@safetnsr/vet 1.5.0 → 1.6.1

package/README.md

@@ -2,6 +2,8 @@
 
 your AI coding agent doesn't know what it broke. you need a second opinion.
 
+![vet demo](demo.gif)
+
 ```bash
 npx @safetnsr/vet
 ```

package/dist/checks/deps.js

@@ -83,11 +83,14 @@ export function extractPackageName(specifier) {
     // Skip node: builtins
     if (specifier.startsWith('node:'))
         return null;
+    // Path aliases: @/ is always a path alias (no npm package starts with @/)
+    if (specifier.startsWith('@/'))
+        return null;
     // Scoped packages: @scope/name or @scope/name/sub
     if (specifier.startsWith('@')) {
         const parts = specifier.split('/');
         if (parts.length < 2)
-            return null;
+            return null; // bare @scope with no / is not a valid package
         return `${parts[0]}/${parts[1]}`;
     }
     // Regular package: name or name/sub
@@ -184,15 +187,25 @@ export async function checkDeps(cwd) {
     }
     // ── 2. Typosquat detection ─────────────────────────────────────────────────
     const topSet = new Set(TOP_PACKAGES);
+    // Known-legitimate short packages that happen to be close to popular ones
+    const TYPOSQUAT_WHITELIST = new Set([
+        'ai', 'clsx', 'ws', 'os', 'ms', 'pg', 'ip', 'bn', 'qs', 'co', 'is',
+    ]);
     for (const pkg of declaredNames) {
         if (topSet.has(pkg))
             continue; // it IS the popular package
+        if (pkg.length <= 3)
+            continue; // too short, too many false matches
+        if (TYPOSQUAT_WHITELIST.has(pkg))
+            continue;
         for (const top of TOP_PACKAGES) {
             const dist = levenshtein(pkg, top);
             if (dist >= 1 && dist <= 2) {
+                // If the package exists on the registry, it's likely legitimate — downgrade to info
+                const existsOnRegistry = registryResults.get(pkg) === true;
                 issues.push({
-                    severity: 'error',
-                    message: `possible typosquat: "${pkg}" is ${dist} edit${dist > 1 ? 's' : ''} from "${top}"`,
+                    severity: existsOnRegistry ? 'info' : 'error',
+                    message: `possible typosquat: "${pkg}" is ${dist} edit${dist > 1 ? 's' : ''} from "${top}"${existsOnRegistry ? ' (exists on npm)' : ''}`,
                     file: 'package.json',
                     fixable: true,
                     fixHint: `did you mean "${top}"?`,

package/dist/checks/verify.js

@@ -83,10 +83,26 @@ function getRecentMessages(cwd, since) {
     }
     return raw.split('\n').map(l => l.replace(/^[a-f0-9]+\s+/, '').trim()).filter(l => l.length > 0);
 }
+// ── Python project detection ─────────────────────────────────────────────────
+function isPythonProject(cwd) {
+    const markers = ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt'];
+    return markers.some(m => existsSync(join(cwd, m)));
+}
+function isPythonBoilerplate(filePath) {
+    const base = basename(filePath);
+    if (base === '__init__.py')
+        return true;
+    if (filePath.endsWith('.pyi'))
+        return true;
+    if (filePath.replace(/\\/g, '/').includes('__pycache__/'))
+        return true;
+    return false;
+}
 // ── Main check ───────────────────────────────────────────────────────────────
 export function checkVerify(cwd, since) {
     const issues = [];
     let deductions = 0;
+    const python = isPythonProject(cwd);
     // Check if git repo
     const isGit = safeExec('git rev-parse --is-inside-work-tree', cwd).trim();
     if (isGit !== 'true') {
@@ -165,6 +181,11 @@ export function checkVerify(cwd, since) {
         }
         const lineCount = countLines(content);
         // 2. File must have meaningful content (>10 non-empty lines)
+        // Skip thin file check for Python boilerplate files
+        if (python && isPythonBoilerplate(relPath)) {
+            verified++;
+            continue;
+        }
         if (lineCount < 10 && lineCount > 0) {
             issues.push({
                 severity: 'warning',
@@ -207,13 +228,15 @@ export function checkVerify(cwd, since) {
         verified++;
     }
     const finalScore = Math.max(0, 100 - deductions);
+    const baseSummary = failed === 0
+        ? `${verified} agent claim${verified !== 1 ? 's' : ''} verified clean`
+        : `${failed} claim${failed !== 1 ? 's' : ''} failed verification (${verified} passed)`;
+    const summary = python ? `${baseSummary} (python project detected — some checks have reduced scope)` : baseSummary;
     return {
         name: 'verify',
         score: finalScore,
         maxScore: 100,
         issues,
-        summary: failed === 0
-            ? `${verified} agent claim${verified !== 1 ? 's' : ''} verified clean`
-            : `${failed} claim${failed !== 1 ? 's' : ''} failed verification (${verified} passed)`,
+        summary,
     };
 }

package/dist/detect-language.d.ts

@@ -0,0 +1,6 @@
+export type ProjectLanguage = 'javascript' | 'typescript' | 'python' | 'unknown';
+/**
+ * Detect the primary language of a project by checking for marker files.
+ * Priority: typescript > javascript > python > unknown
+ */
+export declare function detectProjectLanguage(cwd: string): ProjectLanguage;

package/dist/detect-language.js

@@ -0,0 +1,24 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Detect the primary language of a project by checking for marker files.
+ * Priority: typescript > javascript > python > unknown
+ */
+export function detectProjectLanguage(cwd) {
+    // TypeScript markers
+    if (existsSync(join(cwd, 'tsconfig.json')))
+        return 'typescript';
+    // JavaScript/TypeScript (package.json present)
+    if (existsSync(join(cwd, 'package.json'))) {
+        // Check if any tsconfig variant exists
+        const tsConfigs = ['tsconfig.build.json', 'tsconfig.app.json', 'tsconfig.node.json'];
+        if (tsConfigs.some(f => existsSync(join(cwd, f))))
+            return 'typescript';
+        return 'javascript';
+    }
+    // Python markers
+    const pythonMarkers = ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt'];
+    if (pythonMarkers.some(f => existsSync(join(cwd, f))))
+        return 'python';
+    return 'unknown';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.5.0",
+  "version": "1.6.1",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {