@safetnsr/vet 1.18.0 → 1.19.0

package/dist/checks/deep.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkDeep(cwd: string): Promise<CheckResult>;

package/dist/checks/deep.js

@@ -0,0 +1,276 @@
+import { join } from 'node:path';
+import ts from 'typescript';
+import { walkFiles, readFile, c } from '../util.js';
+const SOURCE_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
+function isSourceFile(f) {
+    const dot = f.lastIndexOf('.');
+    return dot !== -1 && SOURCE_EXTS.has(f.substring(dot));
+}
+function isTestFile(f) {
+    return /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || /(?:^|[/\\])tests?[/\\]/.test(f);
+}
+// ── AST-based function analysis ─────────────────────────────────────────────
+const BRANCHING_KINDS = new Set([
+    ts.SyntaxKind.IfStatement,
+    ts.SyntaxKind.ForStatement,
+    ts.SyntaxKind.ForInStatement,
+    ts.SyntaxKind.ForOfStatement,
+    ts.SyntaxKind.WhileStatement,
+    ts.SyntaxKind.DoStatement,
+    ts.SyntaxKind.ConditionalExpression,
+    ts.SyntaxKind.CatchClause,
+    ts.SyntaxKind.CaseClause,
+    ts.SyntaxKind.BinaryExpression, // for && and || short-circuits
+]);
+function analyzeCatch(node) {
+    const block = node.block;
+    const stmts = block.statements;
+    const line = node.getSourceFile().getLineAndCharacterOfPosition(node.getStart()).line + 1;
+    if (stmts.length === 0) {
+        return { line, isEmpty: true, isLazy: false, isRethrow: false };
+    }
+    const text = block.getText();
+    const isLazy = stmts.length === 1 && /console\.(log|error|warn)\s*\(/.test(text) && !text.includes('throw');
+    const isRethrow = text.includes('throw');
+    return { line, isEmpty: false, isLazy, isRethrow };
+}
+function analyzeFunction(node, file, src) {
+    let name = '';
+    let paramCount = 0;
+    let hasReturnType = false;
+    let body;
+    if (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node)) {
+        name = node.name?.getText(src) || '(anonymous)';
+        paramCount = node.parameters.length;
+        hasReturnType = !!node.type;
+        body = node.body;
+    }
+    else if (ts.isMethodDeclaration(node)) {
+        name = node.name?.getText(src) || '(method)';
+        paramCount = node.parameters.length;
+        hasReturnType = !!node.type;
+        body = node.body;
+    }
+    else if (ts.isArrowFunction(node)) {
+        // Get name from parent variable declaration
+        const parent = node.parent;
+        if (ts.isVariableDeclaration(parent) && parent.name) {
+            name = parent.name.getText(src);
+        }
+        else {
+            name = '(arrow)';
+        }
+        paramCount = node.parameters.length;
+        hasReturnType = !!node.type;
+        body = node.body;
+    }
+    if (!body || !name)
+        return null;
+    const startLine = src.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+    const endLine = src.getLineAndCharacterOfPosition(node.getEnd()).line + 1;
+    const lineCount = endLine - startLine + 1;
+    if (lineCount < 5)
+        return null; // skip trivial functions
+    // Calculate cyclomatic complexity + max nesting + catch quality
+    let cyclomatic = 1;
+    let maxNesting = 0;
+    let currentNesting = 0;
+    let cognitive = 0;
+    const catchBlocks = [];
+    function walk(n, nesting) {
+        if (BRANCHING_KINDS.has(n.kind)) {
+            // Don't count && and || as branching for cyclomatic (too noisy)
+            if (n.kind === ts.SyntaxKind.BinaryExpression) {
+                const binExpr = n;
+                if (binExpr.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken ||
+                    binExpr.operatorToken.kind === ts.SyntaxKind.BarBarToken) {
+                    cyclomatic++;
+                    cognitive += 1; // no nesting increment for logical ops
+                }
+            }
+            else {
+                cyclomatic++;
+                currentNesting = nesting + 1;
+                if (currentNesting > maxNesting)
+                    maxNesting = currentNesting;
+                cognitive += 1 + nesting; // cognitive complexity: increment + nesting bonus
+            }
+        }
+        if (ts.isCatchClause(n)) {
+            catchBlocks.push(analyzeCatch(n));
+        }
+        const nextNesting = BRANCHING_KINDS.has(n.kind) && n.kind !== ts.SyntaxKind.BinaryExpression
+            ? nesting + 1 : nesting;
+        ts.forEachChild(n, child => walk(child, nextNesting));
+    }
+    walk(body, 0);
+    return {
+        name, file, line: startLine, lineCount, paramCount,
+        cyclomatic, maxNesting, hasReturnType, catchBlocks,
+        cognitiveComplexity: cognitive,
+    };
+}
+// ── Naming analysis (heuristic, no ML) ──────────────────────────────────────
+function isDescriptiveName(name) {
+    if (name.startsWith('('))
+        return 'unclear'; // anonymous
+    if (name.length <= 2)
+        return 'too-short';
+    // Single word with no verb pattern
+    if (!/[A-Z]/.test(name) && !name.includes('_') && name.length < 6)
+        return 'too-short';
+    return 'good';
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkDeep(cwd) {
+    const allFiles = walkFiles(cwd);
+    const sourceFiles = allFiles.filter(f => isSourceFile(f) && !isTestFile(f));
+    if (sourceFiles.length < 3) {
+        return { name: 'deep', score: 100, maxScore: 100, summary: 'too few files', issues: [] };
+    }
+    const issues = [];
+    const allMetrics = [];
+    const t0 = Date.now();
+    for (const file of sourceFiles) {
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        try {
+            const src = ts.createSourceFile(file, content, ts.ScriptTarget.Latest, true);
+            function visit(node) {
+                if (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) ||
+                    ts.isMethodDeclaration(node) || ts.isArrowFunction(node)) {
+                    const metrics = analyzeFunction(node, file, src);
+                    if (metrics)
+                        allMetrics.push(metrics);
+                }
+                ts.forEachChild(node, visit);
+            }
+            visit(src);
+        }
+        catch {
+            // Skip files that can't be parsed
+        }
+    }
+    const elapsed = Date.now() - t0;
+    if (allMetrics.length === 0) {
+        return { name: 'deep', score: 100, maxScore: 100, summary: 'no functions to analyze', issues: [] };
+    }
+    // ── Cyclomatic complexity ─────────────────────────────────────────────────
+    const highComplexity = allMetrics.filter(f => f.cyclomatic > 10);
+    const veryHighComplexity = allMetrics.filter(f => f.cyclomatic > 20);
+    for (const func of veryHighComplexity.slice(0, 5)) {
+        issues.push({
+            severity: 'warning',
+            message: `high cyclomatic complexity: ${func.name} has complexity ${func.cyclomatic} (threshold: 10) — hard to test and modify`,
+            file: func.file, line: func.line,
+            fixable: true,
+            fixHint: 'break into smaller functions, use strategy pattern or lookup tables',
+        });
+    }
+    for (const func of highComplexity.filter(f => f.cyclomatic <= 20).slice(0, 5)) {
+        issues.push({
+            severity: 'info',
+            message: `moderate complexity: ${func.name} has complexity ${func.cyclomatic} (threshold: 10)`,
+            file: func.file, line: func.line,
+            fixable: true,
+            fixHint: 'consider extracting helper functions',
+        });
+    }
+    // ── Deep nesting ──────────────────────────────────────────────────────────
+    const deeplyNested = allMetrics.filter(f => f.maxNesting > 4);
+    for (const func of deeplyNested.slice(0, 5)) {
+        issues.push({
+            severity: 'warning',
+            message: `deep nesting: ${func.name} has ${func.maxNesting} levels of nesting — use early returns or extract functions`,
+            file: func.file, line: func.line,
+            fixable: true,
+            fixHint: 'use guard clauses (early return) to flatten nesting',
+        });
+    }
+    // ── Catch block quality ───────────────────────────────────────────────────
+    const allCatches = allMetrics.flatMap(f => f.catchBlocks.map(cb => ({ ...cb, func: f })));
+    const emptyCatches = allCatches.filter(c => c.isEmpty);
+    const lazyCatches = allCatches.filter(c => c.isLazy);
+    for (const ec of emptyCatches.slice(0, 3)) {
+        issues.push({
+            severity: 'error',
+            message: `empty catch block in ${ec.func.name} — errors are silently swallowed`,
+            file: ec.func.file, line: ec.line,
+            fixable: true,
+            fixHint: 'at minimum: log the error, or re-throw with context',
+        });
+    }
+    for (const lc of lazyCatches.slice(0, 3)) {
+        issues.push({
+            severity: 'warning',
+            message: `lazy error handling in ${lc.func.name} — catch only console.logs the error without recovery or rethrow`,
+            file: lc.func.file, line: lc.line,
+            fixable: true,
+            fixHint: 'add proper error handling: typed errors, retry logic, or graceful degradation',
+        });
+    }
+    // ── Cognitive complexity ──────────────────────────────────────────────────
+    const highCognitive = allMetrics.filter(f => f.cognitiveComplexity > 15);
+    for (const func of highCognitive.slice(0, 3)) {
+        issues.push({
+            severity: 'info',
+            message: `high cognitive complexity: ${func.name} has cognitive complexity ${func.cognitiveComplexity} — difficult for humans and AI agents to understand`,
+            file: func.file, line: func.line,
+            fixable: true,
+            fixHint: 'simplify control flow, extract well-named helper functions',
+        });
+    }
+    // ── Parameter count ───────────────────────────────────────────────────────
+    const manyParams = allMetrics.filter(f => f.paramCount >= 5);
+    if (manyParams.length > 0) {
+        issues.push({
+            severity: 'info',
+            message: `${manyParams.length} function${manyParams.length !== 1 ? 's' : ''} with 5+ parameters: ${manyParams.slice(0, 3).map(f => f.name + '(' + f.paramCount + ')').join(', ')}`,
+            file: manyParams[0].file, line: manyParams[0].line,
+            fixable: true,
+            fixHint: 'use an options object instead of many positional parameters',
+        });
+    }
+    // ── Naming quality ────────────────────────────────────────────────────────
+    const poorNames = allMetrics.filter(f => isDescriptiveName(f.name) !== 'good');
+    if (poorNames.length > 3) {
+        issues.push({
+            severity: 'info',
+            message: `${poorNames.length} functions with unclear or too-short names: ${poorNames.slice(0, 3).map(f => '"' + f.name + '"').join(', ')}`,
+            file: poorNames[0].file,
+            fixable: true,
+            fixHint: 'use descriptive verb+noun function names (e.g., calculateTotal, validateUser)',
+        });
+    }
+    // ── Scoring ───────────────────────────────────────────────────────────────
+    const total = allMetrics.length;
+    // Complexity score: % of functions below threshold
+    const complexityOk = allMetrics.filter(f => f.cyclomatic <= 10).length;
+    const complexityScore = Math.round((complexityOk / total) * 100);
+    // Nesting score
+    const nestingOk = allMetrics.filter(f => f.maxNesting <= 4).length;
+    const nestingScore = Math.round((nestingOk / total) * 100);
+    // Error handling score
+    const errorScore = allCatches.length === 0 ? 100
+        : Math.max(20, 100 - emptyCatches.length * 20 - lazyCatches.length * 10);
+    // Naming score
+    const namingOk = allMetrics.filter(f => isDescriptiveName(f.name) === 'good').length;
+    const namingScore = Math.round((namingOk / total) * 100);
+    const score = Math.max(25, Math.round(complexityScore * 0.35 +
+        nestingScore * 0.25 +
+        errorScore * 0.25 +
+        namingScore * 0.15));
+    // ── Summary ───────────────────────────────────────────────────────────────
+    const parts = [];
+    parts.push(`${total} functions analyzed in ${elapsed}ms`);
+    if (highComplexity.length > 0)
+        parts.push(c.yellow + `${highComplexity.length} complex` + c.reset);
+    if (deeplyNested.length > 0)
+        parts.push(c.yellow + `${deeplyNested.length} deeply nested` + c.reset);
+    if (emptyCatches.length > 0)
+        parts.push(c.red + `${emptyCatches.length} empty catches` + c.reset);
+    if (lazyCatches.length > 0)
+        parts.push(c.yellow + `${lazyCatches.length} lazy catches` + c.reset);
+    return { name: 'deep', score, maxScore: 100, summary: parts.join(', '), issues };
+}

package/dist/checks/semantic.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkSemantic(cwd: string): Promise<CheckResult>;

package/dist/checks/semantic.js

@@ -0,0 +1,181 @@
+import { join } from 'node:path';
+import { walkFiles, readFile, c } from '../util.js';
+const SOURCE_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
+function isSourceFile(f) {
+    const dot = f.lastIndexOf('.');
+    return dot !== -1 && SOURCE_EXTS.has(f.substring(dot));
+}
+function isTestFile(f) {
+    return /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || /(?:^|[/\\])tests?[/\\]/.test(f);
+}
+const ANTI_PATTERNS = [
+    {
+        name: 'lazy-error-handling',
+        description: 'catches error but only logs it without recovery or rethrow',
+        severity: 'warning',
+        fixHint: 'add proper error recovery, rethrow with context, or use typed error classes',
+        embedding_text: 'try { doSomething(); } catch(e) { console.log(e); } try { await fetch(url); } catch(err) { console.error(err); return null; }',
+    },
+    {
+        name: 'any-abuse',
+        description: 'excessive use of TypeScript any type to bypass type checking',
+        severity: 'warning',
+        fixHint: 'replace any with specific types, use unknown for truly unknown types',
+        embedding_text: 'function process(data: any, config: any): any { return (data as any).map((x: any) => x); const result: any = {}; }',
+    },
+    {
+        name: 'callback-hell',
+        description: 'deeply nested callbacks or promise chains',
+        severity: 'info',
+        fixHint: 'refactor to async/await',
+        embedding_text: 'getData(function(a) { getMore(a, function(b) { getEvenMore(b, function(c) { process(c, function(d) { done(d); }); }); }); });',
+    },
+    {
+        name: 'empty-function',
+        description: 'function with no implementation or only comments/todos',
+        severity: 'warning',
+        fixHint: 'implement the function or remove it',
+        embedding_text: 'function handleSubmit() { /* TODO: implement */ } function processData(input) { // not implemented yet return input; }',
+    },
+    {
+        name: 'string-heavy-logic',
+        description: 'business logic driven by string comparisons instead of enums or types',
+        severity: 'info',
+        fixHint: 'use enums, union types, or constants instead of string literals',
+        embedding_text: 'if (status === "pending") { } else if (status === "active") { } else if (status === "cancelled") { } else if (status === "completed") { }',
+    },
+];
+function extractFunctions(file, content) {
+    const funcs = [];
+    const lines = content.split('\n');
+    const funcStartRe = /^(?:export\s+)?(?:async\s+)?function\s+([a-zA-Z_$][a-zA-Z0-9_$]*)/;
+    const arrowRe = /^(?:export\s+)?(?:const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*(?::\s*[^=]+)?\s*=\s*(?:async\s+)?\(/;
+    const methodRe = /^\s+(?:async\s+)?([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\([^)]*\)\s*(?::\s*[^{]+)?\s*\{/;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const match = line.match(funcStartRe) || line.match(arrowRe) || line.match(methodRe);
+        if (!match)
+            continue;
+        const name = match[1];
+        if (!name || ['if', 'for', 'while', 'switch', 'catch'].includes(name))
+            continue;
+        // Find end of function
+        let depth = 0, started = false, endLine = i;
+        for (let j = i; j < lines.length && j < i + 200; j++) {
+            for (const ch of lines[j]) {
+                if (ch === '{') {
+                    depth++;
+                    started = true;
+                }
+                if (ch === '}')
+                    depth--;
+            }
+            if (started && depth <= 0) {
+                endLine = j;
+                break;
+            }
+        }
+        const lineCount = endLine - i + 1;
+        if (lineCount < 8)
+            continue; // skip tiny functions
+        const body = lines.slice(i, endLine + 1).join('\n').slice(0, 400);
+        funcs.push({ name, file, line: i + 1, body });
+    }
+    return funcs;
+}
+// ── Cosine similarity ───────────────────────────────────────────────────────
+function cosine(a, b) {
+    let dot = 0, na = 0, nb = 0;
+    for (let i = 0; i < a.length; i++) {
+        dot += a[i] * b[i];
+        na += a[i] * a[i];
+        nb += b[i] * b[i];
+    }
+    return dot / (Math.sqrt(na) * Math.sqrt(nb));
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkSemantic(cwd) {
+    const allFiles = walkFiles(cwd);
+    const sourceFiles = allFiles.filter(f => isSourceFile(f) && !isTestFile(f));
+    if (sourceFiles.length < 3) {
+        return { name: 'semantic', score: 100, maxScore: 100, summary: 'too few files', issues: [] };
+    }
+    // Extract functions
+    const allFuncs = [];
+    for (const file of sourceFiles) {
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        allFuncs.push(...extractFunctions(file, content));
+    }
+    if (allFuncs.length === 0) {
+        return { name: 'semantic', score: 100, maxScore: 100, summary: 'no functions', issues: [] };
+    }
+    // Cap at 100 longest functions for performance
+    const funcsToAnalyze = allFuncs
+        .sort((a, b) => b.body.length - a.body.length)
+        .slice(0, 100);
+    const issues = [];
+    const t0 = Date.now();
+    let matchCount = 0;
+    try {
+        const { pipeline } = await import('@huggingface/transformers');
+        const extractor = await pipeline('feature-extraction', 'Xenova/all-MiniLM-L6-v2', {
+            dtype: 'q8',
+        });
+        // Embed anti-patterns once
+        const patternEmbeddings = [];
+        for (const pattern of ANTI_PATTERNS) {
+            const result = await extractor(pattern.embedding_text, { pooling: 'mean', normalize: true });
+            patternEmbeddings.push({ pattern, embedding: new Float32Array(result.data) });
+        }
+        // Embed and compare each function
+        const THRESHOLD = 0.40; // similarity threshold — code-to-code embeddings
+        for (const func of funcsToAnalyze) {
+            const result = await extractor(func.body, { pooling: 'mean', normalize: true });
+            const funcEmb = new Float32Array(result.data);
+            for (const { pattern, embedding } of patternEmbeddings) {
+                const sim = cosine(funcEmb, embedding);
+                if (sim > THRESHOLD) {
+                    matchCount++;
+                    issues.push({
+                        severity: pattern.severity,
+                        message: `semantic match: ${func.name} matches "${pattern.name}" pattern (${Math.round(sim * 100)}% similarity) — ${pattern.description}`,
+                        file: func.file,
+                        line: func.line,
+                        fixable: true,
+                        fixHint: pattern.fixHint,
+                    });
+                    break; // one match per function
+                }
+            }
+        }
+    }
+    catch (err) {
+        // transformers.js not available or model download failed
+        return {
+            name: 'semantic',
+            score: 100,
+            maxScore: 100,
+            summary: `semantic analysis unavailable: ${err instanceof Error ? err.message : 'unknown'}`,
+            issues: [],
+        };
+    }
+    const elapsed = Date.now() - t0;
+    // Score based on % of functions matching anti-patterns
+    const matchRate = funcsToAnalyze.length > 0 ? matchCount / funcsToAnalyze.length : 0;
+    const score = Math.max(25, Math.round(100 - matchRate * 200));
+    const parts = [];
+    parts.push(`${funcsToAnalyze.length} functions scanned in ${elapsed}ms`);
+    if (matchCount > 0)
+        parts.push(c.yellow + `${matchCount} anti-pattern matches` + c.reset);
+    else
+        parts.push('no anti-patterns detected');
+    return {
+        name: 'semantic',
+        score,
+        maxScore: 100,
+        summary: parts.join(', '),
+        issues,
+    };
+}

package/dist/cli.js

@@ -15,6 +15,8 @@ import { checkDebt } from './checks/debt.js';
 import { checkIntegrity } from './checks/integrity.js';
 import { checkArchitecture } from './checks/architecture.js';
 import { checkAIReady } from './checks/aiready.js';
+import { checkDeep } from './checks/deep.js';
+import { checkSemantic } from './checks/semantic.js';
 import { checkReceipt, runReceiptCommand } from './checks/receipt.js';
 import { checkMemory } from './checks/memory.js';
 import { checkVerify } from './checks/verify.js';
@@ -33,6 +35,7 @@ import { reportPretty, reportJSON, reportBadge } from './reporter.js';
 import { clearCache } from './file-cache.js';
 const args = process.argv.slice(2);
 const flags = new Set(args.filter(a => a.startsWith('-') && !a.startsWith('--since')));
+const deepMode = flags.has('--deep');
 const flagMap = new Map();
 // Parse --since=value or --since value, --max-files=value
 for (let i = 0; i < args.length; i++) {
@@ -322,7 +325,7 @@ async function runChecks() {
             }
         }
         // Run ALL independent checks in parallel
-        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult, guardResult, explainResult, architectureResult, aireadyResult,] = await Promise.all([
+        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult, guardResult, explainResult, architectureResult, aireadyResult, deepResult, semanticResult,] = await Promise.all([
             withTimeout('scan', () => checkScan(cwd)),
             withTimeout('secrets', () => checkSecrets(cwd)),
             withTimeout('config', () => checkConfig(cwd, ignore)),
@@ -346,6 +349,8 @@ async function runChecks() {
             withTimeout('explain', () => checkExplain(cwd, since)),
             withTimeout('architecture', () => checkArchitecture(cwd)),
             withTimeout('aiready', () => checkAIReady(cwd)),
+            withTimeout('deep', () => checkDeep(cwd), 60_000),
+            withTimeout('semantic', () => checkSemantic(cwd), 60_000),
         ]);
         // Git-dependent checks (diff + history) — parallel with each other
         const [diffResult, historyResult] = await Promise.all([
@@ -360,7 +365,7 @@ async function runChecks() {
             debt: [readyResult, historyResult, debtResult, bloatResult],
             deps: [depsResult],
             architecture: [architectureResult],
-            aiready: [aireadyResult],
+            aiready: [aireadyResult, deepResult, semanticResult],
         });
     }
     catch (e) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.18.0",
+  "version": "1.19.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {
@@ -35,12 +35,15 @@
   "devDependencies": {
     "@types/node": "^20.0.0",
     "tsx": "^4.21.0",
-    "typescript": "^5.7.0"
+    "typescript": "^5.9.3"
   },
   "engines": {
     "node": ">=18"
   },
   "optionalDependencies": {
     "@safetnsr/model-graveyard": "^0.2.0"
+  },
+  "dependencies": {
+    "@huggingface/transformers": "^3.8.1"
   }
 }