seaworthycode 1.2.12 → 1.2.16

package/dist/index.js

@@ -411,7 +411,8 @@ async function crawl(options) {
             path: fullPath,
             relativePath: relPath,
             content: () => fs.readFile(fullPath, "utf-8"),
-            language: inferLanguage(entry.name)
+            language: inferLanguage(entry.name),
+            size: stat2.size
           });
         } catch {
         }
@@ -431,7 +432,8 @@ async function crawl(options) {
           path: fullPath,
           relativePath: relPath,
           content: () => fs.readFile(fullPath, "utf-8"),
-          language: inferLanguage(entry.name)
+          language: inferLanguage(entry.name),
+          size: stat2.size
         });
       } catch {
       }
@@ -789,6 +791,7 @@ var copy = {
   "report.cta.hasFindings": `Fix these before you ship. ${SITE_URL}/docs`,
   "report.cta.critical": `\u26A0 Critical issues found \u2014 patch before you deploy. ${SITE_URL}/docs`,
   "report.proUpsellNamed": (names, count) => `\u2693 Pro unlocks ${count} more check${count === 1 ? "" : "s"} (${names}). ${SITE_URL}`,
+  "report.timedOutChecks": (names, count) => `\u26A0 ${count} check${count === 1 ? "" : "s"} timed out and were skipped (${names}). Use SEAWORTHY_CHECK_TIMEOUT_MS to extend the limit.`,
   "report.preScanNotice": (count) => `\u2693 Pro unlocks ${count} additional checks. Upgrade at ${SITE_URL}`,
   "report.llmPrivacyWarning": "Pro checks will send code context to your LLM provider via your API key. No data is sent to Seaworthy servers.",
   "report.confidenceHigh": "high confidence",
@@ -1601,6 +1604,16 @@ async function runWithConcurrencyCollect(items, fn, concurrency) {
   await Promise.all(workers);
   return results;
 }
+var DEFAULT_CHECK_TIMEOUT_MS = 5 * 60 * 1e3;
+var SLOW_CHECK_THRESHOLD_RATIO = 0.5;
+function getCheckTimeoutMs() {
+  const env2 = process.env.SEAWORTHY_CHECK_TIMEOUT_MS;
+  if (env2 !== void 0) {
+    const n = parseInt(env2, 10);
+    if (!isNaN(n) && n > 0) return n;
+  }
+  return DEFAULT_CHECK_TIMEOUT_MS;
+}
 var ScanRunner = class {
   async run(options) {
     const { concurrency = 4 } = options;
@@ -1617,7 +1630,9 @@ var ScanRunner = class {
       files,
       meta,
       taintCache: /* @__PURE__ */ new Map(),
-      astCache: /* @__PURE__ */ new Map(),
+      // astCache is intentionally omitted here — each check gets its own
+      // per-check cache below so content strings are GC'd when the check ends.
+      astCache: void 0,
       bashAstCache: /* @__PURE__ */ new Map()
     };
     const results = [];
@@ -1628,15 +1643,55 @@ var ScanRunner = class {
     }
     const categoryCompleted = /* @__PURE__ */ new Map();
     let completedCount = 0;
+    const timedOutChecks = [];
+    const checkTimeoutMs = getCheckTimeoutMs();
     await runWithConcurrency(
       checks,
       async (check2) => {
+        if (options.debug) {
+          process.stderr.write(`[seaworthy] check.start ${check2.id}
+`);
+        }
+        const startMs = Date.now();
+        let timedOut = false;
+        let softTimer;
+        let hardTimer;
+        const checkCtx = { ...ctx, astCache: /* @__PURE__ */ new Map() };
         try {
-          const findings2 = await check2.run(ctx);
-          checkResults.set(check2.id, findings2);
+          const findings2 = await new Promise((resolve22, reject) => {
+            softTimer = setTimeout(() => {
+              process.stderr.write(
+                `[seaworthy] check.slow ${check2.id} \u2014 still running after ${Math.round(checkTimeoutMs * SLOW_CHECK_THRESHOLD_RATIO / 1e3)}s
+`
+              );
+            }, checkTimeoutMs * SLOW_CHECK_THRESHOLD_RATIO);
+            hardTimer = setTimeout(() => {
+              timedOut = true;
+              process.stderr.write(
+                `[seaworthy] check.timeout ${check2.id} \u2014 aborting after ${Math.round(checkTimeoutMs / 1e3)}s
+`
+              );
+              resolve22([]);
+            }, checkTimeoutMs);
+            check2.run(checkCtx).then(resolve22, reject);
+          });
+          clearTimeout(softTimer);
+          clearTimeout(hardTimer);
+          if (timedOut) {
+            timedOutChecks.push({ id: check2.id, name: check2.name, category: check2.category });
+            checkResults.set(check2.id, []);
+          } else {
+            checkResults.set(check2.id, findings2);
+          }
         } catch (err) {
+          clearTimeout(softTimer);
+          clearTimeout(hardTimer);
           console.error(`Check "${check2.id}" failed: ${String(err)}`);
         }
+        if (options.debug) {
+          process.stderr.write(`[seaworthy] check.done ${check2.id} ${Date.now() - startMs}ms
+`);
+        }
         options.onCheckComplete?.(++completedCount, checks.length, check2.name);
         if (options.onCategoryComplete) {
           const catDone = (categoryCompleted.get(check2.category) ?? 0) + 1;
@@ -1685,7 +1740,8 @@ var ScanRunner = class {
     return {
       findings,
       scannedFileCount: files.length,
-      skippedChecks
+      skippedChecks,
+      timedOutChecks
     };
   }
 };
@@ -2486,7 +2542,7 @@ function renderCollapsedGroup(group, showIds) {
 }
 var TerminalReporter = class {
   generate(input) {
-    const { findings: rawFindings, targetDir, tier, licensedTo, scannedFileCount, skippedChecks = [], showIds = false, all = false } = input;
+    const { findings: rawFindings, targetDir, tier, licensedTo, scannedFileCount, skippedChecks = [], timedOutChecks = [], showIds = false, all = false } = input;
     const findings = dedupeDegradedFindings(rawFindings);
     if (findings.length === 0) {
       const lines2 = [];
@@ -2500,6 +2556,10 @@ var TerminalReporter = class {
         lines2.push("");
         lines2.push(text.link(buildProUpsell(skippedChecks)));
       }
+      if (timedOutChecks.length > 0) {
+        lines2.push("");
+        lines2.push(text.warning(buildTimedOutNote(timedOutChecks)));
+      }
       return lines2.join("\n");
     }
     const lines = [];
@@ -2549,9 +2609,18 @@ var TerminalReporter = class {
     if (skippedChecks.length > 0) {
       lines.push(text.link(buildProUpsell(skippedChecks)));
     }
+    if (timedOutChecks.length > 0) {
+      lines.push(text.warning(buildTimedOutNote(timedOutChecks)));
+    }
     return lines.join("\n");
   }
 };
+function buildTimedOutNote(timedOutChecks) {
+  const count = timedOutChecks.length;
+  const names = timedOutChecks.slice(0, 2).map((c) => c.name.toLowerCase()).join(", ");
+  const suffix = count > 2 ? ", \u2026" : "";
+  return getCopy("report.timedOutChecks", names + suffix, count);
+}
 function buildProUpsell(skippedChecks) {
   const count = skippedChecks.length;
   const names = skippedChecks.slice(0, 2).map((c) => c.name.toLowerCase()).join(", ");
@@ -5908,6 +5977,14 @@ function classifyError(err) {
   return "llm.unexpected";
 }
 var LLM_TIMEOUT_MS = 9e4;
+function getMaxFilesPerLlmCheck() {
+  const env2 = process.env.SEAWORTHY_LLM_MAX_FILES;
+  if (env2 !== void 0) {
+    const n = parseInt(env2, 10);
+    if (!isNaN(n) && n > 0) return n;
+  }
+  return 150;
+}
 function withLLMTimeout(promise, ms) {
   return new Promise((resolve22, reject) => {
     const timerId = setTimeout(() => {
@@ -5951,21 +6028,14 @@ function downgradeSeverity(severity) {
   if (idx < 0 || idx >= SEVERITY_ORDER3.length - 1) return severity;
   return SEVERITY_ORDER3[idx + 1];
 }
-function estimateTokens(text22) {
-  return Math.ceil(text22.length / 4);
-}
-async function filterFilesByBudget(files, budget) {
+function filterFilesByBudget(files, budget) {
   if (budget === void 0 || budget === Infinity) {
     return files;
   }
-  const result = [];
-  for (const file of files) {
-    const content = await file.content();
-    if (estimateTokens(content) <= budget) {
-      result.push(file);
-    }
-  }
-  return result;
+  return files.filter((file) => {
+    const tokens2 = file.size !== void 0 ? Math.ceil(file.size / 4) : budget;
+    return tokens2 <= budget;
+  });
 }
 async function buildCacheKey(ctx, template, files) {
   if (!ctx.llm) return void 0;
@@ -6142,14 +6212,21 @@ async function runLLMCheck(ctx, template) {
     return [];
   }
   const proEligibleFiles = ctx.files.filter((f) => isProCheckEligible(f, template));
-  const cacheKey = await buildCacheKey(ctx, template, proEligibleFiles);
+  let eligibleFiles = filterFilesByBudget(proEligibleFiles, template.tokenBudget);
+  const maxFiles = getMaxFilesPerLlmCheck();
+  if (eligibleFiles.length > maxFiles) {
+    console.error(
+      `[seaworthy] ${template.checkId}: ${eligibleFiles.length} eligible files \u2014 capping LLM prompt to ${maxFiles}`
+    );
+    eligibleFiles = eligibleFiles.slice(0, maxFiles);
+  }
+  const cacheKey = await buildCacheKey(ctx, template, eligibleFiles);
   if (cacheKey) {
     const cached = readCache(cacheKey);
     if (cached !== null) {
       return cached;
     }
   }
-  const eligibleFiles = await filterFilesByBudget(proEligibleFiles, template.tokenBudget);
   if (eligibleFiles.length === 0) {
     let mechFindings = await runMechanicalCheck(ctx, template);
     if (template.projectScoped) {
@@ -6318,7 +6395,7 @@ registry.register({
     return runLLMCheck(ctx, promptTemplate2);
   }
 });
-var PROMPT_VERSION3 = "1.0.0";
+var PROMPT_VERSION3 = "1.1.0";
 var fallbackPatterns3 = [
   {
     regex: /['"`]\s*(?:SELECT|INSERT|UPDATE|DELETE)\s+.*\$\{/i,
@@ -6332,7 +6409,22 @@ var fallbackPatterns3 = [
   }
 ];
 async function buildPrompt3(sourceFiles) {
-  const parts = ["Check for SQL injection vulnerabilities. Look for raw string concatenation or template literals used to build SQL queries. Flag any use of string interpolation in .query(), .raw(), .execute(), or raw SQL strings."];
+  const parts = [
+    `Check for SQL injection: flag ONLY where user-controlled input reaches a SQL query WITHOUT parameterization.
+
+SAFE \u2014 do NOT flag:
+- Queries using ? or $N placeholders with a separate args array: db.Query("SELECT * FROM t WHERE id = ?", id)
+- GORM .Raw()/.Exec() with ? bindings, even when the SQL string contains || (PostgreSQL concat operator inside the string): db.Exec("ST_GeomFromText('POINT(' || ? || ')', 4326)", lat, lng)
+- String concatenation where ALL operands are string literals (compile-time constants, not variables)
+- Variables sourced from application config or startup env, not from HTTP requests or user payloads
+
+UNSAFE \u2014 DO flag:
+- Template literals / f-strings injecting request values: db.query(\`SELECT * FROM t WHERE id = \${req.params.id}\`)
+- String concatenation where a variable traces to req.body, req.query, FormValue(), r.URL.Query(), $_GET, $_POST, or similar external input
+- fmt.Sprintf building a SQL string with user-supplied arguments (not just format specifiers over internal values)
+
+Only flag if you can trace the injected value to an external input source (HTTP request, message payload, file upload).`
+  ];
   for (const file of sourceFiles) {
     const content = await file.content();
     parts.push(`--- ${file.relativePath} ---
@@ -6374,7 +6466,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(query|raw|execute)$"))
   arguments: (arguments
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call_expression
   function: (member_expression
@@ -6404,7 +6497,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(query|raw|execute)$"))
   arguments: (arguments
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call_expression
   function: (member_expression
@@ -6434,7 +6528,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(query|raw|execute)$"))
   arguments: (arguments
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call_expression
   function: (member_expression
@@ -6464,7 +6559,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(query|execute|raw)$"))
   arguments: (argument_list
     (binary_operator
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call
   function: (attribute
@@ -6493,7 +6589,8 @@ var tsCheck4 = createTreeSitterCheck({
     (#match? @method "^(Query|Exec|QueryRow)$"))
   arguments: (argument_list
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (call_expression
   function: (selector_expression
@@ -6542,14 +6639,16 @@ var tsCheck4 = createTreeSitterCheck({
   (#match? @method "^execute.*$")
   arguments: (argument_list
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (method_invocation
   name: (identifier) @method
   (#eq? @method "prepareStatement")
   arguments: (argument_list
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 
 (method_invocation
   object: (identifier) @obj
@@ -6558,7 +6657,8 @@ var tsCheck4 = createTreeSitterCheck({
   (#match? @method "^(query|update)$")
   arguments: (argument_list
     (binary_expression
-      operator: "+"))) @match
+      operator: "+"
+      right: (_) @rhs))) @match
 `,
     ruby: `
 (call
@@ -6581,6 +6681,13 @@ var tsCheck4 = createTreeSitterCheck({
   remediationKey: "remediation.security.sql-injection-surface",
   messageFactory: (captures) => {
     return getCopy("checks.sql-injection-surface.message", captures.method ?? "?");
+  },
+  matchFilter: (captures) => {
+    if (!captures.rhs) return true;
+    const rhs = captures.rhs.trim();
+    if (/^["'`]/.test(rhs)) return false;
+    if (/^\[\]byte\s*\(["']/.test(rhs)) return false;
+    return true;
   }
 });
 var llmCheck = {
@@ -8822,52 +8929,6 @@ var QUERIES6 = {
   arguments: (argument_list
     (_) @data)) @match
   `,
-  go: `
-(call_expression
-  function: (selector_expression
-    operand: (identifier) @obj
-    field: (field_identifier) @field
-    (#eq? @obj "json")
-    (#eq? @field "Unmarshal"))
-  arguments: (argument_list
-    [
-      (identifier) @data
-      (call_expression) @data
-      (selector_expression) @data
-      (index_expression) @data
-      (binary_expression) @data
-    ]
-    (_))) @match
-
-(call_expression
-  function: (selector_expression
-    field: (field_identifier) @field
-    (#eq? @field "Decode"))
-  arguments: (argument_list
-    [
-      (identifier) @data
-      (call_expression) @data
-      (selector_expression) @data
-      (index_expression) @data
-      (binary_expression) @data
-    ])) @match
-
-(call_expression
-  function: (selector_expression
-    operand: (identifier) @obj
-    field: (field_identifier) @field
-    (#eq? @obj "xml")
-    (#eq? @field "Unmarshal"))
-  arguments: (argument_list
-    [
-      (identifier) @data
-      (call_expression) @data
-      (selector_expression) @data
-      (index_expression) @data
-      (binary_expression) @data
-    ]
-    (_))) @match
-  `,
   java: `
 (method_invocation
   name: (identifier) @method
@@ -16142,6 +16203,7 @@ async function executeScan(args, ctx) {
     licensedTo: ctx.licensedTo ?? "free tier",
     scannedFileCount: result.scannedFileCount,
     skippedChecks: result.skippedChecks,
+    timedOutChecks: result.timedOutChecks,
     showIds: args.showIds ?? args.debug,
     all: args.all
   };