@safetnsr/vet 1.4.0 → 1.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +92 -89
  2. package/dist/cli.js +0 -0
  3. package/package.json +1 -1
package/README.md CHANGED
@@ -1,26 +1,63 @@
1
1
  # vet
2
2
 
3
- vet your AI-generated code. one command, nine checks, zero config.
3
+ your AI coding agent doesn't know what it broke. you need a second opinion.
4
4
 
5
5
  ```bash
6
6
  npx @safetnsr/vet
7
7
  ```
8
8
 
9
+ vet checks your codebase **before** and **after** AI coding sessions. before: is your repo set up so the agent does good work? after: did it leave behind anti-patterns, stale tests, leaked secrets, or technical debt?
10
+
9
11
  works with Claude Code, Cursor, Copilot, Codex, Aider, Windsurf, Cline — anything that writes code in a git repo.
10
12
 
11
- ## what it checks
13
+ ## two flows, one command
14
+
15
+ `npx @safetnsr/vet` runs everything. but the checks split into two categories:
16
+
17
+ ### before the session — is your codebase ready?
18
+
19
+ | check | what it does |
20
+ |-------|-------------|
21
+ | **ready** | scores your codebase structure: docs, types, tests, AI-friendliness |
22
+ | **config** | deep analysis of CLAUDE.md, .cursorrules, copilot-instructions — completeness, consistency, specificity |
23
+ | **scan** | detects prompt injection, shell injection, exfiltration in agent config files |
24
+ | **permissions** | flags MCP servers with dangerous filesystem access (writes to ~/.ssh, /etc, outside cwd) |
25
+ | **models** | finds deprecated/sunset model strings across OpenAI, Anthropic, Google, Cohere |
26
+ | **map** | verifies your codebase has navigable structure for agents |
27
+ | **memory** | catches stale facts, contradictions, and drift in CLAUDE.md, AGENTS.md, memory/ files |
28
+
29
+ a codebase that scores well here gives AI agents better context, fewer hallucinations, and less cleanup.
30
+
31
+ ### after the session — did the AI leave problems?
32
+
33
+ | check | what it does |
34
+ |-------|-------------|
35
+ | **diff** | AI-specific anti-patterns: wholesale rewrites, orphaned imports, catch-all error handling, over-commenting |
36
+ | **tests** | test theater: tautological assertions, empty test bodies, tests that prove nothing |
37
+ | **debt** | near-duplicate functions, orphaned exports, wrapper pass-throughs, naming drift |
38
+ | **secrets** | scans dist/, build/, .next/ + .env files for leaked API keys using pattern + entropy analysis |
39
+ | **history** | git commit churn, AI attribution ratios, suspiciously large changes |
40
+ | **receipt** | parses Claude Code session logs — files changed, commands run, packages installed, SHA256 integrity hash |
41
+
42
+ plus: **integrity** (hallucinated imports), **deps** (unused/phantom dependencies), **owasp** (OWASP Top 10 for AI agents), **verify** (validates agent claims against actual changes).
43
+
44
+ ## output
45
+
46
+ ```
47
+ my-project B 75/100
48
+
49
+ security ████████░░ 82 scan ✓ secrets ✓ config 3/10 owasp ✓
50
+ integrity ███████░░░ 68 diff: 3 issues integrity ✓ memory: 1 stale
51
+ debt ██████░░░░ 58 ready 4/10 history ✓ debt: 2 duplicates
52
+ deps ██████████ 98 all clean
53
+
54
+ ✗ no README — AI agents have no project context
55
+ ✗ [ai] wholesale rewrite: 40 lines removed, 45 added in utils.ts
56
+ ! config: "strict TS" but tsconfig.strict is false
57
+ ! memory: CLAUDE.md references vitest but package.json uses jest
12
58
 
13
- | check | what | how |
14
- |-------|------|-----|
15
- | **ready** | is your codebase AI-friendly? | scans structure, docs, types, tests |
16
- | **diff** | did the AI leave anti-patterns? | AI-specific patterns: wholesale rewrites, orphaned imports, catch-alls, over-commenting, plus secrets & stubs |
17
- | **models** | using deprecated AI models? | scans code for sunset model strings across OpenAI, Anthropic, Google, Cohere |
18
- | **config** | agent configs in place? | deep analysis of CLAUDE.md, .cursorrules, copilot-instructions — checks completeness, consistency, and specificity against your actual codebase |
19
- | **history** | git patterns healthy? | analyzes commit churn, AI attribution, large changes |
20
- | **scan** | malicious patterns in agent configs? | scans .claude/, .cursorrules, CLAUDE.md, .mcp/ for prompt injection, shell injection, exfiltration endpoints |
21
- | **secrets** | leaked secrets in build output? | scans dist/, build/, .next/ + .env files for API keys, tokens, connection strings using pattern + entropy analysis |
22
- | **receipt** | what did the last agent session do? | parses ~/.claude/projects/ JSONL session logs — files changed, commands run, packages installed, SHA256 integrity hash |
23
- | **debt** | AI-generated technical debt (duplicates, orphans, wrappers) | detects near-duplicate functions, orphaned exports, wrapper pass-throughs, naming drift |
59
+ run --fix to auto-repair 4 issues
60
+ ```
24
61
 
25
62
  ## usage
26
63
 
@@ -28,19 +65,19 @@ works with Claude Code, Cursor, Copilot, Codex, Aider, Windsurf, Cline — anyth
28
65
  # run all checks
29
66
  npx @safetnsr/vet
30
67
 
31
- # check a specific directory
68
+ # specific directory
32
69
  npx @safetnsr/vet ./my-project
33
70
 
34
71
  # auto-fix: generate CLAUDE.md, .cursorrules, fix deprecated models
35
72
  npx @safetnsr/vet --fix
36
73
 
37
- # check specific commit range
74
+ # specific commit range
38
75
  npx @safetnsr/vet --since HEAD~5
39
76
 
40
77
  # live monitoring during AI sessions
41
78
  npx @safetnsr/vet --watch
42
79
 
43
- # CI mode — exit code 1 if score below threshold
80
+ # CI mode — exit 1 if score below threshold
44
81
  npx @safetnsr/vet --ci
45
82
 
46
83
  # JSON output
@@ -49,78 +86,72 @@ npx @safetnsr/vet --json
49
86
  # generate configs + pre-commit hook
50
87
  npx @safetnsr/vet init
51
88
 
52
- # show last agent session receipt (ASCII or JSON)
89
+ # agent session receipt
53
90
  npx @safetnsr/vet receipt
54
91
  npx @safetnsr/vet receipt --json
55
92
  ```
56
93
 
57
- ## output
58
-
59
- ```
60
- my-project 7.5/10
61
-
62
- ready ████░░░░░░ 4 3 readiness issues
63
- diff ████████░░ 8 3 issues (2 AI-specific) in 5 files
64
- models ██████████ 10 all models current
65
- config ███░░░░░░░ 3 Cursor — needs work (3/10)
66
- history █████████░ 9 41 commits (~15% AI-attributed)
67
- scan ██████████ 10 no malicious patterns found
68
- secrets ██████████ 10 no leaked secrets
69
- receipt ██████████ 10 last session: 3 files, 2 commands
70
-
71
- ✗ no README — AI agents have no project context
72
- ✗ no tests — AI agents produce better code when tests exist
73
- ! [ai] wholesale rewrite: 40 lines removed, 45 added in utils.ts
74
- ! [ai] imported "lodash" but never used in new code
75
-
76
- run --fix to auto-repair 4 issues
77
- ```
78
-
79
94
  ## --fix
80
95
 
81
- `vet --fix` analyzes your codebase and generates project-specific configs:
96
+ analyzes your codebase and generates project-specific configs:
82
97
 
83
98
  ```bash
84
99
  $ npx @safetnsr/vet --fix
85
100
 
86
101
  vet --fix
87
102
 
88
- + CLAUDE.md (generated from codebase: Next.js + React, Vitest, Tailwind CSS, TypeScript)
103
+ + CLAUDE.md (generated: Next.js + React, Vitest, Tailwind CSS, TypeScript)
89
104
  + .cursorrules (generated)
90
105
  ✓ src/api.ts: "gpt-3.5-turbo" → "gpt-4o-mini"
91
106
 
92
107
  fixed 3 issues
93
108
  ```
94
109
 
95
- the generated CLAUDE.md includes your actual stack, directory structure, and framework-specific rules.
110
+ the generated CLAUDE.md includes your actual stack, directory structure, and framework-specific rules — not a template.
96
111
 
97
- ## AI-specific diff patterns
112
+ ## --watch
98
113
 
99
- | pattern | what it catches |
100
- |---------|----------------|
101
- | `[ai] wholesale rewrite` | AI rewrote an entire function when a small edit would suffice |
102
- | `[ai] orphaned imports` | AI added imports it never uses |
103
- | `[ai] catch-all handling` | `catch(e) { console.error(e) }` instead of specific error handling |
104
- | `[ai] comment density` | AI over-commented obvious code |
105
- | `[ai] empty test body` | AI stubbed a test without implementation |
106
- | `[ai] trivial assertion` | `expect(true).toBe(true)` — test proves nothing |
114
+ monitors your repo during an active AI session. re-runs checks on every file change:
107
115
 
108
- ## config analysis
116
+ ```bash
117
+ npx @safetnsr/vet --watch
118
+ ```
109
119
 
110
- the config check does deep analysis — not just "does CLAUDE.md exist":
120
+ catch problems as the agent creates them, not after it's done.
111
121
 
112
- ```
113
- config score breakdown:
114
- completeness: 4/10 — mentions typescript but not react, vitest
115
- consistency: 7/10 — "strict TS" but tsconfig.strict is false
116
- specificity: 3/10 — generic rules, nothing project-specific
122
+ ## CI/CD
123
+
124
+ ```yaml
125
+ # .github/workflows/vet.yml
126
+ name: vet
127
+ on: [pull_request]
128
+ jobs:
129
+ vet:
130
+ runs-on: ubuntu-latest
131
+ steps:
132
+ - uses: actions/checkout@v4
133
+ with:
134
+ fetch-depth: 50
135
+ - run: npx @safetnsr/vet --ci
117
136
  ```
118
137
 
119
- ## subcommands
138
+ GitHub Action: [`safetnsr/vet-action`](https://github.com/safetnsr/vet-action) (coming soon)
120
139
 
121
- ### `vet receipt`
140
+ ## config
122
141
 
123
- Shows a receipt for the last Claude Code agent session — what files it touched, what commands it ran, what packages it installed, plus a SHA256 integrity hash:
142
+ optional `.vetrc` in your project root:
143
+
144
+ ```json
145
+ {
146
+ "checks": ["ready", "diff", "models", "config", "scan", "secrets"],
147
+ "ignore": ["vendor/", "generated/"],
148
+ "thresholds": { "min": 60 }
149
+ }
150
+ ```
151
+
152
+ ## receipt
153
+
154
+ shows what the last Claude Code session actually did — files touched, commands run, packages installed, with a SHA256 integrity hash:
124
155
 
125
156
  ```
126
157
  ╔══════════════════════════════════════════════╗
@@ -139,34 +170,6 @@ Shows a receipt for the last Claude Code agent session — what files it touched
139
170
  ╚══════════════════════════════════════════════╝
140
171
  ```
141
172
 
142
- ## config
143
-
144
- create `.vetrc` in your project root (optional):
145
-
146
- ```json
147
- {
148
- "checks": ["ready", "diff", "models", "config", "history", "scan", "secrets", "receipt"],
149
- "ignore": ["vendor/", "generated/"],
150
- "thresholds": { "min": 6 }
151
- }
152
- ```
153
-
154
- ## ci
155
-
156
- ```yaml
157
- # .github/workflows/vet.yml
158
- name: vet
159
- on: [pull_request]
160
- jobs:
161
- vet:
162
- runs-on: ubuntu-latest
163
- steps:
164
- - uses: actions/checkout@v4
165
- with:
166
- fetch-depth: 50
167
- - run: npx @safetnsr/vet --ci
168
- ```
169
-
170
173
  ## zero dependencies
171
174
 
172
175
  vet uses only Node.js built-ins. no runtime dependencies. works with Node 18+.
package/dist/cli.js CHANGED
File without changes
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@safetnsr/vet",
3
- "version": "1.4.0",
3
+ "version": "1.5.0",
4
4
  "description": "vet your AI-generated code — one command, one score card, one letter grade",
5
5
  "type": "module",
6
6
  "bin": {