@ceon-oy/monitor-sdk 1.5.1 → 1.5.3

package/dist/index.d.mts

@@ -217,6 +217,7 @@ declare class MonitorClient {
     private lastScanTime;
     private lastKnownScanRequestedAt;
     private lastKnownTechScanRequestedAt;
+    private currentAuditIntervalHours;
     private versionCheckEnabled;
     private auditTimeoutMs;
     private registryTimeoutMs;
@@ -260,6 +261,21 @@ declare class MonitorClient {
     flush(): Promise<void>;
     private getErrorKey;
     close(): Promise<void>;
+    /**
+     * Node's fetch() (undici) wraps network-level failures (ECONNREFUSED, DNS lookup
+     * failures, TLS errors, ...) in a generic `TypeError: fetch failed`, with the real
+     * reason attached via the standard `cause` chain. Without unwrapping it, every
+     * network failure across the SDK is reported as the same opaque "fetch failed"
+     * message, with no way to diagnose it from the dashboard.
+     */
+    private describeErrorCause;
+    private truncateDescription;
+    /**
+     * Run `fn`, swallowing any throw and returning undefined instead. Used to read
+     * possibly-hostile Error fields (a throwing message/stack/cause getter) without
+     * losing whatever else was already read — each call degrades independently.
+     */
+    private safe;
     /**
      * Queue an SDK error to be reported to the server's system errors page.
      * Fire-and-forget — never throws. If reporting itself fails, logs to console only.
@@ -269,6 +285,7 @@ declare class MonitorClient {
     private startSdkErrorFlushTimer;
     private stopSdkErrorFlushTimer;
     private flushSdkErrors;
+    private clearAuditIntervalTimer;
     private stopAuditIntervalTimer;
     /**
      * Fetch project settings from the monitoring server.
@@ -292,6 +309,12 @@ declare class MonitorClient {
      * Also sets up polling for on-demand scan requests from the server.
      */
     private setupAutoAudit;
+    /**
+     * (Re)configure the recurring audit timer for the given interval, replacing
+     * whichever timer is currently running (if any). intervalHours <= 0 leaves
+     * scanning disabled.
+     */
+    private setAuditInterval;
     /**
      * Run a vulnerability scan and track the time it was run.
      * Uses auditMultiplePaths() if auditPaths is configured, otherwise runs single audit.
@@ -317,6 +340,55 @@ declare class MonitorClient {
     private startFlushTimer;
     private stopFlushTimer;
     syncDependencies(): Promise<void>;
+    /**
+     * How many sequential registry batches a version-fetch over this many packages
+     * will take, given the shared concurrency limit. Shared by fetchLatestVersions
+     * (which does the batching) and calculateSyncTimeoutMs (which budgets for it),
+     * so the two can't drift out of sync with each other.
+     */
+    private registryBatchCount;
+    /**
+     * Estimate a timeout budget that scales with how many roughly-equal-cost units of
+     * sequential work will run (registry batches, audit paths, ...), clamped to a
+     * floor/ceiling. Shared by calculateSyncTimeoutMs and calculateMultiPathAuditTimeoutMs
+     * so the two scaling formulas can't drift apart. At count=0 this always collapses to
+     * floorMs, since overheadMs alone never exceeds a floor sized for real work.
+     */
+    private estimateScaledTimeoutMs;
+    /**
+     * Scale the dependency sync timeout with how many registry lookups AND how many
+     * sequential POSTs (one per source, via sendTechnologiesWithEnvironment) it will
+     * make, so large dependency lists, many dependencySources, or a large requestTimeoutMs
+     * don't spuriously time out against a fixed budget.
+     *
+     * The POST-phase term (sources.length * requestTimeoutMs) is included even when
+     * version checking is off: performDependencySync still does one sequential POST per
+     * source regardless, so a flat overhead that ignores source count would under-budget
+     * that phase exactly the way a flat registry-batch estimate would under-budget large
+     * dependency lists.
+     *
+     * Registry batches are summed PER SOURCE (not over the combined total) because
+     * performDependencySync/fetchLatestVersions batch each source independently and
+     * sequentially — ceil(a/n) + ceil(b/n) can be larger than ceil((a+b)/n), so a
+     * single batch count over the combined total would under-estimate the real
+     * number of sequential registry round-trips when many small sources are configured.
+     */
+    private calculateSyncTimeoutMs;
+    /**
+     * Reads happen before syncDependencies' timeout/AbortSignal exists (see comment
+     * there), so this phase bounds itself with a wall-clock deadline on a budget that
+     * scales with how many sources are configured (mirroring calculateSyncTimeoutMs's
+     * scaling principle for the network phase). A plain deadline timestamp — not an
+     * AbortController — is enough here: readPackageJsonFromPath does purely synchronous,
+     * non-cancelable fs calls, so there is nothing for a signal to actually interrupt;
+     * it can only ever be checked between iterations, exactly like a deadline check.
+     * Once the budget is spent, stop reading further sources rather than always paying
+     * the full read cost for every configured dependencySource regardless of how long
+     * it's already taken — and report it via reportError, not just a console.warn, so a
+     * truncated sync isn't silently indistinguishable from a fully successful one on
+     * the dashboard.
+     */
+    private loadDependencySources;
     private performDependencySync;
     /**
      * Enrich technologies with latest version information from npm registry.
@@ -416,6 +488,13 @@ declare class MonitorClient {
      * Only works in Node.js environment (not browser/bundled).
      */
     private runCommandWithTimeout;
+    /**
+     * `npm audit --json` can exit without emitting valid JSON on stdout — e.g. the
+     * registry is unreachable, or a fatal npm error is written to stderr instead.
+     * Treat that as a soft failure (like a timeout) rather than throwing, so it
+     * doesn't surface as a confusing "Unexpected end of JSON input" SDK_ERROR.
+     */
+    private parseNpmAuditJson;
     /**
      * Run npm audit and send results to the monitoring server.
      * This scans the project for known vulnerabilities in dependencies.
@@ -438,6 +517,13 @@ declare class MonitorClient {
      * @returns Combined summary of all audit results
      */
     auditMultiplePaths(): Promise<MultiAuditSummary | null>;
+    /**
+     * Scale the multi-path audit timeout with how many paths it will scan, so
+     * configuring many auditPaths (or a large per-path auditTimeoutMs) doesn't
+     * spuriously time out the whole batch against a fixed budget — the same
+     * failure mode calculateSyncTimeoutMs fixes for dependency sync.
+     */
+    private calculateMultiPathAuditTimeoutMs;
     private performMultiPathAudit;
     /**
      * Parse npm audit JSON output into vulnerability items
@@ -512,7 +598,8 @@ declare class MonitorClient {
     /**
      * Measure CPU utilization by sampling cpus() twice with a 3s gap.
      * The cumulative counters make this the average utilization over the
-     * window, across all cores of the host. Returns a percentage (0–100).
+     * window, across all cores of the host. Returns a percentage (0–100)
+     * plus the CPU model, read off the same samples at zero extra cost.
      */
     private measureCpuPercent;
     /**
@@ -531,6 +618,7 @@ declare class MonitorClient {
     submitSystemMetric(metric: {
         hostname: string;
         cpuPercent: number;
+        cpuModel?: string | null;
         memoryTotal: number;
         memoryUsed: number;
         memoryPercent: number;

package/dist/index.d.ts

@@ -217,6 +217,7 @@ declare class MonitorClient {
     private lastScanTime;
     private lastKnownScanRequestedAt;
     private lastKnownTechScanRequestedAt;
+    private currentAuditIntervalHours;
     private versionCheckEnabled;
     private auditTimeoutMs;
     private registryTimeoutMs;
@@ -260,6 +261,21 @@ declare class MonitorClient {
     flush(): Promise<void>;
     private getErrorKey;
     close(): Promise<void>;
+    /**
+     * Node's fetch() (undici) wraps network-level failures (ECONNREFUSED, DNS lookup
+     * failures, TLS errors, ...) in a generic `TypeError: fetch failed`, with the real
+     * reason attached via the standard `cause` chain. Without unwrapping it, every
+     * network failure across the SDK is reported as the same opaque "fetch failed"
+     * message, with no way to diagnose it from the dashboard.
+     */
+    private describeErrorCause;
+    private truncateDescription;
+    /**
+     * Run `fn`, swallowing any throw and returning undefined instead. Used to read
+     * possibly-hostile Error fields (a throwing message/stack/cause getter) without
+     * losing whatever else was already read — each call degrades independently.
+     */
+    private safe;
     /**
      * Queue an SDK error to be reported to the server's system errors page.
      * Fire-and-forget — never throws. If reporting itself fails, logs to console only.
@@ -269,6 +285,7 @@ declare class MonitorClient {
     private startSdkErrorFlushTimer;
     private stopSdkErrorFlushTimer;
     private flushSdkErrors;
+    private clearAuditIntervalTimer;
     private stopAuditIntervalTimer;
     /**
      * Fetch project settings from the monitoring server.
@@ -292,6 +309,12 @@ declare class MonitorClient {
      * Also sets up polling for on-demand scan requests from the server.
      */
     private setupAutoAudit;
+    /**
+     * (Re)configure the recurring audit timer for the given interval, replacing
+     * whichever timer is currently running (if any). intervalHours <= 0 leaves
+     * scanning disabled.
+     */
+    private setAuditInterval;
     /**
      * Run a vulnerability scan and track the time it was run.
      * Uses auditMultiplePaths() if auditPaths is configured, otherwise runs single audit.
@@ -317,6 +340,55 @@ declare class MonitorClient {
     private startFlushTimer;
     private stopFlushTimer;
     syncDependencies(): Promise<void>;
+    /**
+     * How many sequential registry batches a version-fetch over this many packages
+     * will take, given the shared concurrency limit. Shared by fetchLatestVersions
+     * (which does the batching) and calculateSyncTimeoutMs (which budgets for it),
+     * so the two can't drift out of sync with each other.
+     */
+    private registryBatchCount;
+    /**
+     * Estimate a timeout budget that scales with how many roughly-equal-cost units of
+     * sequential work will run (registry batches, audit paths, ...), clamped to a
+     * floor/ceiling. Shared by calculateSyncTimeoutMs and calculateMultiPathAuditTimeoutMs
+     * so the two scaling formulas can't drift apart. At count=0 this always collapses to
+     * floorMs, since overheadMs alone never exceeds a floor sized for real work.
+     */
+    private estimateScaledTimeoutMs;
+    /**
+     * Scale the dependency sync timeout with how many registry lookups AND how many
+     * sequential POSTs (one per source, via sendTechnologiesWithEnvironment) it will
+     * make, so large dependency lists, many dependencySources, or a large requestTimeoutMs
+     * don't spuriously time out against a fixed budget.
+     *
+     * The POST-phase term (sources.length * requestTimeoutMs) is included even when
+     * version checking is off: performDependencySync still does one sequential POST per
+     * source regardless, so a flat overhead that ignores source count would under-budget
+     * that phase exactly the way a flat registry-batch estimate would under-budget large
+     * dependency lists.
+     *
+     * Registry batches are summed PER SOURCE (not over the combined total) because
+     * performDependencySync/fetchLatestVersions batch each source independently and
+     * sequentially — ceil(a/n) + ceil(b/n) can be larger than ceil((a+b)/n), so a
+     * single batch count over the combined total would under-estimate the real
+     * number of sequential registry round-trips when many small sources are configured.
+     */
+    private calculateSyncTimeoutMs;
+    /**
+     * Reads happen before syncDependencies' timeout/AbortSignal exists (see comment
+     * there), so this phase bounds itself with a wall-clock deadline on a budget that
+     * scales with how many sources are configured (mirroring calculateSyncTimeoutMs's
+     * scaling principle for the network phase). A plain deadline timestamp — not an
+     * AbortController — is enough here: readPackageJsonFromPath does purely synchronous,
+     * non-cancelable fs calls, so there is nothing for a signal to actually interrupt;
+     * it can only ever be checked between iterations, exactly like a deadline check.
+     * Once the budget is spent, stop reading further sources rather than always paying
+     * the full read cost for every configured dependencySource regardless of how long
+     * it's already taken — and report it via reportError, not just a console.warn, so a
+     * truncated sync isn't silently indistinguishable from a fully successful one on
+     * the dashboard.
+     */
+    private loadDependencySources;
     private performDependencySync;
     /**
      * Enrich technologies with latest version information from npm registry.
@@ -416,6 +488,13 @@ declare class MonitorClient {
      * Only works in Node.js environment (not browser/bundled).
      */
     private runCommandWithTimeout;
+    /**
+     * `npm audit --json` can exit without emitting valid JSON on stdout — e.g. the
+     * registry is unreachable, or a fatal npm error is written to stderr instead.
+     * Treat that as a soft failure (like a timeout) rather than throwing, so it
+     * doesn't surface as a confusing "Unexpected end of JSON input" SDK_ERROR.
+     */
+    private parseNpmAuditJson;
     /**
      * Run npm audit and send results to the monitoring server.
      * This scans the project for known vulnerabilities in dependencies.
@@ -438,6 +517,13 @@ declare class MonitorClient {
      * @returns Combined summary of all audit results
      */
     auditMultiplePaths(): Promise<MultiAuditSummary | null>;
+    /**
+     * Scale the multi-path audit timeout with how many paths it will scan, so
+     * configuring many auditPaths (or a large per-path auditTimeoutMs) doesn't
+     * spuriously time out the whole batch against a fixed budget — the same
+     * failure mode calculateSyncTimeoutMs fixes for dependency sync.
+     */
+    private calculateMultiPathAuditTimeoutMs;
     private performMultiPathAudit;
     /**
      * Parse npm audit JSON output into vulnerability items
@@ -512,7 +598,8 @@ declare class MonitorClient {
     /**
      * Measure CPU utilization by sampling cpus() twice with a 3s gap.
      * The cumulative counters make this the average utilization over the
-     * window, across all cores of the host. Returns a percentage (0–100).
+     * window, across all cores of the host. Returns a percentage (0–100)
+     * plus the CPU model, read off the same samples at zero extra cost.
      */
     private measureCpuPercent;
     /**
@@ -531,6 +618,7 @@ declare class MonitorClient {
     submitSystemMetric(metric: {
         hostname: string;
         cpuPercent: number;
+        cpuModel?: string | null;
         memoryTotal: number;
         memoryUsed: number;
         memoryPercent: number;

package/dist/index.js

@@ -64,9 +64,17 @@ var CONFIG_LIMITS = {
   TECH_VERSION_FETCH_TIMEOUT_MS: 3e4,
   // 30 seconds max for all version fetches
   SYNC_DEPENDENCIES_TIMEOUT_MS: 6e4,
-  // 60 seconds max for all dependency syncs
+  // floor: minimum timeout for all dependency syncs
+  MAX_SYNC_DEPENDENCIES_TIMEOUT_MS: 3e5,
+  // ceiling: 5 minutes, even for very large dependency lists
+  SYNC_FIXED_OVERHEAD_MS: 1e4,
+  // buffer per sync for local reads + POSTs to the server
   AUDIT_MULTI_PATH_TIMEOUT_MS: 18e4,
-  // 3 minutes max for all audit paths
+  // floor: minimum timeout for all audit paths
+  MAX_AUDIT_MULTI_PATH_TIMEOUT_MS: 18e5,
+  // ceiling: 30 minutes, even for many audit paths
+  AUDIT_MULTI_PATH_FIXED_OVERHEAD_MS: 1e4,
+  // buffer per multi-path audit for local reads + POSTs to the server
   REGISTRY_CONCURRENCY_LIMIT: 5,
   // Limit parallel requests to avoid rate limiting
   HEALTH_CHECK_FETCH_INTERVAL_MS: 6e4,
@@ -90,6 +98,9 @@ var MonitorClient = class {
     this.lastScanTime = null;
     this.lastKnownScanRequestedAt = null;
     this.lastKnownTechScanRequestedAt = null;
+    // Interval (in hours) the currently-running auditIntervalTimer was configured with,
+    // so checkForScanRequest() can detect server-side changes and reconfigure it.
+    this.currentAuditIntervalHours = null;
     this.healthCheckFetchTimer = null;
     this.healthCheckTimers = /* @__PURE__ */ new Map();
     this.healthCheckResultsQueue = [];
@@ -338,6 +349,46 @@ var MonitorClient = class {
     await this.flushHealthResults();
     await this.flushSdkErrors();
   }
+  /**
+   * Node's fetch() (undici) wraps network-level failures (ECONNREFUSED, DNS lookup
+   * failures, TLS errors, ...) in a generic `TypeError: fetch failed`, with the real
+   * reason attached via the standard `cause` chain. Without unwrapping it, every
+   * network failure across the SDK is reported as the same opaque "fetch failed"
+   * message, with no way to diagnose it from the dashboard.
+   */
+  describeErrorCause(err, depth = 0) {
+    if (depth > 3) return void 0;
+    const cause = err.cause;
+    if (cause === void 0 || cause === null) return void 0;
+    const aggregateErrors = cause.errors;
+    if (Array.isArray(aggregateErrors)) {
+      const childSummary = aggregateErrors.map((e) => e instanceof Error ? e.message : String(e)).join("; ");
+      const summary = cause instanceof Error && cause.message ? `${cause.message} (${childSummary})` : childSummary;
+      return this.truncateDescription(summary);
+    }
+    if (cause instanceof Error) {
+      const nested = this.describeErrorCause(cause, depth + 1);
+      const description = nested ? `${cause.message} (${nested})` : cause.message;
+      return this.truncateDescription(description);
+    }
+    return this.truncateDescription(String(cause));
+  }
+  truncateDescription(description) {
+    const limit = 500;
+    return description.length > limit ? `${description.slice(0, limit)}...` : description;
+  }
+  /**
+   * Run `fn`, swallowing any throw and returning undefined instead. Used to read
+   * possibly-hostile Error fields (a throwing message/stack/cause getter) without
+   * losing whatever else was already read — each call degrades independently.
+   */
+  safe(fn) {
+    try {
+      return fn();
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Queue an SDK error to be reported to the server's system errors page.
    * Fire-and-forget — never throws. If reporting itself fails, logs to console only.
@@ -346,8 +397,16 @@ var MonitorClient = class {
   reportError(category, message, err) {
     if (this.sdkErrorsInCurrentWindow >= 20) return;
     this.sdkErrorsInCurrentWindow++;
-    const errorMessage = err instanceof Error ? `${message}: ${err.message}` : message;
-    const stack = err instanceof Error ? err.stack : void 0;
+    let errorMessage = message;
+    let stack;
+    if (err instanceof Error) {
+      errorMessage = this.safe(() => `${message}: ${err.message}`) ?? message;
+      const causeDescription = this.safe(() => this.describeErrorCause(err));
+      if (causeDescription) {
+        errorMessage += ` (cause: ${causeDescription})`;
+      }
+      stack = this.safe(() => err.stack);
+    }
     this.sdkErrorQueue.push({ category, message: errorMessage, stack });
     if (this.sdkErrorQueue.length >= 20) {
       this.flushSdkErrors().catch(() => {
@@ -393,11 +452,14 @@ var MonitorClient = class {
       console.warn("[MonitorClient] Failed to flush SDK errors to server:", err instanceof Error ? err.message : String(err));
     }
   }
-  stopAuditIntervalTimer() {
+  clearAuditIntervalTimer() {
     if (this.auditIntervalTimer) {
       clearInterval(this.auditIntervalTimer);
       this.auditIntervalTimer = null;
     }
+  }
+  stopAuditIntervalTimer() {
+    this.clearAuditIntervalTimer();
     if (this.settingsPollingTimer) {
       clearInterval(this.settingsPollingTimer);
       this.settingsPollingTimer = null;
@@ -447,15 +509,11 @@ var MonitorClient = class {
     const intervalHours = settings.vulnerabilityScanIntervalHours;
     if (intervalHours <= 0) {
       console.log("[MonitorClient] Scheduled vulnerability scanning disabled by server configuration");
+      this.currentAuditIntervalHours = intervalHours;
     } else {
       console.log(`[MonitorClient] Auto vulnerability scanning enabled (every ${intervalHours} hours)`);
       await this.runScanAndTrackTime();
-      const intervalMs = intervalHours * 60 * 60 * 1e3;
-      this.auditIntervalTimer = setInterval(() => {
-        this.runScanAndTrackTime().catch((err) => {
-          this.reportError("AUDIT_SCAN", "Auto audit scan failed", err);
-        });
-      }, intervalMs);
+      this.setAuditInterval(intervalHours);
     }
     console.log("[MonitorClient] Polling for scan requests enabled (every 5 minutes)");
     this.settingsPollingTimer = setInterval(() => {
@@ -464,6 +522,24 @@ var MonitorClient = class {
       });
     }, CONFIG_LIMITS.SETTINGS_POLL_INTERVAL_MS);
   }
+  /**
+   * (Re)configure the recurring audit timer for the given interval, replacing
+   * whichever timer is currently running (if any). intervalHours <= 0 leaves
+   * scanning disabled.
+   */
+  setAuditInterval(intervalHours) {
+    this.clearAuditIntervalTimer();
+    this.currentAuditIntervalHours = intervalHours;
+    if (intervalHours <= 0) {
+      return;
+    }
+    const intervalMs = intervalHours * 60 * 60 * 1e3;
+    this.auditIntervalTimer = setInterval(() => {
+      this.runScanAndTrackTime().catch((err) => {
+        this.reportError("AUDIT_SCAN", "Auto audit scan failed", err);
+      });
+    }, intervalMs);
+  }
   /**
    * Run a vulnerability scan and track the time it was run.
    * Uses auditMultiplePaths() if auditPaths is configured, otherwise runs single audit.
@@ -507,6 +583,12 @@ var MonitorClient = class {
           await this.syncDependencies();
         }
       }
+      if (settings.vulnerabilityScanIntervalHours !== this.currentAuditIntervalHours) {
+        console.log(
+          `[MonitorClient] Auto scan interval changed (${this.currentAuditIntervalHours ?? "unset"} \u2192 ${settings.vulnerabilityScanIntervalHours} hours), reconfiguring`
+        );
+        this.setAuditInterval(settings.vulnerabilityScanIntervalHours);
+      }
     } catch (err) {
       this.reportError("SETTINGS_POLL", "Failed to check for scan request", err);
     }
@@ -627,9 +709,11 @@ var MonitorClient = class {
   async syncDependencies() {
     console.log("[MonitorClient] Starting technology sync...");
     try {
+      const sources = await this.loadDependencySources();
+      const timeoutMs = this.calculateSyncTimeoutMs(sources);
       await this.withTimeout(
-        (signal) => this.performDependencySync(signal),
-        CONFIG_LIMITS.SYNC_DEPENDENCIES_TIMEOUT_MS,
+        (signal) => this.performDependencySync(sources, signal),
+        timeoutMs,
         "Technology sync timed out"
       );
       console.log("[MonitorClient] Technology sync completed successfully");
@@ -637,25 +721,100 @@ var MonitorClient = class {
       this.reportError("DEPENDENCY_SYNC", "Technology sync failed", err);
     }
   }
-  async performDependencySync(signal) {
+  /**
+   * How many sequential registry batches a version-fetch over this many packages
+   * will take, given the shared concurrency limit. Shared by fetchLatestVersions
+   * (which does the batching) and calculateSyncTimeoutMs (which budgets for it),
+   * so the two can't drift out of sync with each other.
+   */
+  registryBatchCount(itemCount) {
+    return Math.ceil(itemCount / CONFIG_LIMITS.REGISTRY_CONCURRENCY_LIMIT);
+  }
+  /**
+   * Estimate a timeout budget that scales with how many roughly-equal-cost units of
+   * sequential work will run (registry batches, audit paths, ...), clamped to a
+   * floor/ceiling. Shared by calculateSyncTimeoutMs and calculateMultiPathAuditTimeoutMs
+   * so the two scaling formulas can't drift apart. At count=0 this always collapses to
+   * floorMs, since overheadMs alone never exceeds a floor sized for real work.
+   */
+  estimateScaledTimeoutMs(count, perItemMs, overheadMs, floorMs, ceilingMs) {
+    const estimatedMs = count * perItemMs + overheadMs;
+    return Math.min(ceilingMs, Math.max(floorMs, estimatedMs));
+  }
+  /**
+   * Scale the dependency sync timeout with how many registry lookups AND how many
+   * sequential POSTs (one per source, via sendTechnologiesWithEnvironment) it will
+   * make, so large dependency lists, many dependencySources, or a large requestTimeoutMs
+   * don't spuriously time out against a fixed budget.
+   *
+   * The POST-phase term (sources.length * requestTimeoutMs) is included even when
+   * version checking is off: performDependencySync still does one sequential POST per
+   * source regardless, so a flat overhead that ignores source count would under-budget
+   * that phase exactly the way a flat registry-batch estimate would under-budget large
+   * dependency lists.
+   *
+   * Registry batches are summed PER SOURCE (not over the combined total) because
+   * performDependencySync/fetchLatestVersions batch each source independently and
+   * sequentially — ceil(a/n) + ceil(b/n) can be larger than ceil((a+b)/n), so a
+   * single batch count over the combined total would under-estimate the real
+   * number of sequential registry round-trips when many small sources are configured.
+   */
+  calculateSyncTimeoutMs(sources) {
+    const postPhaseMs = sources.length * this.requestTimeoutMs;
+    const batches = this.versionCheckEnabled ? sources.reduce((sum, source) => sum + this.registryBatchCount(source.technologies.length), 0) : 0;
+    return this.estimateScaledTimeoutMs(
+      batches,
+      this.registryTimeoutMs,
+      CONFIG_LIMITS.SYNC_FIXED_OVERHEAD_MS + postPhaseMs,
+      CONFIG_LIMITS.SYNC_DEPENDENCIES_TIMEOUT_MS,
+      CONFIG_LIMITS.MAX_SYNC_DEPENDENCIES_TIMEOUT_MS
+    );
+  }
+  /**
+   * Reads happen before syncDependencies' timeout/AbortSignal exists (see comment
+   * there), so this phase bounds itself with a wall-clock deadline on a budget that
+   * scales with how many sources are configured (mirroring calculateSyncTimeoutMs's
+   * scaling principle for the network phase). A plain deadline timestamp — not an
+   * AbortController — is enough here: readPackageJsonFromPath does purely synchronous,
+   * non-cancelable fs calls, so there is nothing for a signal to actually interrupt;
+   * it can only ever be checked between iterations, exactly like a deadline check.
+   * Once the budget is spent, stop reading further sources rather than always paying
+   * the full read cost for every configured dependencySource regardless of how long
+   * it's already taken — and report it via reportError, not just a console.warn, so a
+   * truncated sync isn't silently indistinguishable from a fully successful one on
+   * the dashboard.
+   */
+  async loadDependencySources() {
     if (this.dependencySources && this.dependencySources.length > 0) {
+      const sources = [];
+      const readBudgetMs = CONFIG_LIMITS.SYNC_FIXED_OVERHEAD_MS * this.dependencySources.length;
+      const deadline = Date.now() + readBudgetMs;
       for (const source of this.dependencySources) {
-        if (signal?.aborted) {
-          console.log("[MonitorClient] Technology sync cancelled");
-          return;
+        if (Date.now() >= deadline) {
+          const skippedCount = this.dependencySources.length - sources.length;
+          const warning = `Dependency source reads exceeded ${readBudgetMs}ms, skipping remaining ${skippedCount} source(s)`;
+          console.warn(`[MonitorClient] ${warning}`);
+          this.reportError("DEPENDENCY_SYNC", warning);
+          break;
         }
-        const technologies = await this.readPackageJsonFromPath(source.path);
-        if (technologies.length === 0) continue;
-        const enrichedTechnologies = await this.enrichWithLatestVersions(technologies, signal);
-        await this.sendTechnologiesWithEnvironment(enrichedTechnologies, source.environment);
-        console.log(`[MonitorClient] Technology sync completed for ${source.environment}`);
+        const technologies2 = await this.readPackageJsonFromPath(source.path);
+        sources.push({ environment: source.environment, technologies: technologies2 });
       }
-    } else {
-      const technologies = await this.readPackageJson();
-      if (technologies.length === 0) return;
-      const enrichedTechnologies = await this.enrichWithLatestVersions(technologies, signal);
-      await this.sendTechnologies(enrichedTechnologies);
-      console.log(`[MonitorClient] Technology sync completed for ${this.environment}`);
+      return sources;
+    }
+    const technologies = await this.readPackageJson();
+    return [{ environment: this.environment, technologies }];
+  }
+  async performDependencySync(sources, signal) {
+    for (const source of sources) {
+      if (signal?.aborted) {
+        console.log("[MonitorClient] Technology sync cancelled");
+        return;
+      }
+      if (source.technologies.length === 0) continue;
+      const enrichedTechnologies = await this.enrichWithLatestVersions(source.technologies, signal);
+      await this.sendTechnologiesWithEnvironment(enrichedTechnologies, source.environment);
+      console.log(`[MonitorClient] Technology sync completed for ${source.environment}`);
     }
   }
   /**
@@ -769,13 +928,22 @@ var MonitorClient = class {
     try {
       if (signal?.aborted) return null;
       const encodedName = encodeURIComponent(packageName).replace("%40", "@");
-      const response = await fetch(`${this.npmRegistryUrl}/${encodedName}`, {
-        headers: { "Accept": "application/json" },
-        signal: signal ?? AbortSignal.timeout(this.registryTimeoutMs)
-      });
-      if (!response.ok) return null;
-      const data = await response.json();
-      return data["dist-tags"]?.latest || null;
+      const requestController = new AbortController();
+      const timeoutId = setTimeout(() => requestController.abort(), this.registryTimeoutMs);
+      const onOuterAbort = () => requestController.abort();
+      signal?.addEventListener("abort", onOuterAbort);
+      try {
+        const response = await fetch(`${this.npmRegistryUrl}/${encodedName}`, {
+          headers: { "Accept": "application/json" },
+          signal: requestController.signal
+        });
+        if (!response.ok) return null;
+        const data = await response.json();
+        return data["dist-tags"]?.latest || null;
+      } finally {
+        clearTimeout(timeoutId);
+        signal?.removeEventListener("abort", onOuterAbort);
+      }
     } catch {
       return null;
     }
@@ -788,7 +956,7 @@ var MonitorClient = class {
   async fetchLatestVersions(packageNames, signal) {
     const results = /* @__PURE__ */ new Map();
     const concurrencyLimit = CONFIG_LIMITS.REGISTRY_CONCURRENCY_LIMIT;
-    const totalBatches = Math.ceil(packageNames.length / concurrencyLimit);
+    const totalBatches = this.registryBatchCount(packageNames.length);
     for (let i = 0; i < packageNames.length; i += concurrencyLimit) {
       if (signal?.aborted) {
         console.log("[MonitorClient] Version fetch cancelled");
@@ -959,7 +1127,7 @@ var MonitorClient = class {
       "child_process"
     );
     const { spawn } = childProcess;
-    return new Promise((resolve) => {
+    return new Promise((resolve, reject) => {
       const proc = spawn(command, args, {
         cwd: options.cwd,
         stdio: ["pipe", "pipe", "pipe"],
@@ -968,10 +1136,8 @@ var MonitorClient = class {
       let stdout = "";
       let stderr = "";
       let timedOut = false;
-      let killed = false;
       const timeoutId = setTimeout(() => {
         timedOut = true;
-        killed = true;
         proc.kill("SIGTERM");
         setTimeout(() => {
           if (!proc.killed) {
@@ -991,14 +1157,38 @@ var MonitorClient = class {
       });
       proc.on("close", () => {
         clearTimeout(timeoutId);
-        resolve({ stdout, timedOut });
+        resolve({ stdout, stderr, timedOut });
       });
-      proc.on("error", () => {
+      proc.on("error", (err) => {
         clearTimeout(timeoutId);
-        resolve({ stdout, timedOut: killed });
+        reject(err);
       });
     });
   }
+  /**
+   * `npm audit --json` can exit without emitting valid JSON on stdout — e.g. the
+   * registry is unreachable, or a fatal npm error is written to stderr instead.
+   * Treat that as a soft failure (like a timeout) rather than throwing, so it
+   * doesn't surface as a confusing "Unexpected end of JSON input" SDK_ERROR.
+   */
+  parseNpmAuditJson(auditOutput, stderr) {
+    const stderrSuffix = () => {
+      const trimmedStderr = stderr.trim();
+      return trimmedStderr ? ` (stderr: ${this.truncateDescription(trimmedStderr)})` : "";
+    };
+    if (!auditOutput || auditOutput.trim().length === 0) {
+      console.error(`[MonitorClient] npm audit produced no output${stderrSuffix()}`);
+      return null;
+    }
+    try {
+      return JSON.parse(auditOutput);
+    } catch (err) {
+      console.error(
+        `[MonitorClient] npm audit produced invalid JSON: ${err instanceof Error ? err.message : String(err)}${stderrSuffix()}`
+      );
+      return null;
+    }
+  }
   /**
    * Run npm audit and send results to the monitoring server.
    * This scans the project for known vulnerabilities in dependencies.
@@ -1075,6 +1265,13 @@ var MonitorClient = class {
           return null;
         }
         auditOutput = result2.stdout;
+        if (!auditOutput || auditOutput.trim().length === 0) {
+          const trimmedStderr = result2.stderr.trim();
+          console.error(
+            `[MonitorClient] yarn audit produced no output${trimmedStderr ? ` (stderr: ${this.truncateDescription(trimmedStderr)})` : ""}`
+          );
+          return null;
+        }
         vulnerabilities = this.parseYarnAuditOutput(auditOutput);
         const lines = auditOutput.trim().split("\n");
         for (const line of lines) {
@@ -1087,22 +1284,10 @@ var MonitorClient = class {
           } catch {
           }
         }
-      } else if (packageManager === "pnpm") {
-        console.log("[MonitorClient] pnpm detected, using npm audit (pnpm compatible)");
-        const result2 = await this.runCommandWithTimeout("npm", ["audit", "--json"], {
-          cwd: projectPath,
-          timeout: this.auditTimeoutMs,
-          maxBuffer: CONFIG_LIMITS.AUDIT_MAX_BUFFER
-        });
-        if (result2.timedOut) {
-          console.error(`[MonitorClient] npm audit timed out after ${this.auditTimeoutMs}ms`);
-          return null;
-        }
-        auditOutput = result2.stdout;
-        const auditData = JSON.parse(auditOutput);
-        vulnerabilities = this.parseNpmAuditOutput(auditData);
-        totalDeps = auditData.metadata?.dependencies?.total || 0;
       } else {
+        if (packageManager === "pnpm") {
+          console.log("[MonitorClient] pnpm detected, using npm audit (pnpm compatible)");
+        }
         const result2 = await this.runCommandWithTimeout("npm", ["audit", "--json"], {
           cwd: projectPath,
           timeout: this.auditTimeoutMs,
@@ -1113,7 +1298,8 @@ var MonitorClient = class {
           return null;
         }
         auditOutput = result2.stdout;
-        const auditData = JSON.parse(auditOutput);
+        const auditData = this.parseNpmAuditJson(auditOutput, result2.stderr);
+        if (!auditData) return null;
         vulnerabilities = this.parseNpmAuditOutput(auditData);
         totalDeps = auditData.metadata?.dependencies?.total || 0;
       }
@@ -1158,9 +1344,10 @@ var MonitorClient = class {
     }
     console.log(`[MonitorClient] Starting multi-path audit (${this.auditPaths.length} paths)...`);
     try {
+      const timeoutMs = this.calculateMultiPathAuditTimeoutMs(this.auditPaths.length);
       const result = await this.withTimeout(
         () => this.performMultiPathAudit(),
-        CONFIG_LIMITS.AUDIT_MULTI_PATH_TIMEOUT_MS,
+        timeoutMs,
         "Multi-path audit timed out"
       );
       if (result) {
@@ -1172,6 +1359,21 @@ var MonitorClient = class {
       return null;
     }
   }
+  /**
+   * Scale the multi-path audit timeout with how many paths it will scan, so
+   * configuring many auditPaths (or a large per-path auditTimeoutMs) doesn't
+   * spuriously time out the whole batch against a fixed budget — the same
+   * failure mode calculateSyncTimeoutMs fixes for dependency sync.
+   */
+  calculateMultiPathAuditTimeoutMs(pathCount) {
+    return this.estimateScaledTimeoutMs(
+      pathCount,
+      this.auditTimeoutMs,
+      CONFIG_LIMITS.AUDIT_MULTI_PATH_FIXED_OVERHEAD_MS,
+      CONFIG_LIMITS.AUDIT_MULTI_PATH_TIMEOUT_MS,
+      CONFIG_LIMITS.MAX_AUDIT_MULTI_PATH_TIMEOUT_MS
+    );
+  }
   async performMultiPathAudit() {
     if (!this.auditPaths) return null;
     const results = [];
@@ -1594,7 +1796,7 @@ var MonitorClient = class {
     }
     try {
       const hostname = os.hostname();
-      const cpuPercent = await this.measureCpuPercent(os);
+      const { percent: cpuPercent, model: cpuModel } = await this.measureCpuPercent(os);
       const memoryTotal = os.totalmem();
       const memoryAvailable = await this.getAvailableMemoryBytes(os, fs);
       const memoryUsed = memoryTotal - memoryAvailable;
@@ -1603,6 +1805,7 @@ var MonitorClient = class {
       await this.submitSystemMetric({
         hostname,
         cpuPercent,
+        cpuModel,
         memoryTotal,
         memoryUsed,
         memoryPercent,
@@ -1615,12 +1818,14 @@ var MonitorClient = class {
   /**
    * Measure CPU utilization by sampling cpus() twice with a 3s gap.
    * The cumulative counters make this the average utilization over the
-   * window, across all cores of the host. Returns a percentage (0–100).
+   * window, across all cores of the host. Returns a percentage (0–100)
+   * plus the CPU model, read off the same samples at zero extra cost.
    */
   async measureCpuPercent(os) {
     const sample1 = os.cpus();
     await new Promise((resolve) => setTimeout(resolve, 3e3));
     const sample2 = os.cpus();
+    const model = sample1[0]?.model ?? null;
     let totalIdle = 0;
     let totalTick = 0;
     for (let i = 0; i < sample2.length; i++) {
@@ -1632,10 +1837,10 @@ var MonitorClient = class {
       totalIdle += curr.times.idle - prev.times.idle;
     }
     if (totalTick <= 0) {
-      return 0;
+      return { percent: 0, model };
     }
     const idlePercent = totalIdle / totalTick * 100;
-    return Math.max(0, Math.min(100, 100 - idlePercent));
+    return { percent: Math.max(0, Math.min(100, 100 - idlePercent)), model };
   }
   /**
    * Get reclaimable memory in bytes. On Linux, reads MemAvailable from

package/dist/index.mjs

@@ -28,9 +28,17 @@ var CONFIG_LIMITS = {
   TECH_VERSION_FETCH_TIMEOUT_MS: 3e4,
   // 30 seconds max for all version fetches
   SYNC_DEPENDENCIES_TIMEOUT_MS: 6e4,
-  // 60 seconds max for all dependency syncs
+  // floor: minimum timeout for all dependency syncs
+  MAX_SYNC_DEPENDENCIES_TIMEOUT_MS: 3e5,
+  // ceiling: 5 minutes, even for very large dependency lists
+  SYNC_FIXED_OVERHEAD_MS: 1e4,
+  // buffer per sync for local reads + POSTs to the server
   AUDIT_MULTI_PATH_TIMEOUT_MS: 18e4,
-  // 3 minutes max for all audit paths
+  // floor: minimum timeout for all audit paths
+  MAX_AUDIT_MULTI_PATH_TIMEOUT_MS: 18e5,
+  // ceiling: 30 minutes, even for many audit paths
+  AUDIT_MULTI_PATH_FIXED_OVERHEAD_MS: 1e4,
+  // buffer per multi-path audit for local reads + POSTs to the server
   REGISTRY_CONCURRENCY_LIMIT: 5,
   // Limit parallel requests to avoid rate limiting
   HEALTH_CHECK_FETCH_INTERVAL_MS: 6e4,
@@ -54,6 +62,9 @@ var MonitorClient = class {
     this.lastScanTime = null;
     this.lastKnownScanRequestedAt = null;
     this.lastKnownTechScanRequestedAt = null;
+    // Interval (in hours) the currently-running auditIntervalTimer was configured with,
+    // so checkForScanRequest() can detect server-side changes and reconfigure it.
+    this.currentAuditIntervalHours = null;
     this.healthCheckFetchTimer = null;
     this.healthCheckTimers = /* @__PURE__ */ new Map();
     this.healthCheckResultsQueue = [];
@@ -302,6 +313,46 @@ var MonitorClient = class {
     await this.flushHealthResults();
     await this.flushSdkErrors();
   }
+  /**
+   * Node's fetch() (undici) wraps network-level failures (ECONNREFUSED, DNS lookup
+   * failures, TLS errors, ...) in a generic `TypeError: fetch failed`, with the real
+   * reason attached via the standard `cause` chain. Without unwrapping it, every
+   * network failure across the SDK is reported as the same opaque "fetch failed"
+   * message, with no way to diagnose it from the dashboard.
+   */
+  describeErrorCause(err, depth = 0) {
+    if (depth > 3) return void 0;
+    const cause = err.cause;
+    if (cause === void 0 || cause === null) return void 0;
+    const aggregateErrors = cause.errors;
+    if (Array.isArray(aggregateErrors)) {
+      const childSummary = aggregateErrors.map((e) => e instanceof Error ? e.message : String(e)).join("; ");
+      const summary = cause instanceof Error && cause.message ? `${cause.message} (${childSummary})` : childSummary;
+      return this.truncateDescription(summary);
+    }
+    if (cause instanceof Error) {
+      const nested = this.describeErrorCause(cause, depth + 1);
+      const description = nested ? `${cause.message} (${nested})` : cause.message;
+      return this.truncateDescription(description);
+    }
+    return this.truncateDescription(String(cause));
+  }
+  truncateDescription(description) {
+    const limit = 500;
+    return description.length > limit ? `${description.slice(0, limit)}...` : description;
+  }
+  /**
+   * Run `fn`, swallowing any throw and returning undefined instead. Used to read
+   * possibly-hostile Error fields (a throwing message/stack/cause getter) without
+   * losing whatever else was already read — each call degrades independently.
+   */
+  safe(fn) {
+    try {
+      return fn();
+    } catch {
+      return void 0;
+    }
+  }
   /**
    * Queue an SDK error to be reported to the server's system errors page.
    * Fire-and-forget — never throws. If reporting itself fails, logs to console only.
@@ -310,8 +361,16 @@ var MonitorClient = class {
   reportError(category, message, err) {
     if (this.sdkErrorsInCurrentWindow >= 20) return;
     this.sdkErrorsInCurrentWindow++;
-    const errorMessage = err instanceof Error ? `${message}: ${err.message}` : message;
-    const stack = err instanceof Error ? err.stack : void 0;
+    let errorMessage = message;
+    let stack;
+    if (err instanceof Error) {
+      errorMessage = this.safe(() => `${message}: ${err.message}`) ?? message;
+      const causeDescription = this.safe(() => this.describeErrorCause(err));
+      if (causeDescription) {
+        errorMessage += ` (cause: ${causeDescription})`;
+      }
+      stack = this.safe(() => err.stack);
+    }
     this.sdkErrorQueue.push({ category, message: errorMessage, stack });
     if (this.sdkErrorQueue.length >= 20) {
       this.flushSdkErrors().catch(() => {
@@ -357,11 +416,14 @@ var MonitorClient = class {
       console.warn("[MonitorClient] Failed to flush SDK errors to server:", err instanceof Error ? err.message : String(err));
     }
   }
-  stopAuditIntervalTimer() {
+  clearAuditIntervalTimer() {
     if (this.auditIntervalTimer) {
       clearInterval(this.auditIntervalTimer);
       this.auditIntervalTimer = null;
     }
+  }
+  stopAuditIntervalTimer() {
+    this.clearAuditIntervalTimer();
     if (this.settingsPollingTimer) {
       clearInterval(this.settingsPollingTimer);
       this.settingsPollingTimer = null;
@@ -411,15 +473,11 @@ var MonitorClient = class {
     const intervalHours = settings.vulnerabilityScanIntervalHours;
     if (intervalHours <= 0) {
       console.log("[MonitorClient] Scheduled vulnerability scanning disabled by server configuration");
+      this.currentAuditIntervalHours = intervalHours;
     } else {
       console.log(`[MonitorClient] Auto vulnerability scanning enabled (every ${intervalHours} hours)`);
       await this.runScanAndTrackTime();
-      const intervalMs = intervalHours * 60 * 60 * 1e3;
-      this.auditIntervalTimer = setInterval(() => {
-        this.runScanAndTrackTime().catch((err) => {
-          this.reportError("AUDIT_SCAN", "Auto audit scan failed", err);
-        });
-      }, intervalMs);
+      this.setAuditInterval(intervalHours);
     }
     console.log("[MonitorClient] Polling for scan requests enabled (every 5 minutes)");
     this.settingsPollingTimer = setInterval(() => {
@@ -428,6 +486,24 @@ var MonitorClient = class {
       });
     }, CONFIG_LIMITS.SETTINGS_POLL_INTERVAL_MS);
   }
+  /**
+   * (Re)configure the recurring audit timer for the given interval, replacing
+   * whichever timer is currently running (if any). intervalHours <= 0 leaves
+   * scanning disabled.
+   */
+  setAuditInterval(intervalHours) {
+    this.clearAuditIntervalTimer();
+    this.currentAuditIntervalHours = intervalHours;
+    if (intervalHours <= 0) {
+      return;
+    }
+    const intervalMs = intervalHours * 60 * 60 * 1e3;
+    this.auditIntervalTimer = setInterval(() => {
+      this.runScanAndTrackTime().catch((err) => {
+        this.reportError("AUDIT_SCAN", "Auto audit scan failed", err);
+      });
+    }, intervalMs);
+  }
   /**
    * Run a vulnerability scan and track the time it was run.
    * Uses auditMultiplePaths() if auditPaths is configured, otherwise runs single audit.
@@ -471,6 +547,12 @@ var MonitorClient = class {
           await this.syncDependencies();
         }
       }
+      if (settings.vulnerabilityScanIntervalHours !== this.currentAuditIntervalHours) {
+        console.log(
+          `[MonitorClient] Auto scan interval changed (${this.currentAuditIntervalHours ?? "unset"} \u2192 ${settings.vulnerabilityScanIntervalHours} hours), reconfiguring`
+        );
+        this.setAuditInterval(settings.vulnerabilityScanIntervalHours);
+      }
     } catch (err) {
       this.reportError("SETTINGS_POLL", "Failed to check for scan request", err);
     }
@@ -591,9 +673,11 @@ var MonitorClient = class {
   async syncDependencies() {
     console.log("[MonitorClient] Starting technology sync...");
     try {
+      const sources = await this.loadDependencySources();
+      const timeoutMs = this.calculateSyncTimeoutMs(sources);
       await this.withTimeout(
-        (signal) => this.performDependencySync(signal),
-        CONFIG_LIMITS.SYNC_DEPENDENCIES_TIMEOUT_MS,
+        (signal) => this.performDependencySync(sources, signal),
+        timeoutMs,
         "Technology sync timed out"
       );
       console.log("[MonitorClient] Technology sync completed successfully");
@@ -601,25 +685,100 @@ var MonitorClient = class {
       this.reportError("DEPENDENCY_SYNC", "Technology sync failed", err);
     }
   }
-  async performDependencySync(signal) {
+  /**
+   * How many sequential registry batches a version-fetch over this many packages
+   * will take, given the shared concurrency limit. Shared by fetchLatestVersions
+   * (which does the batching) and calculateSyncTimeoutMs (which budgets for it),
+   * so the two can't drift out of sync with each other.
+   */
+  registryBatchCount(itemCount) {
+    return Math.ceil(itemCount / CONFIG_LIMITS.REGISTRY_CONCURRENCY_LIMIT);
+  }
+  /**
+   * Estimate a timeout budget that scales with how many roughly-equal-cost units of
+   * sequential work will run (registry batches, audit paths, ...), clamped to a
+   * floor/ceiling. Shared by calculateSyncTimeoutMs and calculateMultiPathAuditTimeoutMs
+   * so the two scaling formulas can't drift apart. At count=0 this always collapses to
+   * floorMs, since overheadMs alone never exceeds a floor sized for real work.
+   */
+  estimateScaledTimeoutMs(count, perItemMs, overheadMs, floorMs, ceilingMs) {
+    const estimatedMs = count * perItemMs + overheadMs;
+    return Math.min(ceilingMs, Math.max(floorMs, estimatedMs));
+  }
+  /**
+   * Scale the dependency sync timeout with how many registry lookups AND how many
+   * sequential POSTs (one per source, via sendTechnologiesWithEnvironment) it will
+   * make, so large dependency lists, many dependencySources, or a large requestTimeoutMs
+   * don't spuriously time out against a fixed budget.
+   *
+   * The POST-phase term (sources.length * requestTimeoutMs) is included even when
+   * version checking is off: performDependencySync still does one sequential POST per
+   * source regardless, so a flat overhead that ignores source count would under-budget
+   * that phase exactly the way a flat registry-batch estimate would under-budget large
+   * dependency lists.
+   *
+   * Registry batches are summed PER SOURCE (not over the combined total) because
+   * performDependencySync/fetchLatestVersions batch each source independently and
+   * sequentially — ceil(a/n) + ceil(b/n) can be larger than ceil((a+b)/n), so a
+   * single batch count over the combined total would under-estimate the real
+   * number of sequential registry round-trips when many small sources are configured.
+   */
+  calculateSyncTimeoutMs(sources) {
+    const postPhaseMs = sources.length * this.requestTimeoutMs;
+    const batches = this.versionCheckEnabled ? sources.reduce((sum, source) => sum + this.registryBatchCount(source.technologies.length), 0) : 0;
+    return this.estimateScaledTimeoutMs(
+      batches,
+      this.registryTimeoutMs,
+      CONFIG_LIMITS.SYNC_FIXED_OVERHEAD_MS + postPhaseMs,
+      CONFIG_LIMITS.SYNC_DEPENDENCIES_TIMEOUT_MS,
+      CONFIG_LIMITS.MAX_SYNC_DEPENDENCIES_TIMEOUT_MS
+    );
+  }
+  /**
+   * Reads happen before syncDependencies' timeout/AbortSignal exists (see comment
+   * there), so this phase bounds itself with a wall-clock deadline on a budget that
+   * scales with how many sources are configured (mirroring calculateSyncTimeoutMs's
+   * scaling principle for the network phase). A plain deadline timestamp — not an
+   * AbortController — is enough here: readPackageJsonFromPath does purely synchronous,
+   * non-cancelable fs calls, so there is nothing for a signal to actually interrupt;
+   * it can only ever be checked between iterations, exactly like a deadline check.
+   * Once the budget is spent, stop reading further sources rather than always paying
+   * the full read cost for every configured dependencySource regardless of how long
+   * it's already taken — and report it via reportError, not just a console.warn, so a
+   * truncated sync isn't silently indistinguishable from a fully successful one on
+   * the dashboard.
+   */
+  async loadDependencySources() {
     if (this.dependencySources && this.dependencySources.length > 0) {
+      const sources = [];
+      const readBudgetMs = CONFIG_LIMITS.SYNC_FIXED_OVERHEAD_MS * this.dependencySources.length;
+      const deadline = Date.now() + readBudgetMs;
       for (const source of this.dependencySources) {
-        if (signal?.aborted) {
-          console.log("[MonitorClient] Technology sync cancelled");
-          return;
+        if (Date.now() >= deadline) {
+          const skippedCount = this.dependencySources.length - sources.length;
+          const warning = `Dependency source reads exceeded ${readBudgetMs}ms, skipping remaining ${skippedCount} source(s)`;
+          console.warn(`[MonitorClient] ${warning}`);
+          this.reportError("DEPENDENCY_SYNC", warning);
+          break;
         }
-        const technologies = await this.readPackageJsonFromPath(source.path);
-        if (technologies.length === 0) continue;
-        const enrichedTechnologies = await this.enrichWithLatestVersions(technologies, signal);
-        await this.sendTechnologiesWithEnvironment(enrichedTechnologies, source.environment);
-        console.log(`[MonitorClient] Technology sync completed for ${source.environment}`);
+        const technologies2 = await this.readPackageJsonFromPath(source.path);
+        sources.push({ environment: source.environment, technologies: technologies2 });
       }
-    } else {
-      const technologies = await this.readPackageJson();
-      if (technologies.length === 0) return;
-      const enrichedTechnologies = await this.enrichWithLatestVersions(technologies, signal);
-      await this.sendTechnologies(enrichedTechnologies);
-      console.log(`[MonitorClient] Technology sync completed for ${this.environment}`);
+      return sources;
+    }
+    const technologies = await this.readPackageJson();
+    return [{ environment: this.environment, technologies }];
+  }
+  async performDependencySync(sources, signal) {
+    for (const source of sources) {
+      if (signal?.aborted) {
+        console.log("[MonitorClient] Technology sync cancelled");
+        return;
+      }
+      if (source.technologies.length === 0) continue;
+      const enrichedTechnologies = await this.enrichWithLatestVersions(source.technologies, signal);
+      await this.sendTechnologiesWithEnvironment(enrichedTechnologies, source.environment);
+      console.log(`[MonitorClient] Technology sync completed for ${source.environment}`);
     }
   }
   /**
@@ -733,13 +892,22 @@ var MonitorClient = class {
     try {
       if (signal?.aborted) return null;
       const encodedName = encodeURIComponent(packageName).replace("%40", "@");
-      const response = await fetch(`${this.npmRegistryUrl}/${encodedName}`, {
-        headers: { "Accept": "application/json" },
-        signal: signal ?? AbortSignal.timeout(this.registryTimeoutMs)
-      });
-      if (!response.ok) return null;
-      const data = await response.json();
-      return data["dist-tags"]?.latest || null;
+      const requestController = new AbortController();
+      const timeoutId = setTimeout(() => requestController.abort(), this.registryTimeoutMs);
+      const onOuterAbort = () => requestController.abort();
+      signal?.addEventListener("abort", onOuterAbort);
+      try {
+        const response = await fetch(`${this.npmRegistryUrl}/${encodedName}`, {
+          headers: { "Accept": "application/json" },
+          signal: requestController.signal
+        });
+        if (!response.ok) return null;
+        const data = await response.json();
+        return data["dist-tags"]?.latest || null;
+      } finally {
+        clearTimeout(timeoutId);
+        signal?.removeEventListener("abort", onOuterAbort);
+      }
     } catch {
       return null;
     }
@@ -752,7 +920,7 @@ var MonitorClient = class {
   async fetchLatestVersions(packageNames, signal) {
     const results = /* @__PURE__ */ new Map();
     const concurrencyLimit = CONFIG_LIMITS.REGISTRY_CONCURRENCY_LIMIT;
-    const totalBatches = Math.ceil(packageNames.length / concurrencyLimit);
+    const totalBatches = this.registryBatchCount(packageNames.length);
     for (let i = 0; i < packageNames.length; i += concurrencyLimit) {
       if (signal?.aborted) {
         console.log("[MonitorClient] Version fetch cancelled");
@@ -923,7 +1091,7 @@ var MonitorClient = class {
       "child_process"
     );
     const { spawn } = childProcess;
-    return new Promise((resolve) => {
+    return new Promise((resolve, reject) => {
       const proc = spawn(command, args, {
         cwd: options.cwd,
         stdio: ["pipe", "pipe", "pipe"],
@@ -932,10 +1100,8 @@ var MonitorClient = class {
       let stdout = "";
       let stderr = "";
       let timedOut = false;
-      let killed = false;
       const timeoutId = setTimeout(() => {
         timedOut = true;
-        killed = true;
         proc.kill("SIGTERM");
         setTimeout(() => {
           if (!proc.killed) {
@@ -955,14 +1121,38 @@ var MonitorClient = class {
       });
       proc.on("close", () => {
         clearTimeout(timeoutId);
-        resolve({ stdout, timedOut });
+        resolve({ stdout, stderr, timedOut });
       });
-      proc.on("error", () => {
+      proc.on("error", (err) => {
         clearTimeout(timeoutId);
-        resolve({ stdout, timedOut: killed });
+        reject(err);
       });
     });
   }
+  /**
+   * `npm audit --json` can exit without emitting valid JSON on stdout — e.g. the
+   * registry is unreachable, or a fatal npm error is written to stderr instead.
+   * Treat that as a soft failure (like a timeout) rather than throwing, so it
+   * doesn't surface as a confusing "Unexpected end of JSON input" SDK_ERROR.
+   */
+  parseNpmAuditJson(auditOutput, stderr) {
+    const stderrSuffix = () => {
+      const trimmedStderr = stderr.trim();
+      return trimmedStderr ? ` (stderr: ${this.truncateDescription(trimmedStderr)})` : "";
+    };
+    if (!auditOutput || auditOutput.trim().length === 0) {
+      console.error(`[MonitorClient] npm audit produced no output${stderrSuffix()}`);
+      return null;
+    }
+    try {
+      return JSON.parse(auditOutput);
+    } catch (err) {
+      console.error(
+        `[MonitorClient] npm audit produced invalid JSON: ${err instanceof Error ? err.message : String(err)}${stderrSuffix()}`
+      );
+      return null;
+    }
+  }
   /**
    * Run npm audit and send results to the monitoring server.
    * This scans the project for known vulnerabilities in dependencies.
@@ -1039,6 +1229,13 @@ var MonitorClient = class {
           return null;
         }
         auditOutput = result2.stdout;
+        if (!auditOutput || auditOutput.trim().length === 0) {
+          const trimmedStderr = result2.stderr.trim();
+          console.error(
+            `[MonitorClient] yarn audit produced no output${trimmedStderr ? ` (stderr: ${this.truncateDescription(trimmedStderr)})` : ""}`
+          );
+          return null;
+        }
         vulnerabilities = this.parseYarnAuditOutput(auditOutput);
         const lines = auditOutput.trim().split("\n");
         for (const line of lines) {
@@ -1051,22 +1248,10 @@ var MonitorClient = class {
           } catch {
           }
         }
-      } else if (packageManager === "pnpm") {
-        console.log("[MonitorClient] pnpm detected, using npm audit (pnpm compatible)");
-        const result2 = await this.runCommandWithTimeout("npm", ["audit", "--json"], {
-          cwd: projectPath,
-          timeout: this.auditTimeoutMs,
-          maxBuffer: CONFIG_LIMITS.AUDIT_MAX_BUFFER
-        });
-        if (result2.timedOut) {
-          console.error(`[MonitorClient] npm audit timed out after ${this.auditTimeoutMs}ms`);
-          return null;
-        }
-        auditOutput = result2.stdout;
-        const auditData = JSON.parse(auditOutput);
-        vulnerabilities = this.parseNpmAuditOutput(auditData);
-        totalDeps = auditData.metadata?.dependencies?.total || 0;
       } else {
+        if (packageManager === "pnpm") {
+          console.log("[MonitorClient] pnpm detected, using npm audit (pnpm compatible)");
+        }
         const result2 = await this.runCommandWithTimeout("npm", ["audit", "--json"], {
           cwd: projectPath,
           timeout: this.auditTimeoutMs,
@@ -1077,7 +1262,8 @@ var MonitorClient = class {
           return null;
         }
         auditOutput = result2.stdout;
-        const auditData = JSON.parse(auditOutput);
+        const auditData = this.parseNpmAuditJson(auditOutput, result2.stderr);
+        if (!auditData) return null;
         vulnerabilities = this.parseNpmAuditOutput(auditData);
         totalDeps = auditData.metadata?.dependencies?.total || 0;
       }
@@ -1122,9 +1308,10 @@ var MonitorClient = class {
     }
     console.log(`[MonitorClient] Starting multi-path audit (${this.auditPaths.length} paths)...`);
     try {
+      const timeoutMs = this.calculateMultiPathAuditTimeoutMs(this.auditPaths.length);
       const result = await this.withTimeout(
         () => this.performMultiPathAudit(),
-        CONFIG_LIMITS.AUDIT_MULTI_PATH_TIMEOUT_MS,
+        timeoutMs,
         "Multi-path audit timed out"
       );
       if (result) {
@@ -1136,6 +1323,21 @@ var MonitorClient = class {
       return null;
     }
   }
+  /**
+   * Scale the multi-path audit timeout with how many paths it will scan, so
+   * configuring many auditPaths (or a large per-path auditTimeoutMs) doesn't
+   * spuriously time out the whole batch against a fixed budget — the same
+   * failure mode calculateSyncTimeoutMs fixes for dependency sync.
+   */
+  calculateMultiPathAuditTimeoutMs(pathCount) {
+    return this.estimateScaledTimeoutMs(
+      pathCount,
+      this.auditTimeoutMs,
+      CONFIG_LIMITS.AUDIT_MULTI_PATH_FIXED_OVERHEAD_MS,
+      CONFIG_LIMITS.AUDIT_MULTI_PATH_TIMEOUT_MS,
+      CONFIG_LIMITS.MAX_AUDIT_MULTI_PATH_TIMEOUT_MS
+    );
+  }
   async performMultiPathAudit() {
     if (!this.auditPaths) return null;
     const results = [];
@@ -1558,7 +1760,7 @@ var MonitorClient = class {
     }
     try {
       const hostname = os.hostname();
-      const cpuPercent = await this.measureCpuPercent(os);
+      const { percent: cpuPercent, model: cpuModel } = await this.measureCpuPercent(os);
       const memoryTotal = os.totalmem();
       const memoryAvailable = await this.getAvailableMemoryBytes(os, fs);
       const memoryUsed = memoryTotal - memoryAvailable;
@@ -1567,6 +1769,7 @@ var MonitorClient = class {
       await this.submitSystemMetric({
         hostname,
         cpuPercent,
+        cpuModel,
         memoryTotal,
         memoryUsed,
         memoryPercent,
@@ -1579,12 +1782,14 @@ var MonitorClient = class {
   /**
    * Measure CPU utilization by sampling cpus() twice with a 3s gap.
    * The cumulative counters make this the average utilization over the
-   * window, across all cores of the host. Returns a percentage (0–100).
+   * window, across all cores of the host. Returns a percentage (0–100)
+   * plus the CPU model, read off the same samples at zero extra cost.
    */
   async measureCpuPercent(os) {
     const sample1 = os.cpus();
     await new Promise((resolve) => setTimeout(resolve, 3e3));
     const sample2 = os.cpus();
+    const model = sample1[0]?.model ?? null;
     let totalIdle = 0;
     let totalTick = 0;
     for (let i = 0; i < sample2.length; i++) {
@@ -1596,10 +1801,10 @@ var MonitorClient = class {
       totalIdle += curr.times.idle - prev.times.idle;
     }
     if (totalTick <= 0) {
-      return 0;
+      return { percent: 0, model };
     }
     const idlePercent = totalIdle / totalTick * 100;
-    return Math.max(0, Math.min(100, 100 - idlePercent));
+    return { percent: Math.max(0, Math.min(100, 100 - idlePercent)), model };
   }
   /**
    * Get reclaimable memory in bytes. On Linux, reads MemAvailable from

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ceon-oy/monitor-sdk",
-  "version": "1.5.1",
+  "version": "1.5.3",
   "description": "Client SDK for Ceon Monitor - Error tracking, health monitoring, security events, and vulnerability scanning",
   "author": "Ceon",
   "license": "MIT",