jev-crawlers
Bug-hunting crawlers built from five Unix-style primitives.
Recursive crawlers that look for bugs, built out of seed, expand, judge, verify and report. Every node in the crawl carries its own typed judgment from Jev.
# jev-crawlers [](LICENSE) [](https://github.com/Thingscorp/jev-crawlers/actions/workflows/test.yml) [](package.json) **Jev learns your repo's decision norms, then adversarially judges past decisions against them** — as small unix tools for bug-discovery: one tool, one job, JSON lines on stdin/stdout, composed with pipes. AI writes code faster than humans can review it. Linters match patterns; one-shot AI reviewers read a diff once and stop. These tools follow the lead — "who else calls this?", "what config changes it?", "where does this input become trusted?" — until the lead dries up. The trick is cheap judgment: [Jev](https://vercel.com/docs/ai-gateway) (typesafe-ai/jev, via the Vercel AI Gateway) returns typed verdicts (choice, boolean, score) for a fraction of a cent per node in our calibration runs, so you can judge every node instead of every scan. ## Verified claims Every claim below is backed by a mocked test in `test/` — no network, no key, no charges. Run them yourself: `npm test` (`node --test 'test/*.test.mjs'`: 46 tests across 9 files). | Claim | Backing data | |---|---| | Credentials are redacted before the judge state is built | `test/pack-state.test.mjs`: `packState` strips the value from `api_key = "..."` and the state contains `[REDACTED:credential]`; `test/redact.test.mjs`: key-name assignment redacts only the value, PEM private keys redacted (certificates not), `ghp_`/`sk-ant-`/`sk-` prefixes redacted, short fragments and prose mentions untouched | | Excerpts are windowed around the hit line, never the first N lines of the file | `test/search.test.mjs`: `fileExcerpt` windows ±N around line 50 of 80 and reports `excerptStartLine`; `test/pack-state.test.mjs`: a deep hit at line 500 with `excerptStartLine` keeps `HIT-500` and drops `HIT-1` | | Fa