agentaudit 3.9.41 → 3.9.42

package/cli.mjs

@@ -558,18 +558,22 @@ const SKIP_FILES = new Set([
   '.prettierignore', '.eslintignore',
 ]);
 
-function collectFiles(dir, basePath = '', collected = [], totalSize = { bytes: 0 }) {
-  if (totalSize.bytes >= MAX_TOTAL_SIZE) return collected;
+function collectFiles(dir, basePath = '', collected = [], totalSize = { bytes: 0, truncated: false, skippedPaths: [] }) {
+  if (totalSize.bytes >= MAX_TOTAL_SIZE) { totalSize.truncated = true; return collected; }
   let entries;
   try { entries = fs.readdirSync(dir, { withFileTypes: true }); }
   catch { return collected; }
   entries.sort((a, b) => a.name.localeCompare(b.name));
   for (const entry of entries) {
-    if (totalSize.bytes >= MAX_TOTAL_SIZE) break;
+    if (totalSize.bytes >= MAX_TOTAL_SIZE) { totalSize.truncated = true; totalSize.skippedPaths.push(relPath); continue; }
     const relPath = basePath ? `${basePath}/${entry.name}` : entry.name;
     const fullPath = path.join(dir, entry.name);
+    // SECURITY: Never follow symlinks — attacker could link to /etc/passwd or ~/.ssh/
+    if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) {
-      if (SKIP_DIRS.has(entry.name) || entry.name.startsWith('.')) continue;
+      // Allow .github (workflow security), skip other dot-dirs (editor/system config)
+      if (SKIP_DIRS.has(entry.name)) continue;
+      if (entry.name.startsWith('.') && entry.name !== '.github') continue;
       collectFiles(fullPath, relPath, collected, totalSize);
     } else {
       const ext = path.extname(entry.name).toLowerCase();
@@ -1457,8 +1461,15 @@ async function auditRepo(url) {
   
   // Step 2: Collect files
   process.stdout.write(`  ${c.dim}[2/4]${c.reset} Collecting source files...`);
-  const files = collectFiles(repoPath);
+  const _collectMeta = { bytes: 0, truncated: false, skippedPaths: [] };
+  const files = collectFiles(repoPath, '', [], _collectMeta);
   console.log(` ${c.green}${files.length} files${c.reset}`);
+  if (_collectMeta.truncated) {
+    console.log(`  ${c.yellow}⚠  Size limit reached (${(MAX_TOTAL_SIZE / 1000).toFixed(0)}KB) — ${_collectMeta.skippedPaths.length} files NOT collected:${c.reset}`);
+    const shown = _collectMeta.skippedPaths.slice(0, 5);
+    for (const p of shown) console.log(`  ${c.dim}    • ${p}${c.reset}`);
+    if (_collectMeta.skippedPaths.length > 5) console.log(`  ${c.dim}    ... and ${_collectMeta.skippedPaths.length - 5} more${c.reset}`);
+  }
   
   // Step 3: Build audit payload
   process.stdout.write(`  ${c.dim}[3/4]${c.reset} Preparing audit payload...`);
@@ -1469,12 +1480,19 @@ async function auditRepo(url) {
   // ~15k tokens per chunk for code → fits comfortably in 32k+ context models
   // with room for system prompt (~2k tokens) + output (4k tokens)
   const MAX_CHUNK_CHARS = 60_000;
+  // Sort files by directory to keep related files in the same chunk.
+  // This preserves cross-file context (imports, shared modules) within each pass.
+  const sortedFiles = [...files].sort((a, b) => {
+    const dirA = a.path.includes('/') ? a.path.substring(0, a.path.lastIndexOf('/')) : '';
+    const dirB = b.path.includes('/') ? b.path.substring(0, b.path.lastIndexOf('/')) : '';
+    return dirA.localeCompare(dirB) || a.path.localeCompare(b.path);
+  });
   const chunks = []; // array of code block strings
   const chunkFileNames = []; // track which files are in each chunk for error reporting
   let currentChunk = '';
   let currentChars = 0;
   let currentFiles = [];
-  for (const file of files) {
+  for (const file of sortedFiles) {
     const entry = `\n### FILE: ${file.path}\n\`\`\`\n${file.content}\n\`\`\`\n`;
     if (currentChars + entry.length > MAX_CHUNK_CHARS && currentChars > 0) {
       chunks.push(currentChunk);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.41",
+  "version": "3.9.42",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {