@safetnsr/vet 1.15.1 → 1.17.0

package/dist/checks/debt.js

@@ -8,12 +8,45 @@ function isSourceFile(f) {
     return dot !== -1 && SOURCE_EXTS.has(f.substring(dot));
 }
 function isTestFile(f) {
-    return /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || f.startsWith('test/') || f.startsWith('test\\');
+    return /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || /(?:^|[/\\])tests?[/\\]/.test(f);
 }
 function isEntryFile(f) {
     const b = basename(f);
     return /^(cli|main|index)\.[jt]sx?$/.test(b);
 }
+// Next.js / Remix / SvelteKit / Nuxt convention exports consumed by the framework, not via imports
+const FRAMEWORK_CONVENTION_EXPORTS = new Set([
+    // Next.js App Router
+    'GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'HEAD', 'OPTIONS',
+    'metadata', 'generateMetadata', 'generateStaticParams', 'generateViewport',
+    'viewport', 'runtime', 'revalidate', 'dynamic', 'dynamicParams',
+    'fetchCache', 'preferredRegion', 'maxDuration',
+    'default', // default export in page/layout/route files
+    // Next.js Pages Router
+    'getServerSideProps', 'getStaticProps', 'getStaticPaths',
+    // Remix
+    'loader', 'action', 'meta', 'links', 'headers', 'handle',
+    'shouldRevalidate', 'ErrorBoundary', 'HydrateFallback',
+    // SvelteKit
+    'load', 'prerender', 'ssr', 'csr', 'trailingSlash',
+    // Nuxt
+    'definePageMeta', 'useHead',
+]);
+function isFrameworkConventionFile(file) {
+    // Next.js app router: app/**/page.tsx, layout.tsx, route.tsx, loading.tsx, error.tsx, etc.
+    if (/\/(app|pages)\//.test(file) && /\/(page|layout|route|loading|error|not-found|template|default|middleware)\.[jt]sx?$/.test(file))
+        return true;
+    // Next.js API routes
+    if (/\/api\//.test(file) && /\/route\.[jt]sx?$/.test(file))
+        return true;
+    // Remix routes
+    if (/\/routes\//.test(file) && /\.[jt]sx?$/.test(file))
+        return true;
+    // SvelteKit
+    if (/\+(page|layout|server|error)\.[jt]s/.test(file))
+        return true;
+    return false;
+}
 function isBarrelFile(f) {
     const b = basename(f);
     return /^index\.[jt]sx?$/.test(b);
@@ -236,14 +269,14 @@ function findDuplicates(allFuncs) {
         // Downgrade to info if all functions in the group are in test directories
         // or if any function is in an examples/demo directory
         const allInTest = group.every(f => isInTestDir(f.file));
-        const anyInExample = group.some(f => /(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(f.file));
+        const anyInExample = group.some(f => /(?:^|[/\\])(?:examples?|demos?|templates?|fixtures?)[/\\]/.test(f.file));
         issues.push({
             severity: (allInTest || anyInExample) ? 'info' : 'warning',
             message: `near-duplicate functions: ${locations}`,
             file: group[0].file,
             line: group[0].line,
-            fixable: true,
-            fixHint: 'extract shared logic into a single function',
+            fixable: !(allInTest || anyInExample),
+            fixHint: (allInTest || anyInExample) ? 'duplication in examples/tests is often intentional' : 'extract shared logic into a single function',
         });
     }
     // Similarity check for non-exact matches — length-bucketed to avoid O(n²) explosion
@@ -275,14 +308,14 @@ function findDuplicates(allFuncs) {
                 // Downgrade to info if both functions are in test directories
                 // or if either is in an examples/demo directory
                 const bothInTest = isInTestDir(a.file) && isInTestDir(b.file);
-                const anyInExample = /(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(a.file) || /(?:^|[/\\])(?:examples?|demos?)[/\\]/.test(b.file);
+                const anyInExample = /(?:^|[/\\])(?:examples?|demos?|templates?|fixtures?)[/\\]/.test(a.file) || /(?:^|[/\\])(?:examples?|demos?|templates?|fixtures?)[/\\]/.test(b.file);
                 issues.push({
                     severity: (bothInTest || anyInExample) ? 'info' : 'warning',
                     message: `similar functions (${Math.round(sim * 100)}%): ${a.name} (${a.file}:${a.line}) and ${b.name} (${b.file}:${b.line})`,
                     file: a.file,
                     line: a.line,
-                    fixable: true,
-                    fixHint: 'consider merging or extracting shared logic',
+                    fixable: !(bothInTest || anyInExample),
+                    fixHint: (bothInTest || anyInExample) ? 'duplication in examples/tests is often intentional' : 'consider merging or extracting shared logic',
                 });
             }
         }
@@ -373,19 +406,27 @@ function findOrphanedExports(cwd, files) {
                 continue;
             const braceMatch = line.match(/^export\s*\{([^}]+)\}/);
             if (braceMatch) {
-                const names = braceMatch[1].split(',').map(n => n.trim().split(/\s+as\s+/)[0].trim()).filter(Boolean);
-                for (const name of names) {
-                    if (name === 'default' || name === 'type')
+                for (const part of braceMatch[1].split(',')) {
+                    const trimmed = part.trim();
+                    if (!trimmed)
+                        continue;
+                    // export { x as y } — use the alias (y) as the exported name, since that's what consumers see
+                    const asParts = trimmed.split(/\s+as\s+/);
+                    const exportedName = (asParts.length > 1 ? asParts[1] : asParts[0]).trim();
+                    if (exportedName === 'default' || exportedName === 'type')
                         continue;
-                    exports.push({ name, file, line: i + 1 });
+                    exports.push({ name: exportedName, file, line: i + 1 });
                 }
             }
         }
     }
-    // Scan all files for import names — collect all imported identifiers into a Set
+    // Scan ALL files (including tests) for import names — an export consumed by a test is not orphaned
     const importedNames = new Set();
     const importRe = /import\s+(?:type\s+)?(?:\{([^}]+)\}|([a-zA-Z_$][a-zA-Z0-9_$]*)(?:\s*,\s*\{([^}]+)\})?)\s+from\s+/g;
-    for (const file of sourceFiles) {
+    // Also scan for dynamic imports: require('x'), import('x') — to catch non-static usage
+    const dynamicImportRe = /(?:require|import)\s*\(\s*['"]([^'"]+)['"]\s*\)/g;
+    const allSourceFiles = files.filter(f => isSourceFile(f));
+    for (const file of allSourceFiles) {
         const content = readFile(join(cwd, file));
         if (!content)
             continue;
@@ -406,10 +447,39 @@ function findOrphanedExports(cwd, files) {
                 importedNames.add(match[2]);
         }
     }
+    // Build a cross-reference map: for each exported name, check if it appears in other files
+    // This catches hook returns ({ Component } = useHook()), dynamic usage, re-exports, JSX, etc.
+    // Only build refs for names we actually export (not all identifiers — too expensive)
+    const exportNames = new Set(exports.map(e => e.name));
+    const nameToFiles = new Map();
+    for (const name of exportNames)
+        nameToFiles.set(name, new Set());
+    for (const file of allSourceFiles) {
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        for (const name of exportNames) {
+            if (content.includes(name)) {
+                nameToFiles.get(name).add(file);
+            }
+        }
+    }
     const lib = isLibrary(cwd);
     const mono = isMonorepo(cwd);
     for (const exp of exports) {
         if (!importedNames.has(exp.name)) {
+            // Cross-reference check: if the export name appears in a different file, it's likely used
+            // (catches hook returns, JSX usage, dynamic imports, re-exports)
+            const refs = nameToFiles.get(exp.name);
+            if (refs) {
+                const otherFiles = new Set(refs);
+                otherFiles.delete(exp.file);
+                if (otherFiles.size > 0)
+                    continue; // referenced in another file → not orphaned
+            }
+            // Skip framework convention exports (Next.js, Remix, SvelteKit, Nuxt)
+            if (FRAMEWORK_CONVENTION_EXPORTS.has(exp.name) && isFrameworkConventionFile(exp.file))
+                continue;
             // In monorepos, check if the export's file is inside a workspace package that is a library
             const isLib = lib || (mono && isFileInLibraryPackage(cwd, exp.file));
             issues.push({
@@ -417,7 +487,7 @@ function findOrphanedExports(cwd, files) {
                 message: `orphaned export: "${exp.name}" is exported but never imported${isLib ? ' (library detected — exports may be consumed externally)' : ''}`,
                 file: exp.file,
                 line: exp.line,
-                fixable: true,
+                fixable: !isLib,
                 fixHint: isLib ? 'may be public API — verify if still needed' : 'remove the export keyword or delete the function',
             });
         }

package/dist/checks/deps.js

@@ -290,10 +290,27 @@ const TOOLING_PACKAGES = new Set([
     'husky', 'lint-staged', 'tsx', 'ts-node', 'concurrently', 'npm-run-all',
     'shx', 'rimraf', 'cross-env', 'nodemon', 'jest', 'vitest', 'mocha',
     'c8', 'nyc', 'turbo', 'lerna', 'changesets', '@changesets/cli',
+    '@changesets/changelog-github', '@changesets/changelog-git',
     'webpack', 'webpack-cli', 'vite', 'rollup', 'esbuild', 'swc',
     'tailwindcss', 'postcss', 'autoprefixer', 'sass', 'less',
     'commitizen', 'cz-conventional-changelog', 'semantic-release',
     '@typescript/native-preview',
+    // Linting configs (used via eslint extends, not imported)
+    'eslint-config-next', 'eslint-config-prettier', 'eslint-config-turbo',
+    '@next/eslint-plugin-next', 'eslint-plugin-react', 'eslint-plugin-react-hooks',
+    'eslint-plugin-import', 'eslint-plugin-jsx-a11y', 'eslint-plugin-tailwindcss',
+    // Commit/release tooling
+    '@commitlint/cli', '@commitlint/config-conventional',
+    'standard-version', 'release-it', 'np',
+    // Test utilities (used as test runner plugins/reporters)
+    'chai', 'sinon', 'supertest', 'nock', '@testing-library/react',
+    '@testing-library/jest-dom', '@testing-library/user-event',
+    'ts-jest', '@swc/jest', 'babel-jest',
+    // Build plugins (used via config files, not imported)
+    '@vitejs/plugin-react', '@sveltejs/adapter-auto', '@sveltejs/kit',
+    'del-cli', 'make-node',
+    // Type packages (consumed by TS compiler, not imported)
+    '@types/react', '@types/react-dom', '@types/jest', '@types/mocha',
 ]);
 // ── Collect all deps declared in workspace sub-packages ──────────────────────
 export function collectWorkspaceDeps(cwd) {

package/dist/checks/guard.d.ts

@@ -0,0 +1,3 @@
+import type { CheckResult } from '../types.js';
+export declare function checkGuard(cwd: string): CheckResult;
+export declare function runGuardCommand(format: string, cwd?: string): Promise<void>;

package/dist/checks/guard.js

@@ -0,0 +1,179 @@
+import { join, extname } from 'node:path';
+import { cachedRead } from '../file-cache.js';
+import { walkFiles, c } from '../util.js';
+// ── Constants ────────────────────────────────────────────────────────────────
+const SCAN_EXTS = new Set(['.ts', '.js', '.mjs', '.cjs', '.sql', '.sh', '.bash', '.py', '.rb']);
+const SQL_EXTS = new Set(['.sql', '.ts', '.js', '.mjs', '.cjs']);
+const SHELL_EXTS = new Set(['.sh', '.bash', '.ts', '.js']);
+const SKIP_DIRS = ['test', '__tests__'];
+const SKIP_PATTERN = /\.(test|spec)\.[^.]+$/;
+// SQL patterns (case-insensitive)
+const DROP_TABLE_RE = /\bDROP\s+TABLE\b/i;
+const DROP_DB_RE = /\bDROP\s+DATABASE\b/i;
+const TRUNCATE_RE = /\bTRUNCATE\b(\s+TABLE\b)?/i;
+const DELETE_FROM_RE = /\bDELETE\s+FROM\b/i;
+const DELETE_WHERE_RE = /\bDELETE\s+FROM\b.*\bWHERE\b/i;
+// Shell patterns
+const RM_RF_RE = /\brm\s+-(r|rf|fr)\b/i;
+const RMDIR_RE = /\brmdir\b/i;
+const SHRED_RE = /\bshred\b/;
+const TRUNCATE_CMD_RE = /\btruncate\s+--size\b/;
+// JS exec patterns
+const EXEC_CALL_RE = /\b(exec|execSync|spawn|spawnSync)\s*\(/;
+// Migration path patterns
+const MIGRATION_PATH_RE = /migrat|db[/\\]/i;
+// Rollback function patterns
+const ROLLBACK_RE = /\b(down|rollback|revert)\s*\(/;
+// ── Helpers ──────────────────────────────────────────────────────────────────
+function shouldSkip(relPath) {
+    const parts = relPath.split(/[/\\]/);
+    for (const part of parts) {
+        if (SKIP_DIRS.includes(part))
+            return true;
+    }
+    return SKIP_PATTERN.test(relPath);
+}
+function scanLine(line, lineNum, relPath, ext, issues) {
+    const isSqlExt = SQL_EXTS.has(ext);
+    const isShellExt = SHELL_EXTS.has(ext);
+    // Pass 1 — SQL patterns
+    if (isSqlExt) {
+        if (DROP_TABLE_RE.test(line)) {
+            issues.push({ severity: 'error', message: 'DROP TABLE without transaction', file: relPath, line: lineNum, fixable: false, fixHint: 'wrap in transaction or add rollback' });
+        }
+        if (DROP_DB_RE.test(line)) {
+            issues.push({ severity: 'error', message: 'DROP DATABASE detected', file: relPath, line: lineNum, fixable: false, fixHint: 'remove or gate behind confirmation' });
+        }
+        if (TRUNCATE_RE.test(line)) {
+            issues.push({ severity: 'error', message: 'TRUNCATE operation detected', file: relPath, line: lineNum, fixable: false, fixHint: 'use soft-delete or add rollback' });
+        }
+        if (DELETE_FROM_RE.test(line)) {
+            if (DELETE_WHERE_RE.test(line)) {
+                issues.push({ severity: 'warning', message: 'DELETE FROM with WHERE clause', file: relPath, line: lineNum, fixable: false, fixHint: 'consider soft-delete or add --dry-run check' });
+            }
+            else {
+                issues.push({ severity: 'error', message: 'DELETE FROM without WHERE clause', file: relPath, line: lineNum, fixable: false, fixHint: 'add WHERE clause or use TRUNCATE with rollback' });
+            }
+        }
+    }
+    // Pass 2 — Shell patterns
+    if (isShellExt) {
+        // Direct shell commands in .sh/.bash
+        if (ext === '.sh' || ext === '.bash') {
+            if (RM_RF_RE.test(line)) {
+                issues.push({ severity: 'error', message: 'rm -rf in shell script', file: relPath, line: lineNum, fixable: false, fixHint: 'use trash-cli or add confirmation gate' });
+            }
+            if (RMDIR_RE.test(line)) {
+                issues.push({ severity: 'error', message: 'rmdir in shell script', file: relPath, line: lineNum, fixable: false, fixHint: 'use trash-cli or add confirmation gate' });
+            }
+            if (SHRED_RE.test(line)) {
+                issues.push({ severity: 'error', message: 'shred command detected', file: relPath, line: lineNum, fixable: false, fixHint: 'remove or gate behind confirmation' });
+            }
+            if (TRUNCATE_CMD_RE.test(line)) {
+                issues.push({ severity: 'error', message: 'truncate --size command detected', file: relPath, line: lineNum, fixable: false, fixHint: 'remove or gate behind confirmation' });
+            }
+        }
+        // JS/TS exec/spawn calls with destructive commands
+        if (ext === '.ts' || ext === '.js') {
+            if (EXEC_CALL_RE.test(line)) {
+                if (RM_RF_RE.test(line)) {
+                    issues.push({ severity: 'error', message: 'rm -rf in exec call', file: relPath, line: lineNum, fixable: false, fixHint: 'use trash-cli or add confirmation gate' });
+                }
+                if (RMDIR_RE.test(line)) {
+                    issues.push({ severity: 'error', message: 'rmdir in exec call', file: relPath, line: lineNum, fixable: false, fixHint: 'use trash-cli or add confirmation gate' });
+                }
+                if (SHRED_RE.test(line)) {
+                    issues.push({ severity: 'error', message: 'shred in exec call', file: relPath, line: lineNum, fixable: false, fixHint: 'remove or gate behind confirmation' });
+                }
+                if (TRUNCATE_CMD_RE.test(line)) {
+                    issues.push({ severity: 'error', message: 'truncate --size in exec call', file: relPath, line: lineNum, fixable: false, fixHint: 'remove or gate behind confirmation' });
+                }
+            }
+        }
+    }
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export function checkGuard(cwd) {
+    const issues = [];
+    const files = walkFiles(cwd);
+    for (const relPath of files) {
+        const ext = extname(relPath).toLowerCase();
+        if (!SCAN_EXTS.has(ext))
+            continue;
+        if (shouldSkip(relPath))
+            continue;
+        const fullPath = join(cwd, relPath);
+        let content;
+        try {
+            content = cachedRead(fullPath);
+        }
+        catch {
+            continue;
+        }
+        const rel = relPath;
+        const lines = content.split('\n');
+        const fileIssuesBefore = issues.length;
+        for (let i = 0; i < lines.length; i++) {
+            scanLine(lines[i], i + 1, rel, ext, issues);
+        }
+        // Pass 3 — Migration check
+        if (MIGRATION_PATH_RE.test(rel)) {
+            const hasDestructive = DROP_TABLE_RE.test(content) || DROP_DB_RE.test(content) ||
+                DELETE_FROM_RE.test(content) || TRUNCATE_RE.test(content);
+            const hasRollback = ROLLBACK_RE.test(content);
+            if (hasDestructive && !hasRollback) {
+                issues.push({
+                    severity: 'warning',
+                    message: 'migration with destructive operation but no rollback function',
+                    file: rel,
+                    fixable: false,
+                    fixHint: 'add down() or rollback() function',
+                });
+            }
+        }
+    }
+    const errors = issues.filter(i => i.severity === 'error').length;
+    const warnings = issues.filter(i => i.severity === 'warning').length;
+    const total = errors + warnings;
+    const score = Math.max(0, 100 - (errors * 15) - (warnings * 5));
+    const summary = total === 0
+        ? 'no destructive patterns found'
+        : `${total} bomb sites found (${errors} fatal, ${warnings} warning)`;
+    return { name: 'guard', score, maxScore: 100, issues, summary };
+}
+// ── Subcommand output ────────────────────────────────────────────────────────
+export async function runGuardCommand(format, cwd) {
+    const dir = cwd || process.cwd();
+    const result = checkGuard(dir);
+    if (format === 'json') {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log(`\n  ${c.bold}vet guard${c.reset} — destructive operation scanner\n`);
+    const errors = result.issues.filter(i => i.severity === 'error');
+    const warnings = result.issues.filter(i => i.severity === 'warning');
+    if (errors.length > 0) {
+        console.log(`  ${c.red}FATAL${c.reset}`);
+        for (const issue of errors) {
+            const loc = issue.file ? (issue.line ? `${issue.file}:${issue.line}` : issue.file) : '';
+            console.log(`  ${c.red}✗${c.reset} ${issue.message}${loc ? ` (${loc})` : ''}`);
+            if (issue.fixHint)
+                console.log(`    ${c.dim}→ ${issue.fixHint}${c.reset}`);
+        }
+        console.log();
+    }
+    if (warnings.length > 0) {
+        console.log(`  ${c.yellow}WARN${c.reset}`);
+        for (const issue of warnings) {
+            const loc = issue.file ? (issue.line ? `${issue.file}:${issue.line}` : issue.file) : '';
+            console.log(`  ${c.yellow}⚠${c.reset} ${issue.message}${loc ? ` (${loc})` : ''}`);
+            if (issue.fixHint)
+                console.log(`    ${c.dim}→ ${issue.fixHint}${c.reset}`);
+        }
+        console.log();
+    }
+    if (result.issues.length === 0) {
+        console.log(`  ${c.green}no destructive patterns found${c.reset}\n`);
+    }
+    console.log(`  ${result.summary}\n`);
+}

package/dist/cli.js

@@ -23,6 +23,7 @@ import { checkCompact, runCompactCommand } from './checks/compact.js';
 import { checkSubsidy, runSubsidyCommand } from './checks/subsidy.js';
 import { checkLoop, runLoopCommand } from './checks/loop.js';
 import { checkBloat, runBloatCommand } from './checks/bloat.js';
+import { checkGuard, runGuardCommand } from './checks/guard.js';
 import { checkCompleteness } from './checks/completeness.js';
 import { score } from './scorer.js';
 import { reportPretty, reportJSON, reportBadge } from './reporter.js';
@@ -75,6 +76,7 @@ if (flags.has('--help') || flags.has('-h')) {
     npx @safetnsr/vet subsidy [--plan tier] [--since date]  show AI cost vs subscription
     npx @safetnsr/vet loop [log]         /loop session forensics — per-iteration timeline
     npx @safetnsr/vet bloat              detect agent-generated code bloat
+    npx @safetnsr/vet guard [dir]        scan for destructive operation bomb sites
 
   ${c.dim}categories:${c.reset}
     security   (30%)  scan, secrets, config, model usage
@@ -110,7 +112,7 @@ if (flags.has('--version') || flags.has('-v')) {
     }
     process.exit(0);
 }
-const COMMANDS = ['init', 'receipt', 'map', 'permissions', 'compact', 'subsidy', 'loop', 'bloat'];
+const COMMANDS = ['init', 'receipt', 'map', 'permissions', 'compact', 'subsidy', 'loop', 'bloat', 'guard'];
 const command = COMMANDS.includes(positional[0]) ? positional[0] : undefined;
 const cwd = resolve(positional.find(p => !COMMANDS.includes(p)) || '.');
 const isCI = flags.has('--ci');
@@ -241,6 +243,17 @@ if (command === 'bloat') {
     }
     process.exit(0);
 }
+if (command === 'guard') {
+    try {
+        const format = isJSON ? 'json' : 'ascii';
+        await runGuardCommand(format, cwd);
+    }
+    catch (e) {
+        console.error(`${c.red}guard failed:${c.reset}`, e instanceof Error ? e.message : e);
+        process.exit(1);
+    }
+    process.exit(0);
+}
 if (!isGitRepo(cwd)) {
     console.error(`${c.red}not a git repository${c.reset}. vet operates on git repos.`);
     process.exit(1);
@@ -292,7 +305,7 @@ async function runChecks() {
             }
         }
         // Run ALL independent checks in parallel
-        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult,] = await Promise.all([
+        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult, guardResult,] = await Promise.all([
             withTimeout('scan', () => checkScan(cwd)),
             withTimeout('secrets', () => checkSecrets(cwd)),
             withTimeout('config', () => checkConfig(cwd, ignore)),
@@ -312,6 +325,7 @@ async function runChecks() {
             withTimeout('loop', () => checkLoop(cwd)),
             withTimeout('completeness', () => checkCompleteness(cwd, ignore)),
             withTimeout('bloat', () => checkBloat(cwd)),
+            withTimeout('guard', () => checkGuard(cwd)),
         ]);
         // Git-dependent checks (diff + history) — parallel with each other
         const [diffResult, historyResult] = await Promise.all([
@@ -321,7 +335,7 @@ async function runChecks() {
         // Clear file cache after all checks complete
         clearCache();
         return score(cwd, {
-            security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, subsidyResult],
+            security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, subsidyResult, guardResult],
             integrity: [diffResult, integrityResult, receiptResult, compactResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult],
             debt: [readyResult, historyResult, debtResult, bloatResult],
             deps: [depsResult],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.15.1",
+  "version": "1.17.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {