@safetnsr/vet 1.9.0 → 1.10.0

package/README.md

@@ -40,6 +40,7 @@ a codebase that scores well here gives AI agents better context, fewer hallucina
 | **secrets** | scans dist/, build/, .next/ + .env files for leaked API keys using pattern + entropy analysis |
 | **history** | git commit churn, AI attribution ratios, suspiciously large changes |
 | **receipt** | parses Claude Code session logs — files changed, commands run, packages installed, SHA256 integrity hash |
+| **compact** | compaction forensics — what context got dropped during Claude Code session compaction |
 
 plus: **integrity** (hallucinated imports), **deps** (unused/phantom dependencies), **owasp** (OWASP Top 10 for AI agents), **verify** (validates agent claims against actual changes).
 
@@ -91,6 +92,9 @@ npx @safetnsr/vet init
 # agent session receipt
 npx @safetnsr/vet receipt
 npx @safetnsr/vet receipt --json
+
+# compaction forensics for claude sessions
+npx @safetnsr/vet compact [log]
 ```
 
 ## --fix

package/dist/checks/deps.d.ts

@@ -3,4 +3,6 @@ export declare function levenshtein(a: string, b: string): number;
 export declare function extractImports(source: string): string[];
 export declare function extractPackageName(specifier: string): string | null;
 export declare function isBuiltin(specifier: string): boolean;
+export declare function detectWorkspacePackages(cwd: string): Set<string>;
+export declare function detectProvidedDeps(cwd: string): Set<string>;
 export declare function checkDeps(cwd: string): Promise<CheckResult>;

package/dist/checks/deps.js

@@ -1,5 +1,5 @@
 import { join } from 'node:path';
-import { readFileSync } from 'node:fs';
+import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs';
 import { walkFiles, readFile } from '../util.js';
 // ── Top packages list (~150 popular npm packages) ────────────────────────────
 const TOP_PACKAGES = [
@@ -146,6 +146,140 @@ async function checkRegistry(packages) {
     }
     return results;
 }
+// ── Workspace detection ──────────────────────────────────────────────────────
+export function detectWorkspacePackages(cwd) {
+    const names = new Set();
+    // Detect workspace globs from package.json, pnpm-workspace.yaml, lerna.json
+    const globs = [];
+    try {
+        const pkgRaw = readFile(join(cwd, 'package.json'));
+        if (pkgRaw) {
+            const pkg = JSON.parse(pkgRaw);
+            if (Array.isArray(pkg.workspaces)) {
+                globs.push(...pkg.workspaces);
+            }
+            else if (pkg.workspaces?.packages) {
+                globs.push(...pkg.workspaces.packages);
+            }
+        }
+    }
+    catch { /* skip */ }
+    try {
+        const pnpmWs = readFile(join(cwd, 'pnpm-workspace.yaml'));
+        if (pnpmWs) {
+            // Simple YAML parse: extract lines like "  - 'packages/*'"
+            const matches = pnpmWs.matchAll(/['"]?([^'":\n]+\*[^'":\n]*)['"]?/g);
+            for (const m of matches)
+                globs.push(m[1].trim());
+        }
+    }
+    catch { /* skip */ }
+    try {
+        const lernaRaw = readFile(join(cwd, 'lerna.json'));
+        if (lernaRaw) {
+            const lerna = JSON.parse(lernaRaw);
+            if (Array.isArray(lerna.packages))
+                globs.push(...lerna.packages);
+        }
+    }
+    catch { /* skip */ }
+    // Resolve globs to workspace package.json files
+    for (const glob of globs) {
+        // Handle simple globs like "packages/*"
+        const parts = glob.replace(/\/$/, '').split('/');
+        const starIdx = parts.indexOf('*');
+        if (starIdx === -1) {
+            // Exact directory
+            try {
+                const pkgPath = join(cwd, glob, 'package.json');
+                const raw = readFile(pkgPath);
+                if (raw) {
+                    const pkg = JSON.parse(raw);
+                    if (pkg.name)
+                        names.add(pkg.name);
+                }
+            }
+            catch { /* skip */ }
+        }
+        else {
+            // Wildcard — list directory at the non-wildcard prefix
+            const prefix = parts.slice(0, starIdx).join('/');
+            const prefixDir = join(cwd, prefix);
+            try {
+                if (existsSync(prefixDir) && statSync(prefixDir).isDirectory()) {
+                    for (const entry of readdirSync(prefixDir)) {
+                        const entryDir = join(prefixDir, entry);
+                        try {
+                            if (!statSync(entryDir).isDirectory())
+                                continue;
+                            // If there are more parts after *, recurse
+                            const suffix = parts.slice(starIdx + 1);
+                            const pkgDir = suffix.length > 0 ? join(entryDir, ...suffix) : entryDir;
+                            const pkgPath = join(pkgDir, 'package.json');
+                            const raw = readFile(pkgPath);
+                            if (raw) {
+                                const pkg = JSON.parse(raw);
+                                if (pkg.name)
+                                    names.add(pkg.name);
+                            }
+                        }
+                        catch { /* skip */ }
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+    }
+    return names;
+}
+// ── Plugin host-provided deps ────────────────────────────────────────────────
+export function detectProvidedDeps(cwd) {
+    const provided = new Set();
+    try {
+        const pkgRaw = readFile(join(cwd, 'package.json'));
+        if (!pkgRaw)
+            return provided;
+        const pkg = JSON.parse(pkgRaw);
+        const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
+        // Obsidian plugin
+        const hasObsidian = 'obsidian' in (allDeps || {});
+        const manifestPath = join(cwd, 'manifest.json');
+        let hasManifestId = false;
+        try {
+            const manifestRaw = readFile(manifestPath);
+            if (manifestRaw) {
+                const manifest = JSON.parse(manifestRaw);
+                if (manifest.id)
+                    hasManifestId = true;
+            }
+        }
+        catch { /* skip */ }
+        if (hasObsidian || hasManifestId) {
+            provided.add('obsidian');
+            provided.add('electron');
+            // @codemirror/* is handled by prefix check below
+            provided.add('@codemirror/*');
+        }
+        // VSCode extension
+        if (pkg.engines?.vscode) {
+            provided.add('vscode');
+        }
+        // Electron app
+        if (allDeps?.electron) {
+            provided.add('electron');
+        }
+    }
+    catch { /* skip */ }
+    return provided;
+}
+function isProvidedPackage(pkg, provided) {
+    if (provided.has(pkg))
+        return true;
+    // Handle @codemirror/* wildcard
+    if (provided.has('@codemirror/*') && pkg.startsWith('@codemirror/'))
+        return true;
+    return false;
+}
 // ── Main check ───────────────────────────────────────────────────────────────
 export async function checkDeps(cwd) {
     try {
@@ -260,9 +394,18 @@ export async function checkDeps(cwd) {
                 });
             }
         }
+        // Detect workspace packages and host-provided deps
+        const workspacePackages = detectWorkspacePackages(cwd);
+        const providedDeps = detectProvidedDeps(cwd);
         // Phantom imports: imported but not declared
         for (const pkg of importedPackages) {
             if (!declaredSet.has(pkg)) {
+                // Skip workspace packages
+                if (workspacePackages.has(pkg))
+                    continue;
+                // Skip host-provided deps
+                if (isProvidedPackage(pkg, providedDeps))
+                    continue;
                 issues.push({
                     severity: 'warning',
                     message: `phantom import: "${pkg}" is imported but not in package.json`,

package/dist/checks/integrity.js

@@ -102,6 +102,9 @@ function extractRelativeImports(source) {
     }
     return imports;
 }
+function isBuildArtifactImport(importPath) {
+    return /(?:^|\/)(?:dist|build)\//.test(importPath);
+}
 function checkHallucinatedImports(cwd, files) {
     const issues = [];
     const sourceExts = new Set(['.ts', '.tsx', '.js', '.jsx', '.mts', '.mjs', '.cts', '.cjs']);
@@ -111,11 +114,17 @@ function checkHallucinatedImports(cwd, files) {
             continue;
         if (file.includes('node_modules'))
             continue;
+        // Skip .d.ts declaration files — they reference build outputs
+        if (file.endsWith('.d.ts'))
+            continue;
         const content = readFile(join(cwd, file));
         if (!content)
             continue;
         const relImports = extractRelativeImports(content);
         for (const imp of relImports) {
+            // Skip build artifact imports (./dist/..., ../build/...)
+            if (isBuildArtifactImport(imp.path))
+                continue;
             // Skip .js extensions pointing to .ts files (common in ESM TypeScript)
             // The resolver already handles this
             if (!resolveRelativeImport(imp.path, file, cwd)) {

package/dist/checks/memory.js

@@ -1,6 +1,7 @@
 import { join, resolve } from 'node:path';
 import { existsSync, readdirSync, statSync, readFileSync } from 'node:fs';
 import { readFile } from '../util.js';
+import { detectWorkspacePackages } from './deps.js';
 // ── Memory file targets ──────────────────────────────────────────────────────
 const ROOT_FILES = ['CLAUDE.md', 'AGENTS.md', 'SOUL.md', '.cursorrules', 'codex.md'];
 const MEMORY_DIR = 'memory';
@@ -166,6 +167,10 @@ export function checkMemory(cwd) {
         }
         catch { /* skip */ }
     }
+    // Include workspace package names
+    const workspacePackages = detectWorkspacePackages(cwd);
+    for (const name of workspacePackages)
+        allDeps.add(name);
     // Collect all tool mentions across files for contradiction detection
     const globalToolMentions = new Map();
     for (const filePath of memoryFiles) {

package/dist/checks/verify.js

@@ -38,6 +38,18 @@ function isConfigOrMetaFile(filePath) {
     const base = basename(filePath);
     const ext = extname(filePath).toLowerCase();
     const normalized = filePath.replace(/\\/g, '/');
+    // All .d.ts declaration files
+    if (filePath.endsWith('.d.ts'))
+        return true;
+    // *.config.* pattern (vite.config.ts, postcss.config.js, tailwind.config.ts, etc.)
+    if (/\.config\.[a-z]+$/i.test(base))
+        return true;
+    // *.rc.* or dotfile rc pattern (.eslintrc.js, .prettierrc.cjs, etc.)
+    if (/\.rc\.[a-z]+$/i.test(base) || /^\.[a-z]+rc$/i.test(base) || /^\.[a-z]+rc\.[a-z]+$/i.test(base))
+        return true;
+    // tsconfig variants (tsconfig.json, tsconfig.build.json, etc.)
+    if (/^tsconfig(\..+)?\.json$/i.test(base))
+        return true;
     // Dotfiles
     if (CONFIG_DOTFILES.has(base))
         return true;
@@ -303,6 +315,12 @@ export function checkVerify(cwd, since) {
             verified++;
             continue;
         }
+        // Skip barrel index files (index.ts/js/tsx/jsx under 15 lines)
+        const indexNames = new Set(['index.ts', 'index.js', 'index.tsx', 'index.jsx']);
+        if (indexNames.has(basename(relPath)) && lineCount < 15) {
+            verified++;
+            continue;
+        }
         if (lineCount < 10 && lineCount > 0) {
             issues.push({
                 severity: 'warning',

package/dist/cli.js

@@ -25,7 +25,7 @@ import { reportPretty, reportJSON, reportBadge } from './reporter.js';
 const args = process.argv.slice(2);
 const flags = new Set(args.filter(a => a.startsWith('-') && !a.startsWith('--since')));
 const flagMap = new Map();
-// Parse --since=value or --since value
+// Parse --since=value or --since value, --max-files=value
 for (let i = 0; i < args.length; i++) {
     if (args[i].startsWith('--since=')) {
         flagMap.set('since', args[i].split('=')[1]);
@@ -34,6 +34,13 @@ for (let i = 0; i < args.length; i++) {
         flagMap.set('since', args[i + 1]);
         i++;
     }
+    else if (args[i].startsWith('--max-files=')) {
+        flagMap.set('max-files', args[i].split('=')[1]);
+    }
+    else if (args[i] === '--max-files' && args[i + 1]) {
+        flagMap.set('max-files', args[i + 1]);
+        i++;
+    }
 }
 const positional = args.filter(a => !a.startsWith('-'));
 if (flags.has('--help') || flags.has('-h')) {
@@ -72,6 +79,7 @@ if (flags.has('--help') || flags.has('-h')) {
     --watch       re-run on file changes
     --json        JSON output
     --pretty      force pretty output (even in pipes)
+    --max-files N limit file scanning (default: 2000)
     -h, --help    show this help
     -v, --version show version
 `);
@@ -97,6 +105,7 @@ const isWatch = flags.has('--watch');
 const isBadge = flags.has('--badge');
 const isJSON = flags.has('--json') || (!process.stdout.isTTY && !flags.has('--pretty') && !isBadge);
 const since = flagMap.get('since');
+const maxFiles = parseInt(flagMap.get('max-files') || '2000', 10) || 2000;
 // Load config
 let config = {};
 const configContent = readFile(resolve(cwd, '.vetrc'));
@@ -207,39 +216,69 @@ if (isFix) {
     }
     process.exit(0);
 }
+/** Run a check with a per-check timeout (30s). Returns a skip result on timeout. */
+async function withTimeout(name, fn, timeoutMs = 30_000) {
+    return new Promise((res) => {
+        const timer = setTimeout(() => {
+            if (!isJSON)
+                console.error(`  ${c.yellow}⚠ ${name} check timed out after ${timeoutMs / 1000}s — skipped${c.reset}`);
+            res({ name, score: 100, maxScore: 100, issues: [], summary: `skipped (timeout after ${timeoutMs / 1000}s)` });
+        }, timeoutMs);
+        Promise.resolve(fn()).then((r) => { clearTimeout(timer); res(r); }).catch(() => { clearTimeout(timer); res({ name, score: 100, maxScore: 100, issues: [], summary: 'check failed' }); });
+    });
+}
 async function runChecks() {
+    const globalStart = Date.now();
+    const GLOBAL_TIMEOUT = 120_000;
     try {
+        // Check file count and warn if large
+        const { walkFiles: wf } = await import('./util.js');
+        const allProjectFiles = wf(cwd, [], maxFiles);
+        if (allProjectFiles.length >= maxFiles) {
+            if (!isJSON)
+                console.log(`  ${c.yellow}Large project (${allProjectFiles.length}+ files) — scanning first ${maxFiles} files. Use --max-files to increase.${c.reset}\n`);
+        }
         // Run all checks, grouped into categories
         // Security: scan, secrets, config, models, owasp, permissions
         const [scanResult, secretsResult, configResult, modelsResult, owaspResult] = await Promise.all([
-            Promise.resolve(checkScan(cwd)),
-            checkSecrets(cwd),
-            Promise.resolve(checkConfig(cwd, ignore)),
-            checkModels(cwd, ignore),
-            Promise.resolve(checkOwasp(cwd)),
+            withTimeout('scan', () => checkScan(cwd)),
+            withTimeout('secrets', () => checkSecrets(cwd)),
+            withTimeout('config', () => checkConfig(cwd, ignore)),
+            withTimeout('models', () => checkModels(cwd, ignore)),
+            withTimeout('owasp', () => checkOwasp(cwd)),
         ]);
-        const permissionsResult = checkPermissions(cwd);
+        const permissionsResult = await withTimeout('permissions', () => checkPermissions(cwd));
+        if (Date.now() - globalStart > GLOBAL_TIMEOUT) {
+            if (!isJSON)
+                console.error(`  ${c.yellow}⚠ global timeout (${GLOBAL_TIMEOUT / 1000}s) reached — returning partial results${c.reset}`);
+            return score(cwd, { security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult], integrity: [], debt: [], deps: [] });
+        }
         // Integrity: diff, integrity checks
-        const diffResult = checkDiff(cwd, { since });
-        const integrityResult = await checkIntegrity(cwd, ignore);
+        const diffResult = await withTimeout('diff', () => checkDiff(cwd, { since }));
+        const integrityResult = await withTimeout('integrity', () => checkIntegrity(cwd, ignore));
         // Debt: ready, history, debt
         const [readyResult, debtResult] = await Promise.all([
-            checkReady(cwd, ignore),
-            checkDebt(cwd, ignore),
+            withTimeout('ready', () => checkReady(cwd, ignore)),
+            withTimeout('debt', () => checkDebt(cwd, ignore)),
         ]);
-        const historyResult = checkHistory(cwd);
+        const historyResult = await withTimeout('history', () => checkHistory(cwd));
+        if (Date.now() - globalStart > GLOBAL_TIMEOUT) {
+            if (!isJSON)
+                console.error(`  ${c.yellow}⚠ global timeout (${GLOBAL_TIMEOUT / 1000}s) reached — returning partial results${c.reset}`);
+            return score(cwd, { security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult], integrity: [diffResult, integrityResult], debt: [readyResult, historyResult, debtResult], deps: [] });
+        }
         // Deps: deps
-        const depsResult = await checkDeps(cwd);
+        const depsResult = await withTimeout('deps', () => checkDeps(cwd));
         // Receipt is informational — fold into integrity category but keep low weight
-        const receiptResult = await checkReceipt(cwd);
+        const receiptResult = await withTimeout('receipt', () => checkReceipt(cwd));
         // Compact: compaction forensics
-        const compactResult = await checkCompact(cwd);
+        const compactResult = await withTimeout('compact', () => checkCompact(cwd));
         // Memory: stale facts in agent memory files
-        const memoryResult = checkMemory(cwd);
+        const memoryResult = await withTimeout('memory', () => checkMemory(cwd));
         // Verify: agent claim validation
-        const verifyResult = checkVerify(cwd, since);
+        const verifyResult = await withTimeout('verify', () => checkVerify(cwd, since));
         // Tests: test theater detection
-        const testsResult = checkTests(cwd, ignore);
+        const testsResult = await withTimeout('tests', () => checkTests(cwd, ignore));
         return score(cwd, {
             security: [scanResult, secretsResult, configResult, modelsResult, owaspResult, permissionsResult],
             integrity: [diffResult, integrityResult, receiptResult, compactResult, memoryResult, verifyResult, testsResult],

package/dist/util.d.ts

@@ -17,7 +17,7 @@ export declare function isGitRepo(cwd: string): boolean;
 export declare function readFile(path: string): string | null;
 /** Returns true if the path exists (file or directory). Convenience alias for existsSync. */
 export declare function fileExists(path: string): boolean;
-export declare function walkFiles(dir: string, ignore?: string[]): string[];
+export declare function walkFiles(dir: string, ignore?: string[], maxFiles?: number): string[];
 /** Check if a file is binary by sampling first 512 bytes for null bytes */
 export declare function isTextFile(filePath: string): boolean;
 /** Recursively collect all file paths under a directory */

package/dist/util.js

@@ -41,11 +41,14 @@ export function readFile(path) {
 export function fileExists(path) {
     return existsSync(path);
 }
-export function walkFiles(dir, ignore = []) {
+export function walkFiles(dir, ignore = [], maxFiles) {
     const results = [];
     const defaultIgnore = ['node_modules', '.git', 'dist', 'build', '.next', 'coverage', 'vendor', '__pycache__', '.venv', 'venv'];
     const allIgnore = [...defaultIgnore, ...ignore];
+    let stopped = false;
     function walk(d) {
+        if (stopped)
+            return;
         let entries;
         try {
             entries = readdirSync(d);
@@ -54,6 +57,8 @@ export function walkFiles(dir, ignore = []) {
             return;
         }
         for (const entry of entries) {
+            if (stopped)
+                return;
             if (allIgnore.includes(entry))
                 continue;
             const full = join(d, entry);
@@ -61,15 +66,39 @@ export function walkFiles(dir, ignore = []) {
                 const stat = statSync(full);
                 if (stat.isDirectory())
                     walk(full);
-                else
+                else {
                     results.push(relative(dir, full));
+                    if (maxFiles && results.length >= maxFiles) {
+                        stopped = true;
+                        return;
+                    }
+                }
             }
             catch { /* skip */ }
         }
     }
     walk(dir);
+    // When limited, prioritize src/ files over examples/docs/test
+    if (maxFiles && stopped) {
+        results.sort((a, b) => {
+            const aP = priorityBucket(a);
+            const bP = priorityBucket(b);
+            if (aP !== bP)
+                return aP - bP;
+            return a.localeCompare(b);
+        });
+    }
     return results;
 }
+function priorityBucket(file) {
+    if (file.startsWith('src/') || file.startsWith('lib/') || file.startsWith('app/'))
+        return 0;
+    if (file.startsWith('test/') || file.startsWith('tests/') || file.startsWith('__tests__/'))
+        return 2;
+    if (file.startsWith('examples/') || file.startsWith('docs/') || file.startsWith('example/'))
+        return 3;
+    return 1;
+}
 /** Check if a file is binary by sampling first 512 bytes for null bytes */
 export function isTextFile(filePath) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safetnsr/vet",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "vet your AI-generated code — one command, one score card, one letter grade",
   "type": "module",
   "bin": {