agentaudit 3.9.34 → 3.9.35

package/cli.mjs

@@ -1444,11 +1444,34 @@ async function auditRepo(url) {
   process.stdout.write(`  ${c.dim}[3/4]${c.reset} Preparing audit payload...`);
   const auditPrompt = loadAuditPrompt();
   
+  // Build code block with smart truncation to fit context windows.
+  // Reserve ~16k tokens for system prompt + output → budget ~48k tokens for code (~192k chars).
+  // Smaller models may have 32-65k context; we aim for safe default.
+  const MAX_CODE_CHARS = 180_000; // ~45k tokens
   let codeBlock = '';
+  let totalChars = 0;
+  let truncatedFiles = 0;
   for (const file of files) {
-    codeBlock += `\n### FILE: ${file.path}\n\`\`\`\n${file.content}\n\`\`\`\n`;
+    const entry = `\n### FILE: ${file.path}\n\`\`\`\n${file.content}\n\`\`\`\n`;
+    if (totalChars + entry.length > MAX_CODE_CHARS) {
+      // Try to fit a truncated version of this file
+      const remaining = MAX_CODE_CHARS - totalChars;
+      if (remaining > 200) {
+        const truncContent = file.content.substring(0, remaining - 100);
+        codeBlock += `\n### FILE: ${file.path}\n\`\`\`\n${truncContent}\n[... truncated ...]\n\`\`\`\n`;
+      }
+      truncatedFiles = files.length - codeBlock.split('### FILE:').length + 1;
+      break;
+    }
+    codeBlock += entry;
+    totalChars += entry.length;
+  }
+  if (truncatedFiles > 0) {
+    codeBlock += `\n[⚠ ${truncatedFiles} file(s) omitted due to context window limits]\n`;
+    console.log(` ${c.green}done${c.reset} ${c.yellow}(${truncatedFiles} files truncated to fit context window)${c.reset}`);
+  } else {
+    console.log(` ${c.green}done${c.reset}`);
   }
-  console.log(` ${c.green}done${c.reset}`);
   
   // Step 4: LLM Analysis
   // Check for API keys to determine which LLM to use
@@ -1639,7 +1662,12 @@ async function auditRepo(url) {
       const data = await res.json();
       if (data.error) {
         console.log(` ${c.red}failed${c.reset}`);
-        console.log(`  ${c.red}API error: ${data.error.message || JSON.stringify(data.error)}${c.reset}`);
+        const errMsg = data.error.message || JSON.stringify(data.error);
+        console.log(`  ${c.red}API error: ${errMsg}${c.reset}`);
+        if (/context.length|maximum.*tokens|too.many.tokens/i.test(errMsg)) {
+          console.log(`  ${c.dim}This model's context window is too small for this repository.${c.reset}`);
+          console.log(`  ${c.dim}Try a model with a larger context: --model anthropic/claude-sonnet-4 (200k) or --model openai/gpt-4o (128k)${c.reset}`);
+        }
         try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
         return null;
       }
@@ -1667,11 +1695,21 @@ async function auditRepo(url) {
   try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
   
   if (!report) {
-    console.log(`  ${c.red}Could not parse LLM response as JSON${c.reset}`);
-    console.log(`  ${c.dim}Hint: run with --debug to see the raw LLM response${c.reset}`);
-    if (process.argv.includes('--debug')) {
+    const rawLen = typeof _lastLlmText === 'string' ? _lastLlmText.length : 0;
+    if (rawLen === 0) {
+      console.log(`  ${c.red}✖ Model returned an empty response${c.reset}`);
+      console.log(`  ${c.dim}This model may not support structured JSON output or the prompt was too large.${c.reset}`);
+      console.log(`  ${c.dim}Try a different model: --model anthropic/claude-sonnet-4 or --model openai/gpt-4o${c.reset}`);
+    } else {
+      console.log(`  ${c.red}✖ Could not parse LLM response as JSON${c.reset}`);
+      console.log(`  ${c.dim}The model returned ${rawLen} chars but not valid JSON. Try a stronger model.${c.reset}`);
+      if (!process.argv.includes('--debug')) {
+        console.log(`  ${c.dim}Hint: run with --debug to see the raw LLM response${c.reset}`);
+      }
+    }
+    if (process.argv.includes('--debug') && rawLen > 0) {
       console.log(`  ${c.dim}--- Raw LLM response (first 2000 chars) ---${c.reset}`);
-      console.log((typeof _lastLlmText === 'string' ? _lastLlmText : '(empty)').slice(0, 2000));
+      console.log(_lastLlmText.slice(0, 2000));
       console.log(`  ${c.dim}--- end ---${c.reset}`);
     }
     return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.34",
+  "version": "3.9.35",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {