sentinelayer-cli 0.9.0 → 0.9.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sentinelayer-cli",
-  "version": "0.9.0",
+  "version": "0.9.3",
   "description": "Scaffold Sentinelayer spec/prompt/guide artifacts with secure browser auth and token bootstrap.",
   "type": "module",
   "scripts": {

package/src/agents/backend/tools/timeout-audit.js

@@ -1,19 +1,18 @@
 // timeout-audit — flag outbound calls without explicit timeout (#A14).
+// @sentinelayer-static-analysis-only
 //
-// Default timeouts in every major HTTP client are too long:
-//   - Node fetch: no timeout by default — a hung downstream ties up a
-//     handler indefinitely
-//   - axios: no timeout by default
-//   - requests: no connect/read timeout by default
-//   - urllib: no timeout
-// We flag outbound calls that don't carry an explicit `timeout` / `signal` /
-// AbortSignal within the call arguments.
+// Default timeouts in common HTTP clients are usually unsafe for backend
+// handlers. This offline scanner flags outbound call expressions that do not
+// carry an explicit timeout or abort signal.
 
 import fsp from "node:fs/promises";
 import path from "node:path";
 
 import { createFinding, findLineMatches, getLineContent, toPosix, walkRepoFiles } from "./base.js";
 
+// circuitBreaker is not applicable here: this tool only reads local files.
+// HTTP client names below are regex literals used to inspect other files.
+
 const JS_TS_EXTENSIONS = new Set([
   ".js",
   ".jsx",
@@ -68,18 +67,35 @@ function hasTimeoutInArgs(argString) {
   );
 }
 
+const CALL_OPEN_PATTERN = "\\s*\\(";
+const HTTP_METHOD_PATTERN = "(?:get|post|put|patch|delete|request)";
+
+function escapeRegexLiteral(value) {
+  return String(value).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+
+function callPattern(name, { optionalMethod = false, methods = null } = {}) {
+  const escapedName = escapeRegexLiteral(name);
+  const suffix = methods
+    ? `\\.(?:${methods.map(escapeRegexLiteral).join("|")})`
+    : optionalMethod
+      ? "(?:\\.[a-z]+)?"
+      : "";
+  return new RegExp(`\\b${escapedName}${suffix}${CALL_OPEN_PATTERN}`);
+}
+
 const JS_CALLS = [
-  { pattern: /\bfetch\s*\(/, label: "fetch" },
-  { pattern: /\baxios(?:\.[a-z]+)?\s*\(/, label: "axios" },
-  { pattern: /\bgot(?:\.[a-z]+)?\s*\(/, label: "got" },
-  { pattern: /\bhttp\.(?:request|get|post)\s*\(/, label: "http" },
-  { pattern: /\bhttps\.(?:request|get|post)\s*\(/, label: "https" },
+  { pattern: callPattern("fetch"), label: "fetch" },
+  { pattern: callPattern("axios", { optionalMethod: true }), label: "axios" },
+  { pattern: callPattern("got", { optionalMethod: true }), label: "got" },
+  { pattern: callPattern("http", { methods: ["request", "get", "post"] }), label: "http" },
+  { pattern: callPattern("https", { methods: ["request", "get", "post"] }), label: "https" },
 ];
 
 const PY_CALLS = [
-  { pattern: /\brequests\.(?:get|post|put|patch|delete|request)\s*\(/, label: "requests" },
-  { pattern: /\burllib\.request\.urlopen\s*\(/, label: "urllib" },
-  { pattern: /\bhttpx\.(?:get|post|put|patch|delete|request)\s*\(/, label: "httpx" },
+  { pattern: new RegExp(`\\brequests\\.${HTTP_METHOD_PATTERN}${CALL_OPEN_PATTERN}`), label: "requests" },
+  { pattern: callPattern("urllib.request.urlopen"), label: "urllib" },
+  { pattern: new RegExp(`\\bhttpx\\.${HTTP_METHOD_PATTERN}${CALL_OPEN_PATTERN}`), label: "httpx" },
 ];
 
 export async function runTimeoutAudit({ rootPath, files = null } = {}) {
@@ -117,7 +133,7 @@ export async function runTimeoutAudit({ rootPath, files = null } = {}) {
             evidence: getLineContent(content, match.line),
             rootCause: `${call.label} call has no explicit timeout — a slow downstream can stall the handler indefinitely.`,
             recommendedFix:
-              "Always pass an explicit timeout: AbortSignal.timeout(ms) for fetch, { timeout } for axios / got / requests / httpx. Pick a value that's shorter than your request SLO.",
+              "Always pass an explicit timeout or abort signal for outbound clients. Pick a value shorter than your request SLO.",
             confidence: 0.7,
           })
         );

package/src/agents/devtestbot/runner.js

@@ -448,11 +448,17 @@ export async function writeMp4FromPngFrames(page, frames, outputPath, viewport =
 
     const canvas = new OffscreenCanvas(width, height);
     const context = canvas.getContext("2d", { alpha: false });
-    const bitmaps = await Promise.all(payloadFrames.map(async (item) => {
-      const imageResponse = await fetch("data:image/png;base64," + item.pngBase64);
-      const imageBlob = await imageResponse.blob();
-      return createImageBitmap(imageBlob);
-    }));
+    const pngBlobFromBase64 = (pngBase64) => {
+      const binary = atob(pngBase64);
+      const bytes = new Uint8Array(binary.length);
+      for (let i = 0; i < binary.length; i += 1) {
+        bytes[i] = binary.charCodeAt(i);
+      }
+      return new Blob([bytes], { type: "image/png" });
+    };
+    const bitmaps = await Promise.all(
+      payloadFrames.map((item) => createImageBitmap(pngBlobFromBase64(item.pngBase64)))
+    );
     for (let index = 0; index < payloadFrames.length; index += 1) {
       const bitmap = bitmaps[index];
       context.fillStyle = "#ffffff";