seaworthycode 1.1.2 → 1.1.4

package/dist/index.js

@@ -515,7 +515,9 @@ function sortFindings(findings) {
     const fileA = a.file ?? "";
     const fileB = b.file ?? "";
     if (fileA !== fileB) return fileA.localeCompare(fileB);
-    return (a.line ?? 0) - (b.line ?? 0);
+    const lineDiff = (a.line ?? 0) - (b.line ?? 0);
+    if (lineDiff !== 0) return lineDiff;
+    return a.checkId.localeCompare(b.checkId);
   });
 }
 function dedupeDegradedFindings(findings) {
@@ -1559,36 +1561,36 @@ var ScanRunner = class {
       astCache: /* @__PURE__ */ new Map()
     };
     const results = [];
-    const mutex = [];
-    const inFlight = /* @__PURE__ */ new Map();
-    const findingsPerCategory = /* @__PURE__ */ new Map();
-    for (const check2 of checks) {
-      inFlight.set(check2.category, (inFlight.get(check2.category) ?? 0) + 1);
-    }
+    const checkResults = /* @__PURE__ */ new Map();
     await runWithConcurrency(
       checks,
       async (check2) => {
         try {
           const findings2 = await check2.run(ctx);
-          mutex.push(...findings2);
-          if (options.onCategoryComplete) {
-            findingsPerCategory.set(check2.category, (findingsPerCategory.get(check2.category) ?? 0) + findings2.length);
-          }
+          checkResults.set(check2.id, findings2);
         } catch (err) {
           console.error(`Check "${check2.id}" failed: ${String(err)}`);
-        } finally {
-          if (options.onCategoryComplete) {
-            const remaining = (inFlight.get(check2.category) ?? 1) - 1;
-            inFlight.set(check2.category, remaining);
-            if (remaining === 0) {
-              options.onCategoryComplete(check2.category, findingsPerCategory.get(check2.category) ?? 0);
-            }
-          }
         }
       },
       concurrency
     );
-    results.push(...mutex);
+    for (const check2 of checks) {
+      results.push(...checkResults.get(check2.id) ?? []);
+    }
+    if (options.onCategoryComplete) {
+      const findingsPerCategory = /* @__PURE__ */ new Map();
+      for (const check2 of checks) {
+        const count = (checkResults.get(check2.id) ?? []).length;
+        findingsPerCategory.set(check2.category, (findingsPerCategory.get(check2.category) ?? 0) + count);
+      }
+      const seen = /* @__PURE__ */ new Set();
+      for (const check2 of checks) {
+        if (!seen.has(check2.category)) {
+          seen.add(check2.category);
+          options.onCategoryComplete(check2.category, findingsPerCategory.get(check2.category) ?? 0);
+        }
+      }
+    }
     if (ctx.astCache) {
       for (const promise of ctx.astCache.values()) {
         try {
@@ -10234,7 +10236,7 @@ registry.register({
 });
 var CHECK_ID40 = "security.weak-email-validation";
 var REMEDIATION34 = getCopy("remediation.security.weak-email-validation");
-var WEAK_EMAIL_REGEX_LINE = /\/\^[^\/]*@[^\/]*\\\.[^\/]{0,4}\$\/[gimsuy]*/g;
+var WEAK_EMAIL_REGEX_LINE = /\/\^[^/]*@[^/]*\\\.[^/]{0,4}\$\/[gimsuy]*/g;
 var LOOSE_REGEX_CLASS = /\[\^?\\?s@\]\+@\[\^?\\?s@\]\+\\\.\[\^?\\?s@\]\+/g;
 var EMAIL_CONTEXT = /email|e-?mail|validateEmail|isEmail|checkEmail|verifyEmail|deliverable/is;
 function lineAndColumn15(content, index) {
@@ -10290,7 +10292,7 @@ registry.register({
 var CHECK_ID41 = "security.idempotency-key-leak";
 var REMEDIATION35 = getCopy("remediation.security.idempotency-key-leak");
 var IDEMPOTENCY_CONTEXT = /idempotency[_-]?key|idempotency[_-]?token/i;
-var TEMPLATE_LITERAL_INTERPOLATION = /\`[^`]*\$\{[^}]+\}[^`]*\`/g;
+var TEMPLATE_LITERAL_INTERPOLATION = new RegExp("`[^`]*\\$\\{[^}]+\\}[^`]*`", "g");
 var STRUCTURED_ID_PATTERN = /(?:lic(?:ense|ence)|sub(?:scription)?|order|cust(?:omer)?|user|tx|pay(?:ment)?|inv(?:oice)?)[-/]/i;
 function lineAndColumn16(content, index) {
   const prefix = content.slice(0, index);
@@ -15169,6 +15171,7 @@ var copy3 = {
   "cli.sarif.stdout_conflict": "Flags --sarif-stdout and --json cannot be used together. Use --output to send JSON to a file.",
   "cli.error.llmRequired": "LLM API key required for Pro checks. Set it with seaworthy config or the SEAWORTHY_LLM_API_KEY environment variable.",
   "cli.warn.llmSkipped": "Pro checks skipped: no LLM API key configured. Set it with seaworthy config or the SEAWORTHY_LLM_API_KEY environment variable to enable semantic analysis.",
+  "cli.warn.licenseInvalid": "Your license key is invalid or has been revoked. Running in free tier.\nTo re-enter your key, run: npx seaworthycode setup",
   "cli.error.config.missingKey": "Missing config key. Usage: seaworthy config <set|get> <key>",
   "cli.error.config.missingValue": "Missing config value. Usage: seaworthy config set <key> <value>",
   "cli.error.config.unknownKey": "Unknown config key. Valid keys: licenseKey, llmProvider, llmApiKey, llmModel, llmApiUrl",
@@ -15600,6 +15603,7 @@ async function runCli(options) {
       const message = resolveErrorMessage(authResult.code);
       return { code: resolveExitCode(authResult.code), error: message };
     }
+    console.error(getCopy2("cli.warn.licenseInvalid"));
   }
   const auth = authResult.ok ? authResult.value : { tier: "free", token: "", licensedTo: "free tier" };
   const allowedTiers = {
@@ -15764,6 +15768,10 @@ cli.help(() => {
   $ npx seaworthycode ./my-project --sarif report.sarif
   $ npx seaworthycode --provider kimi ./my-project`
     },
+    {
+      title: "Commands",
+      body: `  npx seaworthycode setup    Interactive setup for license key and LLM provider`
+    },
     {
       title: "Options",
       body: `  --json                 Output JSON to stdout
@@ -15779,10 +15787,6 @@ cli.help(() => {
   --show-ids             Show check IDs alongside names
   --debug                Enable debug logging`
     },
-    {
-      title: "Commands",
-      body: `  seaworthy setup        Interactive first-run setup`
-    },
     {
       title: "Configuration",
       body: `  ~/.seaworthy/config            # license key, LLM provider, API key, model, url`