@safetnsr/vet 1.15.0 → 1.16.0

package/dist/categories.d.ts

@@ -1,6 +1,6 @@
 import type { CheckResult, CategoryResult, VetResult } from './types.js';
 export declare function toGrade(score: number): string;
-/** Apply a floor of 20 to non-security checks that have no security-related errors */
+/** Apply a floor of 25 to non-security checks that have no security-related errors */
 export declare function applyScoreFloor(check: CheckResult): number;
 export declare function buildCategories(checkMap: {
     security: CheckResult[];

package/dist/categories.js

@@ -23,12 +23,12 @@ const WEIGHTS = {
 };
 // ── Scoring floor for non-security checks ────────────────────────────────────
 const SECURITY_CHECKS = new Set(['scan', 'secrets', 'permissions', 'owasp']);
-/** Apply a floor of 20 to non-security checks that have no security-related errors */
+/** Apply a floor of 25 to non-security checks that have no security-related errors */
 export function applyScoreFloor(check) {
     if (SECURITY_CHECKS.has(check.name))
         return check.score;
-    // Non-security check: minimum score is 20
-    return Math.max(20, check.score);
+    // Non-security check: minimum score is 25
+    return Math.max(25, check.score);
 }
 // ── Average scores within a category ────────────────────────────────────────
 function averageScore(checks) {
@@ -41,9 +41,11 @@ function averageScore(checks) {
 /**
  * Extract completeness score and apply it as a multiplier to the overall score.
  * A repo with completeness=0 (no JS/TS source) gets heavily penalized.
- * completeness 0-30 → multiplier 0.3-0.6
- * completeness 30-70 → multiplier 0.6-0.85
- * completeness 70-100 → multiplier 0.85-1.0
+ * Steeper curve to better separate quality tiers:
+ * completeness 0-25 → multiplier 0.2-0.45
+ * completeness 25-50 → multiplier 0.45-0.65
+ * completeness 50-75 → multiplier 0.65-0.85
+ * completeness 75-100 → multiplier 0.85-1.0
  */
 function completenessMultiplier(categories) {
     const integrity = categories.find(c => c.name === 'integrity');
@@ -53,11 +55,13 @@ function completenessMultiplier(categories) {
     if (!comp)
         return 1.0;
     const s = comp.score;
-    if (s >= 70)
-        return 0.85 + (s - 70) * (0.15 / 30);
-    if (s >= 30)
-        return 0.6 + (s - 30) * (0.25 / 40);
-    return 0.3 + s * (0.3 / 30);
+    if (s >= 75)
+        return 0.85 + (s - 75) * (0.15 / 25);
+    if (s >= 50)
+        return 0.65 + (s - 50) * (0.20 / 25);
+    if (s >= 25)
+        return 0.45 + (s - 25) * (0.20 / 25);
+    return 0.20 + s * (0.25 / 25);
 }
 // ── Group checks into categories ─────────────────────────────────────────────
 export function buildCategories(checkMap) {

package/dist/checks/guard.d.ts

@@ -0,0 +1,3 @@
+import type { CheckResult } from '../types.js';
+export declare function checkGuard(cwd: string): CheckResult;
+export declare function runGuardCommand(format: string, cwd?: string): Promise<void>;

package/dist/checks/guard.js

@@ -0,0 +1,179 @@
+import { join, extname } from 'node:path';
+import { cachedRead } from '../file-cache.js';
+import { walkFiles, c } from '../util.js';
+// ── Constants ────────────────────────────────────────────────────────────────
+const SCAN_EXTS = new Set(['.ts', '.js', '.mjs', '.cjs', '.sql', '.sh', '.bash', '.py', '.rb']);
+const SQL_EXTS = new Set(['.sql', '.ts', '.js', '.mjs', '.cjs']);
+const SHELL_EXTS = new Set(['.sh', '.bash', '.ts', '.js']);
+const SKIP_DIRS = ['test', '__tests__'];
+const SKIP_PATTERN = /\.(test|spec)\.[^.]+$/;
+// SQL patterns (case-insensitive)
+const DROP_TABLE_RE = /\bDROP\s+TABLE\b/i;
+const DROP_DB_RE = /\bDROP\s+DATABASE\b/i;
+const TRUNCATE_RE = /\bTRUNCATE\b(\s+TABLE\b)?/i;
+const DELETE_FROM_RE = /\bDELETE\s+FROM\b/i;
+const DELETE_WHERE_RE = /\bDELETE\s+FROM\b.*\bWHERE\b/i;
+// Shell patterns
+const RM_RF_RE = /\brm\s+-(r|rf|fr)\b/i;
+const RMDIR_RE = /\brmdir\b/i;
+const SHRED_RE = /\bshred\b/;
+const TRUNCATE_CMD_RE = /\btruncate\s+--size\b/;
+// JS exec patterns
+const EXEC_CALL_RE = /\b(exec|execSync|spawn|spawnSync)\s*\(/;
+// Migration path patterns
+const MIGRATION_PATH_RE = /migrat|db[/\\]/i;
+// Rollback function patterns
+const ROLLBACK_RE = /\b(down|rollback|revert)\s*\(/;
+// ── Helpers ──────────────────────────────────────────────────────────────────
+function shouldSkip(relPath) {
+    const parts = relPath.split(/[/\\]/);
+    for (const part of parts) {
+        if (SKIP_DIRS.includes(part))
+            return true;
+    }
+    return SKIP_PATTERN.test(relPath);
+}
+function scanLine(line, lineNum, relPath, ext, issues) {
+    const isSqlExt = SQL_EXTS.has(ext);
+    const isShellExt = SHELL_EXTS.has(ext);
+    // Pass 1 — SQL patterns
+    if (isSqlExt) {
+        if (DROP_TABLE_RE.test(line)) {
+            issues.push({ severity: 'error', message: 'DROP TABLE without transaction', file: relPath, line: lineNum, fixable: false, fixHint: 'wrap in transaction or add rollback' });
+        }
+        if (DROP_DB_RE.test(line)) {
+            issues.push({ severity: 'error', message: 'DROP DATABASE detected', file: relPath, line: lineNum, fixable: false, fixHint: 'remove or gate behind confirmation' });
+        }
+        if (TRUNCATE_RE.test(line)) {
+            issues.push({ severity: 'error', message: 'TRUNCATE operation detected', file: relPath, line: lineNum, fixable: false, fixHint: 'use soft-delete or add rollback' });
+        }
+        if (DELETE_FROM_RE.test(line)) {
+            if (DELETE_WHERE_RE.test(line)) {
+                issues.push({ severity: 'warning', message: 'DELETE FROM with WHERE clause', file: relPath, line: lineNum, fixable: false, fixHint: 'consider soft-delete or add --dry-run check' });
+            }
+            else {
+                issues.push({ severity: 'error', message: 'DELETE FROM without WHERE clause', file: relPath, line: lineNum, fixable: false, fixHint: 'add WHERE clause or use TRUNCATE with rollback' });
+            }
+        }
+    }
+    // Pass 2 — Shell patterns
+    if (isShellExt) {
+        // Direct shell commands in .sh/.bash
+        if (ext === '.sh' || ext === '.bash') {
+            if (RM_RF_RE.test(line)) {
+                issues.push({ severity: 'error', message: 'rm -rf in shell script', file: relPath, line: lineNum, fixable: false, fixHint: 'use trash-cli or add confirmation gate' });
+            }
+            if (RMDIR_RE.test(line)) {
+                issues.push({ severity: 'error', message: 'rmdir in shell script', file: relPath, line: lineNum, fixable: false, fixHint: 'use trash-cli or add confirmation gate' });
+            }
+            if (SHRED_RE.test(line)) {
+                issues.push({ severity: 'error', message: 'shred command detected', file: relPath, line: lineNum, fixable: false, fixHint: 'remove or gate behind confirmation' });
+            }
+            if (TRUNCATE_CMD_RE.test(line)) {
+                issues.push({ severity: 'error', message: 'truncate --size command detected', file: relPath, line: lineNum, fixable: false, fixHint: 'remove or gate behind confirmation' });
+            }
+        }
+        // JS/TS exec/spawn calls with destructive commands
+        if (ext === '.ts' || ext === '.js') {
+            if (EXEC_CALL_RE.test(line)) {
+                if (RM_RF_RE.test(line)) {
+                    issues.push({ severity: 'error', message: 'rm -rf in exec call', file: relPath, line: lineNum, fixable: false, fixHint: 'use trash-cli or add confirmation gate' });
+                }
+                if (RMDIR_RE.test(line)) {
+                    issues.push({ severity: 'error', message: 'rmdir in exec call', file: relPath, line: lineNum, fixable: false, fixHint: 'use trash-cli or add confirmation gate' });
+                }
+                if (SHRED_RE.test(line)) {
+                    issues.push({ severity: 'error', message: 'shred in exec call', file: relPath, line: lineNum, fixable: false, fixHint: 'remove or gate behind confirmation' });
+                }
+                if (TRUNCATE_CMD_RE.test(line)) {
+                    issues.push({ severity: 'error', message: 'truncate --size in exec call', file: relPath, line: lineNum, fixable: false, fixHint: 'remove or gate behind confirmation' });
+                }
+            }
+        }
+    }
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export function checkGuard(cwd) {
+    const issues = [];
+    const files = walkFiles(cwd);
+    for (const relPath of files) {
+        const ext = extname(relPath).toLowerCase();
+        if (!SCAN_EXTS.has(ext))
+            continue;
+        if (shouldSkip(relPath))
+            continue;
+        const fullPath = join(cwd, relPath);
+        let content;
+        try {
+            content = cachedRead(fullPath);
+        }
+        catch {
+            continue;
+        }
+        const rel = relPath;
+        const lines = content.split('\n');
+        const fileIssuesBefore = issues.length;
+        for (let i = 0; i < lines.length; i++) {
+            scanLine(lines[i], i + 1, rel, ext, issues);
+        }
+        // Pass 3 — Migration check
+        if (MIGRATION_PATH_RE.test(rel)) {
+            const hasDestructive = DROP_TABLE_RE.test(content) || DROP_DB_RE.test(content) ||
+                DELETE_FROM_RE.test(content) || TRUNCATE_RE.test(content);
+            const hasRollback = ROLLBACK_RE.test(content);
+            if (hasDestructive && !hasRollback) {
+                issues.push({
+                    severity: 'warning',
+                    message: 'migration with destructive operation but no rollback function',
+                    file: rel,
+                    fixable: false,
+                    fixHint: 'add down() or rollback() function',
+                });
+            }
+        }
+    }
+    const errors = issues.filter(i => i.severity === 'error').length;
+    const warnings = issues.filter(i => i.severity === 'warning').length;
+    const total = errors + warnings;
+    const score = Math.max(0, 100 - (errors * 15) - (warnings * 5));
+    const summary = total === 0
+        ? 'no destructive patterns found'
+        : `${total} bomb sites found (${errors} fatal, ${warnings} warning)`;
+    return { name: 'guard', score, maxScore: 100, issues, summary };
+}
+// ── Subcommand output ────────────────────────────────────────────────────────
+export async function runGuardCommand(format, cwd) {
+    const dir = cwd || process.cwd();
+    const result = checkGuard(dir);
+    if (format === 'json') {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log(`\n  ${c.bold}vet guard${c.reset} — destructive operation scanner\n`);
+    const errors = result.issues.filter(i => i.severity === 'error');
+    const warnings = result.issues.filter(i => i.severity === 'warning');
+    if (errors.length > 0) {
+        console.log(`  ${c.red}FATAL${c.reset}`);
+        for (const issue of errors) {
+            const loc = issue.file ? (issue.line ? `${issue.file}:${issue.line}` : issue.file) : '';
+            console.log(`  ${c.red}✗${c.reset} ${issue.message}${loc ? ` (${loc})` : ''}`);
+            if (issue.fixHint)
+                console.log(`    ${c.dim}→ ${issue.fixHint}${c.reset}`);
+        }
+        console.log();
+    }
+    if (warnings.length > 0) {
+        console.log(`  ${c.yellow}WARN${c.reset}`);
+        for (const issue of warnings) {
+            const loc = issue.file ? (issue.line ? `${issue.file}:${issue.line}` : issue.file) : '';
+            console.log(`  ${c.yellow}⚠${c.reset} ${issue.message}${loc ? ` (${loc})` : ''}`);
+            if (issue.fixHint)
+                console.log(`    ${c.dim}→ ${issue.fixHint}${c.reset}`);
+        }
+        console.log();
+    }
+    if (result.issues.length === 0) {
+        console.log(`  ${c.green}no destructive patterns found${c.reset}\n`);
+    }
+    console.log(`  ${result.summary}\n`);
+}

package/dist/cli.js

@@ -23,6 +23,7 @@ import { checkCompact, runCompactCommand } from './checks/compact.js';
 import { checkSubsidy, runSubsidyCommand } from './checks/subsidy.js';
 import { checkLoop, runLoopCommand } from './checks/loop.js';
 import { checkBloat, runBloatCommand } from './checks/bloat.js';
+import { checkGuard, runGuardCommand } from './checks/guard.js';
 import { checkCompleteness } from './checks/completeness.js';
 import { score } from './scorer.js';
 import { reportPretty, reportJSON, reportBadge } from './reporter.js';
@@ -75,6 +76,7 @@ if (flags.has('--help') || flags.has('-h')) {
     npx @safetnsr/vet subsidy [--plan tier] [--since date]  show AI cost vs subscription
     npx @safetnsr/vet loop [log]         /loop session forensics — per-iteration timeline
     npx @safetnsr/vet bloat              detect agent-generated code bloat
+    npx @safetnsr/vet guard [dir]        scan for destructive operation bomb sites
 
   ${c.dim}categories:${c.reset}
     security   (30%)  scan, secrets, config, model usage
@@ -110,7 +112,7 @@ if (flags.has('--version') || flags.has('-v')) {
     }
     process.exit(0);
 }
-const COMMANDS = ['init', 'receipt', 'map', 'permissions', 'compact', 'subsidy', 'loop', 'bloat'];
+const COMMANDS = ['init', 'receipt', 'map', 'permissions', 'compact', 'subsidy', 'loop', 'bloat', 'guard'];
 const command = COMMANDS.includes(positional[0]) ? positional[0] : undefined;
 const cwd = resolve(positional.find(p => !COMMANDS.includes(p)) || '.');
 const isCI = flags.has('--ci');
@@ -241,6 +243,17 @@ if (command === 'bloat') {
     }
     process.exit(0);
 }
+if (command === 'guard') {
+    try {
+        const format = isJSON ? 'json' : 'ascii';
+        await runGuardCommand(format, cwd);
+    }
+    catch (e) {
+        console.error(`${c.red}guard failed:${c.reset}`, e instanceof Error ? e.message : e);
+        process.exit(1);
+    }
+    process.exit(0);
+}
 if (!isGitRepo(cwd)) {
     console.error(`${c.red}not a git repository${c.reset}. vet operates on git repos.`);
     process.exit(1);
@@ -292,7 +305,7 @@ async function runChecks() {
             }
         }
         // Run ALL independent checks in parallel
-        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult,] = await Promise.all([
+        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult, guardResult,] = await Promise.all([
             withTimeout('scan', () => checkScan(cwd)),
             withTimeout('secrets', () => checkSecrets(cwd)),
             withTimeout('config', () => checkConfig(cwd, ignore)),
@@ -312,6 +325,7 @@ async function runChecks() {
             withTimeout('loop', () => checkLoop(cwd)),
             withTimeout('completeness', () => checkCompleteness(cwd, ignore)),
             withTimeout('bloat', () => checkBloat(cwd)),
+            withTimeout('guard', () => checkGuard(cwd)),
         ]);
         // Git-dependent checks (diff + history) — parallel with each other
         const [diffResult, historyResult] = await Promise.all([
@@ -321,7 +335,7 @@ async function runChecks() {
         // Clear file cache after all checks complete
         clearCache();
         return score(cwd, {
-            security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, subsidyResult],
+            security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, subsidyResult, guardResult],
             integrity: [diffResult, integrityResult, receiptResult, compactResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult],
             debt: [readyResult, historyResult, debtResult, bloatResult],
             deps: [depsResult],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {