agentaudit 3.9.33 → 3.9.35

package/cli.mjs

@@ -1444,11 +1444,34 @@ async function auditRepo(url) {
   process.stdout.write(`  ${c.dim}[3/4]${c.reset} Preparing audit payload...`);
   const auditPrompt = loadAuditPrompt();
   
+  // Build code block with smart truncation to fit context windows.
+  // Reserve ~16k tokens for system prompt + output → budget ~48k tokens for code (~192k chars).
+  // Smaller models may have 32-65k context; we aim for safe default.
+  const MAX_CODE_CHARS = 180_000; // ~45k tokens
   let codeBlock = '';
+  let totalChars = 0;
+  let truncatedFiles = 0;
   for (const file of files) {
-    codeBlock += `\n### FILE: ${file.path}\n\`\`\`\n${file.content}\n\`\`\`\n`;
+    const entry = `\n### FILE: ${file.path}\n\`\`\`\n${file.content}\n\`\`\`\n`;
+    if (totalChars + entry.length > MAX_CODE_CHARS) {
+      // Try to fit a truncated version of this file
+      const remaining = MAX_CODE_CHARS - totalChars;
+      if (remaining > 200) {
+        const truncContent = file.content.substring(0, remaining - 100);
+        codeBlock += `\n### FILE: ${file.path}\n\`\`\`\n${truncContent}\n[... truncated ...]\n\`\`\`\n`;
+      }
+      truncatedFiles = files.length - codeBlock.split('### FILE:').length + 1;
+      break;
+    }
+    codeBlock += entry;
+    totalChars += entry.length;
+  }
+  if (truncatedFiles > 0) {
+    codeBlock += `\n[⚠ ${truncatedFiles} file(s) omitted due to context window limits]\n`;
+    console.log(` ${c.green}done${c.reset} ${c.yellow}(${truncatedFiles} files truncated to fit context window)${c.reset}`);
+  } else {
+    console.log(` ${c.green}done${c.reset}`);
   }
-  console.log(` ${c.green}done${c.reset}`);
   
   // Step 4: LLM Analysis
   // Check for API keys to determine which LLM to use
@@ -1639,7 +1662,12 @@ async function auditRepo(url) {
       const data = await res.json();
       if (data.error) {
         console.log(` ${c.red}failed${c.reset}`);
-        console.log(`  ${c.red}API error: ${data.error.message || JSON.stringify(data.error)}${c.reset}`);
+        const errMsg = data.error.message || JSON.stringify(data.error);
+        console.log(`  ${c.red}API error: ${errMsg}${c.reset}`);
+        if (/context.length|maximum.*tokens|too.many.tokens/i.test(errMsg)) {
+          console.log(`  ${c.dim}This model's context window is too small for this repository.${c.reset}`);
+          console.log(`  ${c.dim}Try a model with a larger context: --model anthropic/claude-sonnet-4 (200k) or --model openai/gpt-4o (128k)${c.reset}`);
+        }
         try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
         return null;
       }
@@ -1667,11 +1695,21 @@ async function auditRepo(url) {
   try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
   
   if (!report) {
-    console.log(`  ${c.red}Could not parse LLM response as JSON${c.reset}`);
-    console.log(`  ${c.dim}Hint: run with --debug to see the raw LLM response${c.reset}`);
-    if (process.argv.includes('--debug')) {
+    const rawLen = typeof _lastLlmText === 'string' ? _lastLlmText.length : 0;
+    if (rawLen === 0) {
+      console.log(`  ${c.red}✖ Model returned an empty response${c.reset}`);
+      console.log(`  ${c.dim}This model may not support structured JSON output or the prompt was too large.${c.reset}`);
+      console.log(`  ${c.dim}Try a different model: --model anthropic/claude-sonnet-4 or --model openai/gpt-4o${c.reset}`);
+    } else {
+      console.log(`  ${c.red}✖ Could not parse LLM response as JSON${c.reset}`);
+      console.log(`  ${c.dim}The model returned ${rawLen} chars but not valid JSON. Try a stronger model.${c.reset}`);
+      if (!process.argv.includes('--debug')) {
+        console.log(`  ${c.dim}Hint: run with --debug to see the raw LLM response${c.reset}`);
+      }
+    }
+    if (process.argv.includes('--debug') && rawLen > 0) {
       console.log(`  ${c.dim}--- Raw LLM response (first 2000 chars) ---${c.reset}`);
-      console.log((typeof _lastLlmText === 'string' ? _lastLlmText : '(empty)').slice(0, 2000));
+      console.log(_lastLlmText.slice(0, 2000));
       console.log(`  ${c.dim}--- end ---${c.reset}`);
     }
     return null;
@@ -1704,6 +1742,17 @@ async function auditRepo(url) {
   
   // Upload to registry
   const creds = loadCredentials();
+  const finalModel = providerMeta.reported_model || actualModel;
+  const finalProvider = resolvedProvider.id;
+  if (!finalModel || finalModel === 'unknown') {
+    console.log(`  ${c.yellow}⚠  Model not detected — report will not include model attestation.${c.reset}`);
+    console.log(`  ${c.dim}   This usually means the LLM API did not return model info.${c.reset}`);
+    console.log(`  ${c.dim}   Try: agentaudit config set model <model-name>${c.reset}`);
+    if (process.argv.includes('--debug')) {
+      console.log(`  ${c.dim}   providerMeta: ${JSON.stringify(providerMeta)}${c.reset}`);
+      console.log(`  ${c.dim}   actualModel: ${actualModel}, resolvedProvider: ${resolvedProvider.id}${c.reset}`);
+    }
+  }
   if (creds) {
     process.stdout.write(`  Uploading report to registry...`);
     try {
@@ -1717,8 +1766,8 @@ async function auditRepo(url) {
           ...report,
           commit_sha: report.commit_sha || repoCommitSha || undefined,
           package_version: report.package_version || repoPackageVersion || undefined,
-          audit_model: providerMeta.reported_model || actualModel,
-          audit_provider: resolvedProvider.id,
+          audit_model: finalModel !== 'unknown' ? finalModel : undefined,
+          audit_provider: finalProvider,
           provider_msg_id: providerMeta.provider_msg_id || undefined,
           provider_fingerprint: providerMeta.provider_fingerprint || undefined,
           input_tokens: providerMeta.input_tokens || undefined,
@@ -1732,6 +1781,12 @@ async function auditRepo(url) {
         const reportSlug = data?.skill_slug || data?.slug || slug;
         console.log(` ${c.green}done${c.reset}`);
         console.log(`  ${c.dim}Report: ${REGISTRY_URL}/skills/${reportSlug}${c.reset}`);
+        // Show API warnings
+        if (data?.warnings?.length) {
+          for (const w of data.warnings) {
+            console.log(`  ${c.yellow}⚠  ${w}${c.reset}`);
+          }
+        }
         // Refresh stats cache in background
         if (creds.agent_name) refreshStatsCache(creds.agent_name).catch(() => {});
         // Fetch registry consensus after upload

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.33",
+  "version": "3.9.35",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {