circle-ir-ai 2.71.0 → 2.76.0

package/dist/utils/file-skip.js

@@ -48,6 +48,93 @@ export function isMinifiedFilename(filePath) {
     const base = filePath.split(/[\\/]/).pop() ?? filePath;
     return MINIFIED_FILENAME_RE.test(base);
 }
+/**
+ * cognium-ai#252 (problem C) — mirrored CDN/vendor trees.
+ *
+ * #243 catches build artifacts by the `.min.` convention, but mirrored CDN
+ * copies frequently carry neither `.min.` nor a giant line: site-rippers
+ * (wget/httrack and friends) flatten a remote URL into a filename by
+ * replacing separators, producing names like
+ *
+ *   js/ajax.googleapis.com__ajax__libs__dojo__1.4.3__dojo__dojo.js
+ *
+ * poisontap ships 249 such copies. They are third-party code the repo owner
+ * does not maintain, so findings in them are noise, and in #252 they were the
+ * trees that walked discovery into a 7200s timeout with no artifact.
+ *
+ * Two conservative signals, either sufficient:
+ *
+ *  1. a hostname-shaped token ending in a real TLD, immediately followed by
+ *     the `__` flattening marker — `ajax.googleapis.com__`. Both conditions
+ *     matter: the marker keeps ordinary dotted names (`utils.test.js`,
+ *     `app.config.js`) out, and the TLD list keeps first-party names that
+ *     happen to contain `__` (`foo.bar__baz.js`) out.
+ *  2. a known CDN host appearing anywhere in the path, for mirrors that keep
+ *     real directories (`vendor/cdnjs.cloudflare.com/ajax/libs/...`).
+ *
+ * Opt out with `SKIP_CDN_MIRRORS=0`.
+ */
+export const CDN_MIRROR_FLATTENED_RE = /(?:[a-z0-9-]+\.)+(?:com|net|org|io|dev|co|edu|gov|info|biz|app|cloud|cn|jp|uk|de|fr|ru|nl|eu|ca|au|br|in)__/i;
+/** Hosts common enough to be worth matching without the `__` marker. */
+export const KNOWN_CDN_HOSTS = [
+    'ajax.googleapis.com',
+    'cdnjs.cloudflare.com',
+    'cdn.jsdelivr.net',
+    'unpkg.com',
+    'code.jquery.com',
+    'maxcdn.bootstrapcdn.com',
+    'stackpath.bootstrapcdn.com',
+    'ajax.aspnetcdn.com',
+    'ajax.microsoft.com',
+];
+/**
+ * cognium-ai#251 — vendored third-party trees.
+ *
+ * #243 (`.min.` names) and #252 (CDN mirrors) both key on the FILENAME. The
+ * remaining holdouts were vendored *bundles* that look like ordinary source by
+ * name and pass every content cap: `prettier/lib/parser-*.js` sits under the
+ * 1 MB size cap and the 50k line cap, yet wedges analysis at ~100% CPU for
+ * hours. #251 reported 0/45 repos completing because of it.
+ *
+ * The durable signal is not the file, it is the directory: code under
+ * `node_modules/`, `vendor/`, `third_party/` or `bower_components/` is not
+ * maintained by the repo owner, so findings in it are noise regardless of
+ * whether it happens to parse quickly.
+ *
+ * Note the CPU wedge itself is separately bounded since 2.66.0 — with
+ * `SCAN_PARSE_ISOLATION=1` a pathological parse aborts at the per-file
+ * timeout instead of holding the scan. This skip is about not spending the
+ * time at all, and about not reporting third-party findings as the repo's.
+ *
+ * Opt out with `SKIP_VENDORED=0`.
+ */
+export const VENDORED_DIR_RE = /(?:^|\/)(?:node_modules|bower_components|vendor|vendored|third_party|thirdparty|external)(?:\/|$)/i;
+/**
+ * Generated parser bundles that ship inside a library's own `lib/` directory
+ * — the specific shape #251 reported. Anchored on the `parser-` prefix AND a
+ * `lib/` parent so a first-party `src/parser-json.js` is untouched.
+ */
+export const VENDORED_BUNDLE_RE = /(?:^|\/)lib\/parser-[\w.-]+\.(?:js|mjs|cjs)$/i;
+/** cognium-ai#251 — true when the path is third-party vendored code. */
+export function isVendoredPath(filePath) {
+    if (process.env.SKIP_VENDORED === '0')
+        return false;
+    const normalized = filePath.replace(/\\/g, '/');
+    return VENDORED_DIR_RE.test(normalized) || VENDORED_BUNDLE_RE.test(normalized);
+}
+/**
+ * cognium-ai#252 — true when the path looks like a mirrored copy of a
+ * third-party CDN asset rather than first-party source.
+ */
+export function isCdnMirrorPath(filePath) {
+    if (process.env.SKIP_CDN_MIRRORS === '0')
+        return false;
+    const normalized = filePath.replace(/\\/g, '/').toLowerCase();
+    const base = normalized.split('/').pop() ?? normalized;
+    if (CDN_MIRROR_FLATTENED_RE.test(base))
+        return true;
+    return KNOWN_CDN_HOSTS.some((h) => normalized.includes(h));
+}
 /**
  * Pre-flight skip check for a single file. Reads content as a side
  * effect so the caller doesn't double-read.
@@ -65,6 +152,22 @@ export function preFlightSkip(filePath) {
             reason: `minified build artifact by filename (${filePath.split(/[\\/]/).pop()})`,
         };
     }
+    // cognium-ai#252 (problem C) — mirrored CDN/vendor trees. Cheap (no stat,
+    // no read) and refuses third-party copies the repo owner does not maintain
+    // before they reach the parser or the LLM.
+    if (isCdnMirrorPath(filePath)) {
+        return {
+            skip: true,
+            reason: `mirrored CDN/vendor asset (${filePath.split(/[\\/]/).pop()})`,
+        };
+    }
+    // cognium-ai#251 — vendored third-party trees and generated parser bundles.
+    if (isVendoredPath(filePath)) {
+        return {
+            skip: true,
+            reason: `vendored third-party code (${filePath.split(/[\\/]/).pop()})`,
+        };
+    }
     let stat;
     try {
         stat = fs.statSync(filePath);
@@ -109,4 +212,35 @@ export function preFlightSkip(filePath) {
     }
     return { skip: false, content, size: stat.size };
 }
+/**
+ * Detect minified / bundled single-line content. #102, relocated here for #252 problem D.
+ *
+ * Windowed verification can't help when every source/sink lives on the
+ * same logical line — the merged window degenerates to the whole file
+ * and recursive splitting can't reduce the body further. Skipping LLM
+ * verification on minified content avoids pure-cost-no-benefit LLM
+ * fan-out; static-analysis findings are unaffected.
+ *
+ * All three conditions must hold (conservative — avoids flagging
+ * legitimate files with one long embedded JSON / base64 line):
+ *
+ *   - File > 50 KB
+ *   - Longest line > 5,000 chars
+ *   - Average line length > 500 chars
+ */
+export function isMinifiedContent(code) {
+    if (code.length < 50_000)
+        return false;
+    const lines = code.split(/\r?\n/);
+    if (lines.length === 0)
+        return false;
+    let maxLine = 0;
+    for (const l of lines)
+        if (l.length > maxLine)
+            maxLine = l.length;
+    if (maxLine < 5_000)
+        return false;
+    const avgLine = code.length / lines.length;
+    return avgLine > 500;
+}
 //# sourceMappingURL=file-skip.js.map

package/dist/utils/file-skip.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-skip.js","sourceRoot":"","sources":["../../src/utils/file-skip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAazB,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;AACnF,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;AACnF,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AAE/E,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;IACvD,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,wEAAwE;IACxE,0EAA0E;IAC1E,0BAA0B;IAC1B,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,wCAAwC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG;SACjF,CAAC;IACJ,CAAC;IAED,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;YAC1H,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,aAAa,GAAG,OAAO,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,kBAAkB,aAAa,YAAY,OAAO,oBAAoB;YAC9E,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,mBAAmB,KAAK,CAAC,MAAM,MAAM,QAAQ,0BAA0B;YAC/E,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC"}
+{"version":3,"file":"file-skip.js","sourceRoot":"","sources":["../../src/utils/file-skip.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAazB,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,SAAS,EAAE,EAAE,CAAC,CAAC;AACnF,MAAM,eAAe,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;AACnF,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,0CAA0C,CAAC;AAE/E,kFAAkF;AAClF,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;IACvD,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,8GAA8G,CAAC;AAEjH,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,qBAAqB;IACrB,sBAAsB;IACtB,kBAAkB;IAClB,WAAW;IACX,iBAAiB;IACjB,yBAAyB;IACzB,4BAA4B;IAC5B,oBAAoB;IACpB,oBAAoB;CACrB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,eAAe,GAC1B,oGAAoG,CAAC;AAEvG;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,+CAA+C,CAAC;AAElF,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAChD,OAAO,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACjF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,UAAU,CAAC;IACvD,IAAI,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,wEAAwE;IACxE,0EAA0E;IAC1E,0BAA0B;IAC1B,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,wCAAwC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG;SACjF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,2EAA2E;IAC3E,2CAA2C;IAC3C,IAAI,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9B,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,8BAA8B,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG;SACvE,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,IAAI,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,8BAA8B,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,GAAG;SACvE,CAAC;IACJ,CAAC;IAED,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,IAAI,GAAG,OAAO,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,8BAA8B;YAC1H,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC9C,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACvE,IAAI,aAAa,GAAG,OAAO,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,kBAAkB,aAAa,YAAY,OAAO,oBAAoB;YAC9E,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC5B,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,mBAAmB,KAAK,CAAC,MAAM,MAAM,QAAQ,0BAA0B;YAC/E,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,IAAI,CAAC,MAAM,GAAG,MAAM;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAErC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,CAAC,MAAM,GAAG,OAAO;YAAE,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,IAAI,OAAO,GAAG,KAAK;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC3C,OAAO,OAAO,GAAG,GAAG,CAAC;AACvB,CAAC"}

package/dist/utils/scan-heartbeat.d.ts

@@ -0,0 +1,52 @@
+/**
+ * cognium-ai#252 (problem E) — say which file is stuck.
+ *
+ * The scan logged `[N/M] Analyzing: <path>` when a worker *picked up* a file,
+ * using a counter that only advanced when a file *finished*. With four workers
+ * that produced four identical `[1/812]` lines, and when a repo wedged there
+ * was no way to tell which of the in-flight files owned the CPU — #252's
+ * evidence had to be reconstructed by attaching to the process.
+ *
+ * This tracks what is actually in flight and periodically names anything that
+ * has been running too long. It stays silent while a scan is healthy: nothing
+ * is emitted unless a file exceeds `stallMs`, so normal runs look unchanged.
+ *
+ * Env:
+ *   SCAN_HEARTBEAT_MS   poll interval (default 30000; 0 disables)
+ *   SCAN_STALL_WARN_MS  report files in flight longer than this (default 60000)
+ */
+export interface HeartbeatOptions {
+    /** How often to check. 0 disables the heartbeat entirely. */
+    intervalMs?: number;
+    /** Only report a file once it has been in flight this long. */
+    stallMs?: number;
+    /** Sink for the report. Defaults to stderr. */
+    emit?: (line: string) => void;
+    /** Injectable clock, for tests. */
+    now?: () => number;
+}
+export declare class ScanHeartbeat {
+    private inFlight;
+    private timer;
+    private readonly intervalMs;
+    private readonly stallMs;
+    private readonly emit;
+    private readonly now;
+    /** Files already named, so a long stall reports once rather than every tick. */
+    private reported;
+    constructor(opts?: HeartbeatOptions);
+    /** Record that a worker has picked up `file`. */
+    begin(file: string): void;
+    /** Record that `file` finished (or failed). */
+    end(file: string): void;
+    /**
+     * Report anything in flight past `stallMs`, longest first. Exposed for tests
+     * and callable directly; `start()` drives it on a timer.
+     */
+    tick(): void;
+    start(): void;
+    stop(): void;
+    /** Test hook. */
+    get inFlightCount(): number;
+}
+//# sourceMappingURL=scan-heartbeat.d.ts.map

package/dist/utils/scan-heartbeat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-heartbeat.d.ts","sourceRoot":"","sources":["../../src/utils/scan-heartbeat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B,mCAAmC;IACnC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAOD,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAA6B;IAC7C,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAqB;gBAEzB,IAAI,GAAE,gBAAqB;IAOvC,iDAAiD;IACjD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAIzB,+CAA+C;IAC/C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAKvB;;;OAGG;IACH,IAAI,IAAI,IAAI;IAkBZ,KAAK,IAAI,IAAI;IAOb,IAAI,IAAI,IAAI;IAQZ,iBAAiB;IACjB,IAAI,aAAa,IAAI,MAAM,CAE1B;CACF"}

package/dist/utils/scan-heartbeat.js

@@ -0,0 +1,85 @@
+/**
+ * cognium-ai#252 (problem E) — say which file is stuck.
+ *
+ * The scan logged `[N/M] Analyzing: <path>` when a worker *picked up* a file,
+ * using a counter that only advanced when a file *finished*. With four workers
+ * that produced four identical `[1/812]` lines, and when a repo wedged there
+ * was no way to tell which of the in-flight files owned the CPU — #252's
+ * evidence had to be reconstructed by attaching to the process.
+ *
+ * This tracks what is actually in flight and periodically names anything that
+ * has been running too long. It stays silent while a scan is healthy: nothing
+ * is emitted unless a file exceeds `stallMs`, so normal runs look unchanged.
+ *
+ * Env:
+ *   SCAN_HEARTBEAT_MS   poll interval (default 30000; 0 disables)
+ *   SCAN_STALL_WARN_MS  report files in flight longer than this (default 60000)
+ */
+function envInt(name, fallback) {
+    const raw = parseInt(process.env[name] ?? '', 10);
+    return Number.isFinite(raw) && raw >= 0 ? raw : fallback;
+}
+export class ScanHeartbeat {
+    inFlight = new Map();
+    timer;
+    intervalMs;
+    stallMs;
+    emit;
+    now;
+    /** Files already named, so a long stall reports once rather than every tick. */
+    reported = new Set();
+    constructor(opts = {}) {
+        this.intervalMs = opts.intervalMs ?? envInt('SCAN_HEARTBEAT_MS', 30_000);
+        this.stallMs = opts.stallMs ?? envInt('SCAN_STALL_WARN_MS', 60_000);
+        this.emit = opts.emit ?? ((l) => console.error(l));
+        this.now = opts.now ?? Date.now;
+    }
+    /** Record that a worker has picked up `file`. */
+    begin(file) {
+        this.inFlight.set(file, this.now());
+    }
+    /** Record that `file` finished (or failed). */
+    end(file) {
+        this.inFlight.delete(file);
+        this.reported.delete(file);
+    }
+    /**
+     * Report anything in flight past `stallMs`, longest first. Exposed for tests
+     * and callable directly; `start()` drives it on a timer.
+     */
+    tick() {
+        const t = this.now();
+        const stalled = [...this.inFlight.entries()]
+            .filter(([file, since]) => t - since >= this.stallMs && !this.reported.has(file))
+            .sort((a, b) => a[1] - b[1]);
+        for (const [file, since] of stalled) {
+            this.reported.add(file);
+            const elapsedMs = t - since;
+            // Sub-second thresholds are only used in tests, but "after 0s" reads
+            // like a bug, so keep the unit honest.
+            const elapsed = elapsedMs < 1000 ? `${elapsedMs}ms` : `${Math.round(elapsedMs / 1000)}s`;
+            this.emit(`  ⏱ still analyzing after ${elapsed}: ${file} ` +
+                `(${this.inFlight.size} file(s) in flight). cognium-ai#252`);
+        }
+    }
+    start() {
+        if (this.intervalMs <= 0 || this.timer)
+            return;
+        this.timer = setInterval(() => this.tick(), this.intervalMs);
+        // Never hold the process open on account of the heartbeat.
+        this.timer.unref?.();
+    }
+    stop() {
+        if (this.timer)
+            clearTimeout(this.timer);
+        clearInterval(this.timer);
+        this.timer = undefined;
+        this.inFlight.clear();
+        this.reported.clear();
+    }
+    /** Test hook. */
+    get inFlightCount() {
+        return this.inFlight.size;
+    }
+}
+//# sourceMappingURL=scan-heartbeat.js.map

package/dist/utils/scan-heartbeat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-heartbeat.js","sourceRoot":"","sources":["../../src/utils/scan-heartbeat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAaH,SAAS,MAAM,CAAC,IAAY,EAAE,QAAgB;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3D,CAAC;AAED,MAAM,OAAO,aAAa;IAChB,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrC,KAAK,CAA6B;IACzB,UAAU,CAAS;IACnB,OAAO,CAAS;IAChB,IAAI,CAAyB;IAC7B,GAAG,CAAe;IACnC,gFAAgF;IACxE,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,YAAY,OAAyB,EAAE;QACrC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACpE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED,iDAAiD;IACjD,KAAK,CAAC,IAAY;QAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,+CAA+C;IAC/C,GAAG,CAAC,IAAY;QACd,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,IAAI;QACF,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;aACzC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;aAChF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,SAAS,GAAG,CAAC,GAAG,KAAK,CAAC;YAC5B,qEAAqE;YACrE,uCAAuC;YACvC,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;YACzF,IAAI,CAAC,IAAI,CACP,6BAA6B,OAAO,KAAK,IAAI,GAAG;gBAC9C,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,qCAAqC,CAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO;QAC/C,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAC7D,2DAA2D;QAC3D,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,IAAI;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,aAAa,CAAC,IAAI,CAAC,KAAuB,CAAC,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,iBAAiB;IACjB,IAAI,aAAa;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "circle-ir-ai",
-  "version": "2.71.0",
+  "version": "2.76.0",
   "description": "LLM-enhanced SAST analysis built on circle-ir",
   "main": "dist/index.js",
   "module": "dist/index.js",