@safetnsr/vet 1.7.0 → 1.8.2

package/dist/checks/owasp/asi08-cascading.js

@@ -0,0 +1,36 @@
+import { readTextFile } from './shared.js';
+// ── ASI08 — Cascading Failures ────────────────────────────────────────────────
+export function checkASI08(cwd, configFiles) {
+    const findings = [];
+    if (configFiles.length === 0)
+        return { findings, deduction: 0 };
+    const workflowKeywords = ['step', 'workflow', 'pipeline', 'sequence', 'chain', 'loop', 'iterate'];
+    const errorHandlingKeywords = [
+        'rollback', 'undo', 'revert', 'recover', 'retry', 'error handling', 'handle error',
+        'circuit breaker', 'rate limit', 'max retries', 'timeout', 'fail safe', 'fallback',
+        'on error', 'if it fails', 'if something goes wrong',
+    ];
+    let hasWorkflowContent = false;
+    let hasErrorHandling = false;
+    for (const filePath of configFiles) {
+        const content = readTextFile(filePath);
+        if (!content)
+            continue;
+        if (workflowKeywords.some(kw => new RegExp(kw, 'i').test(content))) {
+            hasWorkflowContent = true;
+        }
+        if (errorHandlingKeywords.some(kw => new RegExp(kw, 'i').test(content))) {
+            hasErrorHandling = true;
+        }
+    }
+    if (hasWorkflowContent && !hasErrorHandling) {
+        findings.push({
+            asiId: 'ASI08',
+            severity: 'warning',
+            message: 'ASI08: multi-step workflow config lacks error handling, rollback, or recovery instructions',
+            fixHint: 'add error handling instructions: rollback procedures, retry limits, and circuit breakers',
+        });
+        return { findings, deduction: 5 };
+    }
+    return { findings, deduction: 0 };
+}

package/dist/checks/owasp/asi09-trust-exploitation.d.ts

@@ -0,0 +1,5 @@
+import { type OwaspFinding } from './shared.js';
+export declare function checkASI09(cwd: string, configFiles: string[]): {
+    findings: OwaspFinding[];
+    deduction: number;
+};

package/dist/checks/owasp/asi09-trust-exploitation.js

@@ -0,0 +1,65 @@
+import { join } from 'node:path';
+import { existsSync } from 'node:fs';
+import { readTextFile } from './shared.js';
+// ── ASI09 — Human-Agent Trust Exploitation ────────────────────────────────────
+export function checkASI09(cwd, configFiles) {
+    const findings = [];
+    if (configFiles.length === 0)
+        return { findings, deduction: 0 };
+    const destructiveKeywords = ['delete', 'drop', 'remove', 'deploy', 'publish', 'push', 'rm ', 'truncate'];
+    const approvalKeywords = [
+        'confirm', 'approval', 'approve', 'ask.*before', 'human.*review', 'manual.*review',
+        'permission', 'consent', 'verify.*before', 'check.*before', 'gate',
+    ];
+    let hasDestructiveOps = false;
+    let hasApprovalGate = false;
+    for (const filePath of configFiles) {
+        const content = readTextFile(filePath);
+        if (!content)
+            continue;
+        if (destructiveKeywords.some(kw => new RegExp(`\\b${kw}\\b`, 'i').test(content))) {
+            hasDestructiveOps = true;
+        }
+        if (approvalKeywords.some(kw => new RegExp(kw, 'i').test(content))) {
+            hasApprovalGate = true;
+        }
+    }
+    const claudeSettings = join(cwd, '.claude', 'settings.json');
+    if (existsSync(claudeSettings)) {
+        const content = readTextFile(claudeSettings);
+        if (content) {
+            try {
+                const settings = JSON.parse(content);
+                if (settings.autoApprove === true || (Array.isArray(settings.autoApprove) && settings.autoApprove.length > 0)) {
+                    findings.push({
+                        asiId: 'ASI09',
+                        severity: 'warning',
+                        message: 'ASI09: autoApprove enabled in .claude/settings.json — destructive ops may run unattended',
+                        file: '.claude/settings.json',
+                        fixHint: 'disable autoApprove or restrict it to non-destructive operations only',
+                    });
+                    return { findings, deduction: 10 };
+                }
+            }
+            catch { /* intentional: skip unparseable settings */ }
+        }
+    }
+    if (hasDestructiveOps && !hasApprovalGate) {
+        findings.push({
+            asiId: 'ASI09',
+            severity: 'warning',
+            message: 'ASI09: agent config references destructive operations (delete/deploy/publish) without approval gates',
+            fixHint: 'require explicit human confirmation before destructive operations (delete, deploy, publish)',
+        });
+        return { findings, deduction: 10 };
+    }
+    if (!hasApprovalGate) {
+        findings.push({
+            asiId: 'ASI09',
+            severity: 'info',
+            message: 'ASI09: no human approval gates mentioned in agent configs',
+            fixHint: 'document which operations require human approval in your agent config',
+        });
+    }
+    return { findings, deduction: 0 };
+}

package/dist/checks/owasp/asi10-rogue-agents.d.ts

@@ -0,0 +1,5 @@
+import { type OwaspFinding } from './shared.js';
+export declare function checkASI10(cwd: string, configFiles: string[]): {
+    findings: OwaspFinding[];
+    deduction: number;
+};

package/dist/checks/owasp/asi10-rogue-agents.js

@@ -0,0 +1,31 @@
+import { readTextFile } from './shared.js';
+// ── ASI10 — Rogue Agents ─────────────────────────────────────────────────────
+export function checkASI10(cwd, configFiles) {
+    const findings = [];
+    if (configFiles.length === 0)
+        return { findings, deduction: 0 };
+    const monitoringKeywords = [
+        'log', 'audit', 'monitor', 'alert', 'trace', 'observ', 'kill switch',
+        'stop', 'timeout', 'session limit', 'max token', 'budget', 'governance',
+    ];
+    let hasGovernance = false;
+    for (const filePath of configFiles) {
+        const content = readTextFile(filePath);
+        if (!content)
+            continue;
+        if (monitoringKeywords.some(kw => new RegExp(kw, 'i').test(content))) {
+            hasGovernance = true;
+            break;
+        }
+    }
+    if (!hasGovernance) {
+        findings.push({
+            asiId: 'ASI10',
+            severity: 'info',
+            message: 'ASI10: no monitoring, logging, or kill switch mechanisms mentioned in agent configs',
+            fixHint: 'add monitoring/audit trail requirements and session limits to your agent config',
+        });
+        return { findings, deduction: 5 };
+    }
+    return { findings, deduction: 0 };
+}

package/dist/checks/owasp/index.d.ts

@@ -0,0 +1,11 @@
+export { type OwaspFinding, collectAgentConfigFiles, collectMcpConfigFiles, readTextFile } from './shared.js';
+export { checkASI01 } from './asi01-goal-hijack.js';
+export { checkASI02 } from './asi02-tool-misuse.js';
+export { checkASI03 } from './asi03-identity-abuse.js';
+export { checkASI04 } from './asi04-supply-chain.js';
+export { checkASI05 } from './asi05-code-execution.js';
+export { checkASI06 } from './asi06-memory-poisoning.js';
+export { checkASI07 } from './asi07-inter-agent.js';
+export { checkASI08 } from './asi08-cascading.js';
+export { checkASI09 } from './asi09-trust-exploitation.js';
+export { checkASI10 } from './asi10-rogue-agents.js';

package/dist/checks/owasp/index.js

@@ -0,0 +1,11 @@
+export { collectAgentConfigFiles, collectMcpConfigFiles, readTextFile } from './shared.js';
+export { checkASI01 } from './asi01-goal-hijack.js';
+export { checkASI02 } from './asi02-tool-misuse.js';
+export { checkASI03 } from './asi03-identity-abuse.js';
+export { checkASI04 } from './asi04-supply-chain.js';
+export { checkASI05 } from './asi05-code-execution.js';
+export { checkASI06 } from './asi06-memory-poisoning.js';
+export { checkASI07 } from './asi07-inter-agent.js';
+export { checkASI08 } from './asi08-cascading.js';
+export { checkASI09 } from './asi09-trust-exploitation.js';
+export { checkASI10 } from './asi10-rogue-agents.js';

package/dist/checks/owasp/shared.d.ts

@@ -0,0 +1,11 @@
+export declare function collectAgentConfigFiles(cwd: string): string[];
+export declare function collectMcpConfigFiles(cwd: string): string[];
+export declare function readTextFile(filePath: string): string | null;
+export interface OwaspFinding {
+    asiId: string;
+    severity: 'error' | 'warning' | 'info';
+    message: string;
+    file?: string;
+    line?: number;
+    fixHint?: string;
+}

package/dist/checks/owasp/shared.js

@@ -0,0 +1,61 @@
+import { join } from 'node:path';
+import { readFileSync, statSync, existsSync } from 'node:fs';
+import { isTextFile, collectDirFiles } from '../../util.js';
+// ── Agent config file targets ─────────────────────────────────────────────────
+const AGENT_CONFIG_TARGETS = [
+    '.claude',
+    'CLAUDE.md',
+    'AGENTS.md',
+    '.cursorrules',
+    '.cursor',
+    '.github/copilot-instructions.md',
+    '.mcp',
+    'mcp.json',
+    '.aider.conf.yml',
+    '.continue',
+    '.roomodes',
+    '.roo',
+    'codex.md',
+];
+const MCP_CONFIG_PATHS = [
+    'mcp.json',
+    '.mcp',
+    '.cursor/mcp.json',
+    '.claude/mcp.json',
+];
+// ── File helpers ──────────────────────────────────────────────────────────────
+/** Collect files for a given list of target paths (files or directories). */
+function collectConfigFiles(cwd, targets) {
+    const files = [];
+    for (const target of targets) {
+        const full = join(cwd, target);
+        if (!existsSync(full))
+            continue;
+        try {
+            const s = statSync(full);
+            if (s.isFile()) {
+                files.push(full);
+            }
+            else if (s.isDirectory()) {
+                files.push(...collectDirFiles(full));
+            }
+        }
+        catch { /* intentional: resolver may fail on unreadable files */ }
+    }
+    return [...new Set(files)];
+}
+export function collectAgentConfigFiles(cwd) {
+    return collectConfigFiles(cwd, AGENT_CONFIG_TARGETS);
+}
+export function collectMcpConfigFiles(cwd) {
+    return collectConfigFiles(cwd, MCP_CONFIG_PATHS);
+}
+export function readTextFile(filePath) {
+    if (!isTextFile(filePath))
+        return null;
+    try {
+        return readFileSync(filePath, 'utf-8');
+    }
+    catch { /* intentional: resolver may fail on unreadable files */ }
+    return null;
+}

package/dist/checks/owasp.js

@@ -1,4 +1,4 @@
-import { collectAgentConfigFiles, collectMcpConfigFiles, checkASI01, checkASI02, checkASI03, checkASI04, checkASI05, checkASI06, checkASI07, checkASI08, checkASI09, checkASI10, } from './owasp-checks.js';
+import { collectAgentConfigFiles, collectMcpConfigFiles, checkASI01, checkASI02, checkASI03, checkASI04, checkASI05, checkASI06, checkASI07, checkASI08, checkASI09, checkASI10, } from './owasp/index.js';
 // ── Main export ───────────────────────────────────────────────────────────────
 export function checkOwasp(cwd) {
     const allConfigFiles = collectAgentConfigFiles(cwd);

package/dist/checks/ready.js

@@ -48,13 +48,40 @@ function builtinReady(cwd, ignore) {
     if (!hasReadme) {
         issues.push({ severity: 'error', message: 'no README — AI agents have no project context', fixable: true, fixHint: 'create a README.md' });
     }
+    // Detect Python project (root or subdirs)
+    const pythonMarkers = ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt'];
+    const hasPythonRoot = pythonMarkers.some(m => files.includes(m));
+    const hasPythonSubdir = files.some(f => pythonMarkers.some(m => f.endsWith('/' + m) || f.endsWith('\\' + m)));
+    const isPython = hasPythonRoot || hasPythonSubdir;
+    // Detect monorepo (multiple manifests in subdirs)
+    const subPyprojects = files.filter(f => f !== 'pyproject.toml' && f.endsWith('pyproject.toml'));
+    const subPackageJsons = files.filter(f => f !== 'package.json' && f.endsWith('package.json'));
+    const isMonorepo = subPyprojects.length > 0 || subPackageJsons.length > 1;
     const manifests = ['package.json', 'pyproject.toml', 'Cargo.toml', 'go.mod', 'pom.xml', 'build.gradle', 'Gemfile', 'composer.json'];
     const hasManifest = manifests.some(m => files.includes(m));
-    if (!hasManifest) {
+    // For Python projects, any pyproject.toml in subdirs counts as a manifest
+    const hasManifestAnywhere = hasManifest || isPython;
+    if (!hasManifestAnywhere) {
         issues.push({ severity: 'error', message: 'no package manifest — agents can\'t resolve dependencies', fixable: false });
     }
     const codeExts = ['.ts', '.js', '.tsx', '.jsx', '.py', '.rs', '.go', '.java', '.rb', '.php', '.cs', '.swift', '.kt'];
-    const testFiles = files.filter(f => /\.(test|spec)\.(ts|js|tsx|jsx|py)$/.test(f) || f.includes('__tests__/') || f.startsWith('tests/') || f.startsWith('test/'));
+    // Broader test detection: includes Python test patterns and nested test directories
+    const testFiles = files.filter(f => {
+        if (/\.(test|spec)\.(ts|js|tsx|jsx|py)$/.test(f))
+            return true;
+        if (f.includes('__tests__/'))
+            return true;
+        if (f.startsWith('tests/') || f.startsWith('test/'))
+            return true;
+        if (f.includes('/tests/') || f.includes('/test/'))
+            return true;
+        // Python test file patterns: test_*.py, *_test.py
+        if (/(?:^|[/\\])test_[^/\\]+\.py$/.test(f))
+            return true;
+        if (/(?:^|[/\\])[^/\\]+_test\.py$/.test(f))
+            return true;
+        return false;
+    });
     const codeFiles = files.filter(f => codeExts.some(ext => f.endsWith(ext)));
     if (codeFiles.length > 5 && testFiles.length === 0) {
         issues.push({ severity: 'error', message: 'no tests — AI agents produce better code when tests exist to validate against', fixable: false });
@@ -88,17 +115,25 @@ function builtinReady(cwd, ignore) {
     const warnings = issues.filter(i => i.severity === 'warning').length;
     const infos = issues.filter(i => i.severity === 'info').length;
     const score = Math.max(0, Math.min(100, 100 - errors * 30 - warnings * 15 - infos * 3));
+    let summary = issues.length === 0 ? 'codebase is well-structured for AI' : `${issues.length} readiness issues`;
+    if (isMonorepo)
+        summary += ' (monorepo detected)';
     return {
         name: 'ready',
         score: Math.round(score),
         maxScore: 100,
         issues,
-        summary: issues.length === 0 ? 'codebase is well-structured for AI' : `${issues.length} readiness issues`,
+        summary,
     };
 }
 export async function checkReady(cwd, ignore) {
-    const rich = await tryAiReady(cwd);
-    if (rich)
-        return rich;
-    return builtinReady(cwd, ignore);
+    try {
+        const rich = await tryAiReady(cwd);
+        if (rich)
+            return rich;
+        return builtinReady(cwd, ignore);
+    }
+    catch {
+        return { name: 'ready', score: 100, maxScore: 100, issues: [], summary: 'ready check failed' };
+    }
 }

package/dist/checks/receipt.js

@@ -1,28 +1,14 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import * as crypto from 'node:crypto';
+import { collectDirFiles } from '../util.js';
 import { createInterface } from 'node:readline';
 // ── Session file discovery ───────────────────────────────────────────────────
-function walkDir(dir) {
-    const results = [];
-    try {
-        const entries = fs.readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            const full = path.join(dir, entry.name);
-            if (entry.isDirectory())
-                results.push(...walkDir(full));
-            else
-                results.push(full);
-        }
-    }
-    catch { /* skip */ }
-    return results;
-}
 export function findSessionFiles(baseDir) {
     const dir = baseDir || path.join(process.env['HOME'] || '~', '.claude', 'projects');
     if (!fs.existsSync(dir))
         return [];
-    return walkDir(dir).filter(f => f.endsWith('.jsonl')).sort();
+    return collectDirFiles(dir).filter(f => f.endsWith('.jsonl')).sort();
 }
 export function findLatestSession(baseDir) {
     const files = findSessionFiles(baseDir);

package/dist/checks/scan.js

@@ -9,16 +9,34 @@ const CRITICAL_PATTERNS = [
         regex: /(?:aHR0c|data:text\/html;base64)/i,
     },
     {
-        id: 'curl-wget',
+        id: 'curl-pipe-shell',
         severity: 'critical',
-        description: 'Network download command in agent config — potential remote payload fetch',
-        regex: /(?:curl|wget|fetch)\s+(?:https?:\/\/|[-])/i,
+        description: 'Download-and-execute pattern — remote code execution',
+        regex: /(?:curl|wget)\s+[^\n|]*\|\s*(?:ba)?sh\b/i,
     },
     {
-        id: 'shell-injection',
+        id: 'pipe-to-shell',
         severity: 'critical',
-        description: 'Shell injection pattern — command substitution or eval/exec call',
-        regex: /\$\(|`[^`]+`|\beval\b|\bexec\b/,
+        description: 'Pipe to shell interpreter — potential code execution',
+        regex: /\|\s*(?:ba)?sh\b|\|\s*\beval\b/,
+    },
+    {
+        id: 'command-substitution',
+        severity: 'critical',
+        description: 'Command substitution in config — potential injection vector',
+        regex: /\$\([^)]+\)/,
+    },
+    {
+        id: 'data-exfiltration',
+        severity: 'critical',
+        description: 'Data exfiltration pattern — sending local data to external URL',
+        regex: /curl\s+[^\n]*(?:-[dFT]\s*@|--data-binary\s*@|--upload-file)|curl\s+[^\n]*\$(?:API_KEY|SECRET|TOKEN|PASSWORD)|nc\s+-[^\n]*\d+\.\d+/i,
+    },
+    {
+        id: 'base64-exec',
+        severity: 'critical',
+        description: 'Base64-decoded payload piped to execution',
+        regex: /base64\s+(?:-d|--decode)[^\n]*\|\s*(?:ba)?sh\b/i,
     },
     {
         id: 'powershell-download',
@@ -118,12 +136,42 @@ function collectConfigFiles(cwd) {
     }
     return [...new Set(files)];
 }
+/** Check if a line is inside a markdown code fence or inline code */
+function isInCodeContext(lines, lineIndex) {
+    const line = lines[lineIndex];
+    // Check if the match is inside inline backticks on this line
+    // Simple heuristic: line contains backtick-wrapped content with the pattern
+    if (/`[^`]*\$\([^)]+\)[^`]*`/.test(line))
+        return true;
+    // Check if we're inside a fenced code block (``` or ~~~)
+    let inFence = false;
+    for (let i = 0; i < lineIndex; i++) {
+        if (/^```|^~~~/.test(lines[i].trim()))
+            inFence = !inFence;
+    }
+    return inFence;
+}
+/** Check if a file is a CI/workflow file where shell commands are expected */
+function isWorkflowFile(relPath) {
+    const normalized = relPath.replace(/\\/g, '/');
+    return normalized.includes('.github/workflows/') ||
+        normalized.includes('.circleci/') ||
+        normalized.includes('.gitlab-ci') ||
+        /Makefile|Dockerfile|Jenkinsfile/i.test(normalized);
+}
 function scanContent(content, relPath) {
     const findings = [];
     const lines = content.split('\n');
+    const isWorkflow = isWorkflowFile(relPath);
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
         for (const pattern of ALL_SCAN_PATTERNS) {
+            // Skip command-substitution checks in workflow files (shell commands are expected)
+            if (pattern.id === 'command-substitution' && isWorkflow)
+                continue;
+            // Skip command-substitution in markdown code contexts
+            if (pattern.id === 'command-substitution' && relPath.endsWith('.md') && isInCodeContext(lines, i))
+                continue;
             if (pattern.regex.test(line)) {
                 pattern.regex.lastIndex = 0;
                 findings.push({

package/dist/checks/secrets.js

@@ -3,6 +3,7 @@ import { join, relative, extname, dirname } from 'node:path';
 import { homedir } from 'node:os';
 import { execSync } from 'node:child_process';
 import { createInterface } from 'node:readline';
+import { collectDirFiles } from '../util.js';
 // ── Shannon entropy ──────────────────────────────────────────────────────────
 function calculateEntropy(str) {
     if (str.length === 0)
@@ -117,25 +118,6 @@ function detectBuildDir(cwd) {
     }
     return null;
 }
-function walkBuild(dir) {
-    const results = [];
-    try {
-        const entries = readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            const full = join(dir, entry.name);
-            if (entry.isDirectory()) {
-                if (entry.name === 'node_modules')
-                    continue;
-                results.push(...walkBuild(full));
-            }
-            else {
-                results.push(full);
-            }
-        }
-    }
-    catch { /* skip */ }
-    return results;
-}
 function shouldScan(filePath) {
     const ext = extname(filePath).toLowerCase();
     if (SKIP_EXTS.has(ext))
@@ -213,7 +195,7 @@ export async function checkSecrets(cwd) {
     // 1. Build output scan
     const buildDir = detectBuildDir(cwd);
     if (buildDir) {
-        const buildFiles = walkBuild(buildDir).filter(f => shouldScan(f));
+        const buildFiles = collectDirFiles(buildDir).filter(f => shouldScan(f));
         for (const file of buildFiles) {
             try {
                 const findings = await scanBuildFile(file);

package/dist/checks/tests.d.ts

@@ -1,2 +1,5 @@
 import type { CheckResult } from '../types.js';
+/** Check if a file has a vet-ignore directive for a specific check in its first 5 lines.
+ *  Format: // vet-ignore: check-name  OR  /* vet-ignore: check-name */
+export declare function hasVetIgnore(content: string, checkName: string): boolean;
 export declare function checkTests(cwd: string, ignore: string[]): CheckResult;

package/dist/checks/tests.js

@@ -191,6 +191,13 @@ function findDuplicateDescribes(lines, file) {
     }
     return issues;
 }
+/** Check if a file has a vet-ignore directive for a specific check in its first 5 lines.
+ *  Format: // vet-ignore: check-name  OR  /* vet-ignore: check-name */
+export function hasVetIgnore(content, checkName) {
+    const firstLines = content.split('\n').slice(0, 5);
+    const re = new RegExp(`(?://|/\\*|#)\\s*vet-ignore:\\s*${checkName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
+    return firstLines.some(line => re.test(line));
+}
 export function checkTests(cwd, ignore) {
     const allFiles = walkFiles(cwd, ignore);
     const testFiles = allFiles.filter(f => isTestFile(f));
@@ -203,6 +210,9 @@ export function checkTests(cwd, ignore) {
         catch {
             continue;
         }
+        // Skip files with vet-ignore: tests directive
+        if (hasVetIgnore(content, 'tests'))
+            continue;
         const lines = content.split('\n');
         issues.push(...findTautological(lines, rel));
         issues.push(...findEmptyBodies(content, rel));

package/dist/checks/verify.js

@@ -21,6 +21,18 @@ const CONFIG_EXTENSIONS = new Set([
 const CONFIG_DIRS = ['.github/', '.husky/', '.vscode/', '.idea/'];
 const META_FILES = new Set([
     'FUNDING.yaml', 'CODEOWNERS', 'LICENSE',
+    'py.typed', 'MANIFEST.in', 'CITATION.cff',
+]);
+const META_EXTENSIONS = new Set([
+    '.cff', '.mdc', '.txt', '.html', '.md', '.rst', '.csv',
+    '.css', '.scss', '.less', '.map', '.wasm',
+    '.sh', '.bash', '.zsh', '.fish', '.bat', '.cmd', '.ps1',
+    '.sql', '.graphql', '.gql', '.proto',
+]);
+/** Source code extensions that should be checked for thin files */
+const SOURCE_CODE_EXTS = new Set([
+    '.ts', '.js', '.tsx', '.jsx', '.mts', '.mjs', '.cts', '.cjs',
+    '.py', '.go', '.rs', '.java', '.rb', '.php', '.cs', '.swift', '.kt',
 ]);
 function isConfigOrMetaFile(filePath) {
     const base = basename(filePath);
@@ -32,6 +44,9 @@ function isConfigOrMetaFile(filePath) {
     // Config extensions
     if (CONFIG_EXTENSIONS.has(ext))
         return true;
+    // Meta/non-source extensions
+    if (META_EXTENSIONS.has(ext))
+        return true;
     // Config directories
     if (CONFIG_DIRS.some(d => normalized.includes(d) || normalized.startsWith(d)))
         return true;
@@ -40,6 +55,9 @@ function isConfigOrMetaFile(filePath) {
         return true;
     if (base.startsWith('CHANGELOG'))
         return true;
+    // Any file that is NOT source code should not be flagged for thin content
+    if (!SOURCE_CODE_EXTS.has(ext))
+        return true;
     return false;
 }
 // ── Code file extensions for test detection ──────────────────────────────────
@@ -127,16 +145,26 @@ function isPythonProject(cwd) {
     const markers = ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt'];
     return markers.some(m => existsSync(join(cwd, m)));
 }
+/** Directories where small files are expected (examples, demos, docs) */
+const SMALL_FILE_DIRS = ['examples/', 'example/', 'demos/', 'demo/', 'docs/'];
 function isPythonBoilerplate(filePath) {
     const base = basename(filePath);
     if (base === '__init__.py')
         return true;
+    if (base === '__main__.py')
+        return true;
+    if (base === 'py.typed')
+        return true;
     if (filePath.endsWith('.pyi'))
         return true;
     if (filePath.replace(/\\/g, '/').includes('__pycache__/'))
         return true;
     return false;
 }
+function isInSmallFileDir(filePath) {
+    const normalized = filePath.replace(/\\/g, '/');
+    return SMALL_FILE_DIRS.some(d => normalized.includes(d) || normalized.startsWith(d));
+}
 // ── Main check ───────────────────────────────────────────────────────────────
 export function checkVerify(cwd, since) {
     const issues = [];
@@ -220,8 +248,13 @@ export function checkVerify(cwd, since) {
         }
         const lineCount = countLines(content);
         // 2. File must have meaningful content (>10 non-empty lines)
-        // Skip thin file check for Python boilerplate files
-        if (python && isPythonBoilerplate(relPath)) {
+        // Skip thin file check for Python boilerplate files (always, regardless of project type)
+        if (isPythonBoilerplate(relPath)) {
+            verified++;
+            continue;
+        }
+        // Skip thin file check for files in examples/docs directories
+        if (isInSmallFileDir(relPath)) {
             verified++;
             continue;
         }