@westbayberry/dg 1.0.0 → 1.0.2

package/dist/index.js

@@ -19,7 +19,78 @@ class APIError extends Error {
     }
 }
 exports.APIError = APIError;
-async function callAnalyzeAPI(packages, config) {
+const BATCH_SIZE = 15;
+const MAX_RETRIES = 2;
+const RETRY_DELAY_MS = 5000;
+async function callAnalyzeAPI(packages, config, onProgress) {
+    if (packages.length <= BATCH_SIZE) {
+        return callAnalyzeBatch(packages, config);
+    }
+    const batches = [];
+    for (let i = 0; i < packages.length; i += BATCH_SIZE) {
+        batches.push(packages.slice(i, i + BATCH_SIZE));
+    }
+    // Process batches sequentially — parallel batches overload the server on cold scans
+    const results = [];
+    let completed = 0;
+    for (const batch of batches) {
+        const result = await callBatchWithRetry(batch, config);
+        completed += batch.length;
+        if (onProgress) {
+            onProgress(completed, packages.length);
+        }
+        results.push(result);
+    }
+    return mergeResponses(results, config);
+}
+/**
+ * Retry a batch on 504 (gateway timeout). The server continues processing
+ * during a timeout, so retries find previously-analyzed packages cached
+ * in Redis — fewer cold packages means faster response.
+ */
+async function callBatchWithRetry(packages, config) {
+    for (let attempt = 0; attempt <= MAX_RETRIES; attempt++) {
+        try {
+            return await callAnalyzeBatch(packages, config);
+        }
+        catch (error) {
+            const is504 = error instanceof APIError && error.statusCode === 504;
+            const isTimeout = error instanceof APIError && error.statusCode === 408;
+            if ((is504 || isTimeout) && attempt < MAX_RETRIES) {
+                // Server is still working — wait, then retry.
+                // Packages that finished before the timeout are now cached.
+                const delay = RETRY_DELAY_MS * (attempt + 1);
+                process.stderr.write(`  Batch timed out, retrying in ${delay / 1000}s (attempt ${attempt + 2}/${MAX_RETRIES + 1})...\n`);
+                await new Promise((r) => setTimeout(r, delay));
+                continue;
+            }
+            throw error;
+        }
+    }
+    // Unreachable, but TypeScript needs it
+    throw new Error("Exhausted retries");
+}
+function mergeResponses(results, config) {
+    const allPackages = results.flatMap((r) => r.packages);
+    const maxScore = Math.max(0, ...allPackages.map((p) => p.score));
+    const action = maxScore >= config.blockThreshold
+        ? "block"
+        : maxScore >= config.warnThreshold
+            ? "warn"
+            : "pass";
+    const safeVersions = {};
+    for (const r of results) {
+        Object.assign(safeVersions, r.safeVersions);
+    }
+    return {
+        score: maxScore,
+        action: action,
+        packages: allPackages,
+        safeVersions,
+        durationMs: Math.max(0, ...results.map((r) => r.durationMs)),
+    };
+}
+async function callAnalyzeBatch(packages, config) {
     const url = `${config.apiUrl}/v1/analyze`;
     const payload = {
         packages: packages.map((p) => ({
@@ -53,7 +124,10 @@ async function callAnalyzeAPI(packages, config) {
         if (error instanceof Error && error.name === "AbortError") {
             throw new APIError("Request timed out after 120s. Try scanning fewer packages.", 408, "");
         }
-        throw error;
+        // Node.js fetch wraps the real error in .cause
+        const cause = error instanceof Error && error.cause;
+        const detail = cause ? `: ${cause.message || cause}` : "";
+        throw new Error(`fetch failed${detail}`);
     }
     clearTimeout(timeoutId);
     if (response.status === 401) {
@@ -186,11 +260,15 @@ function parseConfig(argv) {
         process.exit(0);
     }
     const command = positionals[0] ?? "scan";
+    if (values["api-key"]) {
+        process.stderr.write("Warning: --api-key is deprecated (visible in process list). Use DG_API_KEY env var instead.\n");
+    }
     const apiKey = values["api-key"] ??
         process.env.DG_API_KEY ??
         "";
     if (!apiKey) {
-        process.stderr.write("Error: API key required. Set --api-key or DG_API_KEY environment variable.\n" +
+        process.stderr.write("Error: API key required. Set DG_API_KEY environment variable.\n" +
+            "Do NOT pass keys via --api-key (visible in process list).\n" +
             "Get your key at https://westbayberry.com/dashboard\n");
         process.exit(1);
     }
@@ -291,15 +369,23 @@ function discoverChanges(cwd, config) {
             skipped: diff.skipped,
         };
     }
-    // 4. Fallback: try package.json diff, else scan all
+    // 4. Fallback: try package.json diff, resolve ranges via lockfile
     const pkgJsonPath = (0, node_path_1.join)(cwd, "package.json");
     if ((0, node_fs_1.existsSync)(pkgJsonPath)) {
         const headPkgJson = (0, node_fs_1.readFileSync)(pkgJsonPath, "utf-8");
         const basePkgJson = getGitBaseFile(cwd, "package.json");
         if (basePkgJson !== null) {
             const diff = (0, parse_package_json_1.diffPackageJsons)(basePkgJson, headPkgJson, config.maxPackages);
+            // Resolve semver ranges (e.g. "^3.0.1") to exact versions from the lockfile
+            const resolved = diff.changes.map((change) => {
+                const lockEntry = headParsed.packages.get(change.name);
+                return {
+                    ...change,
+                    newVersion: lockEntry?.version ?? change.newVersion,
+                };
+            });
             return {
-                packages: diff.changes.map(toPackageInput),
+                packages: resolved.map(toPackageInput),
                 method: "fallback",
                 skipped: [],
             };
@@ -779,7 +865,9 @@ async function main() {
         process.stderr.write((0, color_1.yellow)(`  Warning: ${discovery.skipped.length} package(s) skipped (max-packages=${config.maxPackages})\n`));
     }
     // Call Detection API
-    const result = await (0, api_1.callAnalyzeAPI)(packages, config);
+    const result = await (0, api_1.callAnalyzeAPI)(packages, config, (done, total) => {
+        process.stderr.write((0, color_1.dim)(`  Analyzed ${done}/${total}...\n`));
+    });
     // Render output
     const output = (0, output_1.renderResult)(result, config);
     process.stdout.write(output + "\n");

package/package.json

@@ -1,16 +1,25 @@
 {
   "name": "@westbayberry/dg",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Supply chain security scanner — scan npm dependencies in any CI or terminal",
   "bin": {
-    "dependency-guardian": "./dist/index.js",
-    "dg": "./dist/index.js"
+    "dependency-guardian": "dist/index.js",
+    "dg": "dist/index.js"
   },
-  "files": ["dist"],
+  "files": [
+    "dist"
+  ],
   "license": "UNLICENSED",
   "author": "WestBayBerry",
   "homepage": "https://westbayberry.com",
-  "keywords": ["security", "npm", "supply-chain", "scanner", "cli", "dependencies"],
+  "keywords": [
+    "security",
+    "npm",
+    "supply-chain",
+    "scanner",
+    "cli",
+    "dependencies"
+  ],
   "publishConfig": {
     "access": "public"
   },