agentaudit 3.9.37 → 3.9.39

package/cli.mjs

@@ -537,6 +537,22 @@ const SKIP_EXTENSIONS = new Set([
   '.woff2', '.ttf', '.eot', '.mp3', '.mp4', '.zip', '.tar', '.gz',
   '.map', '.min.js', '.min.css', '.d.ts', '.pyc', '.pyo', '.so',
   '.dylib', '.dll', '.exe', '.bin', '.dat', '.db', '.sqlite',
+  '.snap', '.patch', '.diff', '.log', '.csv', '.tsv', '.parquet',
+]);
+// Files that are never security-relevant (config/docs/metadata)
+const SKIP_FILES = new Set([
+  'license', 'license.md', 'license.txt', 'licence', 'licence.md',
+  'changelog.md', 'changelog', 'changes.md', 'history.md',
+  'contributing.md', 'contributors.md', 'authors', 'authors.md',
+  'code_of_conduct.md', 'security.md', 'funding.yml',
+  '.prettierrc', '.prettierrc.json', '.prettierrc.js', '.prettierignore',
+  '.eslintignore', '.gitignore', '.gitattributes', '.npmignore',
+  '.editorconfig', '.browserslistrc', '.nvmrc', '.node-version',
+  '.dockerignore', 'renovate.json', '.renovaterc',
+  'jest.config.js', 'jest.config.ts', 'vitest.config.ts', 'vitest.config.js',
+  '.babelrc', 'babel.config.js', 'babel.config.json',
+  'postcss.config.js', 'postcss.config.mjs', 'tailwind.config.js', 'tailwind.config.ts',
+  'prettier.config.js', 'prettier.config.mjs',
 ]);
 
 function collectFiles(dir, basePath = '', collected = [], totalSize = { bytes: 0 }) {
@@ -555,6 +571,7 @@ function collectFiles(dir, basePath = '', collected = [], totalSize = { bytes: 0
     } else {
       const ext = path.extname(entry.name).toLowerCase();
       if (SKIP_EXTENSIONS.has(ext)) continue;
+      if (SKIP_FILES.has(entry.name.toLowerCase())) continue;
       try {
         const stat = fs.statSync(fullPath);
         if (stat.size > MAX_FILE_SIZE || stat.size === 0) continue;
@@ -1446,7 +1463,9 @@ async function auditRepo(url) {
   
   // Build code chunks for multi-pass analysis.
   // Budget ~45k tokens (~180k chars) per chunk for code, leaving room for prompt + output.
-  const MAX_CHUNK_CHARS = 180_000;
+  // ~15k tokens per chunk for code → fits comfortably in 32k+ context models
+  // with room for system prompt (~2k tokens) + output (4k tokens)
+  const MAX_CHUNK_CHARS = 60_000;
   const chunks = []; // array of code block strings
   let currentChunk = '';
   let currentChars = 0;
@@ -1573,6 +1592,34 @@ async function auditRepo(url) {
   }
   
   // ── LLM call helper (reused for multi-pass) ──
+  // Determine optimal max_tokens based on model context size
+  // For large-context models (128k+) we can afford 8192 output tokens
+  // For medium (32k-128k) use 4096, for small (<32k) use 2048
+  let outputTokenBudget = 4096; // safe default
+  if (resolvedProvider.id === 'openrouter') {
+    try {
+      const modelInfoRes = await fetch(`https://openrouter.ai/api/v1/models`, {
+        signal: AbortSignal.timeout(5000),
+        headers: { 'HTTP-Referer': 'https://agentaudit.dev' },
+      });
+      if (modelInfoRes.ok) {
+        const modelData = await modelInfoRes.json();
+        const modelInfo = modelData.data?.find(m => m.id === actualModel);
+        if (modelInfo?.context_length) {
+          const ctx = modelInfo.context_length;
+          outputTokenBudget = ctx >= 128_000 ? 8192 : ctx >= 64_000 ? 4096 : ctx >= 32_000 ? 2048 : 1024;
+          if (process.argv.includes('--debug')) {
+            console.log(`  ${c.dim}  Model context: ${ctx.toLocaleString()} tokens → max_tokens: ${outputTokenBudget}${c.reset}`);
+          }
+        }
+      }
+    } catch { /* ignore — use default */ }
+  } else if (resolvedProvider.id === 'anthropic') {
+    outputTokenBudget = 8192; // Claude models have 200k context
+  } else if (resolvedProvider.id === 'openai') {
+    outputTokenBudget = 8192; // GPT-4o has 128k context
+  }
+
   async function callLLM(codeContent, passLabel) {
     const systemPrompt = auditPrompt || 'You are a security auditor. Analyze the code and report findings as JSON.';
     const userMessage = [
@@ -1603,11 +1650,11 @@ async function auditRepo(url) {
           },
           body: JSON.stringify({
             model: modelOverride || 'claude-sonnet-4-20250514',
-            max_tokens: 8192,
+            max_tokens: outputTokenBudget,
             system: systemPrompt,
             messages: [{ role: 'user', content: userMessage }],
           }),
-          signal: AbortSignal.timeout(120_000),
+          signal: AbortSignal.timeout(180_000),
         });
         const data = await res.json();
         if (data.error) {
@@ -1651,13 +1698,13 @@ async function auditRepo(url) {
           headers: { 'Content-Type': 'application/json', ...authHeaders },
           body: JSON.stringify({
             model: modelName,
-            max_tokens: 8192,
+            max_tokens: outputTokenBudget,
             messages: [
               { role: 'system', content: systemPrompt },
               { role: 'user', content: userMessage },
             ],
           }),
-          signal: AbortSignal.timeout(resolvedProvider.id === 'ollama' ? 300_000 : 120_000),
+          signal: AbortSignal.timeout(resolvedProvider.id === 'ollama' ? 300_000 : 180_000),
         });
         const data = await res.json();
         if (data.error) {
@@ -1700,15 +1747,9 @@ async function auditRepo(url) {
       const result = await callLLM(chunks[i], `pass ${i + 1}`);
       
       if (result.error) {
-        console.log(` ${c.red}failed${c.reset}`);
-        const errMsg = result.error;
-        console.log(`  ${c.red}API error: ${errMsg}${c.reset}`);
-        if (/context.length|maximum.*tokens|too.many.tokens/i.test(errMsg)) {
-          console.log(`  ${c.dim}This model's context window is too small even for chunked analysis.${c.reset}`);
-          console.log(`  ${c.dim}Try: --model anthropic/claude-sonnet-4 (200k) or --model openai/gpt-4o (128k)${c.reset}`);
-        }
-        try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
-        return null;
+        console.log(` ${c.red}failed${c.reset} ${c.dim}(${result.error.slice(0, 80)})${c.reset}`);
+        // Don't abort on individual pass failures — continue with remaining chunks
+        continue;
       }
       
       if (!result.report) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.37",
+  "version": "3.9.39",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {