@safetnsr/vet 1.7.0 → 1.8.0

package/dist/checks/integrity.js

@@ -1,4 +1,4 @@
-import { join, resolve, dirname, extname } from 'node:path';
+import { join, resolve, dirname, extname, basename } from 'node:path';
 import { existsSync } from 'node:fs';
 import { walkFiles, readFile } from '../util.js';
 // ── Hallucinated imports ─────────────────────────────────────────────────────
@@ -277,6 +277,38 @@ function checkStubbedTests(cwd, files) {
     return issues;
 }
 // ── Unhandled async (removed error handling) ─────────────────────────────────
+/** Files that ARE error boundaries — they handle errors by design */
+function isErrorBoundaryFile(file) {
+    const normalized = file.replace(/\\/g, '/');
+    const base = basename(normalized);
+    // Next.js error boundaries
+    if (/^error\.[jt]sx?$/.test(base))
+        return true;
+    if (/^global-error\.[jt]sx?$/.test(base))
+        return true;
+    // Middleware files
+    if (/^middleware\.[jt]sx?$/.test(base))
+        return true;
+    // Error handler files
+    if (/error[-_]?handler/i.test(base))
+        return true;
+    if (/error[-_]?boundary/i.test(base))
+        return true;
+    return false;
+}
+/** Check if a file has a top-level error handler (global catch-all) */
+function hasGlobalErrorHandling(content) {
+    // process.on('unhandledRejection'/'uncaughtException')
+    if (/process\.on\s*\(\s*['"](?:unhandledRejection|uncaughtException)['"]/i.test(content))
+        return true;
+    // Express/Koa-style error middleware: (err, req, res, next) or app.use with 4 params
+    if (/(?:app|router)\.use\s*\(\s*(?:async\s*)?\(\s*\w+\s*,\s*\w+\s*,\s*\w+\s*,\s*\w+\s*\)/.test(content))
+        return true;
+    // window.addEventListener('error'/'unhandledrejection')
+    if (/addEventListener\s*\(\s*['"](?:error|unhandledrejection)['"]/i.test(content))
+        return true;
+    return false;
+}
 function checkUnhandledAsync(cwd, files) {
     const issues = [];
     const sourceExts = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs']);
@@ -286,9 +318,15 @@ function checkUnhandledAsync(cwd, files) {
         // Skip test files — test runners handle errors at the framework level
         if (isTestFile(file))
             continue;
+        // Skip error boundary files — they ARE the error handlers
+        if (isErrorBoundaryFile(file))
+            continue;
         const content = readFile(join(cwd, file));
         if (!content)
             continue;
+        // Skip files with global error handling
+        if (hasGlobalErrorHandling(content))
+            continue;
         const lines = content.split('\n');
         let unhandledCount = 0;
         for (let i = 0; i < lines.length; i++) {
@@ -299,7 +337,7 @@ function checkUnhandledAsync(cwd, files) {
             if (!hasAwait)
                 continue;
             // Check context window — look for try { in surrounding lines
-            const contextStart = Math.max(0, i - 15);
+            const contextStart = Math.max(0, i - 20);
             const contextEnd = Math.min(lines.length - 1, i + 5);
             const contextLines = lines.slice(contextStart, contextEnd + 1);
             const contextText = contextLines.join('\n');
@@ -307,9 +345,11 @@ function checkUnhandledAsync(cwd, files) {
             const tryCount = (contextText.match(/\btry\s*\{/g) || []).length;
             const catchCount = (contextText.match(/\bcatch\s*(?:\([^)]*\))?\s*\{/g) || []).length;
             if (tryCount === 0 || catchCount === 0) {
-                // Also check for .catch() chained
+                // Check for .catch() chained on this or next line
                 const hasCatch = /\.catch\s*\(/.test(line) || (i + 1 < lines.length && /\.catch\s*\(/.test(lines[i + 1]));
-                if (!hasCatch) {
+                // Check for .then(..., errorHandler) pattern
+                const hasThenError = /\.then\s*\([^,]+,\s*\w+/.test(line) || (i + 1 < lines.length && /\.then\s*\([^,]+,\s*\w+/.test(lines[i + 1]));
+                if (!hasCatch && !hasThenError) {
                     unhandledCount++;
                     if (unhandledCount <= 10) {
                         issues.push({

package/dist/checks/models.js

@@ -1,9 +1,11 @@
 import { join, basename } from 'node:path';
+import { readdirSync, existsSync } from 'node:fs';
 import { readFile, walkFiles } from '../util.js';
 // ── AI framework detection ───────────────────────────────────────────────────
-const AI_NAME_KEYWORDS = ['ai', 'llm', 'model', 'openai', 'anthropic', 'langchain', 'provider'];
+const AI_NAME_KEYWORDS = ['ai', 'llm', 'openai', 'anthropic', 'langchain', 'provider'];
 const AI_PKG_KEYWORDS = new Set(['ai', 'llm', 'language-model', 'openai', 'anthropic']);
 function isAiFramework(cwd) {
+    const aiDeps = ['openai', 'anthropic', 'langchain', 'transformers', 'torch', 'tensorflow', 'llama', 'huggingface'];
     // Check package.json
     const pkgRaw = readFile(join(cwd, 'package.json'));
     if (pkgRaw) {
@@ -17,17 +19,44 @@ function isAiFramework(cwd) {
         }
         catch { /* skip */ }
     }
-    // Check pyproject.toml / setup.py for AI deps
-    const pyproject = readFile(join(cwd, 'pyproject.toml'));
-    if (pyproject) {
-        const aiDeps = ['openai', 'anthropic', 'langchain', 'transformers', 'torch', 'tensorflow'];
-        if (aiDeps.some(d => pyproject.includes(d)))
+    // Check pyproject.toml / setup.py in root AND subdirectories
+    const pyprojectPaths = [join(cwd, 'pyproject.toml')];
+    try {
+        const entries = readdirSync(cwd);
+        for (const entry of entries) {
+            if (entry.startsWith('.') || entry === 'node_modules')
+                continue;
+            const subPyproject = join(cwd, entry, 'pyproject.toml');
+            if (existsSync(subPyproject))
+                pyprojectPaths.push(subPyproject);
+        }
+    }
+    catch { /* skip */ }
+    for (const pyprojectPath of pyprojectPaths) {
+        const pyproject = readFile(pyprojectPath);
+        if (pyproject && aiDeps.some(d => pyproject.includes(d)))
             return true;
     }
     const setupPy = readFile(join(cwd, 'setup.py'));
-    if (setupPy) {
-        const aiDeps = ['openai', 'anthropic', 'langchain', 'transformers', 'torch', 'tensorflow'];
-        if (aiDeps.some(d => setupPy.includes(d)))
+    if (setupPy && aiDeps.some(d => setupPy.includes(d)))
+        return true;
+    // Check directory name for AI keywords (use word-boundary-like matching with separators)
+    const dirName = basename(cwd).toLowerCase();
+    const dirParts = dirName.split(/[-_./\\]/);
+    const DIR_AI_KEYWORDS = ['ai', 'llm', 'openai', 'anthropic', 'langchain', 'pydantic-ai', 'autogen', 'crewai'];
+    if (DIR_AI_KEYWORDS.some(k => dirParts.includes(k) || dirName.includes(k)))
+        return true;
+    // Check CLAUDE.md or .claude/settings.json for AI/LLM terms
+    const claudeMd = readFile(join(cwd, 'CLAUDE.md'));
+    if (claudeMd) {
+        const aiTerms = /\b(llm|language model|ai agent|openai|anthropic|embedding|vector|rag|prompt|fine.?tun)/i;
+        if (aiTerms.test(claudeMd))
+            return true;
+    }
+    const claudeSettings = readFile(join(cwd, '.claude', 'settings.json'));
+    if (claudeSettings) {
+        const aiTerms = /\b(llm|language model|ai|openai|anthropic|model)/i;
+        if (aiTerms.test(claudeSettings))
             return true;
     }
     return false;

package/dist/checks/ready.js

@@ -48,13 +48,40 @@ function builtinReady(cwd, ignore) {
     if (!hasReadme) {
         issues.push({ severity: 'error', message: 'no README — AI agents have no project context', fixable: true, fixHint: 'create a README.md' });
     }
+    // Detect Python project (root or subdirs)
+    const pythonMarkers = ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt'];
+    const hasPythonRoot = pythonMarkers.some(m => files.includes(m));
+    const hasPythonSubdir = files.some(f => pythonMarkers.some(m => f.endsWith('/' + m) || f.endsWith('\\' + m)));
+    const isPython = hasPythonRoot || hasPythonSubdir;
+    // Detect monorepo (multiple manifests in subdirs)
+    const subPyprojects = files.filter(f => f !== 'pyproject.toml' && f.endsWith('pyproject.toml'));
+    const subPackageJsons = files.filter(f => f !== 'package.json' && f.endsWith('package.json'));
+    const isMonorepo = subPyprojects.length > 0 || subPackageJsons.length > 1;
     const manifests = ['package.json', 'pyproject.toml', 'Cargo.toml', 'go.mod', 'pom.xml', 'build.gradle', 'Gemfile', 'composer.json'];
     const hasManifest = manifests.some(m => files.includes(m));
-    if (!hasManifest) {
+    // For Python projects, any pyproject.toml in subdirs counts as a manifest
+    const hasManifestAnywhere = hasManifest || isPython;
+    if (!hasManifestAnywhere) {
         issues.push({ severity: 'error', message: 'no package manifest — agents can\'t resolve dependencies', fixable: false });
     }
     const codeExts = ['.ts', '.js', '.tsx', '.jsx', '.py', '.rs', '.go', '.java', '.rb', '.php', '.cs', '.swift', '.kt'];
-    const testFiles = files.filter(f => /\.(test|spec)\.(ts|js|tsx|jsx|py)$/.test(f) || f.includes('__tests__/') || f.startsWith('tests/') || f.startsWith('test/'));
+    // Broader test detection: includes Python test patterns and nested test directories
+    const testFiles = files.filter(f => {
+        if (/\.(test|spec)\.(ts|js|tsx|jsx|py)$/.test(f))
+            return true;
+        if (f.includes('__tests__/'))
+            return true;
+        if (f.startsWith('tests/') || f.startsWith('test/'))
+            return true;
+        if (f.includes('/tests/') || f.includes('/test/'))
+            return true;
+        // Python test file patterns: test_*.py, *_test.py
+        if (/(?:^|[/\\])test_[^/\\]+\.py$/.test(f))
+            return true;
+        if (/(?:^|[/\\])[^/\\]+_test\.py$/.test(f))
+            return true;
+        return false;
+    });
     const codeFiles = files.filter(f => codeExts.some(ext => f.endsWith(ext)));
     if (codeFiles.length > 5 && testFiles.length === 0) {
         issues.push({ severity: 'error', message: 'no tests — AI agents produce better code when tests exist to validate against', fixable: false });
@@ -88,12 +115,15 @@ function builtinReady(cwd, ignore) {
     const warnings = issues.filter(i => i.severity === 'warning').length;
     const infos = issues.filter(i => i.severity === 'info').length;
     const score = Math.max(0, Math.min(100, 100 - errors * 30 - warnings * 15 - infos * 3));
+    let summary = issues.length === 0 ? 'codebase is well-structured for AI' : `${issues.length} readiness issues`;
+    if (isMonorepo)
+        summary += ' (monorepo detected)';
     return {
         name: 'ready',
         score: Math.round(score),
         maxScore: 100,
         issues,
-        summary: issues.length === 0 ? 'codebase is well-structured for AI' : `${issues.length} readiness issues`,
+        summary,
     };
 }
 export async function checkReady(cwd, ignore) {

package/dist/checks/scan.js

@@ -9,16 +9,34 @@ const CRITICAL_PATTERNS = [
         regex: /(?:aHR0c|data:text\/html;base64)/i,
     },
     {
-        id: 'curl-wget',
+        id: 'curl-pipe-shell',
         severity: 'critical',
-        description: 'Network download command in agent config — potential remote payload fetch',
-        regex: /(?:curl|wget|fetch)\s+(?:https?:\/\/|[-])/i,
+        description: 'Download-and-execute pattern — remote code execution',
+        regex: /(?:curl|wget)\s+[^\n|]*\|\s*(?:ba)?sh\b/i,
     },
     {
-        id: 'shell-injection',
+        id: 'pipe-to-shell',
         severity: 'critical',
-        description: 'Shell injection pattern — command substitution or eval/exec call',
-        regex: /\$\(|`[^`]+`|\beval\b|\bexec\b/,
+        description: 'Pipe to shell interpreter — potential code execution',
+        regex: /\|\s*(?:ba)?sh\b|\|\s*\beval\b/,
+    },
+    {
+        id: 'command-substitution',
+        severity: 'critical',
+        description: 'Command substitution in config — potential injection vector',
+        regex: /\$\([^)]+\)/,
+    },
+    {
+        id: 'data-exfiltration',
+        severity: 'critical',
+        description: 'Data exfiltration pattern — sending local data to external URL',
+        regex: /curl\s+[^\n]*(?:-[dFT]\s*@|--data-binary\s*@|--upload-file)|curl\s+[^\n]*\$(?:API_KEY|SECRET|TOKEN|PASSWORD)|nc\s+-[^\n]*\d+\.\d+/i,
+    },
+    {
+        id: 'base64-exec',
+        severity: 'critical',
+        description: 'Base64-decoded payload piped to execution',
+        regex: /base64\s+(?:-d|--decode)[^\n]*\|\s*(?:ba)?sh\b/i,
     },
     {
         id: 'powershell-download',

package/dist/checks/verify.js

@@ -21,6 +21,18 @@ const CONFIG_EXTENSIONS = new Set([
 const CONFIG_DIRS = ['.github/', '.husky/', '.vscode/', '.idea/'];
 const META_FILES = new Set([
     'FUNDING.yaml', 'CODEOWNERS', 'LICENSE',
+    'py.typed', 'MANIFEST.in', 'CITATION.cff',
+]);
+const META_EXTENSIONS = new Set([
+    '.cff', '.mdc', '.txt', '.html', '.md', '.rst', '.csv',
+    '.css', '.scss', '.less', '.map', '.wasm',
+    '.sh', '.bash', '.zsh', '.fish', '.bat', '.cmd', '.ps1',
+    '.sql', '.graphql', '.gql', '.proto',
+]);
+/** Source code extensions that should be checked for thin files */
+const SOURCE_CODE_EXTS = new Set([
+    '.ts', '.js', '.tsx', '.jsx', '.mts', '.mjs', '.cts', '.cjs',
+    '.py', '.go', '.rs', '.java', '.rb', '.php', '.cs', '.swift', '.kt',
 ]);
 function isConfigOrMetaFile(filePath) {
     const base = basename(filePath);
@@ -32,6 +44,9 @@ function isConfigOrMetaFile(filePath) {
     // Config extensions
     if (CONFIG_EXTENSIONS.has(ext))
         return true;
+    // Meta/non-source extensions
+    if (META_EXTENSIONS.has(ext))
+        return true;
     // Config directories
     if (CONFIG_DIRS.some(d => normalized.includes(d) || normalized.startsWith(d)))
         return true;
@@ -40,6 +55,9 @@ function isConfigOrMetaFile(filePath) {
         return true;
     if (base.startsWith('CHANGELOG'))
         return true;
+    // Any file that is NOT source code should not be flagged for thin content
+    if (!SOURCE_CODE_EXTS.has(ext))
+        return true;
     return false;
 }
 // ── Code file extensions for test detection ──────────────────────────────────
@@ -131,6 +149,8 @@ function isPythonBoilerplate(filePath) {
     const base = basename(filePath);
     if (base === '__init__.py')
         return true;
+    if (base === 'py.typed')
+        return true;
     if (filePath.endsWith('.pyi'))
         return true;
     if (filePath.replace(/\\/g, '/').includes('__pycache__/'))
@@ -220,8 +240,8 @@ export function checkVerify(cwd, since) {
         }
         const lineCount = countLines(content);
         // 2. File must have meaningful content (>10 non-empty lines)
-        // Skip thin file check for Python boilerplate files
-        if (python && isPythonBoilerplate(relPath)) {
+        // Skip thin file check for Python boilerplate files (always, regardless of project type)
+        if (isPythonBoilerplate(relPath)) {
             verified++;
             continue;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {