@safetnsr/vet 1.8.0 → 1.8.2

package/dist/checks/debt.js

@@ -189,6 +189,18 @@ function findDuplicates(allFuncs) {
     return issues;
 }
 // ── B) Orphaned exports ──────────────────────────────────────────────────────
+function isLibrary(cwd) {
+    try {
+        const raw = readFile(join(cwd, 'package.json'));
+        if (!raw)
+            return false;
+        const pkg = JSON.parse(raw);
+        return !!(pkg.main || pkg.exports || pkg.module || pkg.types || pkg.bin);
+    }
+    catch {
+        return false;
+    }
+}
 function findOrphanedExports(cwd, files) {
     const issues = [];
     const sourceFiles = files.filter(f => isSourceFile(f) && !isTestFile(f));
@@ -237,18 +249,19 @@ function findOrphanedExports(cwd, files) {
             allContent.push(content);
     }
     const allText = allContent.join('\n');
+    const lib = isLibrary(cwd);
     for (const exp of exports) {
         // Check if name appears in import statements across all files
         // import { name } from or import { x, name } from or import { name as y }
         const importPattern = new RegExp(`import\\s+[^;]*\\b${exp.name}\\b[^;]*from\\s+`, 'm');
         if (!importPattern.test(allText)) {
             issues.push({
-                severity: 'warning',
-                message: `orphaned export: "${exp.name}" is exported but never imported`,
+                severity: lib ? 'info' : 'warning',
+                message: `orphaned export: "${exp.name}" is exported but never imported${lib ? ' (library detected — exports may be consumed externally)' : ''}`,
                 file: exp.file,
                 line: exp.line,
                 fixable: true,
-                fixHint: 'remove the export keyword or delete the function',
+                fixHint: lib ? 'may be public API — verify if still needed' : 'remove the export keyword or delete the function',
             });
         }
     }
@@ -344,7 +357,7 @@ export async function checkDebt(cwd, ignore) {
     const driftIssues = findNamingDrift(allFuncs);
     issues.push(...driftIssues);
     // ── Scoring ──────────────────────────────────────────────────────────────
-    const dupPenalty = Math.min(60, dupIssues.length * 15);
+    const dupPenalty = Math.min(50, dupIssues.length * 8);
     const orphanPenalty = Math.min(30, orphanIssues.length * 5);
     const wrapperPenalty = Math.min(15, wrapperIssues.length * 3);
     const driftPenalty = Math.min(10, driftIssues.length * 2);

package/dist/checks/deps.js

@@ -73,7 +73,8 @@ export function extractImports(source) {
     while ((match = dynamicImport.exec(source)) !== null) {
         imports.add(match[1]);
     }
-    return [...imports];
+    // Filter out template literal fragments (e.g. "${top}" from fixHint strings)
+    return [...imports].filter(s => !s.includes('$'));
 }
 // ── Package name extraction ──────────────────────────────────────────────────
 export function extractPackageName(specifier) {
@@ -130,10 +131,15 @@ async function checkRegistry(packages) {
         }
     }
     // Process in batches of 5
-    const concurrency = 5;
-    for (let i = 0; i < queue.length; i += concurrency) {
-        const batch = queue.slice(i, i + concurrency);
-        await Promise.all(batch.map(checkOne));
+    try {
+        const concurrency = 5;
+        for (let i = 0; i < queue.length; i += concurrency) {
+            const batch = queue.slice(i, i + concurrency);
+            await Promise.all(batch.map(checkOne));
+        }
+    }
+    catch {
+        networkError = true;
     }
     if (networkError) {
         results.set('__network_error__', true);
@@ -142,150 +148,155 @@ async function checkRegistry(packages) {
 }
 // ── Main check ───────────────────────────────────────────────────────────────
 export async function checkDeps(cwd) {
-    const issues = [];
-    // Read package.json
-    let declaredDeps = {};
-    let hasPkgJson = false;
     try {
-        const pkgRaw = readFile(join(cwd, 'package.json'));
-        if (pkgRaw) {
-            const pkg = JSON.parse(pkgRaw);
-            hasPkgJson = true;
-            declaredDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+        const issues = [];
+        // Read package.json
+        let declaredDeps = {};
+        let hasPkgJson = false;
+        try {
+            const pkgRaw = readFile(join(cwd, 'package.json'));
+            if (pkgRaw) {
+                const pkg = JSON.parse(pkgRaw);
+                hasPkgJson = true;
+                declaredDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+            }
         }
-    }
-    catch { /* skip */ }
-    if (!hasPkgJson) {
-        return {
-            name: 'deps',
-            score: 100,
-            maxScore: 100,
-            issues: [],
-            summary: 'no package.json found',
-        };
-    }
-    const declaredNames = Object.keys(declaredDeps);
-    // ── 1. Registry check (nonexistent packages) ──────────────────────────────
-    const registryResults = await checkRegistry(declaredNames);
-    if (registryResults.get('__network_error__')) {
-        issues.push({
-            severity: 'info',
-            message: 'could not reach npm registry — skipping existence checks',
-            fixable: false,
-        });
-    }
-    for (const pkg of declaredNames) {
-        if (registryResults.get(pkg) === false) {
+        catch { /* skip */ }
+        if (!hasPkgJson) {
+            return {
+                name: 'deps',
+                score: 100,
+                maxScore: 100,
+                issues: [],
+                summary: 'no package.json found',
+            };
+        }
+        const declaredNames = Object.keys(declaredDeps);
+        // ── 1. Registry check (nonexistent packages) ──────────────────────────────
+        const registryResults = await checkRegistry(declaredNames);
+        if (registryResults.get('__network_error__')) {
             issues.push({
-                severity: 'error',
-                message: `phantom dependency: "${pkg}" does not exist on npm`,
-                file: 'package.json',
-                fixable: true,
-                fixHint: 'remove from package.json',
+                severity: 'info',
+                message: 'could not reach npm registry — skipping existence checks',
+                fixable: false,
             });
         }
-    }
-    // ── 2. Typosquat detection ─────────────────────────────────────────────────
-    const topSet = new Set(TOP_PACKAGES);
-    // Known-legitimate short packages that happen to be close to popular ones
-    const TYPOSQUAT_WHITELIST = new Set([
-        'ai', 'clsx', 'ws', 'os', 'ms', 'pg', 'ip', 'bn', 'qs', 'co', 'is',
-    ]);
-    for (const pkg of declaredNames) {
-        if (topSet.has(pkg))
-            continue; // it IS the popular package
-        if (pkg.length <= 3)
-            continue; // too short, too many false matches
-        if (TYPOSQUAT_WHITELIST.has(pkg))
-            continue;
-        for (const top of TOP_PACKAGES) {
-            const dist = levenshtein(pkg, top);
-            if (dist >= 1 && dist <= 2) {
-                // If the package exists on the registry, it's likely legitimate — downgrade to info
-                const existsOnRegistry = registryResults.get(pkg) === true;
+        for (const pkg of declaredNames) {
+            if (registryResults.get(pkg) === false) {
                 issues.push({
-                    severity: existsOnRegistry ? 'info' : 'error',
-                    message: `possible typosquat: "${pkg}" is ${dist} edit${dist > 1 ? 's' : ''} from "${top}"${existsOnRegistry ? ' (exists on npm)' : ''}`,
+                    severity: 'error',
+                    message: `phantom dependency: "${pkg}" does not exist on npm`,
                     file: 'package.json',
                     fixable: true,
-                    fixHint: `did you mean "${top}"?`,
+                    fixHint: 'remove from package.json',
                 });
-                break; // one match is enough
             }
         }
-    }
-    // ── 3 & 4. Dead deps + phantom imports ─────────────────────────────────────
-    const sourceExts = new Set(['.ts', '.js', '.tsx', '.jsx', '.mts', '.mjs', '.cts', '.cjs']);
-    const allFiles = walkFiles(cwd);
-    const isTestFile = (f) => /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || /^test[/\\]/.test(f);
-    const sourceFiles = allFiles.filter(f => {
-        const ext = f.substring(f.lastIndexOf('.'));
-        // Skip test files — they contain import strings as test fixtures, not real imports
-        return sourceExts.has(ext) && !isTestFile(f);
-    });
-    const importedPackages = new Set();
-    for (const file of sourceFiles) {
-        try {
-            const content = readFileSync(join(cwd, file), 'utf-8');
-            const rawImports = extractImports(content);
-            for (const imp of rawImports) {
-                if (isBuiltin(imp))
-                    continue;
-                const pkg = extractPackageName(imp);
-                if (pkg)
-                    importedPackages.add(pkg);
+        // ── 2. Typosquat detection ─────────────────────────────────────────────────
+        const topSet = new Set(TOP_PACKAGES);
+        // Known-legitimate short packages that happen to be close to popular ones
+        const TYPOSQUAT_WHITELIST = new Set([
+            'ai', 'clsx', 'ws', 'os', 'ms', 'pg', 'ip', 'bn', 'qs', 'co', 'is',
+        ]);
+        for (const pkg of declaredNames) {
+            if (topSet.has(pkg))
+                continue; // it IS the popular package
+            if (pkg.length <= 3)
+                continue; // too short, too many false matches
+            if (TYPOSQUAT_WHITELIST.has(pkg))
+                continue;
+            for (const top of TOP_PACKAGES) {
+                const dist = levenshtein(pkg, top);
+                if (dist >= 1 && dist <= 2) {
+                    // If the package exists on the registry, it's likely legitimate — downgrade to info
+                    const existsOnRegistry = registryResults.get(pkg) === true;
+                    issues.push({
+                        severity: existsOnRegistry ? 'info' : 'error',
+                        message: `possible typosquat: "${pkg}" is ${dist} edit${dist > 1 ? 's' : ''} from "${top}"${existsOnRegistry ? ' (exists on npm)' : ''}`,
+                        file: 'package.json',
+                        fixable: true,
+                        fixHint: `did you mean "${top}"?`,
+                    });
+                    break; // one match is enough
+                }
             }
         }
-        catch { /* skip unreadable files */ }
-    }
-    // Dead deps: declared but never imported
-    const declaredSet = new Set(declaredNames);
-    for (const pkg of declaredNames) {
-        if (!importedPackages.has(pkg)) {
-            // Check if it's a CLI tool / plugin / type package (common false positives)
-            // Still flag it, but as info
-            issues.push({
-                severity: 'info',
-                message: `unused dependency: "${pkg}" is declared but never imported`,
-                file: 'package.json',
-                fixable: true,
-                fixHint: 'remove from package.json',
-            });
+        // ── 3 & 4. Dead deps + phantom imports ─────────────────────────────────────
+        const sourceExts = new Set(['.ts', '.js', '.tsx', '.jsx', '.mts', '.mjs', '.cts', '.cjs']);
+        const allFiles = walkFiles(cwd);
+        const isTestFile = (f) => /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || /^test[/\\]/.test(f);
+        const sourceFiles = allFiles.filter(f => {
+            const ext = f.substring(f.lastIndexOf('.'));
+            // Skip test files — they contain import strings as test fixtures, not real imports
+            return sourceExts.has(ext) && !isTestFile(f);
+        });
+        const importedPackages = new Set();
+        for (const file of sourceFiles) {
+            try {
+                const content = readFileSync(join(cwd, file), 'utf-8');
+                const rawImports = extractImports(content);
+                for (const imp of rawImports) {
+                    if (isBuiltin(imp))
+                        continue;
+                    const pkg = extractPackageName(imp);
+                    if (pkg)
+                        importedPackages.add(pkg);
+                }
+            }
+            catch { /* skip unreadable files */ }
         }
-    }
-    // Phantom imports: imported but not declared
-    for (const pkg of importedPackages) {
-        if (!declaredSet.has(pkg)) {
-            issues.push({
-                severity: 'warning',
-                message: `phantom import: "${pkg}" is imported but not in package.json`,
-                fixable: true,
-                fixHint: `run: npm install ${pkg}`,
-            });
+        // Dead deps: declared but never imported
+        const declaredSet = new Set(declaredNames);
+        for (const pkg of declaredNames) {
+            if (!importedPackages.has(pkg)) {
+                // Check if it's a CLI tool / plugin / type package (common false positives)
+                // Still flag it, but as info
+                issues.push({
+                    severity: 'info',
+                    message: `unused dependency: "${pkg}" is declared but never imported`,
+                    file: 'package.json',
+                    fixable: true,
+                    fixHint: 'remove from package.json',
+                });
+            }
         }
+        // Phantom imports: imported but not declared
+        for (const pkg of importedPackages) {
+            if (!declaredSet.has(pkg)) {
+                issues.push({
+                    severity: 'warning',
+                    message: `phantom import: "${pkg}" is imported but not in package.json`,
+                    fixable: true,
+                    fixHint: `run: npm install ${pkg}`,
+                });
+            }
+        }
+        // ── Scoring ────────────────────────────────────────────────────────────────
+        const errors = issues.filter(i => i.severity === 'error').length;
+        const warnings = issues.filter(i => i.severity === 'warning').length;
+        const rawScore = 100 - (errors * 30) - (warnings * 10);
+        const finalScore = Math.max(0, Math.min(100, rawScore));
+        // ── Summary ────────────────────────────────────────────────────────────────
+        const parts = [];
+        if (errors > 0)
+            parts.push(`${errors} error${errors !== 1 ? 's' : ''}`);
+        if (warnings > 0)
+            parts.push(`${warnings} warning${warnings !== 1 ? 's' : ''}`);
+        const infos = issues.filter(i => i.severity === 'info').length;
+        if (infos > 0)
+            parts.push(`${infos} info`);
+        const summary = parts.length === 0
+            ? `${declaredNames.length} dependencies checked, all clean`
+            : `${declaredNames.length} dependencies: ${parts.join(', ')}`;
+        return {
+            name: 'deps',
+            score: finalScore,
+            maxScore: 100,
+            issues,
+            summary,
+        };
+    }
+    catch {
+        return { name: 'deps', score: 100, maxScore: 100, issues: [], summary: 'deps check failed' };
     }
-    // ── Scoring ────────────────────────────────────────────────────────────────
-    const errors = issues.filter(i => i.severity === 'error').length;
-    const warnings = issues.filter(i => i.severity === 'warning').length;
-    const rawScore = 100 - (errors * 30) - (warnings * 10);
-    const finalScore = Math.max(0, Math.min(100, rawScore));
-    // ── Summary ────────────────────────────────────────────────────────────────
-    const parts = [];
-    if (errors > 0)
-        parts.push(`${errors} error${errors !== 1 ? 's' : ''}`);
-    if (warnings > 0)
-        parts.push(`${warnings} warning${warnings !== 1 ? 's' : ''}`);
-    const infos = issues.filter(i => i.severity === 'info').length;
-    if (infos > 0)
-        parts.push(`${infos} info`);
-    const summary = parts.length === 0
-        ? `${declaredNames.length} dependencies checked, all clean`
-        : `${declaredNames.length} dependencies: ${parts.join(', ')}`;
-    return {
-        name: 'deps',
-        score: finalScore,
-        maxScore: 100,
-        issues,
-        summary,
-    };
 }

package/dist/checks/diff.js

@@ -1,4 +1,13 @@
-import { git } from '../util.js';
+import { git, readFile } from '../util.js';
+import { join } from 'node:path';
+function fileHasVetIgnore(cwd, filePath, checkName) {
+    const content = readFile(join(cwd, filePath));
+    if (!content)
+        return false;
+    const lines = content.split('\n').slice(0, 5);
+    const re = new RegExp(`(?://|/\\*|#)\\s*vet-ignore:\\s*${checkName}\\b`);
+    return lines.some(l => re.test(l));
+}
 // Generic patterns (still useful but not the star)
 const GENERIC_PATTERNS = [
     // Secrets
@@ -83,6 +92,8 @@ export function checkDiff(cwd, opts = {}) {
     const allPatterns = [...GENERIC_PATTERNS, ...AI_PATTERNS];
     // Pattern matching on added lines
     for (const file of files) {
+        if (fileHasVetIgnore(cwd, file.path, 'diff'))
+            continue;
         for (const { num, text } of file.addedLines) {
             for (const pattern of allPatterns) {
                 if (pattern.regex.test(text)) {
@@ -117,9 +128,17 @@ export function checkDiff(cwd, opts = {}) {
                 for (const name of names) {
                     if (!name || name.length < 2)
                         continue;
-                    // Check if name is used in any other added line
-                    const usedElsewhere = file.addedLines.some(l => l !== imp && l.text.includes(name));
-                    if (!usedElsewhere && file.addedLines.length > 3) {
+                    // Check if name is used in any other added line OR in unchanged file content
+                    const usedInAdded = file.addedLines.some(l => l !== imp && l.text.includes(name));
+                    // Also read the full file to check if name is used in existing (unchanged) code
+                    const fullContent = readFile(join(cwd, file.path));
+                    const usedInFile = fullContent ? fullContent.split('\n').some((l, idx) => {
+                        // Skip the import line itself
+                        if (l.trim() === imp.text.trim())
+                            return false;
+                        return l.includes(name);
+                    }) : false;
+                    if (!usedInAdded && !usedInFile && file.addedLines.length > 3) {
                         issues.push({
                             severity: 'warning',
                             message: `[ai] imported "${name}" but never used in new code`,

package/dist/checks/integrity.js

@@ -296,6 +296,19 @@ function isErrorBoundaryFile(file) {
         return true;
     return false;
 }
+/** Next.js server component files where framework handles errors */
+const NEXTJS_SERVER_FILES = /^(page|layout|loading|not-found|template)\.[jt]sx?$/;
+function isNextjsServerComponent(file) {
+    const normalized = file.replace(/\\/g, '/');
+    const base = basename(normalized);
+    // Next.js app directory server components
+    if (NEXTJS_SERVER_FILES.test(base))
+        return true;
+    // Next.js API route handlers (app/api/)
+    if (normalized.includes('app/api/') && /^route\.[jt]sx?$/.test(base))
+        return true;
+    return false;
+}
 /** Check if a file has a top-level error handler (global catch-all) */
 function hasGlobalErrorHandling(content) {
     // process.on('unhandledRejection'/'uncaughtException')
@@ -329,32 +342,56 @@ function checkUnhandledAsync(cwd, files) {
             continue;
         const lines = content.split('\n');
         let unhandledCount = 0;
+        // Build a map of which lines are inside try blocks using brace tracking
+        const insideTry = new Set();
+        const tryStack = [];
+        let braceDepth = 0;
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // Detect try { 
+            if (/\btry\s*\{/.test(line)) {
+                tryStack.push({ braceDepth });
+            }
+            // Count braces
+            for (const ch of line) {
+                if (ch === '{')
+                    braceDepth++;
+                if (ch === '}') {
+                    braceDepth--;
+                    // Check if we're closing a try block
+                    if (tryStack.length > 0 && braceDepth <= tryStack[tryStack.length - 1].braceDepth) {
+                        tryStack.pop();
+                    }
+                }
+            }
+            if (tryStack.length > 0) {
+                insideTry.add(i);
+            }
+        }
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
             // await without try/catch context — detect standalone awaits
-            // We look for: const/let/var x = await or just await on its own, not inside try
             const hasAwait = /^\s*(?:const|let|var)\s+\w.*=\s*await\s+/.test(line) || /^\s*await\s+/.test(line);
             if (!hasAwait)
                 continue;
-            // Check context window — look for try { in surrounding lines
-            const contextStart = Math.max(0, i - 20);
-            const contextEnd = Math.min(lines.length - 1, i + 5);
-            const contextLines = lines.slice(contextStart, contextEnd + 1);
-            const contextText = contextLines.join('\n');
-            // Count try/catch blocks in context
-            const tryCount = (contextText.match(/\btry\s*\{/g) || []).length;
-            const catchCount = (contextText.match(/\bcatch\s*(?:\([^)]*\))?\s*\{/g) || []).length;
-            if (tryCount === 0 || catchCount === 0) {
+            // Skip if inside a try block (proper scope tracking)
+            if (insideTry.has(i))
+                continue;
+            {
                 // Check for .catch() chained on this or next line
                 const hasCatch = /\.catch\s*\(/.test(line) || (i + 1 < lines.length && /\.catch\s*\(/.test(lines[i + 1]));
                 // Check for .then(..., errorHandler) pattern
                 const hasThenError = /\.then\s*\([^,]+,\s*\w+/.test(line) || (i + 1 < lines.length && /\.then\s*\([^,]+,\s*\w+/.test(lines[i + 1]));
                 if (!hasCatch && !hasThenError) {
                     unhandledCount++;
+                    // Downgrade Next.js server components to info (framework handles errors)
+                    const isServerComp = isNextjsServerComponent(file);
                     if (unhandledCount <= 10) {
                         issues.push({
-                            severity: 'warning',
-                            message: 'unhandled async: await without try/catch',
+                            severity: isServerComp ? 'info' : 'warning',
+                            message: isServerComp
+                                ? 'unhandled async: await without try/catch (Next.js server component — framework-managed)'
+                                : 'unhandled async: await without try/catch',
                             file,
                             line: i + 1,
                             fixable: false,
@@ -385,8 +422,8 @@ export async function checkIntegrity(cwd, ignore) {
     score -= hallucinatedIssues.length * 10;
     score -= emptyCatchIssues.filter(i => i.severity === 'error').length * 8;
     score -= stubbedTestIssues.filter(i => i.severity === 'error').length * 5;
-    // Unhandled async capped at -30
-    const unhandledErrors = unhandledAsyncIssues.length;
+    // Unhandled async capped at -30 (only count warnings, not info-downgraded ones)
+    const unhandledErrors = unhandledAsyncIssues.filter(i => i.severity === 'warning').length;
     score -= Math.min(30, unhandledErrors * 3);
     score = Math.max(0, Math.round(score));
     // Summary parts

package/dist/checks/memory.js

@@ -1,5 +1,6 @@
 import { join, resolve } from 'node:path';
-import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
+import { existsSync, readdirSync, statSync, readFileSync } from 'node:fs';
+import { readFile } from '../util.js';
 // ── Memory file targets ──────────────────────────────────────────────────────
 const ROOT_FILES = ['CLAUDE.md', 'AGENTS.md', 'SOUL.md', '.cursorrules', 'codex.md'];
 const MEMORY_DIR = 'memory';
@@ -11,14 +12,6 @@ const TOOL_CATEGORIES = {
     'package manager': [/\bnpm\b/, /\byarn\b/, /\bpnpm\b/, /\bbun\b/],
 };
 // ── Helpers ──────────────────────────────────────────────────────────────────
-function safeRead(path) {
-    try {
-        return readFileSync(path, 'utf-8');
-    }
-    catch {
-        return null;
-    }
-}
 function collectMemoryFiles(cwd) {
     const files = [];
     // Root-level memory files
@@ -160,6 +153,9 @@ export function checkMemory(cwd) {
     if (existsSync(pkgPath)) {
         try {
             const pkg = JSON.parse(readFileSync(pkgPath, 'utf-8'));
+            // Include the package's own name
+            if (pkg.name)
+                allDeps.add(pkg.name);
             for (const key of ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies']) {
                 if (pkg[key]) {
                     for (const name of Object.keys(pkg[key])) {
@@ -173,7 +169,7 @@ export function checkMemory(cwd) {
     // Collect all tool mentions across files for contradiction detection
     const globalToolMentions = new Map();
     for (const filePath of memoryFiles) {
-        const content = safeRead(filePath);
+        const content = readFile(filePath);
         if (!content)
             continue;
         const relPath = filePath.startsWith(cwd) ? filePath.slice(cwd.length + 1) : filePath;

package/dist/checks/models.js

@@ -19,16 +19,29 @@ function isAiFramework(cwd) {
         }
         catch { /* skip */ }
     }
-    // Check pyproject.toml / setup.py in root AND subdirectories
+    // Check pyproject.toml / setup.py in root AND subdirectories (up to 2 levels deep for monorepos)
     const pyprojectPaths = [join(cwd, 'pyproject.toml')];
     try {
         const entries = readdirSync(cwd);
         for (const entry of entries) {
             if (entry.startsWith('.') || entry === 'node_modules')
                 continue;
-            const subPyproject = join(cwd, entry, 'pyproject.toml');
+            const subPath = join(cwd, entry);
+            const subPyproject = join(subPath, 'pyproject.toml');
             if (existsSync(subPyproject))
                 pyprojectPaths.push(subPyproject);
+            // Check 2 levels deep for monorepos (e.g., libs/langchain/pyproject.toml)
+            try {
+                const subEntries = readdirSync(subPath);
+                for (const subEntry of subEntries) {
+                    if (subEntry.startsWith('.') || subEntry === 'node_modules')
+                        continue;
+                    const deepPyproject = join(subPath, subEntry, 'pyproject.toml');
+                    if (existsSync(deepPyproject))
+                        pyprojectPaths.push(deepPyproject);
+                }
+            }
+            catch { /* not a directory or unreadable */ }
         }
     }
     catch { /* skip */ }
@@ -229,8 +242,13 @@ function builtinModels(cwd, ignore) {
     };
 }
 export async function checkModels(cwd, ignore) {
-    const rich = await tryModelGraveyard(cwd);
-    if (rich)
-        return rich;
-    return builtinModels(cwd, ignore);
+    try {
+        const rich = await tryModelGraveyard(cwd);
+        if (rich)
+            return rich;
+        return builtinModels(cwd, ignore);
+    }
+    catch {
+        return { name: 'models', score: 100, maxScore: 100, issues: [], summary: 'models check failed' };
+    }
 }

package/dist/checks/owasp/asi01-goal-hijack.d.ts

@@ -0,0 +1,5 @@
+import { type OwaspFinding } from './shared.js';
+export declare function checkASI01(cwd: string, configFiles: string[]): {
+    findings: OwaspFinding[];
+    deduction: number;
+};