@safetnsr/vet 1.18.0 → 1.19.1

package/dist/categories.d.ts

@@ -9,5 +9,6 @@ export declare function buildCategories(checkMap: {
     deps: CheckResult[];
     architecture: CheckResult[];
     aiready: CheckResult[];
+    history: CheckResult[];
 }): CategoryResult[];
 export declare function buildVetResult(project: string, categories: CategoryResult[]): VetResult;

package/dist/categories.js

@@ -16,12 +16,13 @@ export function toGrade(score) {
 }
 // ── Category weights ─────────────────────────────────────────────────────────
 const WEIGHTS = {
-    security: 0.25,
-    integrity: 0.25,
-    debt: 0.20,
+    security: 0.20,
+    integrity: 0.20,
+    debt: 0.15,
     deps: 0.10,
     architecture: 0.10,
     aiready: 0.10,
+    history: 0.15,
 };
 // ── Scoring floor for non-security checks ────────────────────────────────────
 const SECURITY_CHECKS = new Set(['scan', 'secrets', 'permissions', 'owasp']);
@@ -68,7 +69,7 @@ function completenessMultiplier(categories) {
 // ── Group checks into categories ─────────────────────────────────────────────
 export function buildCategories(checkMap) {
     const categories = [];
-    for (const name of ['security', 'integrity', 'debt', 'deps', 'architecture', 'aiready']) {
+    for (const name of ['security', 'integrity', 'debt', 'deps', 'architecture', 'aiready', 'history']) {
         const checks = checkMap[name];
         if (!checks || checks.length === 0)
             continue;

package/dist/checks/deep.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkDeep(cwd: string): Promise<CheckResult>;

package/dist/checks/deep.js

@@ -0,0 +1,276 @@
+import { join } from 'node:path';
+import ts from 'typescript';
+import { walkFiles, readFile, c } from '../util.js';
+const SOURCE_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
+function isSourceFile(f) {
+    const dot = f.lastIndexOf('.');
+    return dot !== -1 && SOURCE_EXTS.has(f.substring(dot));
+}
+function isTestFile(f) {
+    return /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || /(?:^|[/\\])tests?[/\\]/.test(f);
+}
+// ── AST-based function analysis ─────────────────────────────────────────────
+const BRANCHING_KINDS = new Set([
+    ts.SyntaxKind.IfStatement,
+    ts.SyntaxKind.ForStatement,
+    ts.SyntaxKind.ForInStatement,
+    ts.SyntaxKind.ForOfStatement,
+    ts.SyntaxKind.WhileStatement,
+    ts.SyntaxKind.DoStatement,
+    ts.SyntaxKind.ConditionalExpression,
+    ts.SyntaxKind.CatchClause,
+    ts.SyntaxKind.CaseClause,
+    ts.SyntaxKind.BinaryExpression, // for && and || short-circuits
+]);
+function analyzeCatch(node) {
+    const block = node.block;
+    const stmts = block.statements;
+    const line = node.getSourceFile().getLineAndCharacterOfPosition(node.getStart()).line + 1;
+    if (stmts.length === 0) {
+        return { line, isEmpty: true, isLazy: false, isRethrow: false };
+    }
+    const text = block.getText();
+    const isLazy = stmts.length === 1 && /console\.(log|error|warn)\s*\(/.test(text) && !text.includes('throw');
+    const isRethrow = text.includes('throw');
+    return { line, isEmpty: false, isLazy, isRethrow };
+}
+function analyzeFunction(node, file, src) {
+    let name = '';
+    let paramCount = 0;
+    let hasReturnType = false;
+    let body;
+    if (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node)) {
+        name = node.name?.getText(src) || '(anonymous)';
+        paramCount = node.parameters.length;
+        hasReturnType = !!node.type;
+        body = node.body;
+    }
+    else if (ts.isMethodDeclaration(node)) {
+        name = node.name?.getText(src) || '(method)';
+        paramCount = node.parameters.length;
+        hasReturnType = !!node.type;
+        body = node.body;
+    }
+    else if (ts.isArrowFunction(node)) {
+        // Get name from parent variable declaration
+        const parent = node.parent;
+        if (ts.isVariableDeclaration(parent) && parent.name) {
+            name = parent.name.getText(src);
+        }
+        else {
+            name = '(arrow)';
+        }
+        paramCount = node.parameters.length;
+        hasReturnType = !!node.type;
+        body = node.body;
+    }
+    if (!body || !name)
+        return null;
+    const startLine = src.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+    const endLine = src.getLineAndCharacterOfPosition(node.getEnd()).line + 1;
+    const lineCount = endLine - startLine + 1;
+    if (lineCount < 5)
+        return null; // skip trivial functions
+    // Calculate cyclomatic complexity + max nesting + catch quality
+    let cyclomatic = 1;
+    let maxNesting = 0;
+    let currentNesting = 0;
+    let cognitive = 0;
+    const catchBlocks = [];
+    function walk(n, nesting) {
+        if (BRANCHING_KINDS.has(n.kind)) {
+            // Don't count && and || as branching for cyclomatic (too noisy)
+            if (n.kind === ts.SyntaxKind.BinaryExpression) {
+                const binExpr = n;
+                if (binExpr.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken ||
+                    binExpr.operatorToken.kind === ts.SyntaxKind.BarBarToken) {
+                    cyclomatic++;
+                    cognitive += 1; // no nesting increment for logical ops
+                }
+            }
+            else {
+                cyclomatic++;
+                currentNesting = nesting + 1;
+                if (currentNesting > maxNesting)
+                    maxNesting = currentNesting;
+                cognitive += 1 + nesting; // cognitive complexity: increment + nesting bonus
+            }
+        }
+        if (ts.isCatchClause(n)) {
+            catchBlocks.push(analyzeCatch(n));
+        }
+        const nextNesting = BRANCHING_KINDS.has(n.kind) && n.kind !== ts.SyntaxKind.BinaryExpression
+            ? nesting + 1 : nesting;
+        ts.forEachChild(n, child => walk(child, nextNesting));
+    }
+    walk(body, 0);
+    return {
+        name, file, line: startLine, lineCount, paramCount,
+        cyclomatic, maxNesting, hasReturnType, catchBlocks,
+        cognitiveComplexity: cognitive,
+    };
+}
+// ── Naming analysis (heuristic, no ML) ──────────────────────────────────────
+function isDescriptiveName(name) {
+    if (name.startsWith('('))
+        return 'unclear'; // anonymous
+    if (name.length <= 2)
+        return 'too-short';
+    // Single word with no verb pattern
+    if (!/[A-Z]/.test(name) && !name.includes('_') && name.length < 6)
+        return 'too-short';
+    return 'good';
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkDeep(cwd) {
+    const allFiles = walkFiles(cwd);
+    const sourceFiles = allFiles.filter(f => isSourceFile(f) && !isTestFile(f));
+    if (sourceFiles.length < 3) {
+        return { name: 'deep', score: 100, maxScore: 100, summary: 'too few files', issues: [] };
+    }
+    const issues = [];
+    const allMetrics = [];
+    const t0 = Date.now();
+    for (const file of sourceFiles) {
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        try {
+            const src = ts.createSourceFile(file, content, ts.ScriptTarget.Latest, true);
+            function visit(node) {
+                if (ts.isFunctionDeclaration(node) || ts.isFunctionExpression(node) ||
+                    ts.isMethodDeclaration(node) || ts.isArrowFunction(node)) {
+                    const metrics = analyzeFunction(node, file, src);
+                    if (metrics)
+                        allMetrics.push(metrics);
+                }
+                ts.forEachChild(node, visit);
+            }
+            visit(src);
+        }
+        catch {
+            // Skip files that can't be parsed
+        }
+    }
+    const elapsed = Date.now() - t0;
+    if (allMetrics.length === 0) {
+        return { name: 'deep', score: 100, maxScore: 100, summary: 'no functions to analyze', issues: [] };
+    }
+    // ── Cyclomatic complexity ─────────────────────────────────────────────────
+    const highComplexity = allMetrics.filter(f => f.cyclomatic > 10);
+    const veryHighComplexity = allMetrics.filter(f => f.cyclomatic > 20);
+    for (const func of veryHighComplexity.slice(0, 5)) {
+        issues.push({
+            severity: 'warning',
+            message: `high cyclomatic complexity: ${func.name} has complexity ${func.cyclomatic} (threshold: 10) — hard to test and modify`,
+            file: func.file, line: func.line,
+            fixable: true,
+            fixHint: 'break into smaller functions, use strategy pattern or lookup tables',
+        });
+    }
+    for (const func of highComplexity.filter(f => f.cyclomatic <= 20).slice(0, 5)) {
+        issues.push({
+            severity: 'info',
+            message: `moderate complexity: ${func.name} has complexity ${func.cyclomatic} (threshold: 10)`,
+            file: func.file, line: func.line,
+            fixable: true,
+            fixHint: 'consider extracting helper functions',
+        });
+    }
+    // ── Deep nesting ──────────────────────────────────────────────────────────
+    const deeplyNested = allMetrics.filter(f => f.maxNesting > 4);
+    for (const func of deeplyNested.slice(0, 5)) {
+        issues.push({
+            severity: 'warning',
+            message: `deep nesting: ${func.name} has ${func.maxNesting} levels of nesting — use early returns or extract functions`,
+            file: func.file, line: func.line,
+            fixable: true,
+            fixHint: 'use guard clauses (early return) to flatten nesting',
+        });
+    }
+    // ── Catch block quality ───────────────────────────────────────────────────
+    const allCatches = allMetrics.flatMap(f => f.catchBlocks.map(cb => ({ ...cb, func: f })));
+    const emptyCatches = allCatches.filter(c => c.isEmpty);
+    const lazyCatches = allCatches.filter(c => c.isLazy);
+    for (const ec of emptyCatches.slice(0, 3)) {
+        issues.push({
+            severity: 'error',
+            message: `empty catch block in ${ec.func.name} — errors are silently swallowed`,
+            file: ec.func.file, line: ec.line,
+            fixable: true,
+            fixHint: 'at minimum: log the error, or re-throw with context',
+        });
+    }
+    for (const lc of lazyCatches.slice(0, 3)) {
+        issues.push({
+            severity: 'warning',
+            message: `lazy error handling in ${lc.func.name} — catch only console.logs the error without recovery or rethrow`,
+            file: lc.func.file, line: lc.line,
+            fixable: true,
+            fixHint: 'add proper error handling: typed errors, retry logic, or graceful degradation',
+        });
+    }
+    // ── Cognitive complexity ──────────────────────────────────────────────────
+    const highCognitive = allMetrics.filter(f => f.cognitiveComplexity > 15);
+    for (const func of highCognitive.slice(0, 3)) {
+        issues.push({
+            severity: 'info',
+            message: `high cognitive complexity: ${func.name} has cognitive complexity ${func.cognitiveComplexity} — difficult for humans and AI agents to understand`,
+            file: func.file, line: func.line,
+            fixable: true,
+            fixHint: 'simplify control flow, extract well-named helper functions',
+        });
+    }
+    // ── Parameter count ───────────────────────────────────────────────────────
+    const manyParams = allMetrics.filter(f => f.paramCount >= 5);
+    if (manyParams.length > 0) {
+        issues.push({
+            severity: 'info',
+            message: `${manyParams.length} function${manyParams.length !== 1 ? 's' : ''} with 5+ parameters: ${manyParams.slice(0, 3).map(f => f.name + '(' + f.paramCount + ')').join(', ')}`,
+            file: manyParams[0].file, line: manyParams[0].line,
+            fixable: true,
+            fixHint: 'use an options object instead of many positional parameters',
+        });
+    }
+    // ── Naming quality ────────────────────────────────────────────────────────
+    const poorNames = allMetrics.filter(f => isDescriptiveName(f.name) !== 'good');
+    if (poorNames.length > 3) {
+        issues.push({
+            severity: 'info',
+            message: `${poorNames.length} functions with unclear or too-short names: ${poorNames.slice(0, 3).map(f => '"' + f.name + '"').join(', ')}`,
+            file: poorNames[0].file,
+            fixable: true,
+            fixHint: 'use descriptive verb+noun function names (e.g., calculateTotal, validateUser)',
+        });
+    }
+    // ── Scoring ───────────────────────────────────────────────────────────────
+    const total = allMetrics.length;
+    // Complexity score: % of functions below threshold
+    const complexityOk = allMetrics.filter(f => f.cyclomatic <= 10).length;
+    const complexityScore = Math.round((complexityOk / total) * 100);
+    // Nesting score
+    const nestingOk = allMetrics.filter(f => f.maxNesting <= 4).length;
+    const nestingScore = Math.round((nestingOk / total) * 100);
+    // Error handling score
+    const errorScore = allCatches.length === 0 ? 100
+        : Math.max(20, 100 - emptyCatches.length * 20 - lazyCatches.length * 10);
+    // Naming score
+    const namingOk = allMetrics.filter(f => isDescriptiveName(f.name) === 'good').length;
+    const namingScore = Math.round((namingOk / total) * 100);
+    const score = Math.max(25, Math.round(complexityScore * 0.35 +
+        nestingScore * 0.25 +
+        errorScore * 0.25 +
+        namingScore * 0.15));
+    // ── Summary ───────────────────────────────────────────────────────────────
+    const parts = [];
+    parts.push(`${total} functions analyzed in ${elapsed}ms`);
+    if (highComplexity.length > 0)
+        parts.push(c.yellow + `${highComplexity.length} complex` + c.reset);
+    if (deeplyNested.length > 0)
+        parts.push(c.yellow + `${deeplyNested.length} deeply nested` + c.reset);
+    if (emptyCatches.length > 0)
+        parts.push(c.red + `${emptyCatches.length} empty catches` + c.reset);
+    if (lazyCatches.length > 0)
+        parts.push(c.yellow + `${lazyCatches.length} lazy catches` + c.reset);
+    return { name: 'deep', score, maxScore: 100, summary: parts.join(', '), issues };
+}

package/dist/checks/hotspots.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkHotspots(cwd: string): Promise<CheckResult>;

package/dist/checks/hotspots.js

@@ -0,0 +1,228 @@
+import { execSync } from 'node:child_process';
+import { join } from 'node:path';
+import { walkFiles, readFile, c } from '../util.js';
+const SOURCE_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs', '.py', '.go', '.rs', '.java']);
+function isSourceFile(f) {
+    const dot = f.lastIndexOf('.');
+    return dot !== -1 && SOURCE_EXTS.has(f.substring(dot));
+}
+function getGitChurn(cwd, months = 6) {
+    const churn = new Map();
+    try {
+        const since = `--since="${months} months ago"`;
+        // Get commit count + authors per file
+        const log = execSync(`git log ${since} --format="%H %ae" --name-only --no-merges 2>/dev/null`, { cwd, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024, timeout: 15_000 });
+        let currentAuthor = '';
+        const fileAuthors = new Map();
+        const fileCommits = new Map();
+        for (const line of log.split('\n')) {
+            if (!line.trim())
+                continue;
+            if (/^[0-9a-f]{40}\s/.test(line)) {
+                currentAuthor = line.split(' ').slice(1).join(' ');
+                continue;
+            }
+            const file = line.trim();
+            fileCommits.set(file, (fileCommits.get(file) || 0) + 1);
+            if (!fileAuthors.has(file))
+                fileAuthors.set(file, new Set());
+            fileAuthors.get(file).add(currentAuthor);
+        }
+        // Get lines changed per file
+        const numstat = execSync(`git log ${since} --numstat --format="" --no-merges 2>/dev/null`, { cwd, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024, timeout: 15_000 });
+        const fileLinesChanged = new Map();
+        for (const line of numstat.split('\n')) {
+            const match = line.match(/^(\d+)\s+(\d+)\s+(.+)$/);
+            if (!match)
+                continue;
+            const added = parseInt(match[1], 10);
+            const removed = parseInt(match[2], 10);
+            const file = match[3];
+            fileLinesChanged.set(file, (fileLinesChanged.get(file) || 0) + added + removed);
+        }
+        for (const [file, commits] of fileCommits) {
+            churn.set(file, {
+                file,
+                commits,
+                authors: fileAuthors.get(file)?.size || 1,
+                linesChanged: fileLinesChanged.get(file) || 0,
+            });
+        }
+    }
+    catch {
+        // Not a git repo or git not available
+    }
+    return churn;
+}
+function getTemporalCoupling(cwd, months = 6) {
+    const couplings = [];
+    try {
+        const since = `--since="${months} months ago"`;
+        const log = execSync(`git log ${since} --format="COMMIT" --name-only --no-merges 2>/dev/null`, { cwd, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024, timeout: 15_000 });
+        // Parse commits into file sets
+        const commits = [];
+        let current = [];
+        for (const line of log.split('\n')) {
+            if (line === 'COMMIT') {
+                if (current.length > 0)
+                    commits.push(current);
+                current = [];
+            }
+            else if (line.trim()) {
+                const f = line.trim();
+                if (isSourceFile(f))
+                    current.push(f);
+            }
+        }
+        if (current.length > 0)
+            commits.push(current);
+        // Count co-changes (files that appear in same commit)
+        const pairCount = new Map();
+        const fileCommitCount = new Map();
+        for (const files of commits) {
+            if (files.length > 20)
+                continue; // skip huge commits (refactors/renames)
+            for (const f of files) {
+                fileCommitCount.set(f, (fileCommitCount.get(f) || 0) + 1);
+            }
+            for (let i = 0; i < files.length; i++) {
+                for (let j = i + 1; j < files.length; j++) {
+                    const key = [files[i], files[j]].sort().join('::');
+                    pairCount.set(key, (pairCount.get(key) || 0) + 1);
+                }
+            }
+        }
+        // Find strong couplings
+        for (const [key, count] of pairCount) {
+            if (count < 3)
+                continue; // minimum 3 co-changes
+            const [f1, f2] = key.split('::');
+            const minCommits = Math.min(fileCommitCount.get(f1) || 1, fileCommitCount.get(f2) || 1);
+            const strength = count / minCommits;
+            if (strength > 0.5) { // >50% of the time they change together
+                couplings.push({ file1: f1, file2: f2, cochanges: count, couplingStrength: strength });
+            }
+        }
+        couplings.sort((a, b) => b.couplingStrength - a.couplingStrength);
+    }
+    catch {
+        // Not a git repo
+    }
+    return couplings;
+}
+// ── Complexity proxy: indentation depth ─────────────────────────────────────
+function getIndentationComplexity(content) {
+    const lines = content.split('\n');
+    let totalDepth = 0;
+    let maxDepth = 0;
+    let measured = 0;
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        const match = line.match(/^(\s+)/);
+        if (match) {
+            const depth = match[1].includes('\t')
+                ? match[1].split('\t').length - 1
+                : Math.floor(match[1].length / 2);
+            totalDepth += depth;
+            if (depth > maxDepth)
+                maxDepth = depth;
+        }
+        measured++;
+    }
+    return measured > 0 ? totalDepth / measured : 0;
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkHotspots(cwd) {
+    const issues = [];
+    const t0 = Date.now();
+    const churn = getGitChurn(cwd);
+    if (churn.size === 0) {
+        return { name: 'hotspots', score: 100, maxScore: 100, summary: 'no git history', issues: [] };
+    }
+    const allFiles = walkFiles(cwd);
+    const sourceFiles = allFiles.filter(f => isSourceFile(f));
+    // Calculate complexity for each file (indentation-based, fast)
+    const fileComplexity = new Map();
+    for (const file of sourceFiles) {
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        fileComplexity.set(file, getIndentationComplexity(content));
+    }
+    const hotspots = [];
+    for (const [file, ch] of churn) {
+        const complexity = fileComplexity.get(file);
+        if (complexity === undefined)
+            continue;
+        // Normalize: risk = log(commits) × complexity
+        const risk = Math.log2(ch.commits + 1) * complexity;
+        hotspots.push({ file, commits: ch.commits, complexity, risk, authors: ch.authors });
+    }
+    hotspots.sort((a, b) => b.risk - a.risk);
+    // Top hotspots are issues
+    const topHotspots = hotspots.slice(0, 5);
+    for (const hs of topHotspots) {
+        if (hs.risk < 5)
+            continue; // skip low-risk files
+        issues.push({
+            severity: hs.risk > 20 ? 'warning' : 'info',
+            message: `hotspot: ${hs.file} — ${hs.commits} commits, complexity ${hs.complexity.toFixed(1)}, risk score ${hs.risk.toFixed(1)}${hs.authors > 3 ? `, ${hs.authors} authors` : ''}`,
+            file: hs.file,
+            fixable: false,
+            fixHint: 'high-churn complex files are bug magnets — prioritize refactoring and add tests',
+        });
+    }
+    // ── Temporal coupling ─────────────────────────────────────────────────────
+    const couplings = getTemporalCoupling(cwd);
+    // Filter out obvious couplings (same directory, test+source)
+    const interestingCouplings = couplings.filter(cp => {
+        const dir1 = cp.file1.split('/').slice(0, -1).join('/');
+        const dir2 = cp.file2.split('/').slice(0, -1).join('/');
+        // Same directory coupling is expected
+        if (dir1 === dir2)
+            return false;
+        // Test+source coupling is expected
+        if (cp.file1.includes('test') || cp.file2.includes('test'))
+            return false;
+        return true;
+    });
+    for (const cp of interestingCouplings.slice(0, 3)) {
+        issues.push({
+            severity: 'info',
+            message: `temporal coupling: ${cp.file1} ↔ ${cp.file2} change together ${Math.round(cp.couplingStrength * 100)}% of the time (${cp.cochanges} co-changes) — possible hidden dependency`,
+            file: cp.file1,
+            fixable: false,
+            fixHint: 'investigate if these files share a concept that should be co-located or abstracted',
+        });
+    }
+    // ── Multi-author hotfiles ─────────────────────────────────────────────────
+    const manyAuthors = hotspots.filter(h => h.authors >= 5).slice(0, 3);
+    for (const ma of manyAuthors) {
+        issues.push({
+            severity: 'info',
+            message: `knowledge diffusion: ${ma.file} touched by ${ma.authors} authors — high bus factor risk if not well-documented`,
+            file: ma.file,
+            fixable: false,
+            fixHint: 'ensure this file has clear documentation and tests — many people modify it',
+        });
+    }
+    const elapsed = Date.now() - t0;
+    // ── Scoring ───────────────────────────────────────────────────────────────
+    // Score based on how many high-risk hotspots exist relative to codebase size
+    const highRiskCount = hotspots.filter(h => h.risk > 20).length;
+    const riskRatio = sourceFiles.length > 0 ? highRiskCount / sourceFiles.length : 0;
+    const hotspotScore = Math.max(25, Math.round(100 - riskRatio * 500));
+    // Temporal coupling penalty
+    const couplingPenalty = Math.min(30, interestingCouplings.length * 5);
+    const score = Math.max(25, hotspotScore - couplingPenalty);
+    const parts = [];
+    parts.push(`${churn.size} files in git history, ${elapsed}ms`);
+    if (topHotspots.length > 0 && topHotspots[0].risk > 5) {
+        parts.push(c.yellow + `top hotspot: ${topHotspots[0].file.split('/').pop()} (risk ${topHotspots[0].risk.toFixed(0)})` + c.reset);
+    }
+    if (interestingCouplings.length > 0) {
+        parts.push(`${interestingCouplings.length} temporal couplings`);
+    }
+    return { name: 'hotspots', score, maxScore: 100, summary: parts.join(', '), issues };
+}

package/dist/checks/semantic.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkSemantic(cwd: string): Promise<CheckResult>;

package/dist/checks/semantic.js

@@ -0,0 +1,181 @@
+import { join } from 'node:path';
+import { walkFiles, readFile, c } from '../util.js';
+const SOURCE_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
+function isSourceFile(f) {
+    const dot = f.lastIndexOf('.');
+    return dot !== -1 && SOURCE_EXTS.has(f.substring(dot));
+}
+function isTestFile(f) {
+    return /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || /(?:^|[/\\])tests?[/\\]/.test(f);
+}
+const ANTI_PATTERNS = [
+    {
+        name: 'lazy-error-handling',
+        description: 'catches error but only logs it without recovery or rethrow',
+        severity: 'warning',
+        fixHint: 'add proper error recovery, rethrow with context, or use typed error classes',
+        embedding_text: 'try { doSomething(); } catch(e) { console.log(e); } try { await fetch(url); } catch(err) { console.error(err); return null; }',
+    },
+    {
+        name: 'any-abuse',
+        description: 'excessive use of TypeScript any type to bypass type checking',
+        severity: 'warning',
+        fixHint: 'replace any with specific types, use unknown for truly unknown types',
+        embedding_text: 'function process(data: any, config: any): any { return (data as any).map((x: any) => x); const result: any = {}; }',
+    },
+    {
+        name: 'callback-hell',
+        description: 'deeply nested callbacks or promise chains',
+        severity: 'info',
+        fixHint: 'refactor to async/await',
+        embedding_text: 'getData(function(a) { getMore(a, function(b) { getEvenMore(b, function(c) { process(c, function(d) { done(d); }); }); }); });',
+    },
+    {
+        name: 'empty-function',
+        description: 'function with no implementation or only comments/todos',
+        severity: 'warning',
+        fixHint: 'implement the function or remove it',
+        embedding_text: 'function handleSubmit() { /* TODO: implement */ } function processData(input) { // not implemented yet return input; }',
+    },
+    {
+        name: 'string-heavy-logic',
+        description: 'business logic driven by string comparisons instead of enums or types',
+        severity: 'info',
+        fixHint: 'use enums, union types, or constants instead of string literals',
+        embedding_text: 'if (status === "pending") { } else if (status === "active") { } else if (status === "cancelled") { } else if (status === "completed") { }',
+    },
+];
+function extractFunctions(file, content) {
+    const funcs = [];
+    const lines = content.split('\n');
+    const funcStartRe = /^(?:export\s+)?(?:async\s+)?function\s+([a-zA-Z_$][a-zA-Z0-9_$]*)/;
+    const arrowRe = /^(?:export\s+)?(?:const|let|var)\s+([a-zA-Z_$][a-zA-Z0-9_$]*)\s*(?::\s*[^=]+)?\s*=\s*(?:async\s+)?\(/;
+    const methodRe = /^\s+(?:async\s+)?([a-zA-Z_$][a-zA-Z0-9_$]*)\s*\([^)]*\)\s*(?::\s*[^{]+)?\s*\{/;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const match = line.match(funcStartRe) || line.match(arrowRe) || line.match(methodRe);
+        if (!match)
+            continue;
+        const name = match[1];
+        if (!name || ['if', 'for', 'while', 'switch', 'catch'].includes(name))
+            continue;
+        // Find end of function
+        let depth = 0, started = false, endLine = i;
+        for (let j = i; j < lines.length && j < i + 200; j++) {
+            for (const ch of lines[j]) {
+                if (ch === '{') {
+                    depth++;
+                    started = true;
+                }
+                if (ch === '}')
+                    depth--;
+            }
+            if (started && depth <= 0) {
+                endLine = j;
+                break;
+            }
+        }
+        const lineCount = endLine - i + 1;
+        if (lineCount < 8)
+            continue; // skip tiny functions
+        const body = lines.slice(i, endLine + 1).join('\n').slice(0, 400);
+        funcs.push({ name, file, line: i + 1, body });
+    }
+    return funcs;
+}
+// ── Cosine similarity ───────────────────────────────────────────────────────
+function cosine(a, b) {
+    let dot = 0, na = 0, nb = 0;
+    for (let i = 0; i < a.length; i++) {
+        dot += a[i] * b[i];
+        na += a[i] * a[i];
+        nb += b[i] * b[i];
+    }
+    return dot / (Math.sqrt(na) * Math.sqrt(nb));
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkSemantic(cwd) {
+    const allFiles = walkFiles(cwd);
+    const sourceFiles = allFiles.filter(f => isSourceFile(f) && !isTestFile(f));
+    if (sourceFiles.length < 3) {
+        return { name: 'semantic', score: 100, maxScore: 100, summary: 'too few files', issues: [] };
+    }
+    // Extract functions
+    const allFuncs = [];
+    for (const file of sourceFiles) {
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        allFuncs.push(...extractFunctions(file, content));
+    }
+    if (allFuncs.length === 0) {
+        return { name: 'semantic', score: 100, maxScore: 100, summary: 'no functions', issues: [] };
+    }
+    // Cap at 100 longest functions for performance
+    const funcsToAnalyze = allFuncs
+        .sort((a, b) => b.body.length - a.body.length)
+        .slice(0, 100);
+    const issues = [];
+    const t0 = Date.now();
+    let matchCount = 0;
+    try {
+        const { pipeline } = await import('@huggingface/transformers');
+        const extractor = await pipeline('feature-extraction', 'Xenova/all-MiniLM-L6-v2', {
+            dtype: 'q8',
+        });
+        // Embed anti-patterns once
+        const patternEmbeddings = [];
+        for (const pattern of ANTI_PATTERNS) {
+            const result = await extractor(pattern.embedding_text, { pooling: 'mean', normalize: true });
+            patternEmbeddings.push({ pattern, embedding: new Float32Array(result.data) });
+        }
+        // Embed and compare each function
+        const THRESHOLD = 0.40; // similarity threshold — code-to-code embeddings
+        for (const func of funcsToAnalyze) {
+            const result = await extractor(func.body, { pooling: 'mean', normalize: true });
+            const funcEmb = new Float32Array(result.data);
+            for (const { pattern, embedding } of patternEmbeddings) {
+                const sim = cosine(funcEmb, embedding);
+                if (sim > THRESHOLD) {
+                    matchCount++;
+                    issues.push({
+                        severity: pattern.severity,
+                        message: `semantic match: ${func.name} matches "${pattern.name}" pattern (${Math.round(sim * 100)}% similarity) — ${pattern.description}`,
+                        file: func.file,
+                        line: func.line,
+                        fixable: true,
+                        fixHint: pattern.fixHint,
+                    });
+                    break; // one match per function
+                }
+            }
+        }
+    }
+    catch (err) {
+        // transformers.js not available or model download failed
+        return {
+            name: 'semantic',
+            score: 100,
+            maxScore: 100,
+            summary: `semantic analysis unavailable: ${err instanceof Error ? err.message : 'unknown'}`,
+            issues: [],
+        };
+    }
+    const elapsed = Date.now() - t0;
+    // Score based on % of functions matching anti-patterns
+    const matchRate = funcsToAnalyze.length > 0 ? matchCount / funcsToAnalyze.length : 0;
+    const score = Math.max(25, Math.round(100 - matchRate * 200));
+    const parts = [];
+    parts.push(`${funcsToAnalyze.length} functions scanned in ${elapsed}ms`);
+    if (matchCount > 0)
+        parts.push(c.yellow + `${matchCount} anti-pattern matches` + c.reset);
+    else
+        parts.push('no anti-patterns detected');
+    return {
+        name: 'semantic',
+        score,
+        maxScore: 100,
+        summary: parts.join(', '),
+        issues,
+    };
+}

package/dist/cli.js

@@ -15,6 +15,9 @@ import { checkDebt } from './checks/debt.js';
 import { checkIntegrity } from './checks/integrity.js';
 import { checkArchitecture } from './checks/architecture.js';
 import { checkAIReady } from './checks/aiready.js';
+import { checkDeep } from './checks/deep.js';
+import { checkSemantic } from './checks/semantic.js';
+import { checkHotspots } from './checks/hotspots.js';
 import { checkReceipt, runReceiptCommand } from './checks/receipt.js';
 import { checkMemory } from './checks/memory.js';
 import { checkVerify } from './checks/verify.js';
@@ -33,6 +36,7 @@ import { reportPretty, reportJSON, reportBadge } from './reporter.js';
 import { clearCache } from './file-cache.js';
 const args = process.argv.slice(2);
 const flags = new Set(args.filter(a => a.startsWith('-') && !a.startsWith('--since')));
+const deepMode = flags.has('--deep');
 const flagMap = new Map();
 // Parse --since=value or --since value, --max-files=value
 for (let i = 0; i < args.length; i++) {
@@ -322,7 +326,7 @@ async function runChecks() {
             }
         }
         // Run ALL independent checks in parallel
-        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult, guardResult, explainResult, architectureResult, aireadyResult,] = await Promise.all([
+        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult, guardResult, explainResult, architectureResult, aireadyResult, deepResult, semanticResult, hotspotsResult,] = await Promise.all([
             withTimeout('scan', () => checkScan(cwd)),
             withTimeout('secrets', () => checkSecrets(cwd)),
             withTimeout('config', () => checkConfig(cwd, ignore)),
@@ -346,6 +350,9 @@ async function runChecks() {
             withTimeout('explain', () => checkExplain(cwd, since)),
             withTimeout('architecture', () => checkArchitecture(cwd)),
             withTimeout('aiready', () => checkAIReady(cwd)),
+            withTimeout('deep', () => checkDeep(cwd), 60_000),
+            withTimeout('semantic', () => checkSemantic(cwd), 60_000),
+            withTimeout('hotspots', () => checkHotspots(cwd), 30_000),
         ]);
         // Git-dependent checks (diff + history) — parallel with each other
         const [diffResult, historyResult] = await Promise.all([
@@ -360,7 +367,8 @@ async function runChecks() {
             debt: [readyResult, historyResult, debtResult, bloatResult],
             deps: [depsResult],
             architecture: [architectureResult],
-            aiready: [aireadyResult],
+            aiready: [aireadyResult, deepResult, semanticResult],
+            history: [hotspotsResult],
         });
     }
     catch (e) {

package/dist/scorer.d.ts

@@ -6,5 +6,6 @@ export interface CheckMap {
     deps: CheckResult[];
     architecture: CheckResult[];
     aiready: CheckResult[];
+    history: CheckResult[];
 }
 export declare function score(project: string, checkMap: CheckMap): VetResult;

package/dist/types.d.ts

@@ -14,7 +14,7 @@ export interface Issue {
     fixHint?: string;
 }
 export interface CategoryResult {
-    name: 'security' | 'integrity' | 'debt' | 'deps' | 'architecture' | 'aiready';
+    name: 'security' | 'integrity' | 'debt' | 'deps' | 'architecture' | 'aiready' | 'history';
     score: number;
     weight: number;
     checks: CheckResult[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.18.0",
+  "version": "1.19.1",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {
@@ -35,12 +35,15 @@
   "devDependencies": {
     "@types/node": "^20.0.0",
     "tsx": "^4.21.0",
-    "typescript": "^5.7.0"
+    "typescript": "^5.9.3"
   },
   "engines": {
     "node": ">=18"
   },
   "optionalDependencies": {
     "@safetnsr/model-graveyard": "^0.2.0"
+  },
+  "dependencies": {
+    "@huggingface/transformers": "^3.8.1"
   }
 }