agentaudit 3.12.5 → 3.12.7

package/cli.mjs

@@ -15,7 +15,8 @@
  *   activity              Your recent audits & findings
  *   search <query>        Search packages in registry
  *   model [name|reset]    Configure LLM provider + model
- *   setup                 Log in to agentaudit.dev (for report uploads)
+ *   login                 Sign in with GitHub (opens browser, auto-creates API key)
+ *   setup                 Manual login — paste an API key from agentaudit.dev
  *   status                Show current config + auth status
  *   profile               Your profile — rank, points, audit stats
  *   help [command]        Show help
@@ -579,6 +580,117 @@ async function setupCommand() {
   console.log();
 }
 
+// ── Login via GitHub Device Flow ─────────────────────────
+
+async function loginCommand() {
+  console.log(`  ${c.bold}AgentAudit Login${c.reset}`);
+  console.log(`  ${c.dim}Sign in with GitHub to upload audit reports${c.reset}`);
+  console.log();
+
+  const existing = loadCredentials();
+  if (existing) {
+    console.log(`  ${icons.safe}  Already logged in as ${c.bold}${existing.agent_name}${c.reset}`);
+    console.log(`  ${c.dim}Key: ${existing.api_key.slice(0, 12)}...${c.reset}`);
+    console.log();
+    const answer = await askQuestion(`  Re-authenticate? ${c.dim}(y/N)${c.reset} `);
+    if (answer.toLowerCase() !== 'y') {
+      console.log(`  ${c.dim}Keeping existing login.${c.reset}`);
+      return;
+    }
+    console.log();
+  }
+
+  // Step 1: Start device flow
+  process.stdout.write(`  Starting login flow...`);
+  let deviceData;
+  try {
+    const res = await fetch(`${REGISTRY_URL}/api/auth/device`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      signal: AbortSignal.timeout(10_000),
+    });
+    deviceData = await res.json();
+    if (!res.ok || !deviceData.device_code) {
+      console.log(` ${c.red}failed${c.reset}`);
+      console.log(`  ${c.red}${deviceData.error || 'Could not start login flow'}${c.reset}`);
+      console.log(`  ${c.dim}Fallback: run ${c.cyan}agentaudit setup${c.dim} to paste an API key manually${c.reset}`);
+      return;
+    }
+    console.log(` ${c.green}ok${c.reset}`);
+  } catch (err) {
+    console.log(` ${c.red}failed${c.reset}`);
+    console.log(`  ${c.red}Could not reach ${REGISTRY_URL}${c.reset}`);
+    console.log(`  ${c.dim}Fallback: run ${c.cyan}agentaudit setup${c.dim} to paste an API key manually${c.reset}`);
+    return;
+  }
+
+  // Step 2: Open browser
+  const verifyUrl = deviceData.verification_url;
+  console.log();
+  console.log(`  ${c.bold}Open this URL in your browser:${c.reset}`);
+  console.log(`  ${c.cyan}${verifyUrl}${c.reset}`);
+  console.log();
+
+  // Try to auto-open browser
+  try {
+    const openCmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'start' : 'xdg-open';
+    const { exec } = await import('child_process');
+    exec(`${openCmd} "${verifyUrl}"`);
+    console.log(`  ${c.dim}(Browser should open automatically)${c.reset}`);
+  } catch {}
+
+  // Step 3: Poll for authorization
+  console.log(`  ${c.dim}Waiting for GitHub authorization...${c.reset}`);
+  console.log();
+
+  const interval = (deviceData.interval || 5) * 1000;
+  const maxAttempts = Math.ceil((deviceData.expires_in || 900) / (interval / 1000));
+
+  for (let attempt = 0; attempt < maxAttempts; attempt++) {
+    await new Promise(r => setTimeout(r, interval));
+
+    try {
+      const res = await fetch(`${REGISTRY_URL}/api/auth/device?device_code=${deviceData.device_code}`, {
+        signal: AbortSignal.timeout(10_000),
+      });
+      const data = await res.json();
+
+      if (res.ok && data.api_key) {
+        // Success!
+        saveCredentials({ api_key: data.api_key, agent_name: data.agent_name });
+        console.log(`  ${c.green}${icons.safe}  Logged in as ${c.bold}${data.agent_name}${c.reset}`);
+        console.log(`  ${c.dim}Key saved to: ${USER_CRED_FILE}${c.reset}`);
+        console.log();
+        console.log(`  ${c.bold}Ready!${c.reset} You can now:`);
+        console.log(`  ${c.dim}•${c.reset} Audit packages:   ${c.cyan}agentaudit audit <repo-url>${c.reset}`);
+        console.log(`  ${c.dim}•${c.reset} Quick scan:        ${c.cyan}agentaudit scan <repo-url>${c.reset}`);
+        console.log(`  ${c.dim}•${c.reset} Check registry:    ${c.cyan}agentaudit check <name>${c.reset}`);
+        console.log();
+        return;
+      }
+
+      if (data.error === 'authorization_pending') {
+        process.stdout.write(`\r  ${c.dim}Waiting... (${attempt + 1}/${maxAttempts})${c.reset}  `);
+        continue;
+      }
+
+      if (data.error === 'expired_token') {
+        console.log(`\n  ${c.red}Login expired. Run ${c.cyan}agentaudit login${c.red} again.${c.reset}`);
+        return;
+      }
+
+      // Unknown error
+      console.log(`\n  ${c.red}${data.error || 'Unknown error'}${c.reset}`);
+      return;
+    } catch {
+      // Network error during poll — continue trying
+      continue;
+    }
+  }
+
+  console.log(`\n  ${c.red}Login timed out. Run ${c.cyan}agentaudit login${c.red} again.${c.reset}`);
+}
+
 // ── Helpers ──────────────────────────────────────────────
 
 function validateGitUrl(url) {
@@ -2587,10 +2699,43 @@ function loadAuditPrompt() {
   return null;
 }
 
+// Known context window sizes (input tokens) for common models
+const MODEL_CONTEXT_LIMITS = {
+  'claude-sonnet-4': 200000, 'claude-opus-4': 200000, 'claude-haiku-4': 200000,
+  'claude-3.5-sonnet': 200000, 'claude-3-haiku': 200000,
+  'gpt-4o': 128000, 'gpt-4o-mini': 128000, 'gpt-4-turbo': 128000, 'gpt-4': 8192,
+  'gemini-2.5-flash': 1048576, 'gemini-2.5-pro': 1048576, 'gemini-2.0-flash': 1048576,
+  'deepseek-chat': 64000, 'deepseek-reasoner': 64000,
+  'mistral-large': 128000, 'mistral-small': 32000,
+};
+
+function estimateTokens(text) { return Math.ceil(text.length / 3.5); }
+
+function checkContextLimit(model, systemPrompt, userMessage) {
+  const modelKey = Object.keys(MODEL_CONTEXT_LIMITS).find(k => model.toLowerCase().includes(k.toLowerCase()));
+  if (!modelKey) return null; // unknown model, skip check
+  const limit = MODEL_CONTEXT_LIMITS[modelKey];
+  const estimated = estimateTokens(systemPrompt) + estimateTokens(userMessage);
+  if (estimated > limit * 0.9) {
+    return { estimated, limit, pct: Math.round(estimated / limit * 100) };
+  }
+  return null;
+}
+
 async function callLlm(llmConfig, systemPrompt, userMessage) {
   const apiKey = process.env[llmConfig.key];
   if (!apiKey) return { error: `Missing API key: ${llmConfig.key}` };
   const start = Date.now();
+
+  // Context window warning
+  const ctxCheck = checkContextLimit(llmConfig.model, systemPrompt, userMessage);
+  if (ctxCheck) {
+    console.log(`  ${c.yellow}⚠ Input ~${Math.round(ctxCheck.estimated/1000)}k tokens (${ctxCheck.pct}% of ${Math.round(ctxCheck.limit/1000)}k context window)${c.reset}`);
+    if (ctxCheck.pct > 100) {
+      return { error: `Input too large (~${Math.round(ctxCheck.estimated/1000)}k tokens) for ${llmConfig.model} (${Math.round(ctxCheck.limit/1000)}k context limit). Try a smaller package or a model with a larger context window.` };
+    }
+  }
+
   let _text = '';
   try {
     let data;
@@ -2607,14 +2752,19 @@ async function callLlm(llmConfig, systemPrompt, userMessage) {
         return { error: friendly?.text || data.error.message || JSON.stringify(data.error), hint: friendly?.hint, duration: Date.now() - start };
       }
       _text = data.content?.[0]?.text || '';
+      if (data.stop_reason === 'max_tokens') {
+        console.log(`  ${c.red}✗ Output truncated — model hit max_tokens limit (${data.usage?.output_tokens || '?'} tokens). Results may be incomplete.${c.reset}`);
+        console.log(`  ${c.dim}  Hint: Try a model with higher output capacity, or scan a smaller package.${c.reset}`);
+      }
       const report = extractJSON(_text);
       if (report) {
         report.audit_model = data.model || llmConfig.model;
         report.audit_provider = llmConfig.provider;
         if (data.id) report.provider_msg_id = data.id;
         if (data.usage) { report.input_tokens = data.usage.input_tokens; report.output_tokens = data.usage.output_tokens; }
+        if (data.stop_reason === 'max_tokens') report.output_truncated = true;
       }
-      return { report, text: _text, duration: Date.now() - start };
+      return { report, text: _text, duration: Date.now() - start, truncated: data.stop_reason === 'max_tokens' };
     } else if (llmConfig.type === 'gemini') {
       const res = await fetch(`${llmConfig.url}/${llmConfig.model}:generateContent?key=${apiKey}`, {
         method: 'POST',
@@ -2632,13 +2782,19 @@ async function callLlm(llmConfig, systemPrompt, userMessage) {
         return { error: friendly?.text || data.error.message || JSON.stringify(data.error), hint: friendly?.hint, duration: Date.now() - start };
       }
       _text = data.candidates?.[0]?.content?.parts?.[0]?.text || '';
+      const geminiFinish = data.candidates?.[0]?.finishReason;
+      if (geminiFinish === 'MAX_TOKENS') {
+        console.log(`  ${c.red}✗ Output truncated — model hit maxOutputTokens limit (${data.usageMetadata?.candidatesTokenCount || '?'} tokens). Results may be incomplete.${c.reset}`);
+        console.log(`  ${c.dim}  Hint: Try a model with higher output capacity, or scan a smaller package.${c.reset}`);
+      }
       const report = extractJSON(_text);
       if (report) {
         report.audit_model = data.modelVersion || llmConfig.model;
         report.audit_provider = llmConfig.provider;
         if (data.usageMetadata) { report.input_tokens = data.usageMetadata.promptTokenCount; report.output_tokens = data.usageMetadata.candidatesTokenCount; }
+        if (geminiFinish === 'MAX_TOKENS') report.output_truncated = true;
       }
-      return { report, text: _text, duration: Date.now() - start };
+      return { report, text: _text, duration: Date.now() - start, truncated: geminiFinish === 'MAX_TOKENS' };
     } else {
       const headers = { 'Authorization': `Bearer ${apiKey}`, 'Content-Type': 'application/json' };
       if (llmConfig.provider === 'openrouter') { headers['HTTP-Referer'] = 'https://agentaudit.dev'; headers['X-Title'] = 'AgentAudit CLI'; }
@@ -2654,6 +2810,11 @@ async function callLlm(llmConfig, systemPrompt, userMessage) {
         return { error: friendly?.text || data.error.message || JSON.stringify(data.error), hint: friendly?.hint, duration: Date.now() - start };
       }
       _text = data.choices?.[0]?.message?.content || '';
+      const oaiFinish = data.choices?.[0]?.finish_reason;
+      if (oaiFinish === 'length') {
+        console.log(`  ${c.red}✗ Output truncated — model hit max_tokens limit (${data.usage?.completion_tokens || '?'} tokens). Results may be incomplete.${c.reset}`);
+        console.log(`  ${c.dim}  Hint: Try a model with higher output capacity, or scan a smaller package.${c.reset}`);
+      }
       const report = extractJSON(_text);
       if (report) {
         report.audit_model = data.model || llmConfig.model;
@@ -2661,12 +2822,13 @@ async function callLlm(llmConfig, systemPrompt, userMessage) {
         if (data.id) report.provider_msg_id = data.id;
         if (data.system_fingerprint) report.provider_fingerprint = data.system_fingerprint;
         if (data.usage) { report.input_tokens = data.usage.prompt_tokens; report.output_tokens = data.usage.completion_tokens; }
+        if (oaiFinish === 'length') report.output_truncated = true;
       }
-      return { report, text: _text, duration: Date.now() - start };
+      return { report, text: _text, duration: Date.now() - start, truncated: oaiFinish === 'length' };
     }
   } catch (err) {
     const dur = Date.now() - start;
-    if (err.name === 'TimeoutError' || err.message?.includes('timeout')) return { error: 'Request timed out (120s)', hint: 'Try again or use a faster model', duration: dur };
+    if (err.name === 'TimeoutError' || err.message?.includes('timeout')) return { error: 'Request timed out (180s)', hint: 'Try again or use a faster model', duration: dur };
     if (err.code === 'ENOTFOUND' || err.code === 'ECONNREFUSED' || err.message?.includes('fetch failed')) return { error: `Network error: could not reach ${llmConfig.provider}`, hint: 'Check your internet connection', duration: dur };
     return { error: err.message, duration: dur };
   }
@@ -3076,7 +3238,7 @@ async function auditRepo(url) {
       for (const { report } of reports) await uploadReport(report, creds);
       console.log(`  ${c.dim}Reports: ${REGISTRY_URL}/packages/${slug}${c.reset}`);
     } else if (!noUpload && !creds) {
-      console.log(`  ${c.dim}Run ${c.cyan}agentaudit setup${c.dim} to upload reports to agentaudit.dev${c.reset}`);
+      console.log(`  ${c.dim}Run ${c.cyan}agentaudit login${c.dim} to upload reports to agentaudit.dev${c.reset}`);
     }
 
     console.log();
@@ -3139,6 +3301,13 @@ async function auditRepo(url) {
 
   console.log(` ${c.green}done${c.reset} ${c.dim}(${elapsed(start)})${c.reset}`);
 
+  if (llmResult.truncated) {
+    console.log();
+    console.log(`  ${c.yellow}⚠ WARNING: The model's output was truncated (hit token limit).${c.reset}`);
+    console.log(`  ${c.yellow}  Some findings may be missing from this scan.${c.reset}`);
+    console.log(`  ${c.dim}  Tip: Try a model with more output capacity or scan a smaller package.${c.reset}`);
+  }
+
   const report = llmResult.report;
   if (!report) {
     console.log(`  ${c.red}Could not parse LLM response as JSON${c.reset}`);
@@ -3208,11 +3377,11 @@ async function auditRepo(url) {
         console.log(`  ${c.dim}Report: ${REGISTRY_URL}/packages/${slug}${c.reset}`);
       } else {
         console.log(` ${c.red}invalid key${c.reset}`);
-        console.log(`  ${c.dim}Run ${c.cyan}agentaudit setup${c.dim} to configure.${c.reset}`);
+        console.log(`  ${c.dim}Run ${c.cyan}agentaudit login${c.dim} to sign in.${c.reset}`);
       }
     }
   } else {
-    console.log(`  ${c.dim}Run ${c.cyan}agentaudit setup${c.dim} to configure your API key and upload reports${c.reset}`);
+    console.log(`  ${c.dim}Run ${c.cyan}agentaudit login${c.dim} to sign in and upload reports${c.reset}`);
   }
 
   console.log();
@@ -3313,7 +3482,7 @@ function renderOverviewTab(data, width) {
     profileLines.push(sevParts.join('  ') || `${c.dim}no findings yet${c.reset}`);
   } else {
     profileLines.push(`${c.dim}Not logged in${c.reset}`);
-    profileLines.push(`${c.dim}Run ${c.cyan}agentaudit setup${c.dim} to create account${c.reset}`);
+    profileLines.push(`${c.dim}Run ${c.cyan}agentaudit login${c.dim} to sign in${c.reset}`);
   }
 
   // Registry box
@@ -3534,7 +3703,7 @@ async function activityCommand(args) {
     } else {
       banner();
       console.log(`  ${c.yellow}Not logged in${c.reset}`);
-      console.log(`  ${c.dim}Run ${c.cyan}agentaudit setup${c.dim} to create an account${c.reset}`);
+      console.log(`  ${c.dim}Run ${c.cyan}agentaudit login${c.dim} to sign in${c.reset}`);
     }
     return;
   }
@@ -4410,7 +4579,8 @@ async function main() {
     console.log();
     console.log(`  ${c.bold}CONFIGURATION${c.reset}`);
     console.log(`    ${c.cyan}model${c.reset}                 Configure LLM provider + model`);
-    console.log(`    ${c.cyan}setup${c.reset}                 Log in to agentaudit.dev (for report uploads)`);
+    console.log(`    ${c.cyan}login${c.reset}                 Sign in with GitHub (opens browser)`);
+    console.log(`    ${c.cyan}setup${c.reset}                 Manual login — paste API key`);
     console.log(`    ${c.cyan}status${c.reset}                Show current config + auth status`);
     console.log(`    ${c.cyan}profile${c.reset}               Your profile — rank, points, audit stats`);
     console.log();
@@ -4569,6 +4739,11 @@ async function main() {
     return;
   }
 
+  if (command === 'login') {
+    await loginCommand();
+    return;
+  }
+
   if (command === 'status' || command === 'whoami') {
     // ── Status / diagnostic overview ──
     const config = loadLlmConfig();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.12.5",
+  "version": "3.12.7",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {