@safetnsr/vet 1.6.1 → 1.8.0

package/dist/categories.d.ts

@@ -1,5 +1,7 @@
 import type { CheckResult, CategoryResult, VetResult } from './types.js';
 export declare function toGrade(score: number): string;
+/** Apply a floor of 20 to non-security checks that have no security-related errors */
+export declare function applyScoreFloor(check: CheckResult): number;
 export declare function buildCategories(checkMap: {
     security: CheckResult[];
     integrity: CheckResult[];

package/dist/categories.js

@@ -21,11 +21,20 @@ const WEIGHTS = {
     debt: 0.25,
     deps: 0.15,
 };
+// ── Scoring floor for non-security checks ────────────────────────────────────
+const SECURITY_CHECKS = new Set(['scan', 'secrets', 'permissions', 'owasp']);
+/** Apply a floor of 20 to non-security checks that have no security-related errors */
+export function applyScoreFloor(check) {
+    if (SECURITY_CHECKS.has(check.name))
+        return check.score;
+    // Non-security check: minimum score is 20
+    return Math.max(20, check.score);
+}
 // ── Average scores within a category ────────────────────────────────────────
 function averageScore(checks) {
     if (checks.length === 0)
         return 100;
-    const total = checks.reduce((sum, c) => sum + c.score, 0);
+    const total = checks.reduce((sum, c) => sum + applyScoreFloor(c), 0);
     return Math.round(total / checks.length);
 }
 // ── Group checks into categories ─────────────────────────────────────────────

package/dist/checks/integrity.js

@@ -1,4 +1,4 @@
-import { join, resolve, dirname, extname } from 'node:path';
+import { join, resolve, dirname, extname, basename } from 'node:path';
 import { existsSync } from 'node:fs';
 import { walkFiles, readFile } from '../util.js';
 // ── Hallucinated imports ─────────────────────────────────────────────────────
@@ -277,6 +277,38 @@ function checkStubbedTests(cwd, files) {
     return issues;
 }
 // ── Unhandled async (removed error handling) ─────────────────────────────────
+/** Files that ARE error boundaries — they handle errors by design */
+function isErrorBoundaryFile(file) {
+    const normalized = file.replace(/\\/g, '/');
+    const base = basename(normalized);
+    // Next.js error boundaries
+    if (/^error\.[jt]sx?$/.test(base))
+        return true;
+    if (/^global-error\.[jt]sx?$/.test(base))
+        return true;
+    // Middleware files
+    if (/^middleware\.[jt]sx?$/.test(base))
+        return true;
+    // Error handler files
+    if (/error[-_]?handler/i.test(base))
+        return true;
+    if (/error[-_]?boundary/i.test(base))
+        return true;
+    return false;
+}
+/** Check if a file has a top-level error handler (global catch-all) */
+function hasGlobalErrorHandling(content) {
+    // process.on('unhandledRejection'/'uncaughtException')
+    if (/process\.on\s*\(\s*['"](?:unhandledRejection|uncaughtException)['"]/i.test(content))
+        return true;
+    // Express/Koa-style error middleware: (err, req, res, next) or app.use with 4 params
+    if (/(?:app|router)\.use\s*\(\s*(?:async\s*)?\(\s*\w+\s*,\s*\w+\s*,\s*\w+\s*,\s*\w+\s*\)/.test(content))
+        return true;
+    // window.addEventListener('error'/'unhandledrejection')
+    if (/addEventListener\s*\(\s*['"](?:error|unhandledrejection)['"]/i.test(content))
+        return true;
+    return false;
+}
 function checkUnhandledAsync(cwd, files) {
     const issues = [];
     const sourceExts = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
@@ -286,9 +318,15 @@ function checkUnhandledAsync(cwd, files) {
         // Skip test files — test runners handle errors at the framework level
         if (isTestFile(file))
             continue;
+        // Skip error boundary files — they ARE the error handlers
+        if (isErrorBoundaryFile(file))
+            continue;
         const content = readFile(join(cwd, file));
         if (!content)
             continue;
+        // Skip files with global error handling
+        if (hasGlobalErrorHandling(content))
+            continue;
         const lines = content.split('\n');
         let unhandledCount = 0;
         for (let i = 0; i < lines.length; i++) {
@@ -299,7 +337,7 @@ function checkUnhandledAsync(cwd, files) {
             if (!hasAwait)
                 continue;
             // Check context window — look for try { in surrounding lines
-            const contextStart = Math.max(0, i - 15);
+            const contextStart = Math.max(0, i - 20);
             const contextEnd = Math.min(lines.length - 1, i + 5);
             const contextLines = lines.slice(contextStart, contextEnd + 1);
             const contextText = contextLines.join('\n');
@@ -307,9 +345,11 @@ function checkUnhandledAsync(cwd, files) {
             const tryCount = (contextText.match(/\btry\s*\{/g) || []).length;
             const catchCount = (contextText.match(/\bcatch\s*(?:\([^)]*\))?\s*\{/g) || []).length;
             if (tryCount === 0 || catchCount === 0) {
-                // Also check for .catch() chained
+                // Check for .catch() chained on this or next line
                 const hasCatch = /\.catch\s*\(/.test(line) || (i + 1 < lines.length && /\.catch\s*\(/.test(lines[i + 1]));
-                if (!hasCatch) {
+                // Check for .then(..., errorHandler) pattern
+                const hasThenError = /\.then\s*\([^,]+,\s*\w+/.test(line) || (i + 1 < lines.length && /\.then\s*\([^,]+,\s*\w+/.test(lines[i + 1]));
+                if (!hasCatch && !hasThenError) {
                     unhandledCount++;
                     if (unhandledCount <= 10) {
                         issues.push({

package/dist/checks/models.js

@@ -1,5 +1,79 @@
-import { join } from 'node:path';
+import { join, basename } from 'node:path';
+import { readdirSync, existsSync } from 'node:fs';
 import { readFile, walkFiles } from '../util.js';
+// ── AI framework detection ───────────────────────────────────────────────────
+const AI_NAME_KEYWORDS = ['ai', 'llm', 'openai', 'anthropic', 'langchain', 'provider'];
+const AI_PKG_KEYWORDS = new Set(['ai', 'llm', 'language-model', 'openai', 'anthropic']);
+function isAiFramework(cwd) {
+    const aiDeps = ['openai', 'anthropic', 'langchain', 'transformers', 'torch', 'tensorflow', 'llama', 'huggingface'];
+    // Check package.json
+    const pkgRaw = readFile(join(cwd, 'package.json'));
+    if (pkgRaw) {
+        try {
+            const pkg = JSON.parse(pkgRaw);
+            const name = (pkg.name || '').toLowerCase();
+            if (AI_NAME_KEYWORDS.some(k => name.includes(k)))
+                return true;
+            if (Array.isArray(pkg.keywords) && pkg.keywords.some((k) => AI_PKG_KEYWORDS.has(k.toLowerCase())))
+                return true;
+        }
+        catch { /* skip */ }
+    }
+    // Check pyproject.toml / setup.py in root AND subdirectories
+    const pyprojectPaths = [join(cwd, 'pyproject.toml')];
+    try {
+        const entries = readdirSync(cwd);
+        for (const entry of entries) {
+            if (entry.startsWith('.') || entry === 'node_modules')
+                continue;
+            const subPyproject = join(cwd, entry, 'pyproject.toml');
+            if (existsSync(subPyproject))
+                pyprojectPaths.push(subPyproject);
+        }
+    }
+    catch { /* skip */ }
+    for (const pyprojectPath of pyprojectPaths) {
+        const pyproject = readFile(pyprojectPath);
+        if (pyproject && aiDeps.some(d => pyproject.includes(d)))
+            return true;
+    }
+    const setupPy = readFile(join(cwd, 'setup.py'));
+    if (setupPy && aiDeps.some(d => setupPy.includes(d)))
+        return true;
+    // Check directory name for AI keywords (use word-boundary-like matching with separators)
+    const dirName = basename(cwd).toLowerCase();
+    const dirParts = dirName.split(/[-_./\\]/);
+    const DIR_AI_KEYWORDS = ['ai', 'llm', 'openai', 'anthropic', 'langchain', 'pydantic-ai', 'autogen', 'crewai'];
+    if (DIR_AI_KEYWORDS.some(k => dirParts.includes(k) || dirName.includes(k)))
+        return true;
+    // Check CLAUDE.md or .claude/settings.json for AI/LLM terms
+    const claudeMd = readFile(join(cwd, 'CLAUDE.md'));
+    if (claudeMd) {
+        const aiTerms = /\b(llm|language model|ai agent|openai|anthropic|embedding|vector|rag|prompt|fine.?tun)/i;
+        if (aiTerms.test(claudeMd))
+            return true;
+    }
+    const claudeSettings = readFile(join(cwd, '.claude', 'settings.json'));
+    if (claudeSettings) {
+        const aiTerms = /\b(llm|language model|ai|openai|anthropic|model)/i;
+        if (aiTerms.test(claudeSettings))
+            return true;
+    }
+    return false;
+}
+// ── Test/example/docs path detection ─────────────────────────────────────────
+const TEST_DOCS_PATTERNS = ['test/', 'tests/', '__tests__/', 'examples/', 'docs/'];
+function isTestOrDocsFile(filePath) {
+    const normalized = filePath.replace(/\\/g, '/');
+    if (TEST_DOCS_PATTERNS.some(p => normalized.includes(p) || normalized.startsWith(p)))
+        return true;
+    const base = basename(filePath);
+    if (/\.(test|spec)\./i.test(base))
+        return true;
+    if (base.endsWith('.md'))
+        return true;
+    return false;
+}
 // Try to use @safetnsr/model-graveyard if installed (248 models, alias matching, YAML registry)
 async function tryModelGraveyard(cwd) {
     try {
@@ -8,6 +82,7 @@ async function tryModelGraveyard(cwd) {
             return null;
         const report = await mod.scan(cwd);
         const issues = [];
+        const aiFramework = isAiFramework(cwd);
         // Files that define deprecated model registries should not be flagged
         const SELF_FILES = ['models.ts', 'models.js', 'model-graveyard', 'model-registry', 'sunset', 'fix/models'];
         for (const match of report.matches) {
@@ -17,8 +92,10 @@ async function tryModelGraveyard(cwd) {
             if (match.file && SELF_FILES.some(s => match.file.toLowerCase().includes(s)))
                 continue;
             if (match.model.status === 'deprecated' || match.model.status === 'eol') {
+                const inTestDocs = match.file && isTestOrDocsFile(match.file);
+                const severity = (aiFramework || inTestDocs) ? 'info' : 'error';
                 issues.push({
-                    severity: 'error',
+                    severity,
                     message: `${match.model.status} model "${match.raw}" in ${match.file}:${match.line}${match.model.successor ? ` — use "${match.model.successor}"` : ''}`,
                     file: match.file,
                     line: match.line,
@@ -27,15 +104,22 @@ async function tryModelGraveyard(cwd) {
                 });
             }
         }
-        const score = Math.max(0, 100 - issues.length * 20);
+        const errorCount = issues.filter(i => i.severity === 'error').length;
+        const score = aiFramework
+            ? Math.max(70, 100 - errorCount * 20)
+            : Math.max(0, 100 - errorCount * 20);
+        let summary = issues.length === 0
+            ? `${report.filesScanned} files scanned (via model-graveyard) — all current`
+            : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} (via model-graveyard)`;
+        if (aiFramework) {
+            summary += ' — AI framework detected — model references are expected';
+        }
         return {
             name: 'models',
             score: Math.min(100, score),
             maxScore: 100,
             issues,
-            summary: issues.length === 0
-                ? `${report.filesScanned} files scanned (via model-graveyard) — all current`
-                : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} (via model-graveyard)`,
+            summary,
         };
     }
     catch {
@@ -87,6 +171,7 @@ function builtinModels(cwd, ignore) {
     const issues = [];
     const files = walkFiles(cwd, ignore);
     const found = new Map();
+    const aiFramework = isAiFramework(cwd);
     for (const f of files) {
         if (!SCAN_EXTS.some(ext => f.endsWith(ext)))
             continue;
@@ -105,24 +190,42 @@ function builtinModels(cwd, ignore) {
             found.set(model, existing);
         }
     }
-    for (const [model, files] of found) {
+    for (const [model, modelFiles] of found) {
         const info = SUNSET_MODELS[model];
-        const fileList = files.length <= 2 ? files.join(', ') : `${files[0]} +${files.length - 1} more`;
+        const fileList = modelFiles.length <= 2 ? modelFiles.join(', ') : `${modelFiles[0]} +${modelFiles.length - 1} more`;
+        // Determine severity: downgrade for AI frameworks or test/docs files
+        const allInTestDocs = modelFiles.every(f => isTestOrDocsFile(f));
+        const severity = (aiFramework || allInTestDocs) ? 'info' : 'error';
         issues.push({
-            severity: 'error',
+            severity,
             message: `deprecated model "${model}" in ${fileList} — use "${info.replacement}"${info.sunset ? ` (sunset ${info.sunset})` : ''}`,
-            file: files[0],
+            file: modelFiles[0],
             fixable: true,
             fixHint: `replace "${model}" with "${info.replacement}"`,
         });
     }
-    const score = Math.max(0, 100 - issues.length * 20);
+    let score;
+    if (aiFramework) {
+        // AI framework: models exist for compatibility, score 70+ base
+        const errorCount = issues.filter(i => i.severity === 'error').length;
+        score = Math.max(70, 100 - errorCount * 20);
+    }
+    else {
+        const errorCount = issues.filter(i => i.severity === 'error').length;
+        score = Math.max(0, 100 - errorCount * 20);
+    }
+    let summary = issues.length === 0
+        ? 'all model references current'
+        : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} found`;
+    if (aiFramework) {
+        summary += ' — AI framework detected — model references are expected';
+    }
     return {
         name: 'models',
         score: Math.min(100, score),
         maxScore: 100,
         issues,
-        summary: issues.length === 0 ? 'all model references current' : `${issues.length} deprecated model${issues.length > 1 ? 's' : ''} found`,
+        summary,
     };
 }
 export async function checkModels(cwd, ignore) {

package/dist/checks/ready.js

@@ -48,13 +48,40 @@ function builtinReady(cwd, ignore) {
     if (!hasReadme) {
         issues.push({ severity: 'error', message: 'no README — AI agents have no project context', fixable: true, fixHint: 'create a README.md' });
     }
+    // Detect Python project (root or subdirs)
+    const pythonMarkers = ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt'];
+    const hasPythonRoot = pythonMarkers.some(m => files.includes(m));
+    const hasPythonSubdir = files.some(f => pythonMarkers.some(m => f.endsWith('/' + m) || f.endsWith('\\' + m)));
+    const isPython = hasPythonRoot || hasPythonSubdir;
+    // Detect monorepo (multiple manifests in subdirs)
+    const subPyprojects = files.filter(f => f !== 'pyproject.toml' && f.endsWith('pyproject.toml'));
+    const subPackageJsons = files.filter(f => f !== 'package.json' && f.endsWith('package.json'));
+    const isMonorepo = subPyprojects.length > 0 || subPackageJsons.length > 1;
     const manifests = ['package.json', 'pyproject.toml', 'Cargo.toml', 'go.mod', 'pom.xml', 'build.gradle', 'Gemfile', 'composer.json'];
     const hasManifest = manifests.some(m => files.includes(m));
-    if (!hasManifest) {
+    // For Python projects, any pyproject.toml in subdirs counts as a manifest
+    const hasManifestAnywhere = hasManifest || isPython;
+    if (!hasManifestAnywhere) {
         issues.push({ severity: 'error', message: 'no package manifest — agents can\'t resolve dependencies', fixable: false });
     }
     const codeExts = ['.ts', '.js', '.tsx', '.jsx', '.py', '.rs', '.go', '.java', '.rb', '.php', '.cs', '.swift', '.kt'];
-    const testFiles = files.filter(f => /\.(test|spec)\.(ts|js|tsx|jsx|py)$/.test(f) || f.includes('__tests__/') || f.startsWith('tests/') || f.startsWith('test/'));
+    // Broader test detection: includes Python test patterns and nested test directories
+    const testFiles = files.filter(f => {
+        if (/\.(test|spec)\.(ts|js|tsx|jsx|py)$/.test(f))
+            return true;
+        if (f.includes('__tests__/'))
+            return true;
+        if (f.startsWith('tests/') || f.startsWith('test/'))
+            return true;
+        if (f.includes('/tests/') || f.includes('/test/'))
+            return true;
+        // Python test file patterns: test_*.py, *_test.py
+        if (/(?:^|[/\\])test_[^/\\]+\.py$/.test(f))
+            return true;
+        if (/(?:^|[/\\])[^/\\]+_test\.py$/.test(f))
+            return true;
+        return false;
+    });
     const codeFiles = files.filter(f => codeExts.some(ext => f.endsWith(ext)));
     if (codeFiles.length > 5 && testFiles.length === 0) {
         issues.push({ severity: 'error', message: 'no tests — AI agents produce better code when tests exist to validate against', fixable: false });
@@ -88,12 +115,15 @@ function builtinReady(cwd, ignore) {
     const warnings = issues.filter(i => i.severity === 'warning').length;
     const infos = issues.filter(i => i.severity === 'info').length;
     const score = Math.max(0, Math.min(100, 100 - errors * 30 - warnings * 15 - infos * 3));
+    let summary = issues.length === 0 ? 'codebase is well-structured for AI' : `${issues.length} readiness issues`;
+    if (isMonorepo)
+        summary += ' (monorepo detected)';
     return {
         name: 'ready',
         score: Math.round(score),
         maxScore: 100,
         issues,
-        summary: issues.length === 0 ? 'codebase is well-structured for AI' : `${issues.length} readiness issues`,
+        summary,
     };
 }
 export async function checkReady(cwd, ignore) {

package/dist/checks/scan.js

@@ -9,16 +9,34 @@ const CRITICAL_PATTERNS = [
         regex: /(?:aHR0c|data:text\/html;base64)/i,
     },
     {
-        id: 'curl-wget',
+        id: 'curl-pipe-shell',
         severity: 'critical',
-        description: 'Network download command in agent config — potential remote payload fetch',
-        regex: /(?:curl|wget|fetch)\s+(?:https?:\/\/|[-])/i,
+        description: 'Download-and-execute pattern — remote code execution',
+        regex: /(?:curl|wget)\s+[^\n|]*\|\s*(?:ba)?sh\b/i,
     },
     {
-        id: 'shell-injection',
+        id: 'pipe-to-shell',
         severity: 'critical',
-        description: 'Shell injection pattern — command substitution or eval/exec call',
-        regex: /\$\(|`[^`]+`|\beval\b|\bexec\b/,
+        description: 'Pipe to shell interpreter — potential code execution',
+        regex: /\|\s*(?:ba)?sh\b|\|\s*\beval\b/,
+    },
+    {
+        id: 'command-substitution',
+        severity: 'critical',
+        description: 'Command substitution in config — potential injection vector',
+        regex: /\$\([^)]+\)/,
+    },
+    {
+        id: 'data-exfiltration',
+        severity: 'critical',
+        description: 'Data exfiltration pattern — sending local data to external URL',
+        regex: /curl\s+[^\n]*(?:-[dFT]\s*@|--data-binary\s*@|--upload-file)|curl\s+[^\n]*\$(?:API_KEY|SECRET|TOKEN|PASSWORD)|nc\s+-[^\n]*\d+\.\d+/i,
+    },
+    {
+        id: 'base64-exec',
+        severity: 'critical',
+        description: 'Base64-decoded payload piped to execution',
+        regex: /base64\s+(?:-d|--decode)[^\n]*\|\s*(?:ba)?sh\b/i,
     },
     {
         id: 'powershell-download',
@@ -85,9 +103,10 @@ const CONFIG_TARGETS = [
     '.claude', 'CLAUDE.md', 'AGENTS.md',
     '.cursorrules', '.cursor',
     '.github',
-    '.aider.conf.yml',
+    'copilot-instructions.md',
+    '.aider.conf.yml', '.aider',
     '.continue',
-    '.mcp',
+    '.mcp', 'mcp.json', '.mcp.json',
     '.roomodes', '.roo',
 ];
 // ── File helpers (delegated to util.ts) ──────────────────────────────────────

package/dist/checks/verify.js

@@ -1,4 +1,4 @@
-import { join, basename } from 'node:path';
+import { join, basename, extname } from 'node:path';
 import { readFileSync, existsSync, statSync } from 'node:fs';
 import { execSync } from 'node:child_process';
 // ── Helpers ──────────────────────────────────────────────────────────────────
@@ -10,9 +10,66 @@ function safeExec(cmd, cwd) {
         return '';
     }
 }
+// ── Config/meta file exclusion for thin-file checks ──────────────────────────
+const CONFIG_DOTFILES = new Set([
+    '.gitignore', '.gitattributes', '.nvmrc', '.node-version', '.editorconfig',
+    '.prettierrc', '.eslintignore', '.npmrc', '.npmignore',
+]);
+const CONFIG_EXTENSIONS = new Set([
+    '.yml', '.yaml', '.json', '.toml', '.cfg', '.ini', '.lock', '.svg', '.xml',
+]);
+const CONFIG_DIRS = ['.github/', '.husky/', '.vscode/', '.idea/'];
+const META_FILES = new Set([
+    'FUNDING.yaml', 'CODEOWNERS', 'LICENSE',
+    'py.typed', 'MANIFEST.in', 'CITATION.cff',
+]);
+const META_EXTENSIONS = new Set([
+    '.cff', '.mdc', '.txt', '.html', '.md', '.rst', '.csv',
+    '.css', '.scss', '.less', '.map', '.wasm',
+    '.sh', '.bash', '.zsh', '.fish', '.bat', '.cmd', '.ps1',
+    '.sql', '.graphql', '.gql', '.proto',
+]);
+/** Source code extensions that should be checked for thin files */
+const SOURCE_CODE_EXTS = new Set([
+    '.ts', '.js', '.tsx', '.jsx', '.mts', '.mjs', '.cts', '.cjs',
+    '.py', '.go', '.rs', '.java', '.rb', '.php', '.cs', '.swift', '.kt',
+]);
+function isConfigOrMetaFile(filePath) {
+    const base = basename(filePath);
+    const ext = extname(filePath).toLowerCase();
+    const normalized = filePath.replace(/\\/g, '/');
+    // Dotfiles
+    if (CONFIG_DOTFILES.has(base))
+        return true;
+    // Config extensions
+    if (CONFIG_EXTENSIONS.has(ext))
+        return true;
+    // Meta/non-source extensions
+    if (META_EXTENSIONS.has(ext))
+        return true;
+    // Config directories
+    if (CONFIG_DIRS.some(d => normalized.includes(d) || normalized.startsWith(d)))
+        return true;
+    // Meta files
+    if (META_FILES.has(base))
+        return true;
+    if (base.startsWith('CHANGELOG'))
+        return true;
+    // Any file that is NOT source code should not be flagged for thin content
+    if (!SOURCE_CODE_EXTS.has(ext))
+        return true;
+    return false;
+}
+// ── Code file extensions for test detection ──────────────────────────────────
+const CODE_EXTENSIONS = new Set(['.js', '.ts', '.jsx', '.tsx', '.mjs', '.cjs']);
+const TEST_FILE_PATTERN = /\.(test|spec)\.(ts|js|tsx|jsx)$/i;
 function isTestFile(filePath) {
     const base = basename(filePath);
-    if (/\.(test|spec)\.[a-z]+$/i.test(base))
+    const ext = extname(filePath).toLowerCase();
+    // Only code files can be test files
+    if (!CODE_EXTENSIONS.has(ext))
+        return false;
+    if (TEST_FILE_PATTERN.test(base))
         return true;
     const normalized = filePath.replace(/\\/g, '/');
     // Match __tests__/ anywhere in path (including at root)
@@ -92,6 +149,8 @@ function isPythonBoilerplate(filePath) {
     const base = basename(filePath);
     if (base === '__init__.py')
         return true;
+    if (base === 'py.typed')
+        return true;
     if (filePath.endsWith('.pyi'))
         return true;
     if (filePath.replace(/\\/g, '/').includes('__pycache__/'))
@@ -181,8 +240,13 @@ export function checkVerify(cwd, since) {
         }
         const lineCount = countLines(content);
         // 2. File must have meaningful content (>10 non-empty lines)
-        // Skip thin file check for Python boilerplate files
-        if (python && isPythonBoilerplate(relPath)) {
+        // Skip thin file check for Python boilerplate files (always, regardless of project type)
+        if (isPythonBoilerplate(relPath)) {
+            verified++;
+            continue;
+        }
+        // Skip thin file check for config/meta files (they're supposed to be small)
+        if (isConfigOrMetaFile(relPath)) {
             verified++;
             continue;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.6.1",
+  "version": "1.8.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {