agentaudit 3.9.44 → 3.9.46

package/cli.mjs

@@ -75,6 +75,7 @@ let jsonMode = false;
 let quietMode = false;
 let modelOverride = null; // --model flag or AGENTAUDIT_MODEL env or config
 let globalModelOverride = null; // same, but set early for resolveProvider
+let llmTimeoutMs = null; // --timeout flag (seconds → ms)
 
 // ── ANSI Colors (respects NO_COLOR and --no-color) ───────
 
@@ -1679,7 +1680,7 @@ async function auditRepo(url) {
             system: systemPrompt,
             messages: [{ role: 'user', content: userMessage }],
           }),
-          signal: AbortSignal.timeout(180_000),
+          signal: AbortSignal.timeout(llmTimeoutMs || 180_000),
         });
         const data = await res.json();
         if (data.error) {
@@ -1729,7 +1730,7 @@ async function auditRepo(url) {
               { role: 'user', content: userMessage },
             ],
           }),
-          signal: AbortSignal.timeout(resolvedProvider.id === 'ollama' ? 300_000 : 180_000),
+          signal: AbortSignal.timeout(llmTimeoutMs || (resolvedProvider.id === 'ollama' ? 300_000 : 180_000)),
         });
         const data = await res.json();
         if (data.error) {
@@ -1916,6 +1917,12 @@ async function auditRepo(url) {
       console.log(` ${c.red}failed${c.reset}`);
       const errMsg = result.error;
       console.log(`  ${c.red}API error: ${errMsg}${c.reset}`);
+      if (/abort|timeout/i.test(errMsg)) {
+        const currentTimeout = llmTimeoutMs ? (llmTimeoutMs / 1000) : 180;
+        console.log(`  ${c.dim}The model took longer than ${currentTimeout}s to respond.${c.reset}`);
+        console.log(`  ${c.dim}Try increasing the timeout: --timeout 300 (or --timeout 600 for reasoning models)${c.reset}`);
+        console.log(`  ${c.dim}You can also set AGENTAUDIT_TIMEOUT=300 as environment variable.${c.reset}`);
+      }
       if (/context.length|maximum.*tokens|too.many.tokens/i.test(errMsg)) {
         console.log(`  ${c.dim}This model's context window is too small for this repository.${c.reset}`);
         console.log(`  ${c.dim}Try a model with a larger context: --model anthropic/claude-sonnet-4 (200k) or --model openai/gpt-4o (128k)${c.reset}`);
@@ -2210,6 +2217,18 @@ async function main() {
     || null;
   globalModelOverride = modelOverride;
   
+  // --timeout flag: --timeout=<seconds> or --timeout <seconds>
+  const timeoutFlagIdx = rawArgs.findIndex(a => a === '--timeout');
+  const timeoutFlagEq = rawArgs.find(a => a.startsWith('--timeout='));
+  const timeoutVal = timeoutFlagEq?.split('=')[1]
+    || (timeoutFlagIdx >= 0 ? rawArgs[timeoutFlagIdx + 1] : null)
+    || process.env.AGENTAUDIT_TIMEOUT
+    || null;
+  if (timeoutVal) {
+    const secs = parseInt(timeoutVal, 10);
+    if (secs > 0) llmTimeoutMs = secs * 1000;
+  }
+  
   // Strip global flags from args
   const globalFlags = new Set(['--json', '--quiet', '-q', '--no-color']);
   let args = rawArgs.filter(a => !globalFlags.has(a));
@@ -2217,6 +2236,8 @@ async function main() {
   args = args.filter((a, i, arr) => {
     if (a.startsWith('--model=')) return false;
     if (a === '--model') { arr[i + 1] = '__skip__'; return false; }
+    if (a.startsWith('--timeout=')) return false;
+    if (a === '--timeout') { arr[i + 1] = '__skip__'; return false; }
     if (a === '__skip__') return false;
     return true;
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.44",
+  "version": "3.9.46",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {

package/prompts/audit-prompt.md

@@ -409,12 +409,9 @@ If **any** fails → real vulnerability (`by_design: false`).
 
 ## 3.10 Final Triage
 
-### Finding Count Cap: Maximum 8 real findings per audit.
+### Finding Quality Check
 
-If more than 8 candidates after triage:
-1. Keep highest severity + highest confidence
-2. Merge ONLY when same pattern_id + same file
-3. Drop LOW-confidence findings first
+Report ALL genuine findings — do not artificially limit the count. If a package has 20 real vulnerabilities, report all 20. However, if you have more than 15 candidates, double-check each against the Self-Check (§3.1) to ensure every finding has concrete evidence and is not a duplicate.
 
 ### Anti-Merging Rules
 
@@ -654,10 +651,6 @@ Consult these patterns during Phase 2 evidence collection. Remember: a pattern m
 - risk_score > 50 for a package with no confirmed exploit path
 - Multiple credential-config findings for the same .env/env-var system — merge or drop
 
-## Ideal Distribution (benchmark)
+## Quality Guidance
 
-- ~60-70% of packages: `safe` (0-25 risk)
-- ~20-25%: `caution` (26-50)
-- ~5-10%: `unsafe` (51-100) — only confirmed malware or severe vulnerabilities
-- CRITICAL findings in <5% of audits
-- Average findings per audit: 1-3 (not 5-10)
+Judge each audit on its own merits. A clean package should have 0 findings; a heavily vulnerable package may have 20+. Do not target a specific distribution — report what you find with evidence.