@safetnsr/vet 1.19.0 → 1.19.1

package/dist/categories.d.ts

@@ -9,5 +9,6 @@ export declare function buildCategories(checkMap: {
     deps: CheckResult[];
     architecture: CheckResult[];
     aiready: CheckResult[];
+    history: CheckResult[];
 }): CategoryResult[];
 export declare function buildVetResult(project: string, categories: CategoryResult[]): VetResult;

package/dist/categories.js

@@ -16,12 +16,13 @@ export function toGrade(score) {
 }
 // ── Category weights ─────────────────────────────────────────────────────────
 const WEIGHTS = {
-    security: 0.25,
-    integrity: 0.25,
-    debt: 0.20,
+    security: 0.20,
+    integrity: 0.20,
+    debt: 0.15,
     deps: 0.10,
     architecture: 0.10,
     aiready: 0.10,
+    history: 0.15,
 };
 // ── Scoring floor for non-security checks ────────────────────────────────────
 const SECURITY_CHECKS = new Set(['scan', 'secrets', 'permissions', 'owasp']);
@@ -68,7 +69,7 @@ function completenessMultiplier(categories) {
 // ── Group checks into categories ─────────────────────────────────────────────
 export function buildCategories(checkMap) {
     const categories = [];
-    for (const name of ['security', 'integrity', 'debt', 'deps', 'architecture', 'aiready']) {
+    for (const name of ['security', 'integrity', 'debt', 'deps', 'architecture', 'aiready', 'history']) {
         const checks = checkMap[name];
         if (!checks || checks.length === 0)
             continue;

package/dist/checks/hotspots.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkHotspots(cwd: string): Promise<CheckResult>;

package/dist/checks/hotspots.js

@@ -0,0 +1,228 @@
+import { execSync } from 'node:child_process';
+import { join } from 'node:path';
+import { walkFiles, readFile, c } from '../util.js';
+const SOURCE_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs', '.py', '.go', '.rs', '.java']);
+function isSourceFile(f) {
+    const dot = f.lastIndexOf('.');
+    return dot !== -1 && SOURCE_EXTS.has(f.substring(dot));
+}
+function getGitChurn(cwd, months = 6) {
+    const churn = new Map();
+    try {
+        const since = `--since="${months} months ago"`;
+        // Get commit count + authors per file
+        const log = execSync(`git log ${since} --format="%H %ae" --name-only --no-merges 2>/dev/null`, { cwd, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024, timeout: 15_000 });
+        let currentAuthor = '';
+        const fileAuthors = new Map();
+        const fileCommits = new Map();
+        for (const line of log.split('\n')) {
+            if (!line.trim())
+                continue;
+            if (/^[0-9a-f]{40}\s/.test(line)) {
+                currentAuthor = line.split(' ').slice(1).join(' ');
+                continue;
+            }
+            const file = line.trim();
+            fileCommits.set(file, (fileCommits.get(file) || 0) + 1);
+            if (!fileAuthors.has(file))
+                fileAuthors.set(file, new Set());
+            fileAuthors.get(file).add(currentAuthor);
+        }
+        // Get lines changed per file
+        const numstat = execSync(`git log ${since} --numstat --format="" --no-merges 2>/dev/null`, { cwd, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024, timeout: 15_000 });
+        const fileLinesChanged = new Map();
+        for (const line of numstat.split('\n')) {
+            const match = line.match(/^(\d+)\s+(\d+)\s+(.+)$/);
+            if (!match)
+                continue;
+            const added = parseInt(match[1], 10);
+            const removed = parseInt(match[2], 10);
+            const file = match[3];
+            fileLinesChanged.set(file, (fileLinesChanged.get(file) || 0) + added + removed);
+        }
+        for (const [file, commits] of fileCommits) {
+            churn.set(file, {
+                file,
+                commits,
+                authors: fileAuthors.get(file)?.size || 1,
+                linesChanged: fileLinesChanged.get(file) || 0,
+            });
+        }
+    }
+    catch {
+        // Not a git repo or git not available
+    }
+    return churn;
+}
+function getTemporalCoupling(cwd, months = 6) {
+    const couplings = [];
+    try {
+        const since = `--since="${months} months ago"`;
+        const log = execSync(`git log ${since} --format="COMMIT" --name-only --no-merges 2>/dev/null`, { cwd, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024, timeout: 15_000 });
+        // Parse commits into file sets
+        const commits = [];
+        let current = [];
+        for (const line of log.split('\n')) {
+            if (line === 'COMMIT') {
+                if (current.length > 0)
+                    commits.push(current);
+                current = [];
+            }
+            else if (line.trim()) {
+                const f = line.trim();
+                if (isSourceFile(f))
+                    current.push(f);
+            }
+        }
+        if (current.length > 0)
+            commits.push(current);
+        // Count co-changes (files that appear in same commit)
+        const pairCount = new Map();
+        const fileCommitCount = new Map();
+        for (const files of commits) {
+            if (files.length > 20)
+                continue; // skip huge commits (refactors/renames)
+            for (const f of files) {
+                fileCommitCount.set(f, (fileCommitCount.get(f) || 0) + 1);
+            }
+            for (let i = 0; i < files.length; i++) {
+                for (let j = i + 1; j < files.length; j++) {
+                    const key = [files[i], files[j]].sort().join('::');
+                    pairCount.set(key, (pairCount.get(key) || 0) + 1);
+                }
+            }
+        }
+        // Find strong couplings
+        for (const [key, count] of pairCount) {
+            if (count < 3)
+                continue; // minimum 3 co-changes
+            const [f1, f2] = key.split('::');
+            const minCommits = Math.min(fileCommitCount.get(f1) || 1, fileCommitCount.get(f2) || 1);
+            const strength = count / minCommits;
+            if (strength > 0.5) { // >50% of the time they change together
+                couplings.push({ file1: f1, file2: f2, cochanges: count, couplingStrength: strength });
+            }
+        }
+        couplings.sort((a, b) => b.couplingStrength - a.couplingStrength);
+    }
+    catch {
+        // Not a git repo
+    }
+    return couplings;
+}
+// ── Complexity proxy: indentation depth ─────────────────────────────────────
+function getIndentationComplexity(content) {
+    const lines = content.split('\n');
+    let totalDepth = 0;
+    let maxDepth = 0;
+    let measured = 0;
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        const match = line.match(/^(\s+)/);
+        if (match) {
+            const depth = match[1].includes('\t')
+                ? match[1].split('\t').length - 1
+                : Math.floor(match[1].length / 2);
+            totalDepth += depth;
+            if (depth > maxDepth)
+                maxDepth = depth;
+        }
+        measured++;
+    }
+    return measured > 0 ? totalDepth / measured : 0;
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkHotspots(cwd) {
+    const issues = [];
+    const t0 = Date.now();
+    const churn = getGitChurn(cwd);
+    if (churn.size === 0) {
+        return { name: 'hotspots', score: 100, maxScore: 100, summary: 'no git history', issues: [] };
+    }
+    const allFiles = walkFiles(cwd);
+    const sourceFiles = allFiles.filter(f => isSourceFile(f));
+    // Calculate complexity for each file (indentation-based, fast)
+    const fileComplexity = new Map();
+    for (const file of sourceFiles) {
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        fileComplexity.set(file, getIndentationComplexity(content));
+    }
+    const hotspots = [];
+    for (const [file, ch] of churn) {
+        const complexity = fileComplexity.get(file);
+        if (complexity === undefined)
+            continue;
+        // Normalize: risk = log(commits) × complexity
+        const risk = Math.log2(ch.commits + 1) * complexity;
+        hotspots.push({ file, commits: ch.commits, complexity, risk, authors: ch.authors });
+    }
+    hotspots.sort((a, b) => b.risk - a.risk);
+    // Top hotspots are issues
+    const topHotspots = hotspots.slice(0, 5);
+    for (const hs of topHotspots) {
+        if (hs.risk < 5)
+            continue; // skip low-risk files
+        issues.push({
+            severity: hs.risk > 20 ? 'warning' : 'info',
+            message: `hotspot: ${hs.file} — ${hs.commits} commits, complexity ${hs.complexity.toFixed(1)}, risk score ${hs.risk.toFixed(1)}${hs.authors > 3 ? `, ${hs.authors} authors` : ''}`,
+            file: hs.file,
+            fixable: false,
+            fixHint: 'high-churn complex files are bug magnets — prioritize refactoring and add tests',
+        });
+    }
+    // ── Temporal coupling ─────────────────────────────────────────────────────
+    const couplings = getTemporalCoupling(cwd);
+    // Filter out obvious couplings (same directory, test+source)
+    const interestingCouplings = couplings.filter(cp => {
+        const dir1 = cp.file1.split('/').slice(0, -1).join('/');
+        const dir2 = cp.file2.split('/').slice(0, -1).join('/');
+        // Same directory coupling is expected
+        if (dir1 === dir2)
+            return false;
+        // Test+source coupling is expected
+        if (cp.file1.includes('test') || cp.file2.includes('test'))
+            return false;
+        return true;
+    });
+    for (const cp of interestingCouplings.slice(0, 3)) {
+        issues.push({
+            severity: 'info',
+            message: `temporal coupling: ${cp.file1} ↔ ${cp.file2} change together ${Math.round(cp.couplingStrength * 100)}% of the time (${cp.cochanges} co-changes) — possible hidden dependency`,
+            file: cp.file1,
+            fixable: false,
+            fixHint: 'investigate if these files share a concept that should be co-located or abstracted',
+        });
+    }
+    // ── Multi-author hotfiles ─────────────────────────────────────────────────
+    const manyAuthors = hotspots.filter(h => h.authors >= 5).slice(0, 3);
+    for (const ma of manyAuthors) {
+        issues.push({
+            severity: 'info',
+            message: `knowledge diffusion: ${ma.file} touched by ${ma.authors} authors — high bus factor risk if not well-documented`,
+            file: ma.file,
+            fixable: false,
+            fixHint: 'ensure this file has clear documentation and tests — many people modify it',
+        });
+    }
+    const elapsed = Date.now() - t0;
+    // ── Scoring ───────────────────────────────────────────────────────────────
+    // Score based on how many high-risk hotspots exist relative to codebase size
+    const highRiskCount = hotspots.filter(h => h.risk > 20).length;
+    const riskRatio = sourceFiles.length > 0 ? highRiskCount / sourceFiles.length : 0;
+    const hotspotScore = Math.max(25, Math.round(100 - riskRatio * 500));
+    // Temporal coupling penalty
+    const couplingPenalty = Math.min(30, interestingCouplings.length * 5);
+    const score = Math.max(25, hotspotScore - couplingPenalty);
+    const parts = [];
+    parts.push(`${churn.size} files in git history, ${elapsed}ms`);
+    if (topHotspots.length > 0 && topHotspots[0].risk > 5) {
+        parts.push(c.yellow + `top hotspot: ${topHotspots[0].file.split('/').pop()} (risk ${topHotspots[0].risk.toFixed(0)})` + c.reset);
+    }
+    if (interestingCouplings.length > 0) {
+        parts.push(`${interestingCouplings.length} temporal couplings`);
+    }
+    return { name: 'hotspots', score, maxScore: 100, summary: parts.join(', '), issues };
+}

package/dist/cli.js

@@ -17,6 +17,7 @@ import { checkArchitecture } from './checks/architecture.js';
 import { checkAIReady } from './checks/aiready.js';
 import { checkDeep } from './checks/deep.js';
 import { checkSemantic } from './checks/semantic.js';
+import { checkHotspots } from './checks/hotspots.js';
 import { checkReceipt, runReceiptCommand } from './checks/receipt.js';
 import { checkMemory } from './checks/memory.js';
 import { checkVerify } from './checks/verify.js';
@@ -325,7 +326,7 @@ async function runChecks() {
             }
         }
         // Run ALL independent checks in parallel
-        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult, guardResult, explainResult, architectureResult, aireadyResult, deepResult, semanticResult,] = await Promise.all([
+        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult, guardResult, explainResult, architectureResult, aireadyResult, deepResult, semanticResult, hotspotsResult,] = await Promise.all([
             withTimeout('scan', () => checkScan(cwd)),
             withTimeout('secrets', () => checkSecrets(cwd)),
             withTimeout('config', () => checkConfig(cwd, ignore)),
@@ -351,6 +352,7 @@ async function runChecks() {
             withTimeout('aiready', () => checkAIReady(cwd)),
             withTimeout('deep', () => checkDeep(cwd), 60_000),
             withTimeout('semantic', () => checkSemantic(cwd), 60_000),
+            withTimeout('hotspots', () => checkHotspots(cwd), 30_000),
         ]);
         // Git-dependent checks (diff + history) — parallel with each other
         const [diffResult, historyResult] = await Promise.all([
@@ -366,6 +368,7 @@ async function runChecks() {
             deps: [depsResult],
             architecture: [architectureResult],
             aiready: [aireadyResult, deepResult, semanticResult],
+            history: [hotspotsResult],
         });
     }
     catch (e) {

package/dist/scorer.d.ts

@@ -6,5 +6,6 @@ export interface CheckMap {
     deps: CheckResult[];
     architecture: CheckResult[];
     aiready: CheckResult[];
+    history: CheckResult[];
 }
 export declare function score(project: string, checkMap: CheckMap): VetResult;

package/dist/types.d.ts

@@ -14,7 +14,7 @@ export interface Issue {
     fixHint?: string;
 }
 export interface CategoryResult {
-    name: 'security' | 'integrity' | 'debt' | 'deps' | 'architecture' | 'aiready';
+    name: 'security' | 'integrity' | 'debt' | 'deps' | 'architecture' | 'aiready' | 'history';
     score: number;
     weight: number;
     checks: CheckResult[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.19.0",
+  "version": "1.19.1",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {