@safetnsr/vet 1.6.0 → 1.7.0

package/dist/categories.d.ts

@@ -1,5 +1,7 @@
 import type { CheckResult, CategoryResult, VetResult } from './types.js';
 export declare function toGrade(score: number): string;
+/** Apply a floor of 20 to non-security checks that have no security-related errors */
+export declare function applyScoreFloor(check: CheckResult): number;
 export declare function buildCategories(checkMap: {
     security: CheckResult[];
     integrity: CheckResult[];

package/dist/categories.js

@@ -21,11 +21,20 @@ const WEIGHTS = {
     debt: 0.25,
     deps: 0.15,
 };
+// ── Scoring floor for non-security checks ────────────────────────────────────
+const SECURITY_CHECKS = new Set(['scan', 'secrets', 'permissions', 'owasp']);
+/** Apply a floor of 20 to non-security checks that have no security-related errors */
+export function applyScoreFloor(check) {
+    if (SECURITY_CHECKS.has(check.name))
+        return check.score;
+    // Non-security check: minimum score is 20
+    return Math.max(20, check.score);
+}
 // ── Average scores within a category ────────────────────────────────────────
 function averageScore(checks) {
     if (checks.length === 0)
         return 100;
-    const total = checks.reduce((sum, c) => sum + c.score, 0);
+    const total = checks.reduce((sum, c) => sum + applyScoreFloor(c), 0);
     return Math.round(total / checks.length);
 }
 // ── Group checks into categories ─────────────────────────────────────────────

package/dist/checks/deps.js

@@ -83,11 +83,14 @@ export function extractPackageName(specifier) {
     // Skip node: builtins
     if (specifier.startsWith('node:'))
         return null;
+    // Path aliases: @/ is always a path alias (no npm package starts with @/)
+    if (specifier.startsWith('@/'))
+        return null;
     // Scoped packages: @scope/name or @scope/name/sub
     if (specifier.startsWith('@')) {
         const parts = specifier.split('/');
         if (parts.length < 2)
-            return null;
+            return null; // bare @scope with no / is not a valid package
         return `${parts[0]}/${parts[1]}`;
     }
     // Regular package: name or name/sub
@@ -184,15 +187,25 @@ export async function checkDeps(cwd) {
     }
     // ── 2. Typosquat detection ─────────────────────────────────────────────────
     const topSet = new Set(TOP_PACKAGES);
+    // Known-legitimate short packages that happen to be close to popular ones
+    const TYPOSQUAT_WHITELIST = new Set([
+        'ai', 'clsx', 'ws', 'os', 'ms', 'pg', 'ip', 'bn', 'qs', 'co', 'is',
+    ]);
     for (const pkg of declaredNames) {
         if (topSet.has(pkg))
             continue; // it IS the popular package
+        if (pkg.length <= 3)
+            continue; // too short, too many false matches
+        if (TYPOSQUAT_WHITELIST.has(pkg))
+            continue;
         for (const top of TOP_PACKAGES) {
             const dist = levenshtein(pkg, top);
             if (dist >= 1 && dist <= 2) {
+                // If the package exists on the registry, it's likely legitimate — downgrade to info
+                const existsOnRegistry = registryResults.get(pkg) === true;
                 issues.push({
-                    severity: 'error',
-                    message: `possible typosquat: "${pkg}" is ${dist} edit${dist > 1 ? 's' : ''} from "${top}"`,
+                    severity: existsOnRegistry ? 'info' : 'error',
+                    message: `possible typosquat: "${pkg}" is ${dist} edit${dist > 1 ? 's' : ''} from "${top}"${existsOnRegistry ? ' (exists on npm)' : ''}`,
                     file: 'package.json',
                     fixable: true,
                     fixHint: `did you mean "${top}"?`,

package/dist/checks/models.js

@@ -1,5 +1,50 @@
-import { join } from 'node:path';
+import { join, basename } from 'node:path';
 import { readFile, walkFiles } from '../util.js';
+// ── AI framework detection ───────────────────────────────────────────────────
+const AI_NAME_KEYWORDS = ['ai', 'llm', 'model', 'openai', 'anthropic', 'langchain', 'provider'];
+const AI_PKG_KEYWORDS = new Set(['ai', 'llm', 'language-model', 'openai', 'anthropic']);
+function isAiFramework(cwd) {
+    // Check package.json
+    const pkgRaw = readFile(join(cwd, 'package.json'));
+    if (pkgRaw) {
+        try {
+            const pkg = JSON.parse(pkgRaw);
+            const name = (pkg.name || '').toLowerCase();
+            if (AI_NAME_KEYWORDS.some(k => name.includes(k)))
+                return true;
+            if (Array.isArray(pkg.keywords) && pkg.keywords.some((k) => AI_PKG_KEYWORDS.has(k.toLowerCase())))
+                return true;
+        }
+        catch { /* skip */ }
+    }
+    // Check pyproject.toml / setup.py for AI deps
+    const pyproject = readFile(join(cwd, 'pyproject.toml'));
+    if (pyproject) {
+        const aiDeps = ['openai', 'anthropic', 'langchain', 'transformers', 'torch', 'tensorflow'];
+        if (aiDeps.some(d => pyproject.includes(d)))
+            return true;
+    }
+    const setupPy = readFile(join(cwd, 'setup.py'));
+    if (setupPy) {
+        const aiDeps = ['openai', 'anthropic', 'langchain', 'transformers', 'torch', 'tensorflow'];
+        if (aiDeps.some(d => setupPy.includes(d)))
+            return true;
+    }
+    return false;
+}
+// ── Test/example/docs path detection ─────────────────────────────────────────
+const TEST_DOCS_PATTERNS = ['test/', 'tests/', '__tests__/', 'examples/', 'docs/'];
+function isTestOrDocsFile(filePath) {
+    const normalized = filePath.replace(/\\/g, '/');
+    if (TEST_DOCS_PATTERNS.some(p => normalized.includes(p) || normalized.startsWith(p)))
+        return true;
+    const base = basename(filePath);
+    if (/\.(test|spec)\./i.test(base))
+        return true;
+    if (base.endsWith('.md'))
+        return true;
+    return false;
+}
 // Try to use @safetnsr/model-graveyard if installed (248 models, alias matching, YAML registry)
 async function tryModelGraveyard(cwd) {
     try {
@@ -8,6 +53,7 @@ async function tryModelGraveyard(cwd) {
             return null;
         const report = await mod.scan(cwd);
         const issues = [];
+        const aiFramework = isAiFramework(cwd);
         // Files that define deprecated model registries should not be flagged
         const SELF_FILES = ['models.ts', 'models.js', 'model-graveyard', 'model-registry', 'sunset', 'fix/models'];
         for (const match of report.matches) {
@@ -17,8 +63,10 @@ async function tryModelGraveyard(cwd) {
             if (match.file && SELF_FILES.some(s => match.file.toLowerCase().includes(s)))
                 continue;
             if (match.model.status === 'deprecated' || match.model.status === 'eol') {
+                const inTestDocs = match.file && isTestOrDocsFile(match.file);
+                const severity = (aiFramework || inTestDocs) ? 'info' : 'error';
                 issues.push({
-                    severity: 'error',
+                    severity,
                     message: `${match.model.status} model "${match.raw}" in ${match.file}:${match.line}${match.model.successor ? ` — use "${match.model.successor}"` : ''}`,
                     file: match.file,
                     line: match.line,
@@ -27,15 +75,22 @@ async function tryModelGraveyard(cwd) {
                 });
             }
         }
-        const score = Math.max(0, 100 - issues.length * 20);
+        const errorCount = issues.filter(i => i.severity === 'error').length;
+        const score = aiFramework
+            ? Math.max(70, 100 - errorCount * 20)
+            : Math.max(0, 100 - errorCount * 20);
+        let summary = issues.length === 0
+            ? `${report.filesScanned} files scanned (via model-graveyard) — all current`
+            : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} (via model-graveyard)`;
+        if (aiFramework) {
+            summary += ' — AI framework detected — model references are expected';
+        }
         return {
             name: 'models',
             score: Math.min(100, score),
             maxScore: 100,
             issues,
-            summary: issues.length === 0
-                ? `${report.filesScanned} files scanned (via model-graveyard) — all current`
-                : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} (via model-graveyard)`,
+            summary,
         };
     }
     catch {
@@ -87,6 +142,7 @@ function builtinModels(cwd, ignore) {
     const issues = [];
     const files = walkFiles(cwd, ignore);
     const found = new Map();
+    const aiFramework = isAiFramework(cwd);
     for (const f of files) {
         if (!SCAN_EXTS.some(ext => f.endsWith(ext)))
             continue;
@@ -105,24 +161,42 @@ function builtinModels(cwd, ignore) {
             found.set(model, existing);
         }
     }
-    for (const [model, files] of found) {
+    for (const [model, modelFiles] of found) {
         const info = SUNSET_MODELS[model];
-        const fileList = files.length <= 2 ? files.join(', ') : `${files[0]} +${files.length - 1} more`;
+        const fileList = modelFiles.length <= 2 ? modelFiles.join(', ') : `${modelFiles[0]} +${modelFiles.length - 1} more`;
+        // Determine severity: downgrade for AI frameworks or test/docs files
+        const allInTestDocs = modelFiles.every(f => isTestOrDocsFile(f));
+        const severity = (aiFramework || allInTestDocs) ? 'info' : 'error';
         issues.push({
-            severity: 'error',
+            severity,
             message: `deprecated model "${model}" in ${fileList} — use "${info.replacement}"${info.sunset ? ` (sunset ${info.sunset})` : ''}`,
-            file: files[0],
+            file: modelFiles[0],
             fixable: true,
             fixHint: `replace "${model}" with "${info.replacement}"`,
         });
     }
-    const score = Math.max(0, 100 - issues.length * 20);
+    let score;
+    if (aiFramework) {
+        // AI framework: models exist for compatibility, score 70+ base
+        const errorCount = issues.filter(i => i.severity === 'error').length;
+        score = Math.max(70, 100 - errorCount * 20);
+    }
+    else {
+        const errorCount = issues.filter(i => i.severity === 'error').length;
+        score = Math.max(0, 100 - errorCount * 20);
+    }
+    let summary = issues.length === 0
+        ? 'all model references current'
+        : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} found`;
+    if (aiFramework) {
+        summary += ' — AI framework detected — model references are expected';
+    }
     return {
         name: 'models',
         score: Math.min(100, score),
         maxScore: 100,
         issues,
-        summary: issues.length === 0 ? 'all model references current' : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} found`,
+        summary,
     };
 }
 export async function checkModels(cwd, ignore) {

package/dist/checks/scan.js

@@ -85,9 +85,10 @@ const CONFIG_TARGETS = [
     '.claude', 'CLAUDE.md', 'AGENTS.md',
     '.cursorrules', '.cursor',
     '.github',
-    '.aider.conf.yml',
+    'copilot-instructions.md',
+    '.aider.conf.yml', '.aider',
     '.continue',
-    '.mcp',
+    '.mcp', 'mcp.json', '.mcp.json',
     '.roomodes', '.roo',
 ];
 // ── File helpers (delegated to util.ts) ──────────────────────────────────────

package/dist/checks/verify.js

@@ -1,4 +1,4 @@
-import { join, basename } from 'node:path';
+import { join, basename, extname } from 'node:path';
 import { readFileSync, existsSync, statSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 // ── Helpers ──────────────────────────────────────────────────────────────────
@@ -10,9 +10,48 @@ function safeExec(cmd, cwd) {
         return '';
     }
 }
+// ── Config/meta file exclusion for thin-file checks ──────────────────────────
+const CONFIG_DOTFILES = new Set([
+    '.gitignore', '.gitattributes', '.nvmrc', '.node-version', '.editorconfig',
+    '.prettierrc', '.eslintignore', '.npmrc', '.npmignore',
+]);
+const CONFIG_EXTENSIONS = new Set([
+    '.yml', '.yaml', '.json', '.toml', '.cfg', '.ini', '.lock', '.svg', '.xml',
+]);
+const CONFIG_DIRS = ['.github/', '.husky/', '.vscode/', '.idea/'];
+const META_FILES = new Set([
+    'FUNDING.yaml', 'CODEOWNERS', 'LICENSE',
+]);
+function isConfigOrMetaFile(filePath) {
+    const base = basename(filePath);
+    const ext = extname(filePath).toLowerCase();
+    const normalized = filePath.replace(/\\/g, '/');
+    // Dotfiles
+    if (CONFIG_DOTFILES.has(base))
+        return true;
+    // Config extensions
+    if (CONFIG_EXTENSIONS.has(ext))
+        return true;
+    // Config directories
+    if (CONFIG_DIRS.some(d => normalized.includes(d) || normalized.startsWith(d)))
+        return true;
+    // Meta files
+    if (META_FILES.has(base))
+        return true;
+    if (base.startsWith('CHANGELOG'))
+        return true;
+    return false;
+}
+// ── Code file extensions for test detection ──────────────────────────────────
+const CODE_EXTENSIONS = new Set(['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs']);
+const TEST_FILE_PATTERN = /\.(test|spec)\.(ts|js|tsx|jsx)$/i;
 function isTestFile(filePath) {
     const base = basename(filePath);
-    if (/\.(test|spec)\.[a-z]+$/i.test(base))
+    const ext = extname(filePath).toLowerCase();
+    // Only code files can be test files
+    if (!CODE_EXTENSIONS.has(ext))
+        return false;
+    if (TEST_FILE_PATTERN.test(base))
         return true;
     const normalized = filePath.replace(/\\/g, '/');
     // Match __tests__/ anywhere in path (including at root)
@@ -83,10 +122,26 @@ function getRecentMessages(cwd, since) {
     }
     return raw.split('\n').map(l => l.replace(/^[a-f0-9]+\s+/, '').trim()).filter(l => l.length > 0);
 }
+// ── Python project detection ─────────────────────────────────────────────────
+function isPythonProject(cwd) {
+    const markers = ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt'];
+    return markers.some(m => existsSync(join(cwd, m)));
+}
+function isPythonBoilerplate(filePath) {
+    const base = basename(filePath);
+    if (base === '__init__.py')
+        return true;
+    if (filePath.endsWith('.pyi'))
+        return true;
+    if (filePath.replace(/\\/g, '/').includes('__pycache__/'))
+        return true;
+    return false;
+}
 // ── Main check ───────────────────────────────────────────────────────────────
 export function checkVerify(cwd, since) {
     const issues = [];
     let deductions = 0;
+    const python = isPythonProject(cwd);
     // Check if git repo
     const isGit = safeExec('git rev-parse --is-inside-work-tree', cwd).trim();
     if (isGit !== 'true') {
@@ -165,6 +220,16 @@ export function checkVerify(cwd, since) {
         }
         const lineCount = countLines(content);
         // 2. File must have meaningful content (>10 non-empty lines)
+        // Skip thin file check for Python boilerplate files
+        if (python && isPythonBoilerplate(relPath)) {
+            verified++;
+            continue;
+        }
+        // Skip thin file check for config/meta files (they're supposed to be small)
+        if (isConfigOrMetaFile(relPath)) {
+            verified++;
+            continue;
+        }
         if (lineCount < 10 && lineCount > 0) {
             issues.push({
                 severity: 'warning',
@@ -207,13 +272,15 @@ export function checkVerify(cwd, since) {
         verified++;
     }
     const finalScore = Math.max(0, 100 - deductions);
+    const baseSummary = failed === 0
+        ? `${verified} agent claim${verified !== 1 ? 's' : ''} verified clean`
+        : `${failed} claim${failed !== 1 ? 's' : ''} failed verification (${verified} passed)`;
+    const summary = python ? `${baseSummary} (python project detected — some checks have reduced scope)` : baseSummary;
     return {
         name: 'verify',
         score: finalScore,
         maxScore: 100,
         issues,
-        summary: failed === 0
-            ? `${verified} agent claim${verified !== 1 ? 's' : ''} verified clean`
-            : `${failed} claim${failed !== 1 ? 's' : ''} failed verification (${verified} passed)`,
+        summary,
     };
 }

package/dist/detect-language.d.ts

@@ -0,0 +1,6 @@
+export type ProjectLanguage = 'javascript' | 'typescript' | 'python' | 'unknown';
+/**
+ * Detect the primary language of a project by checking for marker files.
+ * Priority: typescript > javascript > python > unknown
+ */
+export declare function detectProjectLanguage(cwd: string): ProjectLanguage;

package/dist/detect-language.js

@@ -0,0 +1,24 @@
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * Detect the primary language of a project by checking for marker files.
+ * Priority: typescript > javascript > python > unknown
+ */
+export function detectProjectLanguage(cwd) {
+    // TypeScript markers
+    if (existsSync(join(cwd, 'tsconfig.json')))
+        return 'typescript';
+    // JavaScript/TypeScript (package.json present)
+    if (existsSync(join(cwd, 'package.json'))) {
+        // Check if any tsconfig variant exists
+        const tsConfigs = ['tsconfig.build.json', 'tsconfig.app.json', 'tsconfig.node.json'];
+        if (tsConfigs.some(f => existsSync(join(cwd, f))))
+            return 'typescript';
+        return 'javascript';
+    }
+    // Python markers
+    const pythonMarkers = ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt'];
+    if (pythonMarkers.some(f => existsSync(join(cwd, f))))
+        return 'python';
+    return 'unknown';
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {