agentaudit 3.9.9 → 3.9.11

package/cli.mjs

@@ -343,38 +343,47 @@ function extractJSON(text) {
   // 1. Try parsing the entire text as JSON directly
   try { return JSON.parse(text.trim()); } catch {}
   
-  // 2. Strip markdown code fences (```json ... ``` or ``` ... ```)
-  const fenceMatch = text.match(/```(?:json)?\s*\n?([\s\S]*?)\n?\s*```/);
-  if (fenceMatch) {
-    try { return JSON.parse(fenceMatch[1].trim()); } catch {}
+  // 2. Strip markdown code fences — try last fence first (report is usually at the end)
+  const fenceMatches = [...text.matchAll(/```(?:json)?\s*\n?([\s\S]*?)\n?\s*```/g)];
+  for (let i = fenceMatches.length - 1; i >= 0; i--) {
+    try { 
+      const parsed = JSON.parse(fenceMatches[i][1].trim());
+      if (parsed && typeof parsed === 'object' && ('risk_score' in parsed || 'findings' in parsed || 'result' in parsed)) return parsed;
+    } catch {}
+  }
+  // Try any fence even without report keys
+  for (let i = fenceMatches.length - 1; i >= 0; i--) {
+    try { return JSON.parse(fenceMatches[i][1].trim()); } catch {}
   }
   
-  // 3. Find the first balanced top-level { ... } block
-  const start = text.indexOf('{');
-  if (start === -1) return null;
-  let depth = 0;
-  let inString = false;
-  let escape = false;
-  for (let i = start; i < text.length; i++) {
-    const ch = text[i];
-    if (escape) { escape = false; continue; }
-    if (ch === '\\' && inString) { escape = true; continue; }
-    if (ch === '"') { inString = !inString; continue; }
-    if (inString) continue;
-    if (ch === '{') depth++;
-    else if (ch === '}') {
-      depth--;
-      if (depth === 0) {
-        try { return JSON.parse(text.slice(start, i + 1)); } catch {}
-        break;
-      }
+  // 3. Find ALL balanced top-level { ... } blocks, try each (prefer largest valid one)
+  const blocks = [];
+  let searchFrom = 0;
+  while (searchFrom < text.length) {
+    const start = text.indexOf('{', searchFrom);
+    if (start === -1) break;
+    let depth = 0, inStr = false, esc = false;
+    let end = -1;
+    for (let i = start; i < text.length; i++) {
+      const ch = text[i];
+      if (esc) { esc = false; continue; }
+      if (ch === '\\' && inStr) { esc = true; continue; }
+      if (ch === '"') { inStr = !inStr; continue; }
+      if (inStr) continue;
+      if (ch === '{') depth++;
+      else if (ch === '}') { depth--; if (depth === 0) { end = i; break; } }
+    }
+    if (end > start) {
+      blocks.push(text.slice(start, end + 1));
+      searchFrom = end + 1;
+    } else {
+      searchFrom = start + 1;
     }
   }
-  
-  // 4. Last resort: greedy match
-  const greedy = text.match(/\{[\s\S]*\}/);
-  if (greedy) {
-    try { return JSON.parse(greedy[0]); } catch {}
+  // Try largest block first (the report JSON is usually the biggest)
+  blocks.sort((a, b) => b.length - a.length);
+  for (const block of blocks) {
+    try { return JSON.parse(block); } catch {}
   }
   
   return null;
@@ -1381,6 +1390,7 @@ async function auditRepo(url) {
   ].join('\n');
   
   let report = null;
+  let _lastLlmText = '';
   
   try {
     if (anthropicKey) {
@@ -1400,7 +1410,14 @@ async function auditRepo(url) {
         signal: AbortSignal.timeout(120_000),
       });
       const data = await res.json();
+      if (data.error) {
+        console.log(` ${c.red}failed${c.reset}`);
+        console.log(`  ${c.red}API error: ${data.error.message || JSON.stringify(data.error)}${c.reset}`);
+        try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
+        return null;
+      }
       const text = data.content?.[0]?.text || '';
+      _lastLlmText = text;
       report = extractJSON(text);
     } else if (openaiKey) {
       const res = await fetch('https://api.openai.com/v1/chat/completions', {
@@ -1420,7 +1437,14 @@ async function auditRepo(url) {
         signal: AbortSignal.timeout(120_000),
       });
       const data = await res.json();
+      if (data.error) {
+        console.log(` ${c.red}failed${c.reset}`);
+        console.log(`  ${c.red}API error: ${data.error.message || JSON.stringify(data.error)}${c.reset}`);
+        try { fs.rmSync(tmpDir, { recursive: true, force: true }); } catch {}
+        return null;
+      }
       const text = data.choices?.[0]?.message?.content || '';
+      _lastLlmText = text;
       report = extractJSON(text);
     }
     
@@ -1437,6 +1461,12 @@ async function auditRepo(url) {
   
   if (!report) {
     console.log(`  ${c.red}Could not parse LLM response as JSON${c.reset}`);
+    console.log(`  ${c.dim}Hint: run with --debug to see the raw LLM response${c.reset}`);
+    if (process.argv.includes('--debug')) {
+      console.log(`  ${c.dim}--- Raw LLM response (first 2000 chars) ---${c.reset}`);
+      console.log((typeof _lastLlmText === 'string' ? _lastLlmText : '(empty)').slice(0, 2000));
+      console.log(`  ${c.dim}--- end ---${c.reset}`);
+    }
     return null;
   }
   

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentaudit",
-  "version": "3.9.9",
+  "version": "3.9.11",
   "description": "Security scanner for AI packages — MCP server + CLI",
   "type": "module",
   "bin": {