circle-ir-ai 2.7.3 → 2.7.5

package/dist/utils/file-skip.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Shared pre-flight skip heuristics for file walkers.
+ *
+ * #53: Tree-sitter parses are SYNCHRONOUS inside the WASM module —
+ * pathological inputs (auto-generated type defs, vendored module
+ * loaders, large integration-test fixtures, deeply nested const
+ * initializers) wedge the JS event loop entirely. That defeats
+ * Promise-based withTimeout() since the setTimeout callback can't fire
+ * while the loop is blocked. We can't kill a wedged parse without
+ * worker_threads (real fix, larger scope).
+ *
+ * The pragmatic mitigation is a set of pre-flight skip heuristics that
+ * refuse pathological inputs before they reach the parser. These three
+ * caps cover the common offenders the user reported (deno-types.ts,
+ * monaco loader, *IT.java fixtures, ReadOnlyKerberos*Delegate.java):
+ *
+ *  1. File size > 1 MB                 — bundles, vendored output
+ *  2. Longest line > 50 000 chars      — minified
+ *  3. Total lines > MAX_FILE_LINES     — auto-generated mega-files
+ *
+ * All three caps can be overridden via env vars for advanced users:
+ *   MAX_FILE_BYTES (default 1_000_000)
+ *   MAX_LINE_LENGTH (default 50_000)
+ *   MAX_FILE_LINES (default 50_000)
+ */
+export interface SkipResult {
+    /** True if the caller should skip this file (don't call analyze()). */
+    skip: boolean;
+    /** Human-readable reason for the skip, suitable for logging. */
+    reason?: string;
+    /** File content if it was already read (saves a re-read by the caller). */
+    content?: string;
+    /** Stat info if it was already collected. */
+    size?: number;
+}
+/**
+ * Pre-flight skip check for a single file. Reads content as a side
+ * effect so the caller doesn't double-read.
+ *
+ * @returns `skip: false, content: '...'` when the file is safe to parse,
+ *          or `skip: true, reason: '...'` when it should be refused.
+ */
+export declare function preFlightSkip(filePath: string): SkipResult;
+//# sourceMappingURL=file-skip.d.ts.map

package/dist/utils/file-skip.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-skip.d.ts","sourceRoot":"","sources":["../../src/utils/file-skip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,MAAM,WAAW,UAAU;IACzB,uEAAuE;IACvE,IAAI,EAAE,OAAO,CAAC;IACd,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAMD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CA+C1D"}

package/dist/utils/file-skip.js

@@ -0,0 +1,82 @@
+/**
+ * Shared pre-flight skip heuristics for file walkers.
+ *
+ * #53: Tree-sitter parses are SYNCHRONOUS inside the WASM module —
+ * pathological inputs (auto-generated type defs, vendored module
+ * loaders, large integration-test fixtures, deeply nested const
+ * initializers) wedge the JS event loop entirely. That defeats
+ * Promise-based withTimeout() since the setTimeout callback can't fire
+ * while the loop is blocked. We can't kill a wedged parse without
+ * worker_threads (real fix, larger scope).
+ *
+ * The pragmatic mitigation is a set of pre-flight skip heuristics that
+ * refuse pathological inputs before they reach the parser. These three
+ * caps cover the common offenders the user reported (deno-types.ts,
+ * monaco loader, *IT.java fixtures, ReadOnlyKerberos*Delegate.java):
+ *
+ *  1. File size > 1 MB                 — bundles, vendored output
+ *  2. Longest line > 50 000 chars      — minified
+ *  3. Total lines > MAX_FILE_LINES     — auto-generated mega-files
+ *
+ * All three caps can be overridden via env vars for advanced users:
+ *   MAX_FILE_BYTES (default 1_000_000)
+ *   MAX_LINE_LENGTH (default 50_000)
+ *   MAX_FILE_LINES (default 50_000)
+ */
+import * as fs from 'fs';
+const MAX_FILE_BYTES = () => parseInt(process.env.MAX_FILE_BYTES || '1000000', 10);
+const MAX_LINE_LENGTH = () => parseInt(process.env.MAX_LINE_LENGTH || '50000', 10);
+const MAX_FILE_LINES = () => parseInt(process.env.MAX_FILE_LINES || '50000', 10);
+/**
+ * Pre-flight skip check for a single file. Reads content as a side
+ * effect so the caller doesn't double-read.
+ *
+ * @returns `skip: false, content: '...'` when the file is safe to parse,
+ *          or `skip: true, reason: '...'` when it should be refused.
+ */
+export function preFlightSkip(filePath) {
+    let stat;
+    try {
+        stat = fs.statSync(filePath);
+    }
+    catch {
+        return { skip: true, reason: 'unreadable' };
+    }
+    const sizeMax = MAX_FILE_BYTES();
+    if (stat.size > sizeMax) {
+        return {
+            skip: true,
+            reason: `file too large (${(stat.size / 1024).toFixed(0)} KB > ${(sizeMax / 1024).toFixed(0)} KB; likely bundle/vendored)`,
+            size: stat.size,
+        };
+    }
+    let content;
+    try {
+        content = fs.readFileSync(filePath, 'utf-8');
+    }
+    catch {
+        return { skip: true, reason: 'unreadable' };
+    }
+    const lines = content.split('\n');
+    const lineMax = MAX_LINE_LENGTH();
+    const maxLineLength = lines.reduce((m, l) => Math.max(m, l.length), 0);
+    if (maxLineLength > lineMax) {
+        return {
+            skip: true,
+            reason: `line too long (${maxLineLength} chars > ${lineMax}; likely minified)`,
+            content,
+            size: stat.size,
+        };
+    }
+    const countMax = MAX_FILE_LINES();
+    if (lines.length > countMax) {
+        return {
+            skip: true,
+            reason: `too many lines (${lines.length} > ${countMax}; likely auto-generated)`,
+            content,
+            size: stat.size,
+        };
+    }
+    return { skip: false, content, size: stat.size };
+}
+//# sourceMappingURL=file-skip.js.map

package/dist/utils/file-skip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-skip.js","sourceRoot":"","sources":["../../src/utils/file-skip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAazB,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;AACnF,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;AACnF,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;YAC1H,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,aAAa,GAAG,OAAO,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,kBAAkB,aAAa,YAAY,OAAO,oBAAoB;YAC9E,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,mBAAmB,KAAK,CAAC,MAAM,MAAM,QAAQ,0BAA0B;YAC/E,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir-ai",
-  "version": "2.7.3",
+  "version": "2.7.5",
   "description": "LLM-enhanced SAST analysis built on circle-ir",
   "main": "dist/index.js",
   "module": "dist/index.js",