agentaudit 3.9.38 → 3.9.40

package/cli.mjs

@@ -537,6 +537,19 @@ const SKIP_EXTENSIONS = new Set([
   '.woff2', '.ttf', '.eot', '.mp3', '.mp4', '.zip', '.tar', '.gz',
   '.map', '.min.js', '.min.css', '.d.ts', '.pyc', '.pyo', '.so',
   '.dylib', '.dll', '.exe', '.bin', '.dat', '.db', '.sqlite',
+  '.snap', '.patch', '.diff', '.log', '.csv', '.tsv', '.parquet',
+]);
+// Files that are never security-relevant (pure text/metadata only — NO executable files!)
+// Rule: if it CAN execute code (.js, .ts, .mjs, .py etc.), it MUST be scanned.
+// An attacker could hide malware in any executable config file.
+const SKIP_FILES = new Set([
+  'license', 'license.md', 'license.txt', 'licence', 'licence.md',
+  'changelog.md', 'changelog', 'changes.md', 'history.md',
+  'contributing.md', 'contributors.md', 'authors', 'authors.md',
+  'code_of_conduct.md', 'security.md', 'funding.yml',
+  '.gitignore', '.gitattributes', '.npmignore', '.dockerignore',
+  '.editorconfig', '.browserslistrc', '.nvmrc', '.node-version',
+  '.prettierignore', '.eslintignore',
 ]);
 
 function collectFiles(dir, basePath = '', collected = [], totalSize = { bytes: 0 }) {
@@ -555,6 +568,7 @@ function collectFiles(dir, basePath = '', collected = [], totalSize = { bytes: 0
     } else {
       const ext = path.extname(entry.name).toLowerCase();
       if (SKIP_EXTENSIONS.has(ext)) continue;
+      if (SKIP_FILES.has(entry.name.toLowerCase())) continue;
       try {
         const stat = fs.statSync(fullPath);
         if (stat.size > MAX_FILE_SIZE || stat.size === 0) continue;
@@ -1575,6 +1589,34 @@ async function auditRepo(url) {
   }
   
   // ── LLM call helper (reused for multi-pass) ──
+  // Determine optimal max_tokens based on model context size
+  // For large-context models (128k+) we can afford 8192 output tokens
+  // For medium (32k-128k) use 4096, for small (<32k) use 2048
+  let outputTokenBudget = 4096; // safe default
+  if (resolvedProvider.id === 'openrouter') {
+    try {
+      const modelInfoRes = await fetch(`https://openrouter.ai/api/v1/models`, {
+        signal: AbortSignal.timeout(5000),
+        headers: { 'HTTP-Referer': 'https://agentaudit.dev' },
+      });
+      if (modelInfoRes.ok) {
+        const modelData = await modelInfoRes.json();
+        const modelInfo = modelData.data?.find(m => m.id === actualModel);
+        if (modelInfo?.context_length) {
+          const ctx = modelInfo.context_length;
+          outputTokenBudget = ctx >= 128_000 ? 8192 : ctx >= 64_000 ? 4096 : ctx >= 32_000 ? 2048 : 1024;
+          if (process.argv.includes('--debug')) {
+            console.log(`  ${c.dim}  Model context: ${ctx.toLocaleString()} tokens → max_tokens: ${outputTokenBudget}${c.reset}`);
+          }
+        }
+      }
+    } catch { /* ignore — use default */ }
+  } else if (resolvedProvider.id === 'anthropic') {
+    outputTokenBudget = 8192; // Claude models have 200k context
+  } else if (resolvedProvider.id === 'openai') {
+    outputTokenBudget = 8192; // GPT-4o has 128k context
+  }
+
   async function callLLM(codeContent, passLabel) {
     const systemPrompt = auditPrompt || 'You are a security auditor. Analyze the code and report findings as JSON.';
     const userMessage = [
@@ -1605,11 +1647,11 @@ async function auditRepo(url) {
           },
           body: JSON.stringify({
             model: modelOverride || 'claude-sonnet-4-20250514',
-            max_tokens: 4096,
+            max_tokens: outputTokenBudget,
             system: systemPrompt,
             messages: [{ role: 'user', content: userMessage }],
           }),
-          signal: AbortSignal.timeout(120_000),
+          signal: AbortSignal.timeout(180_000),
         });
         const data = await res.json();
         if (data.error) {
@@ -1653,13 +1695,13 @@ async function auditRepo(url) {
           headers: { 'Content-Type': 'application/json', ...authHeaders },
           body: JSON.stringify({
             model: modelName,
-            max_tokens: 4096,
+            max_tokens: outputTokenBudget,
             messages: [
               { role: 'system', content: systemPrompt },
               { role: 'user', content: userMessage },
             ],
           }),
-          signal: AbortSignal.timeout(resolvedProvider.id === 'ollama' ? 300_000 : 120_000),
+          signal: AbortSignal.timeout(resolvedProvider.id === 'ollama' ? 300_000 : 180_000),
         });
         const data = await res.json();
         if (data.error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.38",
+  "version": "3.9.40",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {