seaworthycode 1.2.7 → 1.2.9

package/dist/index.js

@@ -782,6 +782,7 @@ var copy = {
   "report.bySeverity": "By severity",
   "report.tierWatermark": (licensedTo) => `\u2693 Pro \xB7 ${licensedTo}`,
   "report.scanProgress.starting": (targetDir) => `\u2693 Scanning ${targetDir}...`,
+  "report.scanProgress.checking": (completed, total) => `\u2693 Checking... [${completed}/${total}]`,
   "report.scanProgress.category": (label, count) => count > 0 ? `  \u2693 ${label} \u2014 ${count} issue(s)` : `  \u2693 ${label} \u2713`,
   "report.licenseNotice": (licensedTo) => `Licensed to ${licensedTo}`,
   "report.cta.clean": `\u2713 All clear \u2014 your project is shipshape!`,
@@ -1330,7 +1331,7 @@ var copy = {
   "debug.cache_write_failed": (key) => `Cache write failed for key ${key}, skipping.`,
   // CLI
   "cli.help.description": "Seaworthy \u2014 static analysis for vibe coders",
-  "cli.help.usage": "Usage: seaworthy [path] [options]",
+  "cli.help.usage": "Usage: seaworthycode [path] [options]",
   "cli.help.options": "Options",
   "cli.scanning": "Scanning...",
   "cli.reportWritten": (path) => `Report written to ${path}`,
@@ -1621,6 +1622,12 @@ var ScanRunner = class {
     };
     const results = [];
     const checkResults = /* @__PURE__ */ new Map();
+    const categoryTotals = /* @__PURE__ */ new Map();
+    for (const check2 of checks) {
+      categoryTotals.set(check2.category, (categoryTotals.get(check2.category) ?? 0) + 1);
+    }
+    const categoryCompleted = /* @__PURE__ */ new Map();
+    let completedCount = 0;
     await runWithConcurrency(
       checks,
       async (check2) => {
@@ -1630,26 +1637,26 @@ var ScanRunner = class {
         } catch (err) {
           console.error(`Check "${check2.id}" failed: ${String(err)}`);
         }
+        options.onCheckComplete?.(++completedCount, checks.length);
+        if (options.onCategoryComplete) {
+          const catDone = (categoryCompleted.get(check2.category) ?? 0) + 1;
+          categoryCompleted.set(check2.category, catDone);
+          if (catDone === categoryTotals.get(check2.category)) {
+            let catFindingsCount = 0;
+            for (const c of checks) {
+              if (c.category === check2.category) {
+                catFindingsCount += (checkResults.get(c.id) ?? []).length;
+              }
+            }
+            options.onCategoryComplete(check2.category, catFindingsCount);
+          }
+        }
       },
       concurrency
     );
     for (const check2 of checks) {
       results.push(...checkResults.get(check2.id) ?? []);
     }
-    if (options.onCategoryComplete) {
-      const findingsPerCategory = /* @__PURE__ */ new Map();
-      for (const check2 of checks) {
-        const count = (checkResults.get(check2.id) ?? []).length;
-        findingsPerCategory.set(check2.category, (findingsPerCategory.get(check2.category) ?? 0) + count);
-      }
-      const seen = /* @__PURE__ */ new Set();
-      for (const check2 of checks) {
-        if (!seen.has(check2.category)) {
-          seen.add(check2.category);
-          options.onCategoryComplete(check2.category, findingsPerCategory.get(check2.category) ?? 0);
-        }
-      }
-    }
     ctx.astCache?.clear();
     for (const [, promise] of ctx.bashAstCache ?? []) {
       try {
@@ -15914,7 +15921,7 @@ import { dirname as dirname5, resolve as resolve2, relative as relative7, isAbso
 // src/copy/index.ts
 var copy3 = {
   "cli.help.description": "Seaworthy \u2014 static analysis for vibe coders",
-  "cli.help.usage": "Usage: seaworthy [path] [options]",
+  "cli.help.usage": "Usage: seaworthycode [path] [options]",
   "cli.help.options": "Options",
   "cli.help.learnMore": `Documentation: ${SITE_URL}/docs`,
   "cli.setup.intro": "Welcome to Seaworthy! Let's get you set up.",
@@ -15943,14 +15950,14 @@ var copy3 = {
   "cli.help.flag.sarifStdout": "Write SARIF report to stdout",
   "cli.sarif.mutually_exclusive": "Flags --sarif and --sarif-stdout cannot be used together.",
   "cli.sarif.stdout_conflict": "Flags --sarif-stdout and --json cannot be used together. Use --output to send JSON to a file.",
-  "cli.error.llmRequired": "LLM API key required for Pro checks. Set it with seaworthy config or the SEAWORTHY_LLM_API_KEY environment variable.",
-  "cli.warn.llmSkipped": "Pro checks skipped: no LLM API key configured. Set it with seaworthy config or the SEAWORTHY_LLM_API_KEY environment variable to enable semantic analysis.",
+  "cli.error.llmRequired": "LLM API key required for Pro checks. Set it with seaworthycode config or the SEAWORTHY_LLM_API_KEY environment variable.",
+  "cli.warn.llmSkipped": "Pro checks skipped: no LLM API key configured. Set it with seaworthycode config or the SEAWORTHY_LLM_API_KEY environment variable to enable semantic analysis.",
   "cli.warn.licenseInvalid": "Your license key is invalid or has been revoked. Running in free tier.\nTo re-enter your key, run: npx seaworthycode setup",
-  "cli.error.config.missingKey": "Missing config key. Usage: seaworthy config <set|get> <key>",
-  "cli.error.config.missingValue": "Missing config value. Usage: seaworthy config set <key> <value>",
+  "cli.error.config.missingKey": "Missing config key. Usage: seaworthycode config <set|get> <key>",
+  "cli.error.config.missingValue": "Missing config value. Usage: seaworthycode config set <key> <value>",
   "cli.error.config.unknownKey": "Unknown config key. Valid keys: licenseKey, llmProvider, llmApiKey, llmModel, llmApiUrl",
   "cli.error.config.invalidProvider": "Invalid provider. Valid providers: anthropic, openai, kimi, moonshot, deepseek, gemini, ollama, openrouter",
-  "cli.error.config.invalidAction": "Invalid config action. Usage: seaworthy config <set|get|list>",
+  "cli.error.config.invalidAction": "Invalid config action. Usage: seaworthycode config <set|get|list>",
   "cli.config.setSuccess": (key) => `${key} updated.`,
   "cli.licenseNotice": (licensedTo) => `Licensed to ${licensedTo}`,
   "cli.error.debugHint": (logPath) => `Re-run with --debug to write a diagnostic log: ${logPath}
@@ -15996,9 +16003,9 @@ function createCommand(definition, options) {
 }
 
 // src/commands/scan.ts
-var FREE_SCAN_TIMEOUT_MS = 6e4;
-var PRO_SCAN_TIMEOUT_MS = 6e5;
-function resolveScanTimeoutMs(tier) {
+var FREE_CHECK_IDLE_MS = 6e4;
+var PRO_CHECK_IDLE_MS = 3e5;
+function resolveCheckIdleMs(tier) {
   const env2 = process.env.SEAWORTHY_SCAN_TIMEOUT_MS;
   if (env2) {
     const parsed = Number(env2);
@@ -16006,7 +16013,7 @@ function resolveScanTimeoutMs(tier) {
       return parsed;
     }
   }
-  return tier === "free" ? FREE_SCAN_TIMEOUT_MS : PRO_SCAN_TIMEOUT_MS;
+  return tier === "free" ? FREE_CHECK_IDLE_MS : PRO_CHECK_IDLE_MS;
 }
 var CATEGORY_LABELS = {
   security: getCopy2("cli.category.security"),
@@ -16016,17 +16023,29 @@ var CATEGORY_LABELS = {
   configuration: getCopy2("cli.category.configuration"),
   "data-exposure": getCopy2("cli.category.data-exposure")
 };
-function withTimeout(promise, ms, message) {
-  return new Promise((resolve5, reject) => {
-    const timer = setTimeout(() => reject(new Error(message)), ms);
-    promise.then((value) => {
-      clearTimeout(timer);
-      resolve5(value);
-    }).catch((err) => {
-      clearTimeout(timer);
-      reject(err);
-    });
+function withIdleTimeout(promise, idleMs, message) {
+  let timerId;
+  let rejectFn = () => {
+  };
+  const heartbeat = () => {
+    clearTimeout(timerId);
+    timerId = setTimeout(() => rejectFn(new Error(message)), idleMs);
+  };
+  const wrappedPromise = new Promise((resolve5, reject) => {
+    rejectFn = reject;
+    heartbeat();
+    promise.then(
+      (value) => {
+        clearTimeout(timerId);
+        resolve5(value);
+      },
+      (err) => {
+        clearTimeout(timerId);
+        reject(err);
+      }
+    );
   });
+  return { promise: wrappedPromise, heartbeat };
 }
 function isInsideDirectory(outputPath, targetDir) {
   const resolvedOutput = resolve2(outputPath);
@@ -16058,24 +16077,36 @@ async function executeScan(args, ctx) {
     process.stderr.write(getCopy("report.scanProgress.starting", args.targetDir) + "\n");
   }
   const runner = new ScanRunner();
-  const scanTimeoutMs = resolveScanTimeoutMs(ctx.tier);
-  const result = await withTimeout(
-    runner.run({
-      targetDir: args.targetDir,
-      tier: ctx.tier,
-      llm,
-      maxFileSize: args.maxFileSize,
-      debug: args.debug,
-      baseline: args.baseline,
-      minConfidence: args.minConfidence,
-      onCategoryComplete: showProgress ? (category, count) => {
-        const label = CATEGORY_LABELS[category] ?? category;
-        process.stderr.write(getCopy("report.scanProgress.category", label, count) + "\n");
-      } : void 0
-    }),
-    scanTimeoutMs,
-    getCopy("errors.scan.timed_out", Math.round(scanTimeoutMs / 1e3))
+  const checkIdleMs = resolveCheckIdleMs(ctx.tier);
+  let heartbeat = () => {
+  };
+  const scanPromise = runner.run({
+    targetDir: args.targetDir,
+    tier: ctx.tier,
+    llm,
+    maxFileSize: args.maxFileSize,
+    debug: args.debug,
+    baseline: args.baseline,
+    minConfidence: args.minConfidence,
+    onCheckComplete: (completed, total) => {
+      heartbeat();
+      if (showProgress) {
+        process.stderr.write(`\r${getCopy("report.scanProgress.checking", completed, total)}\x1B[K`);
+      }
+    },
+    onCategoryComplete: showProgress ? (category, count) => {
+      const label = CATEGORY_LABELS[category] ?? category;
+      process.stderr.write(`\r\x1B[K${getCopy("report.scanProgress.category", label, count)}
+`);
+    } : void 0
+  });
+  const { promise: timedScanPromise, heartbeat: hb } = withIdleTimeout(
+    scanPromise,
+    checkIdleMs,
+    getCopy("errors.scan.timed_out", Math.round(checkIdleMs / 1e3))
   );
+  heartbeat = hb;
+  const result = await timedScanPromise;
   const reportInput = {
     findings: result.findings,
     targetDir: args.targetDir,
@@ -16267,7 +16298,7 @@ var FsCredentialProvider = class {
 import { readFile } from "fs/promises";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { dirname as dirname6, join as join14 } from "path";
-var NPM_REGISTRY_URL = "https://registry.npmjs.org/seaworthy";
+var NPM_REGISTRY_URL = "https://registry.npmjs.org/seaworthycode";
 var UPDATE_TIMEOUT_MS = 3e3;
 function isLowerVersion(current, latest) {
   const parse2 = (v) => v.split(".").map((n) => Number(n));
@@ -16300,7 +16331,7 @@ async function checkUpdate() {
     }
     const installed = await getInstalledVersion();
     if (isLowerVersion(installed, latest)) {
-      return `Update available: ${installed} \u2192 ${latest}. Run npm i -g seaworthy to update.`;
+      return `Update available: ${installed} \u2192 ${latest}. Run npm i -g seaworthycode to update.`;
     }
     return void 0;
   } catch {
@@ -16605,7 +16636,7 @@ if (existsSync6(repoRootEnv)) {
 }
 var require5 = createRequire4(import.meta.url);
 var { version } = require5("../package.json");
-var cli = cac("seaworthy");
+var cli = cac("seaworthycode");
 cli.version(version);
 cli.command("[path]", "Scan a directory for issues").option("--json", "Output JSON to stdout").option("--output <path>", "Write HTML report to file").option("--sarif <path>", "Write SARIF report to file").option("--sarif-stdout", "Write SARIF report to stdout").option("--fail-on-findings", "Exit with code 5 when findings are found").option("--tier <tier>", "Select tier (free, pro)").option("--provider <provider>", "LLM provider (anthropic, openai, kimi, moonshot, deepseek, gemini, minimax, ollama, openrouter)").option("--max-file-size <bytes>", "Skip files larger than this (default: 1 MB)").option("--show-ids", "Show check IDs alongside names in terminal output").option("--debug", "Enable debug logging").option("--baseline [ref]", "Compare against a baseline file or save current findings as baseline (--baseline save)").option("--min-confidence <level>", "Hide findings below this confidence (high, medium, low)").option("--all", "List every finding; do not collapse low-severity findings").action(async (targetDir, options) => {
   const maxFileSize = options.maxFileSize ? Number(options.maxFileSize) : void 0;