0sec-cli 0.22.1 → 0.22.4

package/chunks/{chunk-4VGLO2YS.js → chunk-CPCHLL6A.js}

@@ -1,6 +1,9 @@
 #!/usr/bin/env node
 import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
+import {
+  scanExecutionTimeout
+} from "./chunk-YAZARMJY.js";
 
 // packages/core/dist/shared-analysis.js
 import { execFileSync } from "node:child_process";
@@ -69,7 +72,7 @@ function runSemgrepScan(targetPath, emit, opts) {
   let rawOutput;
   try {
     rawOutput = execFileSync("semgrep", args, {
-      timeout: 3e5,
+      timeout: scanExecutionTimeout(3e5),
       stdio: "pipe",
       encoding: "utf-8",
       env: { ...process.env, SEMGREP_SEND_METRICS: "off" }
@@ -143,7 +146,7 @@ function runFoxguardScan(targetPath, emit, opts) {
         try {
           return bufferToString(runner(useNpm ? opts?.foxguardCommand ?? "npx" : "foxguard", useNpm ? ["--yes", `foxguard@${foxguardTag}`, ...args] : args, {
             cwd,
-            timeout: 3e5,
+            timeout: scanExecutionTimeout(3e5),
             maxBuffer: 64 * 1024 * 1024,
             stdio: "pipe",
             encoding: "utf-8"

package/chunks/{chunk-ZKQ2I3S2.js → chunk-DPUXXMJW.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   severityRank
-} from "./chunk-KAU6NLGP.js";
+} from "./chunk-6KFB6AYN.js";
 
 // packages/core/dist/triage/kernel-primitive.js
 function maxSeverity(a, b) {

package/chunks/{chunk-XCISCI4T.js → chunk-E3OOBVOK.js}

@@ -3,7 +3,10 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   jitterFor
-} from "./chunk-YL6YAGLL.js";
+} from "./chunk-SCWWLABR.js";
+import {
+  scanExecutionSignal
+} from "./chunk-YAZARMJY.js";
 
 // packages/core/dist/scope/rate-limit.js
 var TokenBucket = class {
@@ -57,24 +60,26 @@ var TokenBucket = class {
    * the 429 park deadline first, then refill-and-spin with sleeps
    * sized to the exact next-token-available time.
    */
-  async acquire(n = 1) {
+  async acquire(n = 1, signal = scanExecutionSignal()) {
+    signal?.throwIfAborted();
     if (n > this.state.capacity) {
       n = this.state.capacity;
     }
     while (this.nowFn() < this.state.retryUntil) {
       const wait = this.state.retryUntil - this.nowFn();
-      await this.sleepFn(Math.max(1, Math.min(wait, 1e3)));
+      await this.sleepFn(Math.max(1, Math.min(wait, 1e3)), signal);
     }
     while (true) {
+      signal?.throwIfAborted();
       this.refill();
       if (this.state.tokens >= n) {
         this.state.tokens -= n;
-        await this.pace();
+        await this.pace(signal);
         return;
       }
       const tokensNeeded = n - this.state.tokens;
       const waitMs = Math.max(1, Math.ceil(tokensNeeded / this.state.refillRatePerMs));
-      await this.sleepFn(waitMs);
+      await this.sleepFn(waitMs, signal);
     }
   }
   /**
@@ -85,12 +90,13 @@ var TokenBucket = class {
    * yields full jitter in `[0, baseMs]` — rather than growing a second
    * jitter implementation.
    */
-  async pace() {
+  async pace(signal = scanExecutionSignal()) {
+    signal?.throwIfAborted();
     if (!this.jitter)
       return;
     const ms = jitterFor(0, this.jitter.baseMs, this.jitter.rng ?? Math.random);
     if (ms > 0)
-      await this.sleepFn(ms);
+      await this.sleepFn(ms, signal);
   }
   /**
    * Park the bucket until `deadline` (ms since epoch). Subsequent
@@ -187,17 +193,18 @@ var RateLimiter = class _RateLimiter {
    * immediately) — callers should not rely on rate-limiting unknowable
    * hosts. The fetch sites that wire this up always pass full URLs.
    */
-  async acquire(urlOrHost, n = 1) {
+  async acquire(urlOrHost, n = 1, signal = scanExecutionSignal()) {
+    signal?.throwIfAborted();
     const host = this.hostKey(urlOrHost);
     if (!host)
       return;
     const bucket = this.getBucket(host);
     if (bucket.tryConsume(n)) {
-      await bucket.pace();
+      await bucket.pace(signal);
       return;
     }
     this.onThrottle?.();
-    await bucket.acquire(n);
+    await bucket.acquire(n, signal);
   }
   /**
    * Non-blocking variant. Returns true and consumes if available,
@@ -238,8 +245,19 @@ var RateLimiter = class _RateLimiter {
     this.buckets.clear();
   }
 };
-function defaultSleep(ms) {
-  return new Promise((r) => setTimeout(r, ms));
+function defaultSleep(ms, signal) {
+  signal?.throwIfAborted();
+  const { promise, resolve, reject } = Promise.withResolvers();
+  const timer = setTimeout(() => {
+    signal?.removeEventListener("abort", abort);
+    resolve();
+  }, ms);
+  const abort = () => {
+    clearTimeout(timer);
+    reject(signal?.reason ?? new Error("Rate-limit wait cancelled."));
+  };
+  signal?.addEventListener("abort", abort, { once: true });
+  return promise;
 }
 function readHeader(headers, name) {
   if (typeof headers.get === "function") {

package/chunks/{chunk-4G7OVYJX.js → chunk-E74LXQFY.js}

@@ -3,7 +3,7 @@ import { createRequire as __0CreateRequire } from "node:module";
 const require = __0CreateRequire(import.meta.url);
 import {
   LlmApiRuntime
-} from "./chunk-AV2LG2L7.js";
+} from "./chunk-QVIRWJ45.js";
 
 // packages/core/dist/stages/variant-candidates.js
 import { execFileSync } from "node:child_process";

package/chunks/{chunk-OSBPGWTE.js → chunk-ELI3BVIK.js}

@@ -5,13 +5,13 @@ import {
   makeSkepticVerifier,
   runHuntScan,
   scoreGeometry
-} from "./chunk-5BTJMINS.js";
+} from "./chunk-H4DH7COV.js";
 import {
   runReproducerInKernelVm
-} from "./chunk-WZRVS7SB.js";
+} from "./chunk-RCRTSKQN.js";
 import {
   LlmApiRuntime
-} from "./chunk-AV2LG2L7.js";
+} from "./chunk-QVIRWJ45.js";
 import {
   __commonJS,
   __require,