@safetnsr/vet 1.8.0 → 1.8.3

package/dist/checks/config.js

@@ -61,6 +61,10 @@ function analyzeConfig(cwd, configFile, agentName, files) {
     if (completenessChecks > 0) {
         completenessScore = Math.round((completenessHits / completenessChecks) * 10);
     }
+    else {
+        // No framework dependencies detected — completeness is not applicable, don't penalize
+        completenessScore = 10;
+    }
     // Consistency: cross-reference with actual project config
     let consistencyScore = 10;
     const tsconfig = readFile(join(cwd, 'tsconfig.json'));
@@ -80,7 +84,9 @@ function analyzeConfig(cwd, configFile, agentName, files) {
         catch { /* */ }
     }
     // Check if config mentions testing but no test framework installed
-    if ((contentLower.includes('test') || contentLower.includes('spec')) && !deps.vitest && !deps.jest && !deps.mocha && !deps.ava) {
+    // Also check if using Node's built-in test runner (node:test)
+    const usesNodeTest = contentLower.includes('node:test') || contentLower.includes('node test runner') || contentLower.includes('node built-in test');
+    if ((contentLower.includes('test') || contentLower.includes('spec')) && !deps.vitest && !deps.jest && !deps.mocha && !deps.ava && !usesNodeTest) {
         consistencyScore -= 2;
         suggestions.push('config mentions tests but no test framework in dependencies');
     }

package/dist/checks/debt.js

@@ -128,6 +128,18 @@ function extractFunctions(source, file) {
     return fns;
 }
 // ── A) Near-duplicate detection ──────────────────────────────────────────────
+/** Check if functions are in a numbered spec implementation pattern (e.g. asi01, asi02...) */
+function isSpecPattern(group) {
+    if (group.length < 3)
+        return false;
+    const dirs = new Set(group.map(f => f.file.substring(0, f.file.lastIndexOf('/'))));
+    if (dirs.size !== 1)
+        return false; // must be same directory
+    // Check if filenames follow a numbered pattern
+    const bases = group.map(f => f.file.substring(f.file.lastIndexOf('/') + 1));
+    const numbered = bases.filter(b => /\d{2}/.test(b));
+    return numbered.length >= 3;
+}
 function findDuplicates(allFuncs) {
     const issues = [];
     const groups = new Map();
@@ -138,15 +150,21 @@ function findDuplicates(allFuncs) {
         groups.set(fn.hash, existing);
     }
     const reported = new Set();
-    // Exact duplicates
+    // Exact duplicates (only flag if normalized body is substantial)
     for (const [, group] of groups) {
         if (group.length < 2)
             continue;
+        // Skip if the normalized body is too generic (short functions normalize to same hash easily)
+        if (group[0].normalized.length < 65)
+            continue;
         // Deduplicate by name+file
         const key = group.map(f => `${f.file}:${f.name}`).sort().join('|');
         if (reported.has(key))
             continue;
         reported.add(key);
+        // Skip groups that follow a numbered spec pattern (e.g., ASI01-ASI10 checks)
+        if (isSpecPattern(group))
+            continue;
         const locations = group.map(f => `${f.name} (${f.file}:${f.line})`).join(', ');
         issues.push({
             severity: 'warning',
@@ -170,7 +188,7 @@ function findDuplicates(allFuncs) {
             if (a.normalized.length < 30 || b.normalized.length < 30)
                 continue;
             const sim = similarity(a.normalized, b.normalized);
-            if (sim > 0.85) {
+            if (sim > 0.92) {
                 const key = [a.file + ':' + a.name, b.file + ':' + b.name].sort().join('|');
                 if (reported.has(key))
                     continue;
@@ -189,6 +207,18 @@ function findDuplicates(allFuncs) {
     return issues;
 }
 // ── B) Orphaned exports ──────────────────────────────────────────────────────
+function isLibrary(cwd) {
+    try {
+        const raw = readFile(join(cwd, 'package.json'));
+        if (!raw)
+            return false;
+        const pkg = JSON.parse(raw);
+        return !!(pkg.main || pkg.exports || pkg.module || pkg.types || pkg.bin);
+    }
+    catch {
+        return false;
+    }
+}
 function findOrphanedExports(cwd, files) {
     const issues = [];
     const sourceFiles = files.filter(f => isSourceFile(f) && !isTestFile(f));
@@ -237,18 +267,19 @@ function findOrphanedExports(cwd, files) {
             allContent.push(content);
     }
     const allText = allContent.join('\n');
+    const lib = isLibrary(cwd);
     for (const exp of exports) {
         // Check if name appears in import statements across all files
         // import { name } from or import { x, name } from or import { name as y }
         const importPattern = new RegExp(`import\\s+[^;]*\\b${exp.name}\\b[^;]*from\\s+`, 'm');
         if (!importPattern.test(allText)) {
             issues.push({
-                severity: 'warning',
-                message: `orphaned export: "${exp.name}" is exported but never imported`,
+                severity: lib ? 'info' : 'warning',
+                message: `orphaned export: "${exp.name}" is exported but never imported${lib ? ' (library detected — exports may be consumed externally)' : ''}`,
                 file: exp.file,
                 line: exp.line,
                 fixable: true,
-                fixHint: 'remove the export keyword or delete the function',
+                fixHint: lib ? 'may be public API — verify if still needed' : 'remove the export keyword or delete the function',
             });
         }
     }
@@ -344,10 +375,13 @@ export async function checkDebt(cwd, ignore) {
     const driftIssues = findNamingDrift(allFuncs);
     issues.push(...driftIssues);
     // ── Scoring ──────────────────────────────────────────────────────────────
-    const dupPenalty = Math.min(60, dupIssues.length * 15);
-    const orphanPenalty = Math.min(30, orphanIssues.length * 5);
-    const wrapperPenalty = Math.min(15, wrapperIssues.length * 3);
-    const driftPenalty = Math.min(10, driftIssues.length * 2);
+    const dupPenalty = Math.min(50, dupIssues.length * 8);
+    const orphanWarnings = orphanIssues.filter(i => i.severity === 'warning');
+    const orphanPenalty = Math.min(30, orphanWarnings.length * 5);
+    const wrapperWarnings = wrapperIssues.filter(i => i.severity === 'warning');
+    const driftWarnings = driftIssues.filter(i => i.severity === 'warning');
+    const wrapperPenalty = Math.min(15, wrapperWarnings.length * 3);
+    const driftPenalty = Math.min(10, driftWarnings.length * 2);
     const rawScore = 100 - dupPenalty - orphanPenalty - wrapperPenalty - driftPenalty;
     const finalScore = Math.max(0, Math.round(rawScore));
     // ── Summary ──────────────────────────────────────────────────────────────

package/dist/checks/deps.js

@@ -73,7 +73,8 @@ export function extractImports(source) {
     while ((match = dynamicImport.exec(source)) !== null) {
         imports.add(match[1]);
     }
-    return [...imports];
+    // Filter out template literal fragments (e.g. "${top}" from fixHint strings)
+    return [...imports].filter(s => !s.includes('$'));
 }
 // ── Package name extraction ──────────────────────────────────────────────────
 export function extractPackageName(specifier) {
@@ -130,10 +131,15 @@ async function checkRegistry(packages) {
         }
     }
     // Process in batches of 5
-    const concurrency = 5;
-    for (let i = 0; i < queue.length; i += concurrency) {
-        const batch = queue.slice(i, i + concurrency);
-        await Promise.all(batch.map(checkOne));
+    try {
+        const concurrency = 5;
+        for (let i = 0; i < queue.length; i += concurrency) {
+            const batch = queue.slice(i, i + concurrency);
+            await Promise.all(batch.map(checkOne));
+        }
+    }
+    catch {
+        networkError = true;
     }
     if (networkError) {
         results.set('__network_error__', true);
@@ -142,150 +148,155 @@ async function checkRegistry(packages) {
 }
 // ── Main check ───────────────────────────────────────────────────────────────
 export async function checkDeps(cwd) {
-    const issues = [];
-    // Read package.json
-    let declaredDeps = {};
-    let hasPkgJson = false;
     try {
-        const pkgRaw = readFile(join(cwd, 'package.json'));
-        if (pkgRaw) {
-            const pkg = JSON.parse(pkgRaw);
-            hasPkgJson = true;
-            declaredDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+        const issues = [];
+        // Read package.json
+        let declaredDeps = {};
+        let hasPkgJson = false;
+        try {
+            const pkgRaw = readFile(join(cwd, 'package.json'));
+            if (pkgRaw) {
+                const pkg = JSON.parse(pkgRaw);
+                hasPkgJson = true;
+                declaredDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+            }
         }
-    }
-    catch { /* skip */ }
-    if (!hasPkgJson) {
-        return {
-            name: 'deps',
-            score: 100,
-            maxScore: 100,
-            issues: [],
-            summary: 'no package.json found',
-        };
-    }
-    const declaredNames = Object.keys(declaredDeps);
-    // ── 1. Registry check (nonexistent packages) ──────────────────────────────
-    const registryResults = await checkRegistry(declaredNames);
-    if (registryResults.get('__network_error__')) {
-        issues.push({
-            severity: 'info',
-            message: 'could not reach npm registry — skipping existence checks',
-            fixable: false,
-        });
-    }
-    for (const pkg of declaredNames) {
-        if (registryResults.get(pkg) === false) {
+        catch { /* skip */ }
+        if (!hasPkgJson) {
+            return {
+                name: 'deps',
+                score: 100,
+                maxScore: 100,
+                issues: [],
+                summary: 'no package.json found',
+            };
+        }
+        const declaredNames = Object.keys(declaredDeps);
+        // ── 1. Registry check (nonexistent packages) ──────────────────────────────
+        const registryResults = await checkRegistry(declaredNames);
+        if (registryResults.get('__network_error__')) {
             issues.push({
-                severity: 'error',
-                message: `phantom dependency: "${pkg}" does not exist on npm`,
-                file: 'package.json',
-                fixable: true,
-                fixHint: 'remove from package.json',
+                severity: 'info',
+                message: 'could not reach npm registry — skipping existence checks',
+                fixable: false,
             });
         }
-    }
-    // ── 2. Typosquat detection ─────────────────────────────────────────────────
-    const topSet = new Set(TOP_PACKAGES);
-    // Known-legitimate short packages that happen to be close to popular ones
-    const TYPOSQUAT_WHITELIST = new Set([
-        'ai', 'clsx', 'ws', 'os', 'ms', 'pg', 'ip', 'bn', 'qs', 'co', 'is',
-    ]);
-    for (const pkg of declaredNames) {
-        if (topSet.has(pkg))
-            continue; // it IS the popular package
-        if (pkg.length <= 3)
-            continue; // too short, too many false matches
-        if (TYPOSQUAT_WHITELIST.has(pkg))
-            continue;
-        for (const top of TOP_PACKAGES) {
-            const dist = levenshtein(pkg, top);
-            if (dist >= 1 && dist <= 2) {
-                // If the package exists on the registry, it's likely legitimate — downgrade to info
-                const existsOnRegistry = registryResults.get(pkg) === true;
+        for (const pkg of declaredNames) {
+            if (registryResults.get(pkg) === false) {
                 issues.push({
-                    severity: existsOnRegistry ? 'info' : 'error',
-                    message: `possible typosquat: "${pkg}" is ${dist} edit${dist > 1 ? 's' : ''} from "${top}"${existsOnRegistry ? ' (exists on npm)' : ''}`,
+                    severity: 'error',
+                    message: `phantom dependency: "${pkg}" does not exist on npm`,
                     file: 'package.json',
                     fixable: true,
-                    fixHint: `did you mean "${top}"?`,
+                    fixHint: 'remove from package.json',
                 });
-                break; // one match is enough
             }
         }
-    }
-    // ── 3 & 4. Dead deps + phantom imports ─────────────────────────────────────
-    const sourceExts = new Set(['.ts', '.js', '.tsx', '.jsx', '.mts', '.mjs', '.cts', '.cjs']);
-    const allFiles = walkFiles(cwd);
-    const isTestFile = (f) => /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || /^test[/\\]/.test(f);
-    const sourceFiles = allFiles.filter(f => {
-        const ext = f.substring(f.lastIndexOf('.'));
-        // Skip test files — they contain import strings as test fixtures, not real imports
-        return sourceExts.has(ext) && !isTestFile(f);
-    });
-    const importedPackages = new Set();
-    for (const file of sourceFiles) {
-        try {
-            const content = readFileSync(join(cwd, file), 'utf-8');
-            const rawImports = extractImports(content);
-            for (const imp of rawImports) {
-                if (isBuiltin(imp))
-                    continue;
-                const pkg = extractPackageName(imp);
-                if (pkg)
-                    importedPackages.add(pkg);
+        // ── 2. Typosquat detection ─────────────────────────────────────────────────
+        const topSet = new Set(TOP_PACKAGES);
+        // Known-legitimate short packages that happen to be close to popular ones
+        const TYPOSQUAT_WHITELIST = new Set([
+            'ai', 'clsx', 'ws', 'os', 'ms', 'pg', 'ip', 'bn', 'qs', 'co', 'is',
+        ]);
+        for (const pkg of declaredNames) {
+            if (topSet.has(pkg))
+                continue; // it IS the popular package
+            if (pkg.length <= 3)
+                continue; // too short, too many false matches
+            if (TYPOSQUAT_WHITELIST.has(pkg))
+                continue;
+            for (const top of TOP_PACKAGES) {
+                const dist = levenshtein(pkg, top);
+                if (dist >= 1 && dist <= 2) {
+                    // If the package exists on the registry, it's likely legitimate — downgrade to info
+                    const existsOnRegistry = registryResults.get(pkg) === true;
+                    issues.push({
+                        severity: existsOnRegistry ? 'info' : 'error',
+                        message: `possible typosquat: "${pkg}" is ${dist} edit${dist > 1 ? 's' : ''} from "${top}"${existsOnRegistry ? ' (exists on npm)' : ''}`,
+                        file: 'package.json',
+                        fixable: true,
+                        fixHint: `did you mean "${top}"?`,
+                    });
+                    break; // one match is enough
+                }
             }
         }
-        catch { /* skip unreadable files */ }
-    }
-    // Dead deps: declared but never imported
-    const declaredSet = new Set(declaredNames);
-    for (const pkg of declaredNames) {
-        if (!importedPackages.has(pkg)) {
-            // Check if it's a CLI tool / plugin / type package (common false positives)
-            // Still flag it, but as info
-            issues.push({
-                severity: 'info',
-                message: `unused dependency: "${pkg}" is declared but never imported`,
-                file: 'package.json',
-                fixable: true,
-                fixHint: 'remove from package.json',
-            });
+        // ── 3 & 4. Dead deps + phantom imports ─────────────────────────────────────
+        const sourceExts = new Set(['.ts', '.js', '.tsx', '.jsx', '.mts', '.mjs', '.cts', '.cjs']);
+        const allFiles = walkFiles(cwd);
+        const isTestFile = (f) => /\.(test|spec)\.[jt]sx?$/.test(f) || f.includes('__tests__') || /^test[/\\]/.test(f);
+        const sourceFiles = allFiles.filter(f => {
+            const ext = f.substring(f.lastIndexOf('.'));
+            // Skip test files — they contain import strings as test fixtures, not real imports
+            return sourceExts.has(ext) && !isTestFile(f);
+        });
+        const importedPackages = new Set();
+        for (const file of sourceFiles) {
+            try {
+                const content = readFileSync(join(cwd, file), 'utf-8');
+                const rawImports = extractImports(content);
+                for (const imp of rawImports) {
+                    if (isBuiltin(imp))
+                        continue;
+                    const pkg = extractPackageName(imp);
+                    if (pkg)
+                        importedPackages.add(pkg);
+                }
+            }
+            catch { /* skip unreadable files */ }
         }
-    }
-    // Phantom imports: imported but not declared
-    for (const pkg of importedPackages) {
-        if (!declaredSet.has(pkg)) {
-            issues.push({
-                severity: 'warning',
-                message: `phantom import: "${pkg}" is imported but not in package.json`,
-                fixable: true,
-                fixHint: `run: npm install ${pkg}`,
-            });
+        // Dead deps: declared but never imported
+        const declaredSet = new Set(declaredNames);
+        for (const pkg of declaredNames) {
+            if (!importedPackages.has(pkg)) {
+                // Check if it's a CLI tool / plugin / type package (common false positives)
+                // Still flag it, but as info
+                issues.push({
+                    severity: 'info',
+                    message: `unused dependency: "${pkg}" is declared but never imported`,
+                    file: 'package.json',
+                    fixable: true,
+                    fixHint: 'remove from package.json',
+                });
+            }
         }
+        // Phantom imports: imported but not declared
+        for (const pkg of importedPackages) {
+            if (!declaredSet.has(pkg)) {
+                issues.push({
+                    severity: 'warning',
+                    message: `phantom import: "${pkg}" is imported but not in package.json`,
+                    fixable: true,
+                    fixHint: `run: npm install ${pkg}`,
+                });
+            }
+        }
+        // ── Scoring ────────────────────────────────────────────────────────────────
+        const errors = issues.filter(i => i.severity === 'error').length;
+        const warnings = issues.filter(i => i.severity === 'warning').length;
+        const rawScore = 100 - (errors * 30) - (warnings * 10);
+        const finalScore = Math.max(0, Math.min(100, rawScore));
+        // ── Summary ────────────────────────────────────────────────────────────────
+        const parts = [];
+        if (errors > 0)
+            parts.push(`${errors} error${errors !== 1 ? 's' : ''}`);
+        if (warnings > 0)
+            parts.push(`${warnings} warning${warnings !== 1 ? 's' : ''}`);
+        const infos = issues.filter(i => i.severity === 'info').length;
+        if (infos > 0)
+            parts.push(`${infos} info`);
+        const summary = parts.length === 0
+            ? `${declaredNames.length} dependencies checked, all clean`
+            : `${declaredNames.length} dependencies: ${parts.join(', ')}`;
+        return {
+            name: 'deps',
+            score: finalScore,
+            maxScore: 100,
+            issues,
+            summary,
+        };
+    }
+    catch {
+        return { name: 'deps', score: 100, maxScore: 100, issues: [], summary: 'deps check failed' };
     }
-    // ── Scoring ────────────────────────────────────────────────────────────────
-    const errors = issues.filter(i => i.severity === 'error').length;
-    const warnings = issues.filter(i => i.severity === 'warning').length;
-    const rawScore = 100 - (errors * 30) - (warnings * 10);
-    const finalScore = Math.max(0, Math.min(100, rawScore));
-    // ── Summary ────────────────────────────────────────────────────────────────
-    const parts = [];
-    if (errors > 0)
-        parts.push(`${errors} error${errors !== 1 ? 's' : ''}`);
-    if (warnings > 0)
-        parts.push(`${warnings} warning${warnings !== 1 ? 's' : ''}`);
-    const infos = issues.filter(i => i.severity === 'info').length;
-    if (infos > 0)
-        parts.push(`${infos} info`);
-    const summary = parts.length === 0
-        ? `${declaredNames.length} dependencies checked, all clean`
-        : `${declaredNames.length} dependencies: ${parts.join(', ')}`;
-    return {
-        name: 'deps',
-        score: finalScore,
-        maxScore: 100,
-        issues,
-        summary,
-    };
 }

package/dist/checks/diff.js

@@ -1,4 +1,13 @@
-import { git } from '../util.js';
+import { git, readFile } from '../util.js';
+import { join } from 'node:path';
+function fileHasVetIgnore(cwd, filePath, checkName) {
+    const content = readFile(join(cwd, filePath));
+    if (!content)
+        return false;
+    const lines = content.split('\n').slice(0, 5);
+    const re = new RegExp(`(?://|/\\*|#)\\s*vet-ignore:\\s*${checkName}\\b`);
+    return lines.some(l => re.test(l));
+}
 // Generic patterns (still useful but not the star)
 const GENERIC_PATTERNS = [
     // Secrets
@@ -83,6 +92,8 @@ export function checkDiff(cwd, opts = {}) {
     const allPatterns = [...GENERIC_PATTERNS, ...AI_PATTERNS];
     // Pattern matching on added lines
     for (const file of files) {
+        if (fileHasVetIgnore(cwd, file.path, 'diff'))
+            continue;
         for (const { num, text } of file.addedLines) {
             for (const pattern of allPatterns) {
                 if (pattern.regex.test(text)) {
@@ -113,13 +124,21 @@ export function checkDiff(cwd, opts = {}) {
             // Extract imported name
             const nameMatch = imp.text.match(/import\s+(?:\{([^}]+)\}|(\w+))/);
             if (nameMatch) {
-                const names = (nameMatch[1] || nameMatch[2] || '').split(',').map(n => n.trim().split(' as ').pop()?.trim()).filter(Boolean);
+                const names = (nameMatch[1] || nameMatch[2] || '').split(',').map(n => n.trim().replace(/^type\s+/, '').split(' as ').pop()?.trim()).filter(Boolean);
                 for (const name of names) {
                     if (!name || name.length < 2)
                         continue;
-                    // Check if name is used in any other added line
-                    const usedElsewhere = file.addedLines.some(l => l !== imp && l.text.includes(name));
-                    if (!usedElsewhere && file.addedLines.length > 3) {
+                    // Check if name is used in any other added line OR in unchanged file content
+                    const usedInAdded = file.addedLines.some(l => l !== imp && l.text.includes(name));
+                    // Also read the full file to check if name is used in existing (unchanged) code
+                    const fullContent = readFile(join(cwd, file.path));
+                    const usedInFile = fullContent ? fullContent.split('\n').some((l, idx) => {
+                        // Skip the import line itself
+                        if (l.trim() === imp.text.trim())
+                            return false;
+                        return l.includes(name);
+                    }) : false;
+                    if (!usedInAdded && !usedInFile && file.addedLines.length > 3) {
                         issues.push({
                             severity: 'warning',
                             message: `[ai] imported "${name}" but never used in new code`,

package/dist/checks/history.js

@@ -66,7 +66,7 @@ export function checkHistory(cwd) {
     const aiPct = commits.length > 0 ? Math.round((aiCommits / commits.length) * 100) : 0;
     const infos = issues.filter(i => i.severity === 'info').length;
     const warnings = issues.filter(i => i.severity === 'warning').length;
-    const score = Math.max(0, Math.min(100, 100 - warnings * 10 - infos * 2));
+    const score = Math.max(0, Math.min(100, 100 - warnings * 10));
     return {
         name: 'history',
         score: Math.round(score),

package/dist/checks/integrity.js

@@ -296,6 +296,19 @@ function isErrorBoundaryFile(file) {
         return true;
     return false;
 }
+/** Next.js server component files where framework handles errors */
+const NEXTJS_SERVER_FILES = /^(page|layout|loading|not-found|template)\.[jt]sx?$/;
+function isNextjsServerComponent(file) {
+    const normalized = file.replace(/\\/g, '/');
+    const base = basename(normalized);
+    // Next.js app directory server components
+    if (NEXTJS_SERVER_FILES.test(base))
+        return true;
+    // Next.js API route handlers (app/api/)
+    if (normalized.includes('app/api/') && /^route\.[jt]sx?$/.test(base))
+        return true;
+    return false;
+}
 /** Check if a file has a top-level error handler (global catch-all) */
 function hasGlobalErrorHandling(content) {
     // process.on('unhandledRejection'/'uncaughtException')
@@ -329,32 +342,56 @@ function checkUnhandledAsync(cwd, files) {
             continue;
         const lines = content.split('\n');
         let unhandledCount = 0;
+        // Build a map of which lines are inside try blocks using brace tracking
+        const insideTry = new Set();
+        const tryStack = [];
+        let braceDepth = 0;
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            // Detect try { 
+            if (/\btry\s*\{/.test(line)) {
+                tryStack.push({ braceDepth });
+            }
+            // Count braces
+            for (const ch of line) {
+                if (ch === '{')
+                    braceDepth++;
+                if (ch === '}') {
+                    braceDepth--;
+                    // Check if we're closing a try block
+                    if (tryStack.length > 0 && braceDepth <= tryStack[tryStack.length - 1].braceDepth) {
+                        tryStack.pop();
+                    }
+                }
+            }
+            if (tryStack.length > 0) {
+                insideTry.add(i);
+            }
+        }
         for (let i = 0; i < lines.length; i++) {
             const line = lines[i];
             // await without try/catch context — detect standalone awaits
-            // We look for: const/let/var x = await or just await on its own, not inside try
             const hasAwait = /^\s*(?:const|let|var)\s+\w.*=\s*await\s+/.test(line) || /^\s*await\s+/.test(line);
             if (!hasAwait)
                 continue;
-            // Check context window — look for try { in surrounding lines
-            const contextStart = Math.max(0, i - 20);
-            const contextEnd = Math.min(lines.length - 1, i + 5);
-            const contextLines = lines.slice(contextStart, contextEnd + 1);
-            const contextText = contextLines.join('\n');
-            // Count try/catch blocks in context
-            const tryCount = (contextText.match(/\btry\s*\{/g) || []).length;
-            const catchCount = (contextText.match(/\bcatch\s*(?:\([^)]*\))?\s*\{/g) || []).length;
-            if (tryCount === 0 || catchCount === 0) {
+            // Skip if inside a try block (proper scope tracking)
+            if (insideTry.has(i))
+                continue;
+            {
                 // Check for .catch() chained on this or next line
                 const hasCatch = /\.catch\s*\(/.test(line) || (i + 1 < lines.length && /\.catch\s*\(/.test(lines[i + 1]));
                 // Check for .then(..., errorHandler) pattern
                 const hasThenError = /\.then\s*\([^,]+,\s*\w+/.test(line) || (i + 1 < lines.length && /\.then\s*\([^,]+,\s*\w+/.test(lines[i + 1]));
                 if (!hasCatch && !hasThenError) {
                     unhandledCount++;
+                    // Downgrade Next.js server components to info (framework handles errors)
+                    const isServerComp = isNextjsServerComponent(file);
                     if (unhandledCount <= 10) {
                         issues.push({
-                            severity: 'warning',
-                            message: 'unhandled async: await without try/catch',
+                            severity: isServerComp ? 'info' : 'warning',
+                            message: isServerComp
+                                ? 'unhandled async: await without try/catch (Next.js server component — framework-managed)'
+                                : 'unhandled async: await without try/catch',
                             file,
                             line: i + 1,
                             fixable: false,
@@ -385,8 +422,8 @@ export async function checkIntegrity(cwd, ignore) {
     score -= hallucinatedIssues.length * 10;
     score -= emptyCatchIssues.filter(i => i.severity === 'error').length * 8;
     score -= stubbedTestIssues.filter(i => i.severity === 'error').length * 5;
-    // Unhandled async capped at -30
-    const unhandledErrors = unhandledAsyncIssues.length;
+    // Unhandled async capped at -30 (only count warnings, not info-downgraded ones)
+    const unhandledErrors = unhandledAsyncIssues.filter(i => i.severity === 'warning').length;
     score -= Math.min(30, unhandledErrors * 3);
     score = Math.max(0, Math.round(score));
     // Summary parts