seaworthycode 1.2.11 → 1.2.13

package/dist/index.js

@@ -407,10 +407,11 @@ async function crawl(options) {
           const { isBinary, isGenerated } = await peekFileHead(fullPath);
           if (isBinary || isGenerated) continue;
           if (await shouldSkipMinifiedJs(fullPath, entry.name)) continue;
+          let cachedContent;
           files.push({
             path: fullPath,
             relativePath: relPath,
-            content: () => fs.readFile(fullPath, "utf-8"),
+            content: () => cachedContent ??= fs.readFile(fullPath, "utf-8"),
             language: inferLanguage(entry.name)
           });
         } catch {
@@ -427,10 +428,11 @@ async function crawl(options) {
         const { isBinary, isGenerated } = await peekFileHead(fullPath);
         if (isBinary || isGenerated) continue;
         if (await shouldSkipMinifiedJs(fullPath, entry.name)) continue;
+        let cachedContent;
         files.push({
           path: fullPath,
           relativePath: relPath,
-          content: () => fs.readFile(fullPath, "utf-8"),
+          content: () => cachedContent ??= fs.readFile(fullPath, "utf-8"),
           language: inferLanguage(entry.name)
         });
       } catch {
@@ -789,6 +791,7 @@ var copy = {
   "report.cta.hasFindings": `Fix these before you ship. ${SITE_URL}/docs`,
   "report.cta.critical": `\u26A0 Critical issues found \u2014 patch before you deploy. ${SITE_URL}/docs`,
   "report.proUpsellNamed": (names, count) => `\u2693 Pro unlocks ${count} more check${count === 1 ? "" : "s"} (${names}). ${SITE_URL}`,
+  "report.timedOutChecks": (names, count) => `\u26A0 ${count} check${count === 1 ? "" : "s"} timed out and were skipped (${names}). Use SEAWORTHY_CHECK_TIMEOUT_MS to extend the limit.`,
   "report.preScanNotice": (count) => `\u2693 Pro unlocks ${count} additional checks. Upgrade at ${SITE_URL}`,
   "report.llmPrivacyWarning": "Pro checks will send code context to your LLM provider via your API key. No data is sent to Seaworthy servers.",
   "report.confidenceHigh": "high confidence",
@@ -1601,6 +1604,16 @@ async function runWithConcurrencyCollect(items, fn, concurrency) {
   await Promise.all(workers);
   return results;
 }
+var DEFAULT_CHECK_TIMEOUT_MS = 5 * 60 * 1e3;
+var SLOW_CHECK_THRESHOLD_RATIO = 0.5;
+function getCheckTimeoutMs() {
+  const env2 = process.env.SEAWORTHY_CHECK_TIMEOUT_MS;
+  if (env2 !== void 0) {
+    const n = parseInt(env2, 10);
+    if (!isNaN(n) && n > 0) return n;
+  }
+  return DEFAULT_CHECK_TIMEOUT_MS;
+}
 var ScanRunner = class {
   async run(options) {
     const { concurrency = 4 } = options;
@@ -1628,15 +1641,54 @@ var ScanRunner = class {
     }
     const categoryCompleted = /* @__PURE__ */ new Map();
     let completedCount = 0;
+    const timedOutChecks = [];
+    const checkTimeoutMs = getCheckTimeoutMs();
     await runWithConcurrency(
       checks,
       async (check2) => {
+        if (options.debug) {
+          process.stderr.write(`[seaworthy] check.start ${check2.id}
+`);
+        }
+        const startMs = Date.now();
+        let timedOut = false;
+        let softTimer;
+        let hardTimer;
         try {
-          const findings2 = await check2.run(ctx);
-          checkResults.set(check2.id, findings2);
+          const findings2 = await new Promise((resolve22, reject) => {
+            softTimer = setTimeout(() => {
+              process.stderr.write(
+                `[seaworthy] check.slow ${check2.id} \u2014 still running after ${Math.round(checkTimeoutMs * SLOW_CHECK_THRESHOLD_RATIO / 1e3)}s
+`
+              );
+            }, checkTimeoutMs * SLOW_CHECK_THRESHOLD_RATIO);
+            hardTimer = setTimeout(() => {
+              timedOut = true;
+              process.stderr.write(
+                `[seaworthy] check.timeout ${check2.id} \u2014 aborting after ${Math.round(checkTimeoutMs / 1e3)}s
+`
+              );
+              resolve22([]);
+            }, checkTimeoutMs);
+            check2.run(ctx).then(resolve22, reject);
+          });
+          clearTimeout(softTimer);
+          clearTimeout(hardTimer);
+          if (timedOut) {
+            timedOutChecks.push({ id: check2.id, name: check2.name, category: check2.category });
+            checkResults.set(check2.id, []);
+          } else {
+            checkResults.set(check2.id, findings2);
+          }
         } catch (err) {
+          clearTimeout(softTimer);
+          clearTimeout(hardTimer);
           console.error(`Check "${check2.id}" failed: ${String(err)}`);
         }
+        if (options.debug) {
+          process.stderr.write(`[seaworthy] check.done ${check2.id} ${Date.now() - startMs}ms
+`);
+        }
         options.onCheckComplete?.(++completedCount, checks.length, check2.name);
         if (options.onCategoryComplete) {
           const catDone = (categoryCompleted.get(check2.category) ?? 0) + 1;
@@ -1685,7 +1737,8 @@ var ScanRunner = class {
     return {
       findings,
       scannedFileCount: files.length,
-      skippedChecks
+      skippedChecks,
+      timedOutChecks
     };
   }
 };
@@ -2486,7 +2539,7 @@ function renderCollapsedGroup(group, showIds) {
 }
 var TerminalReporter = class {
   generate(input) {
-    const { findings: rawFindings, targetDir, tier, licensedTo, scannedFileCount, skippedChecks = [], showIds = false, all = false } = input;
+    const { findings: rawFindings, targetDir, tier, licensedTo, scannedFileCount, skippedChecks = [], timedOutChecks = [], showIds = false, all = false } = input;
     const findings = dedupeDegradedFindings(rawFindings);
     if (findings.length === 0) {
       const lines2 = [];
@@ -2500,6 +2553,10 @@ var TerminalReporter = class {
         lines2.push("");
         lines2.push(text.link(buildProUpsell(skippedChecks)));
       }
+      if (timedOutChecks.length > 0) {
+        lines2.push("");
+        lines2.push(text.warning(buildTimedOutNote(timedOutChecks)));
+      }
       return lines2.join("\n");
     }
     const lines = [];
@@ -2549,9 +2606,18 @@ var TerminalReporter = class {
     if (skippedChecks.length > 0) {
       lines.push(text.link(buildProUpsell(skippedChecks)));
     }
+    if (timedOutChecks.length > 0) {
+      lines.push(text.warning(buildTimedOutNote(timedOutChecks)));
+    }
     return lines.join("\n");
   }
 };
+function buildTimedOutNote(timedOutChecks) {
+  const count = timedOutChecks.length;
+  const names = timedOutChecks.slice(0, 2).map((c) => c.name.toLowerCase()).join(", ");
+  const suffix = count > 2 ? ", \u2026" : "";
+  return getCopy("report.timedOutChecks", names + suffix, count);
+}
 function buildProUpsell(skippedChecks) {
   const count = skippedChecks.length;
   const names = skippedChecks.slice(0, 2).map((c) => c.name.toLowerCase()).join(", ");
@@ -5904,19 +5970,49 @@ function classifyError(err) {
   if (err instanceof Error && err.name === "TimeoutError") return "llm.timeout";
   if (err instanceof DOMException && (err.name === "TimeoutError" || err.name === "AbortError")) return "llm.timeout";
   if (err instanceof Error && /rate|429|too many/i.test(err.message)) return "llm.rate_limited";
+  if (err instanceof Error && /auth|401|unauthorized|invalid.*key/i.test(err.message)) return "llm.auth_error";
   return "llm.unexpected";
 }
+var LLM_TIMEOUT_MS = 9e4;
+function getMaxFilesPerLlmCheck() {
+  const env2 = process.env.SEAWORTHY_LLM_MAX_FILES;
+  if (env2 !== void 0) {
+    const n = parseInt(env2, 10);
+    if (!isNaN(n) && n > 0) return n;
+  }
+  return 150;
+}
+function withLLMTimeout(promise, ms) {
+  return new Promise((resolve22, reject) => {
+    const timerId = setTimeout(() => {
+      const err = new Error("LLM request timed out");
+      err.name = "TimeoutError";
+      reject(err);
+    }, ms);
+    promise.then(
+      (value) => {
+        clearTimeout(timerId);
+        resolve22(value);
+      },
+      (err) => {
+        clearTimeout(timerId);
+        reject(err);
+      }
+    );
+  });
+}
 async function callLLMWithRetry(llm, prompt, checkId) {
   let lastError;
   const delays = [0, 2e3];
   for (let attempt = 0; attempt < delays.length; attempt++) {
     try {
       if (attempt > 0) await new Promise((r) => setTimeout(r, delays[attempt]));
-      return await llm.complete(prompt);
+      return await withLLMTimeout(llm.complete(prompt), LLM_TIMEOUT_MS);
     } catch (err) {
       lastError = err;
       if (err instanceof LLMResponseError) break;
       if (err instanceof Error && /rate|429/i.test(err.message)) break;
+      if (err instanceof Error && /auth|401|unauthorized|invalid.*key/i.test(err.message)) break;
     }
   }
   const code = classifyError(lastError);
@@ -6127,7 +6223,7 @@ async function runLLMCheck(ctx, template) {
       return cached;
     }
   }
-  const eligibleFiles = await filterFilesByBudget(proEligibleFiles, template.tokenBudget);
+  let eligibleFiles = await filterFilesByBudget(proEligibleFiles, template.tokenBudget);
   if (eligibleFiles.length === 0) {
     let mechFindings = await runMechanicalCheck(ctx, template);
     if (template.projectScoped) {
@@ -6143,6 +6239,13 @@ async function runLLMCheck(ctx, template) {
     }
     return withRemediation;
   }
+  const maxFiles = getMaxFilesPerLlmCheck();
+  if (eligibleFiles.length > maxFiles) {
+    console.error(
+      `[seaworthy] ${template.checkId}: ${eligibleFiles.length} eligible files \u2014 capping LLM prompt to ${maxFiles}`
+    );
+    eligibleFiles = eligibleFiles.slice(0, maxFiles);
+  }
   const prompt = `${PROMPT_PREAMBLE}
 
 ${await template.buildPrompt(eligibleFiles)}`;
@@ -16120,6 +16223,7 @@ async function executeScan(args, ctx) {
     licensedTo: ctx.licensedTo ?? "free tier",
     scannedFileCount: result.scannedFileCount,
     skippedChecks: result.skippedChecks,
+    timedOutChecks: result.timedOutChecks,
     showIds: args.showIds ?? args.debug,
     all: args.all
   };