+ * Completeness check — scores repos on presence of good practices.
+ *
+ * Unlike other checks (penalty-based), this is BONUS-based:
+ * starts at 0 and adds points for good signals.
+ * This prevents empty/joke repos from scoring 100.
+ */
+export async function checkCompleteness(cwd, ignore) {
+    const issues = [];
+    let points = 0;
+    const maxPoints = 100;
+    const files = walkFiles(cwd, ignore);
+    const fileNames = files.map(f => f.toLowerCase());
+    // ── Source code presence (0-25 points) ──
+    const jstsFiles = files.filter(f => /\.(ts|tsx|js|jsx|mts|mjs|cts|cjs)$/.test(f));
+    const srcFiles = jstsFiles.filter(f => !/node_modules|\.test\.|\.spec\.|__tests__/.test(f));
+    if (srcFiles.length === 0) {
+        issues.push({
+            file: '',
+            message: 'no JS/TS source files found',
+            severity: 'warning',
+            fixable: false,
+        });
+        // No source = max 30 points total (can't be a good JS/TS project)
+        return {
+            name: 'completeness',
+            score: 0,
+            maxScore: 100,
+            issues,
+            summary: 'no JS/TS source files',
+        };
+    }
+    if (srcFiles.length >= 3)
+        points += 25;
+    else if (srcFiles.length >= 1)
+        points += 15;
+    // ── Tests presence (0-20 points) ──
+    const testFiles = jstsFiles.filter(f => /\.test\.|\.spec\.|__tests__/.test(f));
+    const hasTestDir = fileNames.some(f => f.startsWith('test/') || f.startsWith('tests/') || f.startsWith('__tests__/'));
+    if (testFiles.length >= 5) {
+        points += 20;
+    }
+    else if (testFiles.length >= 1 || hasTestDir) {
+        points += 10;
+        issues.push({
+            file: '',
+            message: `only ${testFiles.length} test file(s) found`,
+            severity: 'info',
+            fixable: false,
+        });
+    }
+    else {
+        issues.push({
+            file: '',
+            message: 'no test files found',
+            severity: 'warning',
+            fixable: false,
+        });
+    }
+    // ── Package.json quality (0-15 points) ──
+    const pkgPath = join(cwd, 'package.json');
+    if (existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(readFile(pkgPath) ?? '{}');
+            let pkgPoints = 0;
+            if (pkg.name)
+                pkgPoints += 3;
+            if (pkg.description)
+                pkgPoints += 3;
+            if (pkg.license)
+                pkgPoints += 3;
+            if (pkg.scripts?.test)
+                pkgPoints += 3;
+            if (pkg.scripts?.build || pkg.scripts?.compile)
+                pkgPoints += 3;
+            points += Math.min(15, pkgPoints);
+        }
+        catch { /* skip */ }
+    }
+    else {
+        issues.push({
+            file: 'package.json',
+            message: 'no package.json found',
+            severity: 'info',
+            fixable: false,
+        });
+    }
+    // ── TypeScript (0-10 points) ──
+    const hasTsConfig = existsSync(join(cwd, 'tsconfig.json'));
+    const tsFiles = files.filter(f => /\.tsx?$/.test(f));
+    if (hasTsConfig && tsFiles.length > 0) {
+        points += 10;
+    }
+    else if (tsFiles.length > 0) {
+        points += 5;
+    }
+    // ── Documentation (0-10 points) ──
+    const hasReadme = fileNames.some(f => f === 'readme.md' || f === 'readme');
+    const hasChangelog = fileNames.some(f => f.includes('changelog'));
+    const hasContributing = fileNames.some(f => f.includes('contributing'));
+    if (hasReadme)
+        points += 5;
+    if (hasChangelog || hasContributing)
+        points += 5;
+    // ── CI/CD (0-10 points) ──
+    const hasCI = existsSync(join(cwd, '.github/workflows')) ||
+        existsSync(join(cwd, '.gitlab-ci.yml')) ||
+        existsSync(join(cwd, '.circleci'));
+    if (hasCI)
+        points += 10;
+    // ── Linting/Formatting (0-10 points) ──
+    const hasLint = existsSync(join(cwd, '.eslintrc.json')) ||
+        existsSync(join(cwd, '.eslintrc.js')) ||
+        existsSync(join(cwd, '.eslintrc.cjs')) ||
+        existsSync(join(cwd, 'eslint.config.js')) ||
+        existsSync(join(cwd, 'eslint.config.mjs')) ||
+        existsSync(join(cwd, 'biome.json')) ||
+        existsSync(join(cwd, 'biome.jsonc'));
+    const hasPrettier = existsSync(join(cwd, '.prettierrc')) ||
+        existsSync(join(cwd, '.prettierrc.json')) ||
+        existsSync(join(cwd, 'prettier.config.js'));
+    if (hasLint)
+        points += 5;
+    if (hasPrettier || hasLint)
+        points += 5;
+    const score = Math.min(maxPoints, points);
+    const parts = [];
+    if (srcFiles.length > 0)
+        parts.push(`${srcFiles.length} source files`);
+    if (testFiles.length > 0)
+        parts.push(`${testFiles.length} test files`);
+    if (hasTsConfig)
+        parts.push('TypeScript');
+    if (hasCI)
+        parts.push('CI');
+    return {
+        name: 'completeness',
+        score,
+        maxScore: 100,
+        issues,
+        summary: parts.length > 0 ? parts.join(', ') : 'minimal project',
+    };
+}

package/dist/checks/deps.js

@@ -521,7 +521,7 @@ export async function checkDeps(cwd) {
         // ── Scoring ────────────────────────────────────────────────────────────────
         const errors = issues.filter(i => i.severity === 'error').length;
         const warnings = issues.filter(i => i.severity === 'warning').length;
-        const rawScore = 100 - (errors * 30) - (warnings * 10);
+        const rawScore = 100 - (errors * 20) - (warnings * 5);
         const finalScore = Math.max(0, Math.min(100, rawScore));
         // ── Summary ────────────────────────────────────────────────────────────────
         const parts = [];

package/dist/checks/loop.d.ts

@@ -0,0 +1,39 @@
+import type { CheckResult } from '../types.js';
+interface SessionEntry {
+    type?: string;
+    role?: string;
+    content?: unknown;
+    model?: string;
+    usage?: {
+        input_tokens?: number;
+        output_tokens?: number;
+        cache_read_input_tokens?: number;
+        cache_creation_input_tokens?: number;
+    };
+    message?: {
+        role?: string;
+        content?: unknown;
+        model?: string;
+        usage?: SessionEntry['usage'];
+    };
+    [key: string]: unknown;
+}
+interface Iteration {
+    index: number;
+    fileChanges: number;
+    uniqueFiles: Set<string>;
+    testCount: number;
+    outcome: 'pass' | 'fail' | 'unknown';
+    inputTokens: number;
+    outputTokens: number;
+    cost: number;
+}
+export declare function analyzeSession(entries: SessionEntry[]): {
+    iterations: Iteration[];
+    totalCost: number;
+    allFiles: Set<string>;
+    model: string;
+};
+export declare function checkLoop(cwd: string): Promise<CheckResult>;
+export declare function runLoopCommand(format: 'ascii' | 'json', sessionPath?: string): Promise<void>;
+export {};

package/dist/checks/loop.js

@@ -0,0 +1,391 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { createInterface } from 'node:readline';
+import { c } from '../util.js';
+import { findLatestSession } from './receipt.js';
+// ── Pricing table (per 1M tokens) ────────────────────────────────────────────
+const PRICING = {
+    'claude-sonnet-4-6': { input: 3, output: 15 },
+    'claude-sonnet-4-5': { input: 3, output: 15 },
+    'claude-opus-4-6': { input: 15, output: 75 },
+    'claude-haiku-3-5': { input: 0.25, output: 1.25 },
+};
+const FALLBACK_PRICING = { input: 3, output: 15 };
+function getPricing(model) {
+    for (const [key, price] of Object.entries(PRICING)) {
+        if (model.includes(key))
+            return price;
+    }
+    // Partial match
+    if (model.includes('opus'))
+        return { input: 15, output: 75 };
+    if (model.includes('haiku'))
+        return { input: 0.25, output: 1.25 };
+    return FALLBACK_PRICING;
+}
+function calcCost(inputTokens, outputTokens, model) {
+    const price = getPricing(model);
+    return (inputTokens / 1_000_000) * price.input + (outputTokens / 1_000_000) * price.output;
+}
+// ── Test command detection ────────────────────────────────────────────────────
+const TEST_PATTERNS = [
+    /\bjest\b/,
+    /\bvitest\b/,
+    /\bpytest\b/,
+    /npm\s+test\b/,
+    /npm\s+run\s+test\b/,
+    /node\s+--test\b/,
+    /npx\s+vitest\b/,
+    /npx\s+jest\b/,
+    /\bmake\s+test\b/,
+    /\bcargo\s+test\b/,
+];
+function isTestCommand(cmd) {
+    return TEST_PATTERNS.some(p => p.test(cmd));
+}
+// ── File write detection ──────────────────────────────────────────────────────
+function isFileWrite(name, input) {
+    // Tool name contains str_replace or write
+    if (/str_replace|write|edit/i.test(name)) {
+        const fp = input['path'] || input['file_path'] || undefined;
+        return { isWrite: true, filePath: fp };
+    }
+    // Bash command with redirect
+    if (name === 'bash' || name === 'shell') {
+        const cmd = input['command'] || '';
+        const hasRedirect = /(?:>>?|tee\s|cat\s*>|sed\s+-i)\s*\S/.test(cmd);
+        if (hasRedirect) {
+            // Try to extract the target file
+            const match = cmd.match(/(?:>>?\s*|tee\s+|cat\s*>\s*)([^\s|;&]+)/);
+            return { isWrite: true, filePath: match?.[1] };
+        }
+    }
+    return { isWrite: false };
+}
+// ── Test outcome extraction ───────────────────────────────────────────────────
+function extractTestCount(text) {
+    // "12 passing", "12 passed", "12 tests"
+    const m = text.match(/(\d+)\s+(?:passing|passed|tests?)/i);
+    return m ? parseInt(m[1], 10) : 0;
+}
+function extractOutcome(text) {
+    const lower = text.toLowerCase();
+    // Non-zero explicit failure count wins immediately
+    if (/\b[1-9]\d*\s+fail(?:ed|ing|ure)?\b/i.test(text))
+        return 'fail';
+    // FAIL (all-caps marker used by Jest etc.)
+    if (/\bFAIL\b/.test(text))
+        return 'fail';
+    // Exit code failure
+    if (/exit code [1-9]/i.test(lower))
+        return 'fail';
+    // "0 failing" — explicitly zero failures
+    if (/\b0\s+fail(?:ed|ing|ure)?\b/i.test(lower))
+        return 'pass';
+    // Positive pass signals
+    if (/\bpassing\b|\bpassed\b/.test(lower))
+        return 'pass';
+    if (/test result:\s*ok\b/i.test(text))
+        return 'pass';
+    if (/all tests passed/i.test(text))
+        return 'pass';
+    // Generic fail words (no count context)
+    if (/\b(?:failed|failing|failure)\b/i.test(text))
+        return 'fail';
+    if (/\berror\b/.test(lower))
+        return 'fail';
+    if (/\bpass\b/.test(lower))
+        return 'pass';
+    return 'unknown';
+}
+// ── Core parsing ─────────────────────────────────────────────────────────────
+async function parseEntries(filePath) {
+    const entries = [];
+    const rl = createInterface({
+        input: fs.createReadStream(filePath, { encoding: 'utf-8' }),
+        crlfDelay: Infinity,
+    });
+    for await (const line of rl) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        try {
+            entries.push(JSON.parse(trimmed));
+        }
+        catch { /* skip malformed */ }
+    }
+    return entries;
+}
+function getToolUseBlocks(content) {
+    if (!Array.isArray(content))
+        return [];
+    return content.filter((b) => b && typeof b === 'object' && b.type === 'tool_use');
+}
+function getTextContent(content) {
+    if (typeof content === 'string')
+        return content;
+    if (Array.isArray(content)) {
+        return content.map(b => {
+            if (typeof b === 'string')
+                return b;
+            if (b && typeof b === 'object') {
+                const obj = b;
+                if (typeof obj['text'] === 'string')
+                    return obj['text'];
+                if (typeof obj['content'] === 'string')
+                    return obj['content'];
+            }
+            return '';
+        }).join('\n');
+    }
+    return '';
+}
+export function analyzeSession(entries) {
+    let model = 'claude-sonnet-4-6'; // default
+    const iterations = [];
+    // Detect model
+    for (const entry of entries) {
+        if (typeof entry['model'] === 'string' && entry['model']) {
+            model = entry['model'];
+            break;
+        }
+        if (entry['message'] && typeof entry['message']['model'] === 'string') {
+            model = entry['message']['model'];
+            break;
+        }
+    }
+    // We segment by test command invocations.
+    // Each time we see a test command tool_use, we close the current iteration and start a new one.
+    // The iteration collects file writes BEFORE the test command.
+    let currentIteration = {
+        index: 1,
+        fileChanges: 0,
+        uniqueFiles: new Set(),
+        testCount: 0,
+        outcome: 'unknown',
+        inputTokens: 0,
+        outputTokens: 0,
+        cost: 0,
+    };
+    let hasStarted = false;
+    let pendingTestEntry = false; // next tool_result belongs to a test command
+    const allFiles = new Set();
+    for (const entry of entries) {
+        // Accumulate token usage
+        const usage = entry['usage'] || entry['message']?.['usage'];
+        if (usage) {
+            const inp = (usage.input_tokens || 0) + (usage.cache_read_input_tokens || 0) + (usage.cache_creation_input_tokens || 0);
+            const out = usage.output_tokens || 0;
+            currentIteration.inputTokens += inp;
+            currentIteration.outputTokens += out;
+        }
+        // Assistant messages with tool_use blocks
+        const contentToCheck = entry['content'] || entry['message']?.['content'];
+        const blocks = getToolUseBlocks(contentToCheck);
+        for (const block of blocks) {
+            const name = block.name || '';
+            const input = block.input || {};
+            const cmd = input['command'] || '';
+            // Detect test command
+            if ((name === 'bash' || name === 'shell') && isTestCommand(cmd)) {
+                if (hasStarted) {
+                    // Close current iteration
+                    currentIteration.cost = calcCost(currentIteration.inputTokens, currentIteration.outputTokens, model);
+                    iterations.push(currentIteration);
+                    currentIteration = {
+                        index: iterations.length + 1,
+                        fileChanges: 0,
+                        uniqueFiles: new Set(),
+                        testCount: 0,
+                        outcome: 'unknown',
+                        inputTokens: 0,
+                        outputTokens: 0,
+                        cost: 0,
+                    };
+                }
+                hasStarted = true;
+                pendingTestEntry = true;
+                continue;
+            }
+            // Detect file writes (only if we've started or not yet — track globally)
+            const { isWrite, filePath } = isFileWrite(name, input);
+            if (isWrite) {
+                currentIteration.fileChanges++;
+                if (filePath) {
+                    currentIteration.uniqueFiles.add(filePath);
+                    allFiles.add(filePath);
+                }
+            }
+        }
+        // Tool results (test outcomes)
+        if (pendingTestEntry && (entry['type'] === 'tool_result' || entry['role'] === 'tool')) {
+            const text = getTextContent(entry['content']);
+            const count = extractTestCount(text);
+            if (count > 0)
+                currentIteration.testCount = count;
+            currentIteration.outcome = extractOutcome(text);
+            pendingTestEntry = false;
+        }
+    }
+    // Finalize last iteration if we started one
+    if (hasStarted) {
+        currentIteration.cost = calcCost(currentIteration.inputTokens, currentIteration.outputTokens, model);
+        iterations.push(currentIteration);
+    }
+    const totalCost = iterations.reduce((s, it) => s + it.cost, 0);
+    return { iterations, totalCost, allFiles, model };
+}
+// ── Score calculation ─────────────────────────────────────────────────────────
+function calculateScore(iterations, totalCost, allFiles) {
+    const issues = [];
+    const runawayFlags = [];
+    let penalty = 0;
+    if (iterations.length > 10) {
+        runawayFlags.push(`${iterations.length} iterations (threshold: 10)`);
+        penalty += 30;
+        issues.push({ severity: 'error', message: `runaway: ${iterations.length} iterations (threshold: 10)`, fixable: false });
+    }
+    if (totalCost > 1) {
+        runawayFlags.push(`$${totalCost.toFixed(2)} total cost (threshold: $1.00)`);
+        penalty += 20;
+        issues.push({ severity: 'error', message: `runaway: $${totalCost.toFixed(2)} total cost (threshold: $1.00)`, fixable: false });
+    }
+    if (allFiles.size > 20) {
+        runawayFlags.push(`${allFiles.size} unique files touched (threshold: 20)`);
+        penalty += 10;
+        issues.push({ severity: 'warning', message: `runaway: ${allFiles.size} unique files touched (threshold: 20)`, fixable: false });
+    }
+    for (const it of iterations) {
+        if (it.fileChanges > 5) {
+            penalty += 5;
+            issues.push({ severity: 'warning', message: `iteration ${it.index}: ${it.fileChanges} file changes (threshold: 5)`, fixable: false });
+        }
+    }
+    const score = Math.max(0, 100 - penalty);
+    return { score, issues, runawayFlags };
+}
+// ── Check function (for full vet run) ────────────────────────────────────────
+export async function checkLoop(cwd) {
+    const sessionFile = findLatestSession();
+    if (!sessionFile) {
+        return {
+            name: 'loop',
+            score: 100,
+            maxScore: 100,
+            issues: [{ severity: 'info', message: 'no claude session files found (~/.claude/projects/)', fixable: false }],
+            summary: 'no session logs found',
+        };
+    }
+    let entries;
+    try {
+        entries = await parseEntries(sessionFile);
+    }
+    catch {
+        return {
+            name: 'loop',
+            score: 100,
+            maxScore: 100,
+            issues: [{ severity: 'warning', message: 'could not parse session file', fixable: false }],
+            summary: 'session parse error',
+        };
+    }
+    if (entries.length === 0) {
+        return {
+            name: 'loop',
+            score: 100,
+            maxScore: 100,
+            issues: [{ severity: 'info', message: 'session file is empty', fixable: false }],
+            summary: 'empty session file',
+        };
+    }
+    const { iterations, totalCost, allFiles } = analyzeSession(entries);
+    if (iterations.length === 0) {
+        return {
+            name: 'loop',
+            score: 100,
+            maxScore: 100,
+            issues: [{ severity: 'info', message: 'no /loop iterations detected (no test commands found)', fixable: false }],
+            summary: 'no loop iterations detected',
+        };
+    }
+    const { score, issues, runawayFlags } = calculateScore(iterations, totalCost, allFiles);
+    const failCount = iterations.filter(it => it.outcome === 'fail').length;
+    const passCount = iterations.filter(it => it.outcome === 'pass').length;
+    return {
+        name: 'loop',
+        score,
+        maxScore: 100,
+        issues,
+        summary: `${iterations.length} iteration${iterations.length !== 1 ? 's' : ''}: ${passCount} pass, ${failCount} fail${runawayFlags.length > 0 ? ` — runaway: ${runawayFlags.join(', ')}` : ''}`,
+    };
+}
+// ── Standalone subcommand ─────────────────────────────────────────────────────
+export async function runLoopCommand(format, sessionPath) {
+    const filePath = sessionPath || findLatestSession();
+    if (!filePath) {
+        console.error('no claude session files found in ~/.claude/projects/');
+        process.exit(1);
+    }
+    if (!fs.existsSync(filePath) && !sessionPath) {
+        console.error('session file not found');
+        process.exit(1);
+    }
+    const entries = await parseEntries(filePath);
+    const { iterations, totalCost, allFiles } = analyzeSession(entries);
+    const { score, issues, runawayFlags } = calculateScore(iterations, totalCost, allFiles);
+    if (format === 'json') {
+        const result = {
+            name: 'loop',
+            score,
+            maxScore: 100,
+            issues,
+            summary: iterations.length === 0
+                ? 'no loop iterations detected'
+                : `${iterations.length} iteration${iterations.length !== 1 ? 's' : ''} found`,
+        };
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    // ASCII output
+    const sessionId = path.basename(filePath, '.jsonl').slice(0, 40);
+    console.log(`\n  ${c.bold}vet loop${c.reset} — /loop session forensics\n`);
+    console.log(`  session: ${sessionId}`);
+    console.log(`  iterations: ${iterations.length}`);
+    console.log(`  total cost: $${totalCost.toFixed(2)}\n`);
+    if (iterations.length === 0) {
+        console.log(`  ${c.green}no /loop iterations detected${c.reset}\n`);
+        console.log(`  score: 100/100\n`);
+        return;
+    }
+    // Table header
+    const colW = { num: 3, files: 6, tests: 6, outcome: 8, cost: 8 };
+    const header = [
+        '#'.padEnd(colW.num),
+        'files'.padEnd(colW.files),
+        'tests'.padEnd(colW.tests),
+        'outcome'.padEnd(colW.outcome),
+        'cost',
+    ].join('  ');
+    console.log(`  ${c.dim}${header}${c.reset}`);
+    for (const it of iterations) {
+        const outcomeStr = it.outcome === 'pass'
+            ? `${c.green}pass${c.reset}`
+            : it.outcome === 'fail'
+                ? `${c.red}fail${c.reset}`
+                : `${c.dim}?${c.reset}`;
+        const numStr = String(it.index).padEnd(colW.num);
+        const filesStr = String(it.fileChanges).padEnd(colW.files);
+        const testsStr = String(it.testCount || '-').padEnd(colW.tests);
+        const costStr = `$${it.cost.toFixed(2)}`;
+        // outcome padding needs to account for color codes (invisible)
+        const outcomePadded = outcomeStr + ' '.repeat(Math.max(0, colW.outcome - it.outcome.length));
+        console.log(`  ${numStr}  ${filesStr}  ${testsStr}  ${outcomePadded}  ${costStr}`);
+    }
+    console.log('');
+    for (const flag of runawayFlags) {
+        console.log(`  ${c.yellow}⚠ runaway: ${flag}${c.reset}`);
+    }
+    if (runawayFlags.length > 0)
+        console.log('');
+    console.log(`  score: ${score}/100\n`);
+}

package/dist/cli.js

@@ -21,6 +21,9 @@ import { checkMap, renderMapReport } from './checks/map.js';
 import { checkPermissions } from './checks/permissions.js';
 import { checkCompact, runCompactCommand } from './checks/compact.js';
 import { checkSubsidy, runSubsidyCommand } from './checks/subsidy.js';
+import { checkLoop, runLoopCommand } from './checks/loop.js';
+import { checkBloat, runBloatCommand } from './checks/bloat.js';
+import { checkCompleteness } from './checks/completeness.js';
 import { score } from './scorer.js';
 import { reportPretty, reportJSON, reportBadge } from './reporter.js';
 import { clearCache } from './file-cache.js';
@@ -70,6 +73,8 @@ if (flags.has('--help') || flags.has('-h')) {
     npx @safetnsr/vet permissions [dir]  audit Claude Code config for dangerous grants
     npx @safetnsr/vet compact [log]      compaction forensics for claude code sessions
     npx @safetnsr/vet subsidy [--plan tier] [--since date]  show AI cost vs subscription
+    npx @safetnsr/vet loop [log]         /loop session forensics — per-iteration timeline
+    npx @safetnsr/vet bloat              detect agent-generated code bloat
 
   ${c.dim}categories:${c.reset}
     security   (30%)  scan, secrets, config, model usage
@@ -105,7 +110,7 @@ if (flags.has('--version') || flags.has('-v')) {
     }
     process.exit(0);
 }
-const COMMANDS = ['init', 'receipt', 'map', 'permissions', 'compact', 'subsidy'];
+const COMMANDS = ['init', 'receipt', 'map', 'permissions', 'compact', 'subsidy', 'loop', 'bloat'];
 const command = COMMANDS.includes(positional[0]) ? positional[0] : undefined;
 const cwd = resolve(positional.find(p => !COMMANDS.includes(p)) || '.');
 const isCI = flags.has('--ci');
@@ -213,6 +218,29 @@ if (command === 'subsidy') {
     }
     process.exit(0);
 }
+if (command === 'loop') {
+    try {
+        const format = isJSON ? 'json' : 'ascii';
+        const sessionArg = positional.find(p => p !== 'loop' && !COMMANDS.includes(p));
+        await runLoopCommand(format, sessionArg);
+    }
+    catch (e) {
+        console.error(`${c.red}loop failed:${c.reset}`, e instanceof Error ? e.message : e);
+        process.exit(1);
+    }
+    process.exit(0);
+}
+if (command === 'bloat') {
+    try {
+        const format = isJSON ? 'json' : 'ascii';
+        await runBloatCommand(format);
+    }
+    catch (e) {
+        console.error(`${c.red}bloat failed:${c.reset}`, e instanceof Error ? e.message : e);
+        process.exit(1);
+    }
+    process.exit(0);
+}
 if (!isGitRepo(cwd)) {
     console.error(`${c.red}not a git repository${c.reset}. vet operates on git repos.`);
     process.exit(1);
@@ -264,7 +292,7 @@ async function runChecks() {
             }
         }
         // Run ALL independent checks in parallel
-        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult,] = await Promise.all([
+        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult,] = await Promise.all([
             withTimeout('scan', () => checkScan(cwd)),
             withTimeout('secrets', () => checkSecrets(cwd)),
             withTimeout('config', () => checkConfig(cwd, ignore)),
@@ -281,6 +309,9 @@ async function runChecks() {
             withTimeout('memory', () => checkMemory(cwd)),
             withTimeout('verify', () => checkVerify(cwd, since)),
             withTimeout('tests', () => checkTests(cwd, ignore)),
+            withTimeout('loop', () => checkLoop(cwd)),
+            withTimeout('completeness', () => checkCompleteness(cwd, ignore)),
+            withTimeout('bloat', () => checkBloat(cwd)),
         ]);
         // Git-dependent checks (diff + history) — parallel with each other
         const [diffResult, historyResult] = await Promise.all([
@@ -291,8 +322,8 @@ async function runChecks() {
         clearCache();
         return score(cwd, {
             security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, subsidyResult],
-            integrity: [diffResult, integrityResult, receiptResult, compactResult, memoryResult, verifyResult, testsResult],
-            debt: [readyResult, historyResult, debtResult],
+            integrity: [diffResult, integrityResult, receiptResult, compactResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult],
+            debt: [readyResult, historyResult, debtResult, bloatResult],
             deps: [depsResult],
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.12.0",
+  "version": "1.14.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {