@safetnsr/vet 1.26.0 → 1.27.0

package/dist/checks/triage.d.ts

@@ -0,0 +1,12 @@
+import type { CheckResult } from '../types.js';
+export type TriageRank = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'SKIP';
+export interface TriageEntry {
+    file: string;
+    rank: TriageRank;
+    reason: string;
+    signals: string[];
+    estimateMin: number;
+}
+export declare function analyzeTriage(cwd: string, since?: string): TriageEntry[];
+export declare function checkTriage(cwd: string, since?: string): CheckResult;
+export declare function runTriageCommand(format: string, cwd?: string, since?: string): Promise<void>;

package/dist/checks/triage.js

@@ -0,0 +1,261 @@
+import { extname } from 'node:path';
+import { gitExec, c } from '../util.js';
+// ── Constants ────────────────────────────────────────────────────────────────
+const SECURITY_PATH_RE = /auth|middleware|permission|secret|crypt|jwt|session|cors|password|login|token/i;
+const SECURITY_SKIP_EXTS = new Set(['.css', '.md', '.json', '.svg', '.png']);
+const SCHEMA_PATH_RE = /migration|schema|model|entity|prisma|knex|sequelize|drizzle/i;
+const ERROR_HANDLER_RE = /try\s*\{|\.catch\(|}\s*catch|catch\s*\(/;
+const TEST_PATH_RE = /test|spec|__tests__/;
+const COMMENT_LINE_RE = /^\s*(\/\/|\/\*|\*|#)/;
+const WHITESPACE_ONLY_RE = /^\s*$/;
+function parseStatLine(line) {
+    // Format: " src/foo.ts | 12 +++---"  or  " src/foo.ts | Bin 0 -> 1234 bytes"
+    const match = line.match(/^\s*(.+?)\s*\|\s*(\d+)/);
+    if (!match)
+        return null;
+    const file = match[1].trim();
+    const total = parseInt(match[2], 10);
+    // Count + and - chars at end of line for approximation
+    const plusMinus = line.match(/\|\s*\d+\s*([+\-]+)\s*$/);
+    if (!plusMinus)
+        return { file, added: 0, removed: 0 };
+    const symbols = plusMinus[1];
+    const added = (symbols.match(/\+/g) || []).length;
+    const removed = (symbols.match(/-/g) || []).length;
+    // Scale up: the stat line shows proportional +/- not exact counts
+    // We'll use the full diff to get exact counts — this is just for file list
+    return { file, added, removed };
+}
+function parseDiff(diffOutput) {
+    const result = new Map();
+    if (!diffOutput.trim())
+        return result;
+    const fileDiffs = diffOutput.split(/^diff --git /m).filter(Boolean);
+    for (const fileDiff of fileDiffs) {
+        const lines = fileDiff.split('\n');
+        const headerMatch = lines[0]?.match(/a\/.+? b\/(.+)/);
+        if (!headerMatch)
+            continue;
+        const file = headerMatch[1].trim();
+        const removedLines = [];
+        const addedLines = [];
+        let inHunk = false;
+        for (const line of lines) {
+            if (line.startsWith('@@')) {
+                inHunk = true;
+                continue;
+            }
+            if (!inHunk)
+                continue;
+            if (line.startsWith('---') || line.startsWith('+++'))
+                continue;
+            if (line.startsWith('-')) {
+                removedLines.push(line.slice(1));
+            }
+            else if (line.startsWith('+')) {
+                addedLines.push(line.slice(1));
+            }
+        }
+        result.set(file, {
+            file,
+            added: addedLines.length,
+            removed: removedLines.length,
+            removedLines,
+            addedLines,
+            allChangedLines: [...removedLines, ...addedLines],
+        });
+    }
+    return result;
+}
+// ── Signal detection ─────────────────────────────────────────────────────────
+function isSecurityPath(file) {
+    const ext = extname(file).toLowerCase();
+    if (SECURITY_SKIP_EXTS.has(ext))
+        return false;
+    return SECURITY_PATH_RE.test(file);
+}
+function hasErrorHandlerRemoval(fileDiff) {
+    return fileDiff.removedLines.some(line => ERROR_HANDLER_RE.test(line));
+}
+function isSchemaPath(file) {
+    return SCHEMA_PATH_RE.test(file);
+}
+function isCosmetic(fileDiff) {
+    const totalChanged = fileDiff.added + fileDiff.removed;
+    if (totalChanged < 5)
+        return true;
+    // All changed lines are comments or whitespace
+    const allCommentOrWhitespace = fileDiff.allChangedLines.every(line => WHITESPACE_ONLY_RE.test(line) || COMMENT_LINE_RE.test(line));
+    return allCommentOrWhitespace;
+}
+function isLargeChange(fileDiff, testFilesChanged) {
+    return fileDiff.added >= 50 && !testFilesChanged;
+}
+// ── Ranking ──────────────────────────────────────────────────────────────────
+function rankFile(file, fileDiff, anyTestChanged) {
+    const sig1 = isSecurityPath(file);
+    const sig2 = hasErrorHandlerRemoval(fileDiff);
+    const sig3 = isSchemaPath(file);
+    const sig4 = isCosmetic(fileDiff);
+    const sig5 = isLargeChange(fileDiff, anyTestChanged);
+    const signals = [];
+    if (sig1)
+        signals.push('security path');
+    if (sig2)
+        signals.push('error handler removed');
+    if (sig3)
+        signals.push('schema/db path');
+    if (sig5)
+        signals.push(`${fileDiff.added} lines added, no tests changed`);
+    // CRITICAL: sig1 AND (sig2 OR sig3)
+    if (sig1 && (sig2 || sig3)) {
+        const reasonParts = ['security path'];
+        if (sig2)
+            reasonParts.push('error handler removed');
+        if (sig3)
+            reasonParts.push('schema change');
+        return { file, rank: 'CRITICAL', reason: reasonParts.join(' + '), signals, estimateMin: 5 };
+    }
+    // HIGH: sig1 OR sig2 OR sig3
+    if (sig1)
+        return { file, rank: 'HIGH', reason: 'security-relevant path', signals, estimateMin: 2 };
+    if (sig2)
+        return { file, rank: 'HIGH', reason: 'error handler removed', signals, estimateMin: 2 };
+    if (sig3)
+        return { file, rank: 'HIGH', reason: 'schema/db path', signals, estimateMin: 2 };
+    // MEDIUM: sig5
+    if (sig5) {
+        return {
+            file,
+            rank: 'MEDIUM',
+            reason: `${fileDiff.added} lines added, no tests changed`,
+            signals,
+            estimateMin: 1,
+        };
+    }
+    // SKIP: sig4 or no signals
+    const skipReason = sig4 ? 'cosmetic' : 'no signals';
+    return { file, rank: 'SKIP', reason: skipReason, signals: [], estimateMin: 0 };
+}
+// ── Core logic ───────────────────────────────────────────────────────────────
+export function analyzeTriage(cwd, since = 'HEAD~1') {
+    const statOutput = gitExec(['diff', '--stat', since], cwd);
+    const diffOutput = gitExec(['diff', since], cwd);
+    if (!statOutput && !diffOutput)
+        return [];
+    // Parse full diff for per-file line data
+    const fileDiffs = parseDiff(diffOutput);
+    // Get file list from stat (in case diff missed any)
+    const statFiles = [];
+    for (const line of statOutput.split('\n')) {
+        const parsed = parseStatLine(line);
+        if (parsed)
+            statFiles.push(parsed.file);
+    }
+    // Union of files from stat and diff
+    const allFiles = new Set([...statFiles, ...fileDiffs.keys()]);
+    if (allFiles.size === 0)
+        return [];
+    // Determine if any test file changed
+    const anyTestChanged = [...allFiles].some(f => TEST_PATH_RE.test(f));
+    const entries = [];
+    for (const file of allFiles) {
+        const fd = fileDiffs.get(file) ?? {
+            file,
+            added: 0,
+            removed: 0,
+            removedLines: [],
+            addedLines: [],
+            allChangedLines: [],
+        };
+        entries.push(rankFile(file, fd, anyTestChanged));
+    }
+    // Sort: CRITICAL first, then HIGH, MEDIUM, SKIP
+    const rankOrder = { CRITICAL: 0, HIGH: 1, MEDIUM: 2, SKIP: 3 };
+    entries.sort((a, b) => rankOrder[a.rank] - rankOrder[b.rank]);
+    return entries;
+}
+// ── CheckResult integration ──────────────────────────────────────────────────
+export function checkTriage(cwd, since) {
+    const entries = analyzeTriage(cwd, since ?? 'HEAD~1');
+    const issues = [];
+    for (const entry of entries) {
+        if (entry.rank === 'SKIP')
+            continue;
+        const severity = entry.rank === 'CRITICAL' ? 'error' : entry.rank === 'HIGH' ? 'warning' : 'info';
+        issues.push({
+            severity,
+            message: `[${entry.rank}] ${entry.file} — ${entry.reason}`,
+            file: entry.file,
+            fixable: false,
+            fixHint: `review ${entry.file} (~${entry.estimateMin} min)`,
+        });
+    }
+    const critical = entries.filter(e => e.rank === 'CRITICAL').length;
+    const high = entries.filter(e => e.rank === 'HIGH').length;
+    const medium = entries.filter(e => e.rank === 'MEDIUM').length;
+    const skip = entries.filter(e => e.rank === 'SKIP').length;
+    const totalMin = entries.reduce((sum, e) => sum + e.estimateMin, 0);
+    const score = critical > 0 ? Math.max(0, 100 - critical * 25 - high * 10 - medium * 5)
+        : high > 0 ? Math.max(0, 100 - high * 10 - medium * 5)
+            : Math.max(0, 100 - medium * 5);
+    const summary = entries.length === 0
+        ? 'no diff to analyze'
+        : `${entries.length} files changed — ${critical} critical, ${high} high, ${medium} medium, ${skip} skip (~${totalMin} min)`;
+    return { name: 'triage', score, maxScore: 100, issues, summary };
+}
+// ── Subcommand output ────────────────────────────────────────────────────────
+export async function runTriageCommand(format, cwd, since) {
+    const dir = cwd || process.cwd();
+    const sinceRef = since ?? 'HEAD~1';
+    const entries = analyzeTriage(dir, sinceRef);
+    if (format === 'json') {
+        console.log(JSON.stringify(entries, null, 2));
+        return;
+    }
+    console.log(`\n  ${c.bold}vet triage${c.reset} — diff review urgency\n`);
+    if (entries.length === 0) {
+        console.log(`  ${c.dim}no diff to analyze${c.reset}\n`);
+        return;
+    }
+    const critical = entries.filter(e => e.rank === 'CRITICAL');
+    const high = entries.filter(e => e.rank === 'HIGH');
+    const medium = entries.filter(e => e.rank === 'MEDIUM');
+    const skip = entries.filter(e => e.rank === 'SKIP');
+    if (critical.length > 0) {
+        console.log(`  ${c.red}${c.bold}CRITICAL${c.reset}  ${c.dim}(est. 5 min each)${c.reset}`);
+        for (const e of critical) {
+            console.log(`  ${c.red}✗${c.reset} ${e.file}  ${c.dim}— ${e.reason}${c.reset}`);
+        }
+        console.log();
+    }
+    if (high.length > 0) {
+        console.log(`  ${c.yellow}${c.bold}HIGH${c.reset}  ${c.dim}(est. 2 min each)${c.reset}`);
+        for (const e of high) {
+            console.log(`  ${c.yellow}⚠${c.reset} ${e.file}  ${c.dim}— ${e.reason}${c.reset}`);
+        }
+        console.log();
+    }
+    if (medium.length > 0) {
+        console.log(`  ${c.green}${c.bold}MEDIUM${c.reset}  ${c.dim}(est. 1 min each)${c.reset}`);
+        for (const e of medium) {
+            console.log(`  ${c.green}○${c.reset} ${e.file}  ${c.dim}— ${e.reason}${c.reset}`);
+        }
+        console.log();
+    }
+    if (skip.length > 0) {
+        console.log(`  ${c.dim}SKIP  (${skip.length} file${skip.length !== 1 ? 's' : ''})${c.reset}`);
+        const shown = skip.slice(0, 3);
+        const rest = skip.length - shown.length;
+        for (const e of shown) {
+            console.log(`  ${c.dim}· ${e.file}  — ${e.reason}${c.reset}`);
+        }
+        if (rest > 0) {
+            console.log(`  ${c.dim}· ... and ${rest} more${c.reset}`);
+        }
+        console.log();
+    }
+    const reviewCount = critical.length + high.length + medium.length;
+    const totalMin = entries.reduce((sum, e) => sum + e.estimateMin, 0);
+    console.log(`  ${c.dim}summary: ${entries.length} files changed. review ${reviewCount} files (~${totalMin} min). skip ${skip.length}.${c.reset}\n`);
+}

package/dist/cli.js

@@ -34,6 +34,7 @@ import { checkSandbox, runSandboxCommand } from './checks/sandbox.js';
 import { checkExplain, runExplainCommand } from './checks/explain.js';
 import { checkContext, runContextCommand } from './checks/context.js';
 import { checkSplit, runSplitCommand } from './checks/split.js';
+import { runTriageCommand } from './checks/triage.js';
 import { checkSourceSecurity } from './checks/source-security.js';
 import { checkCompleteness } from './checks/completeness.js';
 import { score } from './scorer.js';
@@ -94,6 +95,7 @@ if (flags.has('--help') || flags.has('-h')) {
     npx @safetnsr/vet context [dir]    audit agent context files for token cost + stale sections
     npx @safetnsr/vet split [--since HEAD~1] [--apply] [--force] [--json]  split AI mega-commits into atomic commits
     npx @safetnsr/vet sandbox [dir]     score agent runtime blast radius
+    npx @safetnsr/vet triage [--since HEAD~1] [--json]  rank diff files by review urgency
 
   ${c.dim}categories:${c.reset}
     security   (30%)  scan, secrets, config, model usage
@@ -130,7 +132,7 @@ if (flags.has('--version') || flags.has('-v')) {
     }
     process.exit(0);
 }
-const COMMANDS = ['init', 'receipt', 'map', 'permissions', 'compact', 'subsidy', 'loop', 'bloat', 'guard', 'explain', 'context', 'split', 'sandbox'];
+const COMMANDS = ['init', 'receipt', 'map', 'permissions', 'compact', 'subsidy', 'loop', 'bloat', 'guard', 'explain', 'context', 'split', 'sandbox', 'triage'];
 const command = COMMANDS.includes(positional[0]) ? positional[0] : undefined;
 const cwd = resolve(positional.find(p => !COMMANDS.includes(p)) || '.');
 const isCI = flags.has('--ci');
@@ -318,6 +320,17 @@ if (command === 'sandbox') {
     }
     process.exit(0);
 }
+if (command === 'triage') {
+    try {
+        const format = isJSON ? 'json' : 'ascii';
+        await runTriageCommand(format, cwd, since);
+    }
+    catch (e) {
+        console.error(`${c.red}triage failed:${c.reset}`, e instanceof Error ? e.message : e);
+        process.exit(1);
+    }
+    process.exit(0);
+}
 if (!isGitRepo(cwd)) {
     console.error(`${c.red}not a git repository${c.reset}. vet operates on git repos.`);
     process.exit(1);
@@ -358,6 +371,14 @@ async function withTimeout(name, fn, timeoutMs = 30_000) {
 /** Get files changed vs main/master branch or --since ref */
 function getChangedFiles(cwd, sinceRef) {
     const base = sinceRef || (() => {
+        // In GitHub Actions PR context, use GITHUB_BASE_REF
+        const ghBase = process.env.GITHUB_BASE_REF;
+        if (ghBase) {
+            const ref = gitExec(['merge-base', 'HEAD', `origin/${ghBase}`], cwd);
+            if (ref)
+                return ref;
+        }
+        // Fallback: try merge-base with main/master
         const main = gitExec(['merge-base', 'HEAD', 'origin/main'], cwd);
         if (main)
             return main;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.26.0",
+  "version": "1.27.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {