agentaudit 3.12.3 → 3.12.4

package/cli.mjs

@@ -2622,9 +2622,9 @@ async function callLlm(llmConfig, systemPrompt, userMessage) {
         body: JSON.stringify({
           systemInstruction: { parts: [{ text: systemPrompt }] },
           contents: [{ role: 'user', parts: [{ text: userMessage }] }],
-          generationConfig: { maxOutputTokens: 8192 },
+          generationConfig: { maxOutputTokens: 65536, responseMimeType: 'application/json', thinkingConfig: { thinkingBudget: 8192 } },
         }),
-        signal: AbortSignal.timeout(120_000),
+        signal: AbortSignal.timeout(180_000),
       });
       data = await res.json();
       if (data.error) {
@@ -2802,27 +2802,39 @@ function enrichFindings(report, files, pkgInfo) {
 
 async function auditRepo(url) {
   const start = Date.now();
-  const slug = slugFromUrl(url);
-  
+
+  // Support local directories
+  const isLocal = fs.existsSync(url) && fs.statSync(url).isDirectory();
+  const slug = isLocal ? path.basename(url) : slugFromUrl(url);
+
   console.log(`${icons.scan}  ${c.bold}Auditing ${slug}${c.reset}  ${c.dim}${url}${c.reset}`);
   console.log(`${icons.pipe}  ${c.dim}Deep LLM-powered analysis (3-pass: UNDERSTAND → DETECT → CLASSIFY)${c.reset}`);
   console.log();
-  
-  // Step 1: Clone
-  process.stdout.write(`  ${stepProgress(1, 4)} Cloning repository...`);
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentaudit-'));
-  const repoPath = path.join(tmpDir, 'repo');
-  try {
-    safeGitClone(url, repoPath);
+
+  let repoPath, tmpDir = null;
+
+  if (isLocal) {
+    // Local directory — no cloning needed
+    repoPath = path.resolve(url);
+    process.stdout.write(`  ${stepProgress(1, 4)} Reading local directory...`);
     console.log(` ${c.green}done${c.reset}`);
-  } catch (err) {
-    console.log(` ${c.red}failed${c.reset}`);
-    const msg = err.stderr?.toString().trim() || err.message?.split('\n')[0] || '';
-    if (msg) console.log(`    ${c.dim}${msg}${c.reset}`);
-    console.log(`    ${c.dim}Make sure git is installed and the URL is accessible.${c.reset}`);
-    return null;
+  } else {
+    // Step 1: Clone
+    process.stdout.write(`  ${stepProgress(1, 4)} Cloning repository...`);
+    tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agentaudit-'));
+    repoPath = path.join(tmpDir, 'repo');
+    try {
+      safeGitClone(url, repoPath);
+      console.log(` ${c.green}done${c.reset}`);
+    } catch (err) {
+      console.log(` ${c.red}failed${c.reset}`);
+      const msg = err.stderr?.toString().trim() || err.message?.split('\n')[0] || '';
+      if (msg) console.log(`    ${c.dim}${msg}${c.reset}`);
+      console.log(`    ${c.dim}Make sure git is installed and the URL is accessible.${c.reset}`);
+      return null;
+    }
   }
-  
+
   // Step 2: Collect files
   process.stdout.write(`  ${stepProgress(2, 4)} Collecting source files...`);
   const files = collectFiles(repoPath);
@@ -2852,8 +2864,8 @@ async function auditRepo(url) {
   if (KNOWN_MCP_LIBS.has(slug)) detectedType = 'library';
   if (KNOWN_CLI.has(slug)) detectedType = 'cli-tool';
 
-  // Cleanup repo (files in memory, provenance captured)
-  try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
+  // Cleanup cloned repo (files in memory, provenance captured); skip for local dirs
+  if (tmpDir) { try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {} }
 
   // Build prompts
   const systemPrompt = auditPrompt || 'You are a security auditor. Analyze the code and report findings as JSON.';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.12.3",
+  "version": "3.12.4",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {