@safetnsr/vet 1.13.0 → 1.15.0

package/dist/categories.js

@@ -16,10 +16,10 @@ export function toGrade(score) {
 }
 // ── Category weights ─────────────────────────────────────────────────────────
 const WEIGHTS = {
-    security: 0.30,
-    integrity: 0.30,
-    debt: 0.25,
-    deps: 0.15,
+    security: 0.25,
+    integrity: 0.35,
+    debt: 0.30,
+    deps: 0.10,
 };
 // ── Scoring floor for non-security checks ────────────────────────────────────
 const SECURITY_CHECKS = new Set(['scan', 'secrets', 'permissions', 'owasp']);
@@ -37,6 +37,28 @@ function averageScore(checks) {
     const total = checks.reduce((sum, c) => sum + applyScoreFloor(c), 0);
     return Math.round(total / checks.length);
 }
+// ── Completeness multiplier ─────────────────────────────────────────────────
+/**
+ * Extract completeness score and apply it as a multiplier to the overall score.
+ * A repo with completeness=0 (no JS/TS source) gets heavily penalized.
+ * completeness 0-30 → multiplier 0.3-0.6
+ * completeness 30-70 → multiplier 0.6-0.85
+ * completeness 70-100 → multiplier 0.85-1.0
+ */
+function completenessMultiplier(categories) {
+    const integrity = categories.find(c => c.name === 'integrity');
+    if (!integrity)
+        return 1.0;
+    const comp = integrity.checks.find(c => c.name === 'completeness');
+    if (!comp)
+        return 1.0;
+    const s = comp.score;
+    if (s >= 70)
+        return 0.85 + (s - 70) * (0.15 / 30);
+    if (s >= 30)
+        return 0.6 + (s - 30) * (0.25 / 40);
+    return 0.3 + s * (0.3 / 30);
+}
 // ── Group checks into categories ─────────────────────────────────────────────
 export function buildCategories(checkMap) {
     const categories = [];
@@ -63,7 +85,9 @@ export function buildVetResult(project, categories) {
         weightedSum += cat.score * cat.weight;
         totalWeight += cat.weight;
     }
-    const overallScore = totalWeight > 0 ? Math.round(weightedSum / totalWeight) : 0;
+    const rawScore = totalWeight > 0 ? weightedSum / totalWeight : 0;
+    const compMult = completenessMultiplier(categories);
+    const overallScore = Math.round(rawScore * compMult);
     const grade = toGrade(overallScore);
     const allIssues = categories.flatMap(c => c.issues);
     // Read version from package.json

package/dist/checks/bloat.d.ts

@@ -0,0 +1,3 @@
+import type { CheckResult } from '../types.js';
+export declare function checkBloat(cwd: string): Promise<CheckResult>;
+export declare function runBloatCommand(format: 'ascii' | 'json'): Promise<void>;

package/dist/checks/bloat.js

@@ -0,0 +1,369 @@
+import { join, extname } from 'node:path';
+import { statSync } from 'node:fs';
+import { walkFiles, readFile, gitExec, c } from '../util.js';
+// ── Constants ────────────────────────────────────────────────────────────────
+const AI_PATTERNS = /\b(claude|copilot|ai|agent)\b|\[(claude|ai)\]/i;
+const AI_FILE_MARKERS = ['.claude/', 'CLAUDE.md', 'AGENTS.md'];
+const NON_CODE_EXTS = new Set(['.txt', '.log', '.csv', '.json']);
+const SOURCE_EXTS = new Set(['.ts', '.js', '.tsx', '.jsx']);
+const TEN_MB = 10 * 1024 * 1024;
+const BRANCH_RE = /\b(if|else|switch|case)\b|&&|\|\||\?[^?.:]/g;
+// ── Baseline detection ───────────────────────────────────────────────────────
+function findBaseline(cwd) {
+    // 1. Search git log for AI-pattern commits
+    const log = gitExec(['log', '--oneline', '--all', '--reverse'], cwd);
+    if (!log) {
+        return { sha: '', message: '', method: 'empty' };
+    }
+    const lines = log.split('\n').filter(Boolean);
+    if (lines.length === 0) {
+        return { sha: '', message: '', method: 'empty' };
+    }
+    for (const line of lines) {
+        const spaceIdx = line.indexOf(' ');
+        if (spaceIdx === -1)
+            continue;
+        const msg = line.substring(spaceIdx + 1);
+        if (AI_PATTERNS.test(msg)) {
+            const sha = line.substring(0, spaceIdx);
+            // Use parent of this commit as baseline (the commit before AI started)
+            const parent = gitExec(['rev-parse', `${sha}~1`], cwd);
+            if (parent) {
+                const parentMsg = gitExec(['log', '--oneline', '-1', parent], cwd);
+                return { sha: parent, message: parentMsg.substring(parentMsg.indexOf(' ') + 1) || parent, method: 'ai-commit-parent' };
+            }
+            // If no parent (first commit is AI), use this commit itself
+            return { sha, message: msg, method: 'ai-commit' };
+        }
+    }
+    // 2. Fallback: find first commit adding AI marker files
+    for (const marker of AI_FILE_MARKERS) {
+        const result = gitExec(['log', '--all', '--reverse', '--diff-filter=A', '--', marker], cwd);
+        if (result) {
+            const firstLine = result.split('\n').find(l => l.startsWith('commit '));
+            if (firstLine) {
+                const sha = firstLine.replace('commit ', '').trim();
+                const shortSha = sha.substring(0, 7);
+                const parent = gitExec(['rev-parse', `${sha}~1`], cwd);
+                if (parent) {
+                    const parentLog = gitExec(['log', '--oneline', '-1', parent], cwd);
+                    return { sha: parent, message: parentLog.substring(parentLog.indexOf(' ') + 1) || parent, method: 'marker-file' };
+                }
+            }
+        }
+    }
+    // 3. Fallback: initial commit (everything is baseline)
+    const initial = lines[0];
+    const spaceIdx = initial.indexOf(' ');
+    const sha = spaceIdx !== -1 ? initial.substring(0, spaceIdx) : initial;
+    const msg = spaceIdx !== -1 ? initial.substring(spaceIdx + 1) : sha;
+    return { sha, message: msg, method: 'initial' };
+}
+function analyzeFileGrowth(cwd, baselineSha) {
+    if (!baselineSha) {
+        return { files: [], baselineLOC: 0, currentLOC: 0 };
+    }
+    const numstat = gitExec(['diff', baselineSha, 'HEAD', '--numstat'], cwd);
+    if (!numstat) {
+        return { files: [], baselineLOC: 0, currentLOC: 0 };
+    }
+    const files = [];
+    let totalBaselineLOC = 0;
+    let totalCurrentLOC = 0;
+    for (const line of numstat.split('\n').filter(Boolean)) {
+        const parts = line.split('\t');
+        if (parts.length < 3)
+            continue;
+        const [addStr, delStr, file] = parts;
+        // Binary files show as '-'
+        if (addStr === '-' || delStr === '-')
+            continue;
+        const additions = parseInt(addStr, 10) || 0;
+        const deletions = parseInt(delStr, 10) || 0;
+        // Get baseline line count for this file
+        const baselineContent = gitExec(['show', `${baselineSha}:${file}`], cwd);
+        const baselineLines = baselineContent ? baselineContent.split('\n').length : 0;
+        const isNew = baselineLines === 0;
+        const currentLines = Math.max(0, baselineLines + additions - deletions);
+        const denominator = Math.max(baselineLines, 1);
+        const growthPct = ((currentLines / denominator) - 1) * 100;
+        totalBaselineLOC += baselineLines;
+        totalCurrentLOC += currentLines;
+        files.push({ file, additions, deletions, baselineLines, currentLines, growthPct, isNew });
+    }
+    // If baseline LOC is 0 but we have current LOC, count all current files
+    if (totalBaselineLOC === 0) {
+        // Count current LOC from all tracked files
+        const lsFiles = gitExec(['ls-files'], cwd);
+        if (lsFiles) {
+            for (const f of lsFiles.split('\n').filter(Boolean)) {
+                const content = readFile(join(cwd, f));
+                if (content)
+                    totalCurrentLOC += content.split('\n').length;
+            }
+        }
+    }
+    return { files, baselineLOC: totalBaselineLOC, currentLOC: totalCurrentLOC };
+}
+function findNonCodeBombs(cwd) {
+    const bombs = [];
+    const allFiles = walkFiles(cwd);
+    for (const file of allFiles) {
+        const ext = extname(file).toLowerCase();
+        if (!NON_CODE_EXTS.has(ext))
+            continue;
+        try {
+            const stat = statSync(join(cwd, file));
+            if (stat.size > TEN_MB) {
+                bombs.push({ file, sizeBytes: stat.size });
+            }
+        }
+        catch { /* skip */ }
+    }
+    return bombs;
+}
+function findPaddingFiles(cwd) {
+    const paddings = [];
+    const allFiles = walkFiles(cwd);
+    for (const file of allFiles) {
+        const ext = extname(file).toLowerCase();
+        if (!SOURCE_EXTS.has(ext))
+            continue;
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        const lines = content.split('\n');
+        const loc = lines.length;
+        if (loc <= 1000)
+            continue;
+        // Count branch constructs
+        let branches = 0;
+        for (const line of lines) {
+            const matches = line.match(BRANCH_RE);
+            if (matches)
+                branches += matches.length;
+        }
+        const density = branches / loc;
+        if (density < 0.02) {
+            paddings.push({ file, loc, density });
+        }
+    }
+    return paddings;
+}
+// ── Scoring ──────────────────────────────────────────────────────────────────
+function calculateScore(bloatRatio, bloatedFiles, bombs, paddings) {
+    let s = 100;
+    const penalties = [];
+    // Bloat ratio penalties
+    if (bloatRatio > 20) {
+        s -= 40;
+        penalties.push(`bloat ratio ${bloatRatio.toFixed(1)}x (>20x): -40`);
+    }
+    else if (bloatRatio > 10) {
+        s -= 30;
+        penalties.push(`bloat ratio ${bloatRatio.toFixed(1)}x (>10x): -30`);
+    }
+    else if (bloatRatio > 5) {
+        s -= 20;
+        penalties.push(`bloat ratio ${bloatRatio.toFixed(1)}x (>5x): -20`);
+    }
+    // Per-file growth penalties
+    const growthPenalty = Math.min(30, bloatedFiles.length * 5);
+    if (growthPenalty > 0) {
+        s -= growthPenalty;
+        penalties.push(`${bloatedFiles.length} file(s) >500% growth: -${growthPenalty}`);
+    }
+    // Non-code bomb penalties
+    const bombPenalty = Math.min(20, bombs.length * 10);
+    if (bombPenalty > 0) {
+        s -= bombPenalty;
+        penalties.push(`${bombs.length} non-code bomb(s) >10MB: -${bombPenalty}`);
+    }
+    // Padding penalties
+    const paddingPenalty = Math.min(20, paddings.length * 5);
+    if (paddingPenalty > 0) {
+        s -= paddingPenalty;
+        penalties.push(`${paddings.length} low-complexity padding file(s): -${paddingPenalty}`);
+    }
+    return { score: Math.max(0, s), penalties };
+}
+// ── Format helpers ───────────────────────────────────────────────────────────
+function formatSize(bytes) {
+    if (bytes >= 1024 * 1024 * 1024)
+        return `${(bytes / (1024 * 1024 * 1024)).toFixed(0)}GB`;
+    if (bytes >= 1024 * 1024)
+        return `${(bytes / (1024 * 1024)).toFixed(0)}MB`;
+    if (bytes >= 1024)
+        return `${(bytes / 1024).toFixed(0)}KB`;
+    return `${bytes}B`;
+}
+// ── Main check (for full vet run) ────────────────────────────────────────────
+export async function checkBloat(cwd) {
+    const baseline = findBaseline(cwd);
+    if (!baseline.sha) {
+        return {
+            name: 'bloat',
+            score: 100,
+            maxScore: 100,
+            issues: [{ severity: 'info', message: 'empty repo — no bloat analysis possible', fixable: false }],
+            summary: 'empty repo',
+        };
+    }
+    const { files, baselineLOC, currentLOC } = analyzeFileGrowth(cwd, baseline.sha);
+    // Check if repo has any tracked files
+    const trackedFiles = gitExec(['ls-files'], cwd);
+    if (!trackedFiles || trackedFiles.trim().length === 0) {
+        return {
+            name: 'bloat',
+            score: 100,
+            maxScore: 100,
+            issues: [{ severity: 'info', message: 'empty repo — no files to analyze', fixable: false }],
+            summary: 'empty repo',
+        };
+    }
+    const bloatRatio = baselineLOC > 0 ? currentLOC / baselineLOC : 1;
+    const bloatedFiles = files.filter(f => f.growthPct > 500);
+    const bombs = findNonCodeBombs(cwd);
+    const paddings = findPaddingFiles(cwd);
+    const { score: finalScore, penalties } = calculateScore(bloatRatio, bloatedFiles, bombs, paddings);
+    const issues = [];
+    for (const f of bloatedFiles) {
+        issues.push({
+            severity: 'warning',
+            message: `file growth +${Math.round(f.growthPct)}%: ${f.file} (${f.baselineLines} → ${f.currentLines} lines)`,
+            file: f.file,
+            fixable: false,
+            fixHint: 'review for unnecessary code generation',
+        });
+    }
+    for (const b of bombs) {
+        issues.push({
+            severity: 'warning',
+            message: `non-code bomb: ${b.file} (${formatSize(b.sizeBytes)})`,
+            file: b.file,
+            fixable: true,
+            fixHint: 'add to .gitignore or remove large non-code file',
+        });
+    }
+    for (const p of paddings) {
+        issues.push({
+            severity: 'warning',
+            message: `low-complexity padding: ${p.file} (${p.loc} LOC, density ${p.density.toFixed(3)})`,
+            file: p.file,
+            fixable: false,
+            fixHint: 'review for auto-generated boilerplate',
+        });
+    }
+    if (bloatRatio > 5) {
+        issues.push({
+            severity: bloatRatio > 20 ? 'error' : 'warning',
+            message: `bloat ratio ${bloatRatio.toFixed(1)}x (baseline: ${baselineLOC} LOC → current: ${currentLOC} LOC)`,
+            fixable: false,
+        });
+    }
+    const parts = [];
+    parts.push(`${bloatRatio.toFixed(1)}x bloat ratio`);
+    if (bloatedFiles.length > 0)
+        parts.push(`${bloatedFiles.length} bloated file(s)`);
+    if (bombs.length > 0)
+        parts.push(`${bombs.length} non-code bomb(s)`);
+    if (paddings.length > 0)
+        parts.push(`${paddings.length} padding file(s)`);
+    return {
+        name: 'bloat',
+        score: finalScore,
+        maxScore: 100,
+        issues,
+        summary: parts.join(', '),
+    };
+}
+// ── Standalone subcommand ────────────────────────────────────────────────────
+export async function runBloatCommand(format) {
+    const cwd = process.cwd();
+    const baseline = findBaseline(cwd);
+    if (!baseline.sha) {
+        if (format === 'json') {
+            console.log(JSON.stringify({ baseline: null, bloatRatio: 1, score: 100, files: [], message: 'empty repo' }));
+        }
+        else {
+            console.log(`\n  ${c.bold}vet bloat${c.reset} — agent code bloat detector\n`);
+            console.log(`  ${c.dim}empty repo — no bloat analysis possible${c.reset}\n`);
+            console.log(`  score: 100/100\n`);
+        }
+        return;
+    }
+    const { files, baselineLOC, currentLOC } = analyzeFileGrowth(cwd, baseline.sha);
+    const bloatRatio = baselineLOC > 0 ? currentLOC / baselineLOC : 1;
+    const bloatedFiles = files.filter(f => f.growthPct > 500);
+    const bombs = findNonCodeBombs(cwd);
+    const paddings = findPaddingFiles(cwd);
+    const { score: finalScore } = calculateScore(bloatRatio, bloatedFiles, bombs, paddings);
+    if (format === 'json') {
+        const result = {
+            baseline: { sha: baseline.sha, message: baseline.message, method: baseline.method },
+            bloatRatio: Math.round(bloatRatio * 10) / 10,
+            baselineLOC,
+            currentLOC,
+            score: finalScore,
+            bloatedFiles: bloatedFiles.map(f => ({ file: f.file, growthPct: Math.round(f.growthPct), lines: f.currentLines })),
+            nonCodeBombs: bombs.map(b => ({ file: b.file, size: b.sizeBytes })),
+            paddingFiles: paddings.map(p => ({ file: p.file, loc: p.loc, density: Math.round(p.density * 1000) / 1000 })),
+        };
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    // ASCII output
+    console.log(`\n  ${c.bold}vet bloat${c.reset} — agent code bloat detector\n`);
+    console.log(`  baseline: ${baseline.sha.substring(0, 7)} (${baseline.message})`);
+    console.log(`  bloat ratio: ${bloatRatio.toFixed(1)}x (baseline: ${baselineLOC} LOC → current: ${currentLOC} LOC)\n`);
+    const tableRows = [];
+    for (const f of bloatedFiles) {
+        tableRows.push({
+            file: f.file,
+            growth: f.isNew ? 'new' : `+${Math.round(f.growthPct)}%`,
+            lines: String(f.currentLines),
+            complexity: '',
+        });
+    }
+    for (const b of bombs) {
+        tableRows.push({
+            file: b.file,
+            growth: 'new',
+            lines: formatSize(b.sizeBytes),
+            complexity: 'non-code bomb',
+        });
+    }
+    for (const p of paddings) {
+        // Only add if not already in bloatedFiles
+        if (!bloatedFiles.some(f => f.file === p.file)) {
+            tableRows.push({
+                file: p.file,
+                growth: '',
+                lines: String(p.loc),
+                complexity: 'low (padding)',
+            });
+        }
+        else {
+            // Annotate existing row
+            const row = tableRows.find(r => r.file === p.file);
+            if (row)
+                row.complexity = 'low (padding)';
+        }
+    }
+    if (tableRows.length > 0) {
+        console.log(`  ${c.dim}#  file${' '.repeat(30)}growth    lines      complexity${c.reset}`);
+        for (let i = 0; i < tableRows.length; i++) {
+            const r = tableRows[i];
+            const num = String(i + 1).padStart(2);
+            const file = r.file.padEnd(35).substring(0, 35);
+            const growth = r.growth.padEnd(10);
+            const lines = r.lines.padEnd(11);
+            console.log(`  ${num} ${file}${growth}${lines}${r.complexity}`);
+        }
+        console.log('');
+    }
+    else {
+        console.log(`  ${c.green}no bloat detected${c.reset}\n`);
+    }
+    console.log(`  score: ${finalScore}/100\n`);
+}

package/dist/checks/completeness.d.ts

@@ -0,0 +1,9 @@
+import type { CheckResult } from '../types.js';
+/**
+ * Completeness check — scores repos on presence of good practices.
+ *
+ * Unlike other checks (penalty-based), this is BONUS-based:
+ * starts at 0 and adds points for good signals.
+ * This prevents empty/joke repos from scoring 100.
+ */
+export declare function checkCompleteness(cwd: string, ignore: string[]): Promise<CheckResult>;

package/dist/checks/completeness.js

@@ -0,0 +1,178 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { execSync } from 'node:child_process';
+import { walkFiles, readFile } from '../util.js';
+/**
+ * Completeness check — scores repos on presence of good practices.
+ *
+ * Unlike other checks (penalty-based), this is BONUS-based:
+ * starts at 0 and adds points for good signals.
+ * This prevents empty/joke repos from scoring 100.
+ */
+export async function checkCompleteness(cwd, ignore) {
+    const issues = [];
+    let points = 0;
+    const maxPoints = 100;
+    const files = walkFiles(cwd, ignore);
+    const fileNames = files.map(f => f.toLowerCase());
+    // ── Source code presence (0-25 points) ──
+    const jstsFiles = files.filter(f => /\.(ts|tsx|js|jsx|mts|mjs|cts|cjs)$/.test(f));
+    const srcFiles = jstsFiles.filter(f => !/node_modules|\.test\.|\.spec\.|__tests__/.test(f));
+    if (srcFiles.length === 0) {
+        issues.push({
+            file: '',
+            message: 'no JS/TS source files found',
+            severity: 'warning',
+            fixable: false,
+        });
+        // No source = max 30 points total (can't be a good JS/TS project)
+        return {
+            name: 'completeness',
+            score: 0,
+            maxScore: 100,
+            issues,
+            summary: 'no JS/TS source files',
+        };
+    }
+    if (srcFiles.length >= 3)
+        points += 25;
+    else if (srcFiles.length >= 1)
+        points += 15;
+    // ── Tests presence (0-20 points) ──
+    const testFiles = jstsFiles.filter(f => /\.test\.|\.spec\.|__tests__/.test(f));
+    const hasTestDir = fileNames.some(f => f.startsWith('test/') || f.startsWith('tests/') || f.startsWith('__tests__/'));
+    if (testFiles.length >= 5) {
+        points += 20;
+    }
+    else if (testFiles.length >= 1 || hasTestDir) {
+        points += 10;
+        issues.push({
+            file: '',
+            message: `only ${testFiles.length} test file(s) found`,
+            severity: 'info',
+            fixable: false,
+        });
+    }
+    else {
+        issues.push({
+            file: '',
+            message: 'no test files found',
+            severity: 'warning',
+            fixable: false,
+        });
+    }
+    // ── Package.json quality (0-15 points) ──
+    const pkgPath = join(cwd, 'package.json');
+    if (existsSync(pkgPath)) {
+        try {
+            const pkg = JSON.parse(readFile(pkgPath) ?? '{}');
+            let pkgPoints = 0;
+            if (pkg.name)
+                pkgPoints += 3;
+            if (pkg.description)
+                pkgPoints += 3;
+            if (pkg.license)
+                pkgPoints += 3;
+            if (pkg.scripts?.test)
+                pkgPoints += 3;
+            if (pkg.scripts?.build || pkg.scripts?.compile)
+                pkgPoints += 3;
+            points += Math.min(15, pkgPoints);
+        }
+        catch { /* skip */ }
+    }
+    else {
+        issues.push({
+            file: 'package.json',
+            message: 'no package.json found',
+            severity: 'info',
+            fixable: false,
+        });
+    }
+    // ── TypeScript (0-10 points) ──
+    const hasTsConfig = existsSync(join(cwd, 'tsconfig.json'));
+    const tsFiles = files.filter(f => /\.tsx?$/.test(f));
+    if (hasTsConfig && tsFiles.length > 0) {
+        points += 10;
+    }
+    else if (tsFiles.length > 0) {
+        points += 5;
+    }
+    // ── Documentation (0-10 points) ──
+    const hasReadme = fileNames.some(f => f === 'readme.md' || f === 'readme');
+    const hasChangelog = fileNames.some(f => f.includes('changelog'));
+    const hasContributing = fileNames.some(f => f.includes('contributing'));
+    if (hasReadme)
+        points += 5;
+    if (hasChangelog || hasContributing)
+        points += 5;
+    // ── CI/CD (0-10 points) ──
+    const hasCI = existsSync(join(cwd, '.github/workflows')) ||
+        existsSync(join(cwd, '.gitlab-ci.yml')) ||
+        existsSync(join(cwd, '.circleci'));
+    if (hasCI)
+        points += 10;
+    // ── Git freshness (0-10 points, negative for very stale) ──
+    try {
+        const lastCommit = execSync('git log -1 --format=%ct', { cwd, stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();
+        const ageMonths = (Date.now() / 1000 - parseInt(lastCommit)) / (30 * 24 * 3600);
+        if (ageMonths < 6) {
+            points += 10; // actively maintained
+        }
+        else if (ageMonths < 12) {
+            points += 5;
+        }
+        else if (ageMonths < 24) {
+            // no bonus, no penalty
+            issues.push({
+                file: '',
+                message: `last commit ${Math.round(ageMonths)} months ago`,
+                severity: 'info',
+                fixable: false,
+            });
+        }
+        else {
+            // Stale: actively penalize
+            points -= 15;
+            issues.push({
+                file: '',
+                message: `last commit ${Math.round(ageMonths)} months ago — likely abandoned`,
+                severity: 'warning',
+                fixable: false,
+            });
+        }
+    }
+    catch { /* not a git repo or no commits */ }
+    // ── Linting/Formatting (0-10 points) ──
+    const hasLint = existsSync(join(cwd, '.eslintrc.json')) ||
+        existsSync(join(cwd, '.eslintrc.js')) ||
+        existsSync(join(cwd, '.eslintrc.cjs')) ||
+        existsSync(join(cwd, 'eslint.config.js')) ||
+        existsSync(join(cwd, 'eslint.config.mjs')) ||
+        existsSync(join(cwd, 'biome.json')) ||
+        existsSync(join(cwd, 'biome.jsonc'));
+    const hasPrettier = existsSync(join(cwd, '.prettierrc')) ||
+        existsSync(join(cwd, '.prettierrc.json')) ||
+        existsSync(join(cwd, 'prettier.config.js'));
+    if (hasLint)
+        points += 5;
+    if (hasPrettier || hasLint)
+        points += 5;
+    const score = Math.min(maxPoints, points);
+    const parts = [];
+    if (srcFiles.length > 0)
+        parts.push(`${srcFiles.length} source files`);
+    if (testFiles.length > 0)
+        parts.push(`${testFiles.length} test files`);
+    if (hasTsConfig)
+        parts.push('TypeScript');
+    if (hasCI)
+        parts.push('CI');
+    return {
+        name: 'completeness',
+        score,
+        maxScore: 100,
+        issues,
+        summary: parts.length > 0 ? parts.join(', ') : 'minimal project',
+    };
+}

package/dist/checks/debt.js

@@ -517,14 +517,19 @@ export async function checkDebt(cwd, ignore) {
     // D) Naming drift
     const driftIssues = findNamingDrift(allFuncs);
     issues.push(...driftIssues);
-    // ── Scoring ──────────────────────────────────────────────────────────────
-    const dupPenalty = Math.min(50, dupIssues.length * 8);
+    // ── Scoring (size-normalized) ─────────────────────────────────────────────
+    // Scale penalties by project size: a repo with 200 files should tolerate
+    // more absolute issues than one with 10 files. The scaling factor ranges
+    // from 1.0 (≤10 files) to 0.3 (500+ files), using log scale.
+    const fileCount = sourceFiles.length;
+    const sizeScale = fileCount <= 10 ? 1.0 : Math.max(0.3, 1.0 - Math.log10(fileCount / 10) * 0.4);
+    const dupPenalty = Math.min(50, dupIssues.length * 8) * sizeScale;
     const orphanWarnings = orphanIssues.filter(i => i.severity === 'warning');
-    const orphanPenalty = Math.min(30, orphanWarnings.length * 5);
+    const orphanPenalty = Math.min(30, orphanWarnings.length * 5) * sizeScale;
     const wrapperWarnings = wrapperIssues.filter(i => i.severity === 'warning');
     const driftWarnings = driftIssues.filter(i => i.severity === 'warning');
-    const wrapperPenalty = Math.min(15, wrapperWarnings.length * 3);
-    const driftPenalty = Math.min(10, driftWarnings.length * 2);
+    const wrapperPenalty = Math.min(15, wrapperWarnings.length * 3) * sizeScale;
+    const driftPenalty = Math.min(10, driftWarnings.length * 2) * sizeScale;
     const rawScore = 100 - dupPenalty - orphanPenalty - wrapperPenalty - driftPenalty;
     const finalScore = Math.max(0, Math.round(rawScore));
     // ── Summary ──────────────────────────────────────────────────────────────

package/dist/checks/deps.js

@@ -521,8 +521,11 @@ export async function checkDeps(cwd) {
         // ── Scoring ────────────────────────────────────────────────────────────────
         const errors = issues.filter(i => i.severity === 'error').length;
         const warnings = issues.filter(i => i.severity === 'warning').length;
-        const rawScore = 100 - (errors * 30) - (warnings * 10);
-        const finalScore = Math.max(0, Math.min(100, rawScore));
+        // Scale by dependency count: more deps = more chances for warnings
+        const depCount = declaredNames.length;
+        const depScale = depCount <= 5 ? 1.0 : Math.max(0.3, 1.0 - Math.log10(depCount / 5) * 0.4);
+        const rawScore = 100 - (errors * 20 * depScale) - (warnings * 5 * depScale);
+        const finalScore = Math.max(0, Math.min(100, Math.round(rawScore)));
         // ── Summary ────────────────────────────────────────────────────────────────
         const parts = [];
         if (errors > 0)

package/dist/checks/integrity.js

@@ -534,15 +534,18 @@ export async function checkIntegrity(cwd, ignore) {
         ...stubbedTestIssues,
         ...unhandledAsyncIssues,
     ];
-    // Scoring: start at 100, penalize per issue type
+    // Scoring: start at 100, penalize per issue type (size-normalized)
+    const srcFiles = files.filter(f => /\.(ts|tsx|js|jsx|mts|mjs)$/.test(f));
+    const fileCount = srcFiles.length;
+    const sizeScale = fileCount <= 10 ? 1.0 : Math.max(0.3, 1.0 - Math.log10(fileCount / 10) * 0.4);
     let score = 100;
-    score -= hallucinatedIssues.length * 10;
-    score -= emptyCatchIssues.filter(i => i.severity === 'error').length * 8;
-    score -= emptyCatchIssues.filter(i => i.severity === 'warning').length * 3;
-    score -= stubbedTestIssues.filter(i => i.severity === 'error').length * 5;
+    score -= hallucinatedIssues.length * 10 * sizeScale;
+    score -= emptyCatchIssues.filter(i => i.severity === 'error').length * 8 * sizeScale;
+    score -= emptyCatchIssues.filter(i => i.severity === 'warning').length * 3 * sizeScale;
+    score -= stubbedTestIssues.filter(i => i.severity === 'error').length * 5 * sizeScale;
     // Unhandled async capped at -15 (only count warnings, not info-downgraded ones)
     const unhandledWarnings = unhandledAsyncIssues.filter(i => i.severity === 'warning').length;
-    score -= Math.min(15, unhandledWarnings * 3);
+    score -= Math.min(15, unhandledWarnings * 3 * sizeScale);
     score = Math.max(0, Math.round(score));
     // Summary parts
     const parts = [];

package/dist/checks/ready.js

@@ -141,7 +141,10 @@ function builtinReady(cwd, ignore) {
     const errors = issues.filter(i => i.severity === 'error').length;
     const warnings = issues.filter(i => i.severity === 'warning').length;
     const infos = issues.filter(i => i.severity === 'info').length;
-    const score = Math.max(0, Math.min(100, 100 - errors * 30 - warnings * 15 - infos * 3));
+    // Scale penalties for monorepos / large projects — more files = more structural issues found
+    const totalFiles = files.length;
+    const readyScale = totalFiles <= 20 ? 1.0 : Math.max(0.4, 1.0 - Math.log10(totalFiles / 20) * 0.35);
+    const score = Math.max(0, Math.min(100, 100 - errors * 30 * readyScale - warnings * 15 * readyScale - infos * 3 * readyScale));
     let summary = issues.length === 0 ? 'codebase is well-structured for AI' : `${issues.length} readiness issues`;
     if (isMonorepo)
         summary += ' (monorepo detected)';

package/dist/checks/tests.js

@@ -245,16 +245,19 @@ export function checkTests(cwd, ignore) {
         issues.push(...findMockOnlyTests(content, rel));
         issues.push(...findDuplicateDescribes(lines, rel));
     }
+    // Size-normalized scoring: scale penalties by test file count
+    // A repo with 150 test files will have more absolute issues than one with 5
+    const testScale = testFiles.length <= 5 ? 1.0 : Math.max(0.15, 1.0 - Math.log10(testFiles.length / 5) * 0.5);
     let score = 100;
     for (const issue of issues) {
         if (issue.severity === 'error')
-            score -= 8;
+            score -= 8 * testScale;
         else if (issue.severity === 'warning')
-            score -= 4;
+            score -= 4 * testScale;
         else
-            score -= 2;
+            score -= 2 * testScale;
     }
-    score = Math.max(0, score);
+    score = Math.max(0, Math.round(score));
     const summary = issues.length > 0
         ? `${issues.length} test anti-pattern${issues.length !== 1 ? 's' : ''} found across ${testFiles.length} test file${testFiles.length !== 1 ? 's' : ''}`
         : 'no test anti-patterns found';

package/dist/checks/verify.js

@@ -414,7 +414,11 @@ export function checkVerify(cwd, since) {
         }
         verified++;
     }
-    const finalScore = Math.max(0, 100 - deductions);
+    // Score based on pass rate rather than absolute deductions
+    // This prevents large codebases with many verified claims from being unfairly penalized
+    const totalClaims = verified + failed;
+    const passRate = totalClaims > 0 ? verified / totalClaims : 1;
+    const finalScore = totalClaims === 0 ? 100 : Math.max(0, Math.round(passRate * 100));
     const baseSummary = failed === 0
         ? `${verified} agent claim${verified !== 1 ? 's' : ''} verified clean`
         : `${failed} claim${failed !== 1 ? 's' : ''} failed verification (${verified} passed)`;

package/dist/cli.js

@@ -22,6 +22,8 @@ import { checkPermissions } from './checks/permissions.js';
 import { checkCompact, runCompactCommand } from './checks/compact.js';
 import { checkSubsidy, runSubsidyCommand } from './checks/subsidy.js';
 import { checkLoop, runLoopCommand } from './checks/loop.js';
+import { checkBloat, runBloatCommand } from './checks/bloat.js';
+import { checkCompleteness } from './checks/completeness.js';
 import { score } from './scorer.js';
 import { reportPretty, reportJSON, reportBadge } from './reporter.js';
 import { clearCache } from './file-cache.js';
@@ -72,6 +74,7 @@ if (flags.has('--help') || flags.has('-h')) {
     npx @safetnsr/vet compact [log]      compaction forensics for claude code sessions
     npx @safetnsr/vet subsidy [--plan tier] [--since date]  show AI cost vs subscription
     npx @safetnsr/vet loop [log]         /loop session forensics — per-iteration timeline
+    npx @safetnsr/vet bloat              detect agent-generated code bloat
 
   ${c.dim}categories:${c.reset}
     security   (30%)  scan, secrets, config, model usage
@@ -107,7 +110,7 @@ if (flags.has('--version') || flags.has('-v')) {
     }
     process.exit(0);
 }
-const COMMANDS = ['init', 'receipt', 'map', 'permissions', 'compact', 'subsidy', 'loop'];
+const COMMANDS = ['init', 'receipt', 'map', 'permissions', 'compact', 'subsidy', 'loop', 'bloat'];
 const command = COMMANDS.includes(positional[0]) ? positional[0] : undefined;
 const cwd = resolve(positional.find(p => !COMMANDS.includes(p)) || '.');
 const isCI = flags.has('--ci');
@@ -227,6 +230,17 @@ if (command === 'loop') {
     }
     process.exit(0);
 }
+if (command === 'bloat') {
+    try {
+        const format = isJSON ? 'json' : 'ascii';
+        await runBloatCommand(format);
+    }
+    catch (e) {
+        console.error(`${c.red}bloat failed:${c.reset}`, e instanceof Error ? e.message : e);
+        process.exit(1);
+    }
+    process.exit(0);
+}
 if (!isGitRepo(cwd)) {
     console.error(`${c.red}not a git repository${c.reset}. vet operates on git repos.`);
     process.exit(1);
@@ -278,7 +292,7 @@ async function runChecks() {
             }
         }
         // Run ALL independent checks in parallel
-        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult,] = await Promise.all([
+        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult,] = await Promise.all([
             withTimeout('scan', () => checkScan(cwd)),
             withTimeout('secrets', () => checkSecrets(cwd)),
             withTimeout('config', () => checkConfig(cwd, ignore)),
@@ -296,6 +310,8 @@ async function runChecks() {
             withTimeout('verify', () => checkVerify(cwd, since)),
             withTimeout('tests', () => checkTests(cwd, ignore)),
             withTimeout('loop', () => checkLoop(cwd)),
+            withTimeout('completeness', () => checkCompleteness(cwd, ignore)),
+            withTimeout('bloat', () => checkBloat(cwd)),
         ]);
         // Git-dependent checks (diff + history) — parallel with each other
         const [diffResult, historyResult] = await Promise.all([
@@ -306,8 +322,8 @@ async function runChecks() {
         clearCache();
         return score(cwd, {
             security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, subsidyResult],
-            integrity: [diffResult, integrityResult, receiptResult, compactResult, memoryResult, verifyResult, testsResult, loopResult],
-            debt: [readyResult, historyResult, debtResult],
+            integrity: [diffResult, integrityResult, receiptResult, compactResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult],
+            debt: [readyResult, historyResult, debtResult, bloatResult],
             deps: [depsResult],
         });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.13.0",
+  "version": "1.15.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {