@safetnsr/vet 1.19.0 → 1.19.2

package/dist/categories.d.ts

@@ -9,5 +9,6 @@ export declare function buildCategories(checkMap: {
     deps: CheckResult[];
     architecture: CheckResult[];
     aiready: CheckResult[];
+    history: CheckResult[];
 }): CategoryResult[];
 export declare function buildVetResult(project: string, categories: CategoryResult[]): VetResult;

package/dist/categories.js

@@ -16,12 +16,13 @@ export function toGrade(score) {
 }
 // ── Category weights ─────────────────────────────────────────────────────────
 const WEIGHTS = {
-    security: 0.25,
-    integrity: 0.25,
-    debt: 0.20,
+    security: 0.20,
+    integrity: 0.20,
+    debt: 0.15,
     deps: 0.10,
     architecture: 0.10,
     aiready: 0.10,
+    history: 0.15,
 };
 // ── Scoring floor for non-security checks ────────────────────────────────────
 const SECURITY_CHECKS = new Set(['scan', 'secrets', 'permissions', 'owasp']);
@@ -68,7 +69,7 @@ function completenessMultiplier(categories) {
 // ── Group checks into categories ─────────────────────────────────────────────
 export function buildCategories(checkMap) {
     const categories = [];
-    for (const name of ['security', 'integrity', 'debt', 'deps', 'architecture', 'aiready']) {
+    for (const name of ['security', 'integrity', 'debt', 'deps', 'architecture', 'aiready', 'history']) {
         const checks = checkMap[name];
         if (!checks || checks.length === 0)
             continue;

package/dist/checks/clones.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkClones(cwd: string): Promise<CheckResult>;

package/dist/checks/clones.js

@@ -0,0 +1,172 @@
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { walkFiles, readFile, c } from '../util.js';
+const SOURCE_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
+function isSourceFile(f) {
+    const dot = f.lastIndexOf('.');
+    return dot !== -1 && SOURCE_EXTS.has(f.substring(dot));
+}
+function isTestFile(f) {
+    return /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || /(?:^|[/\\])tests?[/\\]/.test(f);
+}
+function isExampleFile(f) {
+    return /(?:^|[/\\])(?:examples?|templates?|fixtures?|demos?)[/\\]/.test(f);
+}
+// ── Token normalization ─────────────────────────────────────────────────────
+// Strip comments, normalize whitespace, replace identifiers with placeholders
+// This makes structurally identical code match even with different variable names
+function normalizeTokens(code) {
+    // Remove single-line comments
+    let normalized = code.replace(/\/\/.*$/gm, '');
+    // Remove multi-line comments
+    normalized = normalized.replace(/\/\*[\s\S]*?\*\//g, '');
+    // Remove string literals (replace with placeholder)
+    normalized = normalized.replace(/(["'`])(?:(?!\1|\\).|\\.)*\1/g, '"S"');
+    // Normalize whitespace
+    normalized = normalized.replace(/\s+/g, ' ').trim();
+    // Normalize numbers (replace with placeholder)
+    normalized = normalized.replace(/\b\d+\.?\d*\b/g, '0');
+    return normalized;
+}
+const MIN_CHUNK_LINES = 6; // minimum lines for a clone to matter
+function extractChunks(file, content, windowSize) {
+    const lines = content.split('\n');
+    const chunks = [];
+    for (let i = 0; i <= lines.length - windowSize; i++) {
+        const rawSlice = lines.slice(i, i + windowSize);
+        // Skip chunks that are mostly empty or imports
+        const meaningful = rawSlice.filter(l => {
+            const t = l.trim();
+            return t && !t.startsWith('import ') && !t.startsWith('export ') && t !== '{' && t !== '}' && t !== ');';
+        });
+        if (meaningful.length < windowSize * 0.5)
+            continue;
+        const normalized = normalizeTokens(rawSlice.join('\n'));
+        if (normalized.length < 40)
+            continue; // too short after normalization
+        const hash = createHash('md5').update(normalized).digest('hex');
+        chunks.push({
+            file,
+            startLine: i + 1,
+            endLine: i + windowSize,
+            hash,
+            raw: rawSlice.join('\n'),
+        });
+    }
+    return chunks;
+}
+export async function checkClones(cwd) {
+    const allFiles = walkFiles(cwd);
+    const sourceFiles = allFiles.filter(f => isSourceFile(f) && !isTestFile(f) && !isExampleFile(f));
+    if (sourceFiles.length < 2) {
+        return { name: 'clones', score: 100, maxScore: 100, summary: 'too few files', issues: [] };
+    }
+    const t0 = Date.now();
+    const issues = [];
+    // Single window size — use the largest to reduce noise
+    const WINDOW_SIZE = 10;
+    const hashMap = new Map();
+    for (const file of sourceFiles) {
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        const chunks = extractChunks(file, content, WINDOW_SIZE);
+        for (const chunk of chunks) {
+            if (!hashMap.has(chunk.hash))
+                hashMap.set(chunk.hash, []);
+            hashMap.get(chunk.hash).push(chunk);
+        }
+    }
+    // Find cross-file duplicates, pick ONE representative per file per clone
+    const allCloneGroups = [];
+    for (const [hash, chunks] of hashMap) {
+        if (chunks.length < 2)
+            continue;
+        // Group by file, pick earliest occurrence per file
+        const byFile = new Map();
+        for (const chunk of chunks) {
+            const existing = byFile.get(chunk.file);
+            if (!existing || chunk.startLine < existing.startLine) {
+                byFile.set(chunk.file, chunk);
+            }
+        }
+        // Cross-file only
+        if (byFile.size < 2)
+            continue;
+        const reps = [...byFile.values()];
+        allCloneGroups.push({
+            hash,
+            locations: reps.map(r => ({ file: r.file, startLine: r.startLine, endLine: r.endLine })),
+            lineCount: WINDOW_SIZE,
+            sample: reps[0].raw.slice(0, 200),
+        });
+    }
+    // Deduplicate overlapping clones: group by file-set, merge overlapping line ranges
+    // Sort by number of files (more widespread clones first), then by earliest line
+    allCloneGroups.sort((a, b) => b.locations.length - a.locations.length || a.locations[0].startLine - b.locations[0].startLine);
+    const coveredRanges = new Map();
+    const filteredGroups = [];
+    for (const group of allCloneGroups) {
+        // Check if the first location is already substantially covered
+        const firstLoc = group.locations[0];
+        const covered = coveredRanges.get(firstLoc.file);
+        if (covered) {
+            let overlapCount = 0;
+            for (let line = firstLoc.startLine; line <= firstLoc.endLine; line++) {
+                if (covered.has(line))
+                    overlapCount++;
+            }
+            // Skip if >50% of lines already reported
+            if (overlapCount > group.lineCount * 0.5)
+                continue;
+        }
+        filteredGroups.push(group);
+        // Mark all locations as covered
+        for (const loc of group.locations) {
+            if (!coveredRanges.has(loc.file))
+                coveredRanges.set(loc.file, new Set());
+            const set = coveredRanges.get(loc.file);
+            for (let line = loc.startLine; line <= loc.endLine; line++) {
+                set.add(line);
+            }
+        }
+    }
+    // Report top clones
+    const topClones = filteredGroups.slice(0, 10);
+    for (const clone of topClones) {
+        const locs = clone.locations.slice(0, 3);
+        const locStr = locs.map(l => `${l.file}:${l.startLine}`).join(', ');
+        issues.push({
+            severity: clone.lineCount >= 15 ? 'warning' : 'info',
+            message: `duplicated ${clone.lineCount}-line block across ${clone.locations.length} files: ${locStr}`,
+            file: clone.locations[0].file,
+            line: clone.locations[0].startLine,
+            fixable: true,
+            fixHint: 'extract into a shared function or module',
+        });
+    }
+    const elapsed = Date.now() - t0;
+    // ── Scoring ───────────────────────────────────────────────────────────────
+    // Total duplicated lines as % of codebase
+    const totalSourceLines = sourceFiles.reduce((sum, f) => {
+        const content = readFile(join(cwd, f));
+        return sum + (content ? content.split('\n').length : 0);
+    }, 0);
+    // Count unique duplicated lines from covered ranges
+    let duplicatedLines = 0;
+    for (const lines of coveredRanges.values()) {
+        duplicatedLines += lines.size;
+    }
+    const duplicationRate = totalSourceLines > 0 ? duplicatedLines / totalSourceLines : 0;
+    const score = Math.max(25, Math.round(100 - duplicationRate * 400));
+    const parts = [];
+    parts.push(`${sourceFiles.length} files scanned in ${elapsed}ms`);
+    if (filteredGroups.length > 0) {
+        parts.push(c.yellow + `${filteredGroups.length} clone groups` + c.reset);
+        parts.push(`${duplicatedLines} duplicated lines (${(duplicationRate * 100).toFixed(1)}%)`);
+    }
+    else {
+        parts.push('no cross-file clones detected');
+    }
+    return { name: 'clones', score, maxScore: 100, summary: parts.join(', '), issues };
+}

package/dist/checks/hotspots.d.ts

@@ -0,0 +1,2 @@
+import type { CheckResult } from '../types.js';
+export declare function checkHotspots(cwd: string): Promise<CheckResult>;

package/dist/checks/hotspots.js

@@ -0,0 +1,228 @@
+import { execSync } from 'node:child_process';
+import { join } from 'node:path';
+import { walkFiles, readFile, c } from '../util.js';
+const SOURCE_EXTS = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs', '.py', '.go', '.rs', '.java']);
+function isSourceFile(f) {
+    const dot = f.lastIndexOf('.');
+    return dot !== -1 && SOURCE_EXTS.has(f.substring(dot));
+}
+function getGitChurn(cwd, months = 6) {
+    const churn = new Map();
+    try {
+        const since = `--since="${months} months ago"`;
+        // Get commit count + authors per file
+        const log = execSync(`git log ${since} --format="%H %ae" --name-only --no-merges 2>/dev/null`, { cwd, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024, timeout: 15_000 });
+        let currentAuthor = '';
+        const fileAuthors = new Map();
+        const fileCommits = new Map();
+        for (const line of log.split('\n')) {
+            if (!line.trim())
+                continue;
+            if (/^[0-9a-f]{40}\s/.test(line)) {
+                currentAuthor = line.split(' ').slice(1).join(' ');
+                continue;
+            }
+            const file = line.trim();
+            fileCommits.set(file, (fileCommits.get(file) || 0) + 1);
+            if (!fileAuthors.has(file))
+                fileAuthors.set(file, new Set());
+            fileAuthors.get(file).add(currentAuthor);
+        }
+        // Get lines changed per file
+        const numstat = execSync(`git log ${since} --numstat --format="" --no-merges 2>/dev/null`, { cwd, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024, timeout: 15_000 });
+        const fileLinesChanged = new Map();
+        for (const line of numstat.split('\n')) {
+            const match = line.match(/^(\d+)\s+(\d+)\s+(.+)$/);
+            if (!match)
+                continue;
+            const added = parseInt(match[1], 10);
+            const removed = parseInt(match[2], 10);
+            const file = match[3];
+            fileLinesChanged.set(file, (fileLinesChanged.get(file) || 0) + added + removed);
+        }
+        for (const [file, commits] of fileCommits) {
+            churn.set(file, {
+                file,
+                commits,
+                authors: fileAuthors.get(file)?.size || 1,
+                linesChanged: fileLinesChanged.get(file) || 0,
+            });
+        }
+    }
+    catch {
+        // Not a git repo or git not available
+    }
+    return churn;
+}
+function getTemporalCoupling(cwd, months = 6) {
+    const couplings = [];
+    try {
+        const since = `--since="${months} months ago"`;
+        const log = execSync(`git log ${since} --format="COMMIT" --name-only --no-merges 2>/dev/null`, { cwd, encoding: 'utf-8', maxBuffer: 10 * 1024 * 1024, timeout: 15_000 });
+        // Parse commits into file sets
+        const commits = [];
+        let current = [];
+        for (const line of log.split('\n')) {
+            if (line === 'COMMIT') {
+                if (current.length > 0)
+                    commits.push(current);
+                current = [];
+            }
+            else if (line.trim()) {
+                const f = line.trim();
+                if (isSourceFile(f))
+                    current.push(f);
+            }
+        }
+        if (current.length > 0)
+            commits.push(current);
+        // Count co-changes (files that appear in same commit)
+        const pairCount = new Map();
+        const fileCommitCount = new Map();
+        for (const files of commits) {
+            if (files.length > 20)
+                continue; // skip huge commits (refactors/renames)
+            for (const f of files) {
+                fileCommitCount.set(f, (fileCommitCount.get(f) || 0) + 1);
+            }
+            for (let i = 0; i < files.length; i++) {
+                for (let j = i + 1; j < files.length; j++) {
+                    const key = [files[i], files[j]].sort().join('::');
+                    pairCount.set(key, (pairCount.get(key) || 0) + 1);
+                }
+            }
+        }
+        // Find strong couplings
+        for (const [key, count] of pairCount) {
+            if (count < 3)
+                continue; // minimum 3 co-changes
+            const [f1, f2] = key.split('::');
+            const minCommits = Math.min(fileCommitCount.get(f1) || 1, fileCommitCount.get(f2) || 1);
+            const strength = count / minCommits;
+            if (strength > 0.5) { // >50% of the time they change together
+                couplings.push({ file1: f1, file2: f2, cochanges: count, couplingStrength: strength });
+            }
+        }
+        couplings.sort((a, b) => b.couplingStrength - a.couplingStrength);
+    }
+    catch {
+        // Not a git repo
+    }
+    return couplings;
+}
+// ── Complexity proxy: indentation depth ─────────────────────────────────────
+function getIndentationComplexity(content) {
+    const lines = content.split('\n');
+    let totalDepth = 0;
+    let maxDepth = 0;
+    let measured = 0;
+    for (const line of lines) {
+        if (!line.trim())
+            continue;
+        const match = line.match(/^(\s+)/);
+        if (match) {
+            const depth = match[1].includes('\t')
+                ? match[1].split('\t').length - 1
+                : Math.floor(match[1].length / 2);
+            totalDepth += depth;
+            if (depth > maxDepth)
+                maxDepth = depth;
+        }
+        measured++;
+    }
+    return measured > 0 ? totalDepth / measured : 0;
+}
+// ── Main check ───────────────────────────────────────────────────────────────
+export async function checkHotspots(cwd) {
+    const issues = [];
+    const t0 = Date.now();
+    const churn = getGitChurn(cwd);
+    if (churn.size === 0) {
+        return { name: 'hotspots', score: 100, maxScore: 100, summary: 'no git history', issues: [] };
+    }
+    const allFiles = walkFiles(cwd);
+    const sourceFiles = allFiles.filter(f => isSourceFile(f));
+    // Calculate complexity for each file (indentation-based, fast)
+    const fileComplexity = new Map();
+    for (const file of sourceFiles) {
+        const content = readFile(join(cwd, file));
+        if (!content)
+            continue;
+        fileComplexity.set(file, getIndentationComplexity(content));
+    }
+    const hotspots = [];
+    for (const [file, ch] of churn) {
+        const complexity = fileComplexity.get(file);
+        if (complexity === undefined)
+            continue;
+        // Normalize: risk = log(commits) × complexity
+        const risk = Math.log2(ch.commits + 1) * complexity;
+        hotspots.push({ file, commits: ch.commits, complexity, risk, authors: ch.authors });
+    }
+    hotspots.sort((a, b) => b.risk - a.risk);
+    // Top hotspots are issues
+    const topHotspots = hotspots.slice(0, 5);
+    for (const hs of topHotspots) {
+        if (hs.risk < 5)
+            continue; // skip low-risk files
+        issues.push({
+            severity: hs.risk > 20 ? 'warning' : 'info',
+            message: `hotspot: ${hs.file} — ${hs.commits} commits, complexity ${hs.complexity.toFixed(1)}, risk score ${hs.risk.toFixed(1)}${hs.authors > 3 ? `, ${hs.authors} authors` : ''}`,
+            file: hs.file,
+            fixable: false,
+            fixHint: 'high-churn complex files are bug magnets — prioritize refactoring and add tests',
+        });
+    }
+    // ── Temporal coupling ─────────────────────────────────────────────────────
+    const couplings = getTemporalCoupling(cwd);
+    // Filter out obvious couplings (same directory, test+source)
+    const interestingCouplings = couplings.filter(cp => {
+        const dir1 = cp.file1.split('/').slice(0, -1).join('/');
+        const dir2 = cp.file2.split('/').slice(0, -1).join('/');
+        // Same directory coupling is expected
+        if (dir1 === dir2)
+            return false;
+        // Test+source coupling is expected
+        if (cp.file1.includes('test') || cp.file2.includes('test'))
+            return false;
+        return true;
+    });
+    for (const cp of interestingCouplings.slice(0, 3)) {
+        issues.push({
+            severity: 'info',
+            message: `temporal coupling: ${cp.file1} ↔ ${cp.file2} change together ${Math.round(cp.couplingStrength * 100)}% of the time (${cp.cochanges} co-changes) — possible hidden dependency`,
+            file: cp.file1,
+            fixable: false,
+            fixHint: 'investigate if these files share a concept that should be co-located or abstracted',
+        });
+    }
+    // ── Multi-author hotfiles ─────────────────────────────────────────────────
+    const manyAuthors = hotspots.filter(h => h.authors >= 5).slice(0, 3);
+    for (const ma of manyAuthors) {
+        issues.push({
+            severity: 'info',
+            message: `knowledge diffusion: ${ma.file} touched by ${ma.authors} authors — high bus factor risk if not well-documented`,
+            file: ma.file,
+            fixable: false,
+            fixHint: 'ensure this file has clear documentation and tests — many people modify it',
+        });
+    }
+    const elapsed = Date.now() - t0;
+    // ── Scoring ───────────────────────────────────────────────────────────────
+    // Score based on how many high-risk hotspots exist relative to codebase size
+    const highRiskCount = hotspots.filter(h => h.risk > 20).length;
+    const riskRatio = sourceFiles.length > 0 ? highRiskCount / sourceFiles.length : 0;
+    const hotspotScore = Math.max(25, Math.round(100 - riskRatio * 500));
+    // Temporal coupling penalty
+    const couplingPenalty = Math.min(30, interestingCouplings.length * 5);
+    const score = Math.max(25, hotspotScore - couplingPenalty);
+    const parts = [];
+    parts.push(`${churn.size} files in git history, ${elapsed}ms`);
+    if (topHotspots.length > 0 && topHotspots[0].risk > 5) {
+        parts.push(c.yellow + `top hotspot: ${topHotspots[0].file.split('/').pop()} (risk ${topHotspots[0].risk.toFixed(0)})` + c.reset);
+    }
+    if (interestingCouplings.length > 0) {
+        parts.push(`${interestingCouplings.length} temporal couplings`);
+    }
+    return { name: 'hotspots', score, maxScore: 100, summary: parts.join(', '), issues };
+}

package/dist/cli.js

@@ -17,6 +17,8 @@ import { checkArchitecture } from './checks/architecture.js';
 import { checkAIReady } from './checks/aiready.js';
 import { checkDeep } from './checks/deep.js';
 import { checkSemantic } from './checks/semantic.js';
+import { checkHotspots } from './checks/hotspots.js';
+import { checkClones } from './checks/clones.js';
 import { checkReceipt, runReceiptCommand } from './checks/receipt.js';
 import { checkMemory } from './checks/memory.js';
 import { checkVerify } from './checks/verify.js';
@@ -325,7 +327,7 @@ async function runChecks() {
             }
         }
         // Run ALL independent checks in parallel
-        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult, guardResult, explainResult, architectureResult, aireadyResult, deepResult, semanticResult,] = await Promise.all([
+        const [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, integrityResult, readyResult, debtResult, depsResult, receiptResult, compactResult, subsidyResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, bloatResult, guardResult, explainResult, architectureResult, aireadyResult, deepResult, semanticResult, hotspotsResult, clonesResult,] = await Promise.all([
             withTimeout('scan', () => checkScan(cwd)),
             withTimeout('secrets', () => checkSecrets(cwd)),
             withTimeout('config', () => checkConfig(cwd, ignore)),
@@ -351,6 +353,8 @@ async function runChecks() {
             withTimeout('aiready', () => checkAIReady(cwd)),
             withTimeout('deep', () => checkDeep(cwd), 60_000),
             withTimeout('semantic', () => checkSemantic(cwd), 60_000),
+            withTimeout('hotspots', () => checkHotspots(cwd), 30_000),
+            withTimeout('clones', () => checkClones(cwd), 60_000),
         ]);
         // Git-dependent checks (diff + history) — parallel with each other
         const [diffResult, historyResult] = await Promise.all([
@@ -362,10 +366,11 @@ async function runChecks() {
         return score(cwd, {
             security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult, subsidyResult, guardResult],
             integrity: [diffResult, integrityResult, receiptResult, compactResult, memoryResult, verifyResult, testsResult, loopResult, completenessResult, explainResult],
-            debt: [readyResult, historyResult, debtResult, bloatResult],
+            debt: [readyResult, historyResult, debtResult, bloatResult, clonesResult],
             deps: [depsResult],
             architecture: [architectureResult],
             aiready: [aireadyResult, deepResult, semanticResult],
+            history: [hotspotsResult],
         });
     }
     catch (e) {

package/dist/scorer.d.ts

@@ -6,5 +6,6 @@ export interface CheckMap {
     deps: CheckResult[];
     architecture: CheckResult[];
     aiready: CheckResult[];
+    history: CheckResult[];
 }
 export declare function score(project: string, checkMap: CheckMap): VetResult;

package/dist/types.d.ts

@@ -14,7 +14,7 @@ export interface Issue {
     fixHint?: string;
 }
 export interface CategoryResult {
-    name: 'security' | 'integrity' | 'debt' | 'deps' | 'architecture' | 'aiready';
+    name: 'security' | 'integrity' | 'debt' | 'deps' | 'architecture' | 'aiready' | 'history';
     score: number;
     weight: number;
     checks: CheckResult[];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.19.0",
+  "version": "1.19.2",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {