@safetnsr/vet 1.14.0 → 1.15.1

package/dist/categories.d.ts

@@ -1,6 +1,6 @@
 import type { CheckResult, CategoryResult, VetResult } from './types.js';
 export declare function toGrade(score: number): string;
-/** Apply a floor of 20 to non-security checks that have no security-related errors */
+/** Apply a floor of 25 to non-security checks that have no security-related errors */
 export declare function applyScoreFloor(check: CheckResult): number;
 export declare function buildCategories(checkMap: {
     security: CheckResult[];

package/dist/categories.js

@@ -23,12 +23,12 @@ const WEIGHTS = {
 };
 // ── Scoring floor for non-security checks ────────────────────────────────────
 const SECURITY_CHECKS = new Set(['scan', 'secrets', 'permissions', 'owasp']);
-/** Apply a floor of 20 to non-security checks that have no security-related errors */
+/** Apply a floor of 25 to non-security checks that have no security-related errors */
 export function applyScoreFloor(check) {
     if (SECURITY_CHECKS.has(check.name))
         return check.score;
-    // Non-security check: minimum score is 20
-    return Math.max(20, check.score);
+    // Non-security check: minimum score is 25
+    return Math.max(25, check.score);
 }
 // ── Average scores within a category ────────────────────────────────────────
 function averageScore(checks) {
@@ -41,9 +41,11 @@ function averageScore(checks) {
 /**
  * Extract completeness score and apply it as a multiplier to the overall score.
  * A repo with completeness=0 (no JS/TS source) gets heavily penalized.
- * completeness 0-30 → multiplier 0.3-0.6
- * completeness 30-70 → multiplier 0.6-0.85
- * completeness 70-100 → multiplier 0.85-1.0
+ * Steeper curve to better separate quality tiers:
+ * completeness 0-25 → multiplier 0.2-0.45
+ * completeness 25-50 → multiplier 0.45-0.65
+ * completeness 50-75 → multiplier 0.65-0.85
+ * completeness 75-100 → multiplier 0.85-1.0
  */
 function completenessMultiplier(categories) {
     const integrity = categories.find(c => c.name === 'integrity');
@@ -53,11 +55,13 @@ function completenessMultiplier(categories) {
     if (!comp)
         return 1.0;
     const s = comp.score;
-    if (s >= 70)
-        return 0.85 + (s - 70) * (0.15 / 30);
-    if (s >= 30)
-        return 0.6 + (s - 30) * (0.25 / 40);
-    return 0.3 + s * (0.3 / 30);
+    if (s >= 75)
+        return 0.85 + (s - 75) * (0.15 / 25);
+    if (s >= 50)
+        return 0.65 + (s - 50) * (0.20 / 25);
+    if (s >= 25)
+        return 0.45 + (s - 25) * (0.20 / 25);
+    return 0.20 + s * (0.25 / 25);
 }
 // ── Group checks into categories ─────────────────────────────────────────────
 export function buildCategories(checkMap) {

package/dist/checks/completeness.js

@@ -1,5 +1,6 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { execSync } from 'node:child_process';
 import { walkFiles, readFile } from '../util.js';
 /**
  * Completeness check — scores repos on presence of good practices.
@@ -111,6 +112,37 @@ export async function checkCompleteness(cwd, ignore) {
         existsSync(join(cwd, '.circleci'));
     if (hasCI)
         points += 10;
+    // ── Git freshness (0-10 points, negative for very stale) ──
+    try {
+        const lastCommit = execSync('git log -1 --format=%ct', { cwd, stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();
+        const ageMonths = (Date.now() / 1000 - parseInt(lastCommit)) / (30 * 24 * 3600);
+        if (ageMonths < 6) {
+            points += 10; // actively maintained
+        }
+        else if (ageMonths < 12) {
+            points += 5;
+        }
+        else if (ageMonths < 24) {
+            // no bonus, no penalty
+            issues.push({
+                file: '',
+                message: `last commit ${Math.round(ageMonths)} months ago`,
+                severity: 'info',
+                fixable: false,
+            });
+        }
+        else {
+            // Stale: actively penalize
+            points -= 15;
+            issues.push({
+                file: '',
+                message: `last commit ${Math.round(ageMonths)} months ago — likely abandoned`,
+                severity: 'warning',
+                fixable: false,
+            });
+        }
+    }
+    catch { /* not a git repo or no commits */ }
     // ── Linting/Formatting (0-10 points) ──
     const hasLint = existsSync(join(cwd, '.eslintrc.json')) ||
         existsSync(join(cwd, '.eslintrc.js')) ||

package/dist/checks/debt.js

@@ -517,14 +517,19 @@ export async function checkDebt(cwd, ignore) {
     // D) Naming drift
     const driftIssues = findNamingDrift(allFuncs);
     issues.push(...driftIssues);
-    // ── Scoring ──────────────────────────────────────────────────────────────
-    const dupPenalty = Math.min(50, dupIssues.length * 8);
+    // ── Scoring (size-normalized) ─────────────────────────────────────────────
+    // Scale penalties by project size: a repo with 200 files should tolerate
+    // more absolute issues than one with 10 files. The scaling factor ranges
+    // from 1.0 (≤10 files) to 0.3 (500+ files), using log scale.
+    const fileCount = sourceFiles.length;
+    const sizeScale = fileCount <= 10 ? 1.0 : Math.max(0.3, 1.0 - Math.log10(fileCount / 10) * 0.4);
+    const dupPenalty = Math.min(50, dupIssues.length * 8) * sizeScale;
     const orphanWarnings = orphanIssues.filter(i => i.severity === 'warning');
-    const orphanPenalty = Math.min(30, orphanWarnings.length * 5);
+    const orphanPenalty = Math.min(30, orphanWarnings.length * 5) * sizeScale;
     const wrapperWarnings = wrapperIssues.filter(i => i.severity === 'warning');
     const driftWarnings = driftIssues.filter(i => i.severity === 'warning');
-    const wrapperPenalty = Math.min(15, wrapperWarnings.length * 3);
-    const driftPenalty = Math.min(10, driftWarnings.length * 2);
+    const wrapperPenalty = Math.min(15, wrapperWarnings.length * 3) * sizeScale;
+    const driftPenalty = Math.min(10, driftWarnings.length * 2) * sizeScale;
     const rawScore = 100 - dupPenalty - orphanPenalty - wrapperPenalty - driftPenalty;
     const finalScore = Math.max(0, Math.round(rawScore));
     // ── Summary ──────────────────────────────────────────────────────────────

package/dist/checks/deps.js

@@ -521,8 +521,11 @@ export async function checkDeps(cwd) {
         // ── Scoring ────────────────────────────────────────────────────────────────
         const errors = issues.filter(i => i.severity === 'error').length;
         const warnings = issues.filter(i => i.severity === 'warning').length;
-        const rawScore = 100 - (errors * 20) - (warnings * 5);
-        const finalScore = Math.max(0, Math.min(100, rawScore));
+        // Scale by dependency count: more deps = more chances for warnings
+        const depCount = declaredNames.length;
+        const depScale = depCount <= 5 ? 1.0 : Math.max(0.3, 1.0 - Math.log10(depCount / 5) * 0.4);
+        const rawScore = 100 - (errors * 20 * depScale) - (warnings * 5 * depScale);
+        const finalScore = Math.max(0, Math.min(100, Math.round(rawScore)));
         // ── Summary ────────────────────────────────────────────────────────────────
         const parts = [];
         if (errors > 0)

package/dist/checks/integrity.js

@@ -534,15 +534,18 @@ export async function checkIntegrity(cwd, ignore) {
         ...stubbedTestIssues,
         ...unhandledAsyncIssues,
     ];
-    // Scoring: start at 100, penalize per issue type
+    // Scoring: start at 100, penalize per issue type (size-normalized)
+    const srcFiles = files.filter(f => /\.(ts|tsx|js|jsx|mts|mjs)$/.test(f));
+    const fileCount = srcFiles.length;
+    const sizeScale = fileCount <= 10 ? 1.0 : Math.max(0.3, 1.0 - Math.log10(fileCount / 10) * 0.4);
     let score = 100;
-    score -= hallucinatedIssues.length * 10;
-    score -= emptyCatchIssues.filter(i => i.severity === 'error').length * 8;
-    score -= emptyCatchIssues.filter(i => i.severity === 'warning').length * 3;
-    score -= stubbedTestIssues.filter(i => i.severity === 'error').length * 5;
+    score -= hallucinatedIssues.length * 10 * sizeScale;
+    score -= emptyCatchIssues.filter(i => i.severity === 'error').length * 8 * sizeScale;
+    score -= emptyCatchIssues.filter(i => i.severity === 'warning').length * 3 * sizeScale;
+    score -= stubbedTestIssues.filter(i => i.severity === 'error').length * 5 * sizeScale;
     // Unhandled async capped at -15 (only count warnings, not info-downgraded ones)
     const unhandledWarnings = unhandledAsyncIssues.filter(i => i.severity === 'warning').length;
-    score -= Math.min(15, unhandledWarnings * 3);
+    score -= Math.min(15, unhandledWarnings * 3 * sizeScale);
     score = Math.max(0, Math.round(score));
     // Summary parts
     const parts = [];

package/dist/checks/ready.js

@@ -141,7 +141,10 @@ function builtinReady(cwd, ignore) {
     const errors = issues.filter(i => i.severity === 'error').length;
     const warnings = issues.filter(i => i.severity === 'warning').length;
     const infos = issues.filter(i => i.severity === 'info').length;
-    const score = Math.max(0, Math.min(100, 100 - errors * 30 - warnings * 15 - infos * 3));
+    // Scale penalties for monorepos / large projects — more files = more structural issues found
+    const totalFiles = files.length;
+    const readyScale = totalFiles <= 20 ? 1.0 : Math.max(0.4, 1.0 - Math.log10(totalFiles / 20) * 0.35);
+    const score = Math.max(0, Math.min(100, 100 - errors * 30 * readyScale - warnings * 15 * readyScale - infos * 3 * readyScale));
     let summary = issues.length === 0 ? 'codebase is well-structured for AI' : `${issues.length} readiness issues`;
     if (isMonorepo)
         summary += ' (monorepo detected)';

package/dist/checks/tests.js

@@ -245,16 +245,19 @@ export function checkTests(cwd, ignore) {
         issues.push(...findMockOnlyTests(content, rel));
         issues.push(...findDuplicateDescribes(lines, rel));
     }
+    // Size-normalized scoring: scale penalties by test file count
+    // A repo with 150 test files will have more absolute issues than one with 5
+    const testScale = testFiles.length <= 5 ? 1.0 : Math.max(0.15, 1.0 - Math.log10(testFiles.length / 5) * 0.5);
     let score = 100;
     for (const issue of issues) {
         if (issue.severity === 'error')
-            score -= 8;
+            score -= 8 * testScale;
         else if (issue.severity === 'warning')
-            score -= 4;
+            score -= 4 * testScale;
         else
-            score -= 2;
+            score -= 2 * testScale;
     }
-    score = Math.max(0, score);
+    score = Math.max(0, Math.round(score));
     const summary = issues.length > 0
         ? `${issues.length} test anti-pattern${issues.length !== 1 ? 's' : ''} found across ${testFiles.length} test file${testFiles.length !== 1 ? 's' : ''}`
         : 'no test anti-patterns found';

package/dist/checks/verify.js

@@ -414,7 +414,11 @@ export function checkVerify(cwd, since) {
         }
         verified++;
     }
-    const finalScore = Math.max(0, 100 - deductions);
+    // Score based on pass rate rather than absolute deductions
+    // This prevents large codebases with many verified claims from being unfairly penalized
+    const totalClaims = verified + failed;
+    const passRate = totalClaims > 0 ? verified / totalClaims : 1;
+    const finalScore = totalClaims === 0 ? 100 : Math.max(0, Math.round(passRate * 100));
     const baseSummary = failed === 0
         ? `${verified} agent claim${verified !== 1 ? 's' : ''} verified clean`
         : `${failed} claim${failed !== 1 ? 's' : ''} failed verification (${verified} passed)`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.14.0",
+  "version": "1.15.1",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {